National Aeronautics and

Space Administration

**Headquarters**

Washington, D.C. 20546-0001

Reply to Attn of: Office of Inspector General December 1, 2000

The Honorable Richard K. Armey

House Majority Leader

House of Representatives

Washington, DC 20515-6502

Dear Mr. Armey:

Enclosed is my response to your request dated October 12, 2000,
concerning what the Office of Inspector General perceives to be the 10
most serious management challenges for NASA.

The Agency's three-part mission encompassing scientific research, space
exploration, and technology development and transfer continue to pose
bold challenges for NASA's civil service and contractor workforces. NASA
is reengineering its ways of doing business to ensure the safe operation
of all programs and to maximize the effectiveness of technology
innovation, while adjusting to budgetary and personnel constraints. The
NASA Administrator established safety as the Agency's number one value.
We agree that safety must be a significant priority if the Agency is to
successfully achieve its missions, and we will support that priority by
performing a number of audits and reviews on safety-related issues.
Information technology (IT) is a key tool of a scientific and
technological organization such as NASA. The Agency's ability to remain
free from unauthorized access of its networks becomes more critical as
the Agency becomes ever more reliant on cyber-communications. We will
focus our work to help assure the security and integrity of NASA's
computer and communications systems. We will also continue our focus on
procurement issues and technology transfer. We believe there are
efficiencies from outsourcing aspects of IT. However, outsourcing brings
with it considerable risks unless the Agency carefully provides for
establishing internal controls after analyzing questions such as:

-   Who/what entities have ownership interests in the service provider?
    Is the provider owned by foreign interests?

-   What is the security posture of the provider? Is it compromised by
    organized groups/hostile entities?

-   What process do contractors use to provide security screening for
    potential employees being considered for employment under these
    contracts?

-   Does NASA have contract oversight clauses and an oversight apparatus
    in place?

Enclosure 1 provides a listing of each problem area. Enclosure 2
provides a narrative that describes more fully each management
challenge. Enclosure 3 summarizes completed reports and significant open
recommendations.

Should you have any questions or need additional information, please
call me on

(202) 358-1220. We look forward to working with you and your staff.

Sincerely,

###### Original Signed By

Roberta L. Gross

Inspector General

3 Enclosures

bcc:

L/E. Heffernan

IG, XO, AIGA, AIGI, AIGIAIA Chrons

W/L. Ball

W/P. Iler

[A separate letter to the following]{.underline}:

The Honorable Fred Thompson, Chairman

Senate Governmental Affairs Committee

The Honorable Pete Domenici, Chairman

Senate Budget Committee

The Honorable Dan Burton, Chairman

House Committee on Government Reform

The Honorable John Kasich, Chairman

House Budget Committee

#### Future Issues

#### 

For each of the 10 management challenges, we have identified several
issues. We will examine these issues in future audits and reviews.

#### 

#### Safety and Mission Assurance. Keys to ensuring safety in future NASA operations include:

-   Assuring appropriate level of training for staff who conduct safety
    reviews and evaluations.

-   Maintaining adequate safety reporting systems.

-   Ensuring variances to standard safety procedures are appropriately
    justified, reviewed, and approved.

-   Maintaining an effective emergency preparedness program.

-   Ensuring Agency and contractor compliance with safety standards and
    regulations.

-   Ensuring product safety and reliability.

-   Ensuring the Space Shuttle and ISS maintain crew safety.

##### International Space Station. Keys to continued ISS assembly and operation are: {#international-space-station.-keys-to-continued-iss-assembly-and-operation-are .unnumbered}

-   Managing the political, financial, technical, and safety challenges
    presented by an international partnership.

-   Overcoming technical challenges inherent in manufacturing,
    assembling, and testing complex hardware and software components
    provided by different nations and integrated in space.

-   Safely maintaining, upgrading, and operating a structure as
    complicated as the Space Station.

-   Maximizing the beneficial use of the Space Station for scientific
    research and technology development.

#### Information Technology. Keys to an effective IT program include: {#information-technology.-keys-to-an-effective-it-program-include .unnumbered}

-   Ensuring data security, integrity, and application controls.

-   Protecting operations and communications with spacecraft.

-   Monitoring and evaluating the streamlining of operations through
    outsourcing information technology operations for cost efficiencies,
    dependency on the vendor for technological direction, vulnerability
    of strategic information to outsiders, and dependency on the
    viability of the vendor.

    **Procurement.** Keys to effective procurement at NASA include:

-   Ensuring proper levels of staffing to perform contracting
    requirements.

-   Providing sufficient controls over and monitoring of both prime and
    subcontractors.

-   Implementing or increasing the use of innovative procurement
    procedures such as earned value management and performance incentive
    fees.

-   Ensuring costs billed to NASA cost-type contracts, due to the
    changing industry environment, are reasonable and allowable.

#### Fiscal Management. Keys to improved fiscal management include:  {#fiscal-management.-keys-to-improved-fiscal-management-include .unnumbered}

-   Monitoring contractor performance of financial statement audits to
    ensure that the statements are properly prepared and thoroughly
    reviewed.

-   Ensuring adequate integration and testing of newly developed
    automated accounting modules or capability.

-   Ensuring that the Agency continues to properly account for and
    record financial transactions as new capability is implemented.

#### Program and Project Management. Keys to effectively managing NASA programs include: {#program-and-project-management.-keys-to-effectively-managing-nasa-programs-include .unnumbered}

-   Improving planning to enable the Agency to accomplish its missions
    in the face of budget and human capital issues.

-   Eliminating duplication in programs and improving coordination with
    other research and development organizations.

-   Ensuring that programs and projects accurately assess their progress
    and successfully achieve their goals.

-   Effectively using technology developments to increase Agency
    productivity.

#### Launch Vehicles. Keys to the development and use of launch vehicles include: {#launch-vehicles.-keys-to-the-development-and-use-of-launch-vehicles-include .unnumbered}

-   Assuring the availability of small ELV's to ensure schedule
    milestones and cost effectiveness of NASA missions.

-   Evaluating whether NASA's providing the majority of developmental
    funds and assigning technology rights to its industry partners in
    the development of the new RLV's are in the best interest of the
    Government.

-   Ensuring that plans are in place and are effectively implemented to
    address Shuttle systems obsolescence, logistics support,
    technical/safety upgrades, and funding.

    **Technology Development.** Keys to effective technology development
    include:

-   Achieving a balance between scientific research and technology
    development and demonstration projects.

-   Continuing to refine the technology transfer process to ensure that
    U.S. industry achieves the maximum benefit from the new technologies
    identified.

-   Determining if NASA's organizational structure effectively supports
    technology development and transfer.

-   Forming innovative partnership arrangements with U.S. industry to
    share both the risk and costs of technology demonstration and
    commercialization.

-   Ensuring that NASA technology demonstrations do not unfairly distort
    the marketplace.

-   Ensuring that adequate controls exist on cooperative technology
    development programs.

-   Ensuring adequate protection of NASA-developed technology

#### International Agreements. Key considerations with the use of international agreements are: {#international-agreements.-key-considerations-with-the-use-of-international-agreements-are .unnumbered}

-   Program and project vulnerability to schedule delays and cost
    overruns that require diplomatic rather than contractual solutions.

-   Security controls on technology that impacts national security.

-   Controls to assure the quality and timeliness of the goods and
    services provided.

-   Mechanisms to assure a balance between program needs and national
    considerations.

-   Plans with specific critical paths and planned alternative courses
    of action to maintain program/project continuity.

-   Proper controls over access to NASA facilities by foreign national
    visitors.

#### Environmental Management. Keys to effective management of environmental issues include:

-   Prioritizing and addressing environmental obligations.

-   Developing consistent procedures under an Agencywide policy.

-   Negotiating cost-sharing agreements for environmental cleanup with
    previous Government and private sector tenants that are also
    responsible parties.

    **NASA's Top 10 Management Challenges**

    Under the authority of the Inspector General Act, the Office of
    Inspector General's (OIG's) mission is to conduct and supervise
    independent audits, investigations, inspections, and other reviews
    to promote economy, efficiency, and effectiveness and to prevent and
    detect criminal fraud, waste, and mismanagement. During our
    assessments of NASA's efforts to achieve its scientific and
    technology goals, we identified the following 10 management
    challenges as the Agency's most significant vulnerabilities.

+----------------------------------------+----------+------------------+
| **Challenge**                          | #### Na  | **Table          |
|                                        | rrative  | (Enclosure 3)**  |
|                                        | {#narrat |                  |
|                                        | ive .unn |                  |
|                                        | umbered} |                  |
+----------------------------------------+----------+------------------+
| 1\. Safety and Mission Assurance       | Page 6   | 1, Page 40       |
+----------------------------------------+----------+------------------+
| 2\. International Space Station        | Page 9   | 2, Page 46       |
+----------------------------------------+----------+------------------+
| 3\. Information Technology             | Page 12  | 3, Page 49       |
+----------------------------------------+----------+------------------+
| 4\. Procurement                        | Page 18  | 4, Page 62       |
+----------------------------------------+----------+------------------+
| 5\. Fiscal Management                  | Page 22  | 5, Page 72       |
+----------------------------------------+----------+------------------+
| 6\. Program and Project Management     | Page 25  | 6, Page 79       |
+----------------------------------------+----------+------------------+
| 7\. Launch Vehicles                    | Page 30  | 7, Page 83       |
+----------------------------------------+----------+------------------+
| 8\. Technology Development             | Page 32  | 8, Page 90       |
+----------------------------------------+----------+------------------+
| 9\. International Agreements           | Page 34  | 9, Page 92       |
+----------------------------------------+----------+------------------+
| 10\. Environmental Management          | Page 37  | 10, Page 97      |
+----------------------------------------+----------+------------------+

We modified our list of the top 10 management challenges from those
identified in the prior 2 years due to a number of factors including
completion of corrective actions by the Agency, budget reductions,
implementation of leading edge technology, and the continued
commercialization of the aerospace industry. We eliminated the Year 2000
Problem issue as a single, focused challenge from our list of management
challenges. The Integrated Financial Management Project (IFMP) issue is
a continuing challenge for NASA. However, we have identified other
related financial management issues that we combined with IFMP under the
Fiscal Management challenge. We expanded the Earth Science challenge
into a broader category titled Program and Project Management due to the
Agency's efforts to modify its management process for all programs and
projects, implement earned value management, and update the NASA Federal
Acquisition Regulation (FAR) Supplement. Last year, we added Research
Technology Demonstration/Application as a new management challenge area
due to the importance of ensuring that NASA-developed technology is
effectively transferred to U.S. industry to improve its competitive
position. This year, we renamed the area to more precisely identify the
concern---Technology Development.

The NASA OIG has a positive role in helping the Agency achieve its
goals. Our planned projects for FY 2001 will address each of NASA's top
10 challenges. In addition, our review of the Agency's implementation of
Government Performance and Results Act (GPRA) requirements cuts across
all challenge areas. Our GPRA work will assess, on a selective basis,
the metrics NASA developed to measure the success of its programs and
how well the Agency is measuring its performance. We will also address
requirements of the Government Information Security Reform through our
IT audits and evaluations.

The NASA OIG homepage, http://www.hq.nasa.gov/office/oig/hq, provides
current information on our planning and details related to specific
workplan project objectives. The homepage also provides access to the
complete text of most of our reports issued during the last 3 years.

**1. Safety and Mission Assurance**

The NASA Administrator has stated that the Agency's number one core
value is safety. NASA's Agency Safety Initiative (ASI) established a
goal to make the Agency the nation's leader in the safety and
occupational health of its workforce and the safety of the products and
services it provides. The ASI's four Core Process Requirements are to
promote and ensure safety for (1) the public, (2) astronauts and pilots,
(3) employees on the ground, and (4) high-value equipment and property.
Space exploration involves risk, including the risk of failure. Without
risk, there can be little discovery, and discovery is NASA's principal
mission. To maximize the likelihood of success, NASA must become an
informed risk taker by identifying, understanding, and managing risk as
part of all activities.

NASA has taken action to ensure its contractor workforce is supportive
of and accountable for safety. In April 1999, the Agency established
Risk-Based Acquisition Management as a NASA procurement initiative to
reduce the likelihood and severity of impact from unforeseen events
through vigorous risk management. A key element of the initiative
includes revising the NASA FAR Supplement to incorporate risk management
including safety and security considerations as the core concern of all
contracting actions except for the purchase of commercial off-the-shelf
items.

Completed audit work as well as the Agency\'s continued emphasis
justifies the reporting of safety and mission assurance as a significant
management challenge. For example, as the Kennedy Space Center (Kennedy)
Payload Ground Operations contractor, The Boeing Company (Boeing)
performs payload-processing activities for Space Shuttle and expendable
launch vehicle payloads, including flight elements of the International
Space Station (ISS). Boeing performs such work primarily at two Kennedy
processing facilities: the Space Station Processing Facility (SSPF) and
the Operations and Checkout (O&C) building. Safety is a critical element
of contractor performance. The House of Representatives Committee on
Science requested that the OIG review the safety functions of Kennedy\'s
Payload Ground Operations Contract (PGOC) performed by McDonnell Douglas
Aerospace, Space and Defense Systems, a subsidiary of Boeing. We
reviewed the operations to determine whether the contractor (1) had
clearly defined safety responsibilities between Boeing and NASA, (2)
used hazardous materials in Kennedy's processing facilities, and (3)
properly controlled hazardous materials, if used.

The audit identified that ground workers at Kennedy were using
potentially hazardous materials in both the SSPF and O&C building that
consistently failed required tests for flammability resistance and
electrostatic discharge. This occurred because Boeing's safety office
did not perform adequate, contract-required inspections of the
facilities to ensure that NASA had approved all plastic films, foams,
and adhesive tapes in use or that ground workers removed unapproved
materials from the premises. NASA records show that the materials failed
required tests as far back as July 1992. Beginning in September 1999,
NASA authorized variances for the use of some of the materials. However,
these variances were ineffective because neither the Kennedy nor Boeing
safety offices reviewed the variances, and Boeing did not perform any
risk analyses to support the variances, as required by the PGOC. As a
result, NASA has not identified, documented, and appropriately mitigated
the risks of using the potentially hazardous materials and exposing
ground workers and flight hardware to increased risks. NASA and Boeing
Safety and Materials personnel met in December 1999 and acknowledged
that problems exist regarding the use of potentially hazardous materials
in both the SSPF and O&C building.

We recommended that NASA management (1) implement procedures to ensure
the safe use of all materials that do not meet standards, (2) clarify
instructions for preparing Material Usage Agreements, and (3) increase
surveillance of Boeing's inspection procedures. We also recommended that
the PGOC Contracting Officer (1) determine whether the Agency has a
basis to withhold contract costs related to noncompliant plastics,
foams, and adhesives, and (2) take proper contract award fee action
based on Kennedy's increased surveillance of the Payload Ground
Operations contractor. Management concurred with the recommendations and
has planned or implemented responsive corrective actions. However,
management contended that plastics, foams, and adhesives are not
inherently hazardous materials but can create potentially hazardous
conditions if not properly handled.

On February 26, 1999, the Administrator emphasized the need for NASA
contractors to be supportive of and accountable for safety and has
subsequently reiterated this point several times. The NASA Safety Policy
generally requires that NASA safety personnel be actively involved in
NASA procurement actions and conduct appropriate surveillance of
contractors' safety programs.

Our audit of Contract Safety Requirements at Kennedy and the Marshall
Space Flight Center (Marshall) identified that NASA is taking action to
ensure its contractor workforce is supportive of and accountable for
safety. Through the Risk Based Acquisition Management initiative, the
Agency is revising, but has not yet published, the updated NASA FAR
Supplement to ensure that risk is the core concern of all contracting
actions except for the purchase of commercial off-the-shelf items.
Although the initiative is a positive step toward improving the safety
practices of NASA contractors, it does not apply to existing contracts.
We found that 60 percent (15 out of a total of 25) of the contracts
reviewed at Kennedy and Marshall did not include basic requirements to
ensure safety. Specifically, not all contracts that we reviewed included
basic requirements such as the NASA FAR Supplement safety clause and a
NASA-approved, contractor safety plan at contract award. This condition
occurred because the applicable Center safety offices were not
adequately involved in the procurement process to ensure that these
basic safety requirements were consistently applied to NASA contractors.
As a result, NASA lacks assurance that its contractors at Kennedy and
Marshall are working in accordance with NASA safety standards. By not
including certain safety provisions and requirements in the contract,
contractors are not contractually bound to the requirement for
compliance with all Federal, state, and local laws applicable to safety.
Three of the questioned contracts involve extremely hazardous
operations, and three are with contractors who have been involved in
NASA mishaps. In addition, five of the questioned contractors have had
prior safety violations as reported by Occupational Safety Health
Administration.

We recommended that NASA Management at Kennedy and Marshall (1) identify
all open contracts that either involve potentially hazardous operations
or exceed \$1 million and determine whether those contracts have the
required safety clauses and contractor safety plans; (2) determine the
cost-effectiveness of modifying those contracts determined deficient,
assess the risk of not modifying the contracts, and make those
modifications deemed cost-effective and necessary; and (3) direct Center
safety offices to assist the responsible Center official in performing
an appropriate level (based on assessed risk) of contractor surveillance
for each current, applicable contract. Management concurred with the
recommendations and initiated responsive corrective action.

2\. International Space Station

The mission of the ISS is to enable long-term exploration of space. The
ISS will provide scientists, engineers, and entrepreneurs a platform on
which to perform complex, long-duration, and replicable experiments in
the unique environment of space. The launch of the *Zarya* Control
Module in November 1998 began the assembly phase of the ISS. Since then,
four other elements have been added---*Unity*, the United States Node 1,
in December 1998; *Zvezda*, the Russian-built Service Module, in July
2000; and the Z1 Truss (a 9-ton exterior framework) and a 3-ton docking
port, in October 2000. In November 2000, the first long-duration crew,
Expedition 1, arrived at the ISS. Expedition 1, consisting of one
astronaut and two cosmonauts, will spend about 4 months aboard the ISS
activating critical systems, conducting the first scientific
experiments, and welcoming three visiting Space Shuttle crews. NASA is
reducing dependence on Russian participation in the ISS by acquiring a
U.S. Propulsion System, designed to perform critical functions now
performed by the Service Module.

Our reviews have found significant problems related to ISS cost,
contingency planning, and the X-38/Crew Return Vehicle (CRV). These
problems indicate that the ISS should be reported as a significant
management challenge.

ISS contracts continue to experience significant cost growth. Our review
of Performance Management of the ISS Contract found that Boeing, the
prime contractor, reported to NASA management unrealistically low
estimates of projected cost overruns from October 1998 through February
1999. In March 1999, Boeing announced that actual and projected cost
overruns on the ISS prime contract had grown by \$203 million, from
\$783 million to \$986 million. This was the third major increase in
reported overruns within 2 years---a total increase of \$708 million
over original cost estimates. Both the ISS Program Office and Boeing had
informed senior NASA management that further cost overruns were likely.
Although the Program Office was aware and had evidence of cost overruns
and schedule slippages, it did not effectively challenge the
contractor's estimate or sufficiently emphasize estimates of the cost
overrun. As a result, NASA did not take corrective action corrective
action, and Boeing received incentive fees totaling \$16 million that it
had not earned and benefited financially from those fees. We recommended
that the ISS Program Office strengthen various policies and procedures
to ensure that Program cost estimates are realistic. Management
concurred or partially concurred with the recommendations.

Our report on Space Station Contingency Planning for International
Partners showed that the partners did not include or clearly identify
several critical elements for effective risk management, as required by
Agency guidance. Specifically, the contingency plan did not contain cost
and schedule impacts and did not clearly identify mitigation measures
and primary consequences of the contingencies. Also, the Program Office
did not have a process that ensured the contingency plan was kept
current. The contingency plan did not include some actions being taken
to prevent further Russian delays. Until the contingency plan is
complete, NASA cannot fully reduce Space Station risks through advance
planning and the establishment of response plans. Further, without
estimated costs, the Agency, the Administration, and the Congress cannot
adequately assess the feasibility of proposed responses or determine
budgetary impact. Management concurred with our recommendations to
ensure that the ISS contingency plan complies with Agency risk
management guidance and to establish a process to ensure the contingency
plan is kept current.

The United States is committed to providing a crew-return capability for
the ISS. During our audit of X-38/CRV Project Management, we found that
(1) NASA had made no provision for an operational test of the CRV to
determine its safety for human space flight and (2) the Project's
acquisition strategy of "rapid prototyping" entailed significant risk
compared to a more traditional approach. The project is relying on a
high degree of concurrency among design, development, test, and
engineering/evaluation activities and a highly optimistic schedule to
accomplish development and production of the CRV. While this project
approach offers potential high payoff, it negatively affects the
Agency's ability to accurately adhere to project cost and schedule. We
recommended that NASA management (1) modify the X-38/CRV Project Plan to
include a contingency for an operational test and (2) develop and
document major characteristics, criteria, and strategies for progressing
thorough major project phases. Management concurred with the
recommendations.

We also have concerns with ISS command and control communications and
with the ISS Portable Computer Systems. (See Challenge 3, Information
Technology.)

**Commercialization.** The Commercial Space Act of 1998 established the
policy that a priority goal of constructing the ISS is the economic
development of Earth orbital space. Congress declared that the use of
free market principles would reduce ISS operational costs for all
partners and the Federal Government's share of the United States burden
to fund operations. The use of free market principles applies to
operating, servicing, allocating the use of, and adding capabilities to
the ISS and to the resulting fullest possible engagement of commercial
providers and participation of commercial users. Therefore, Congress
tasked NASA with delivering reports and studies to assess the
feasibility of implementing the Act and to identify opportunities and
potential cost savings from commercial providers.

Congress also asked NASA to conduct an independent market study to help
identify potential commercial uses. The independent study, conducted by
KPMG, LLC, and submitted in December 1999, stated that the future
commercial markets are still too premature and that any market study
would be speculative. However, one of the most promising commercial
markets the study identified was to utilize space imagery in the areas
of education and entertainment. In June 2000, NASA and Dreamtime
Holdings, Incorporated, announced a partnership designed to deliver
high-definition television coverage of astronaut activities aboard the
ISS and on Space Shuttle missions. The partnership is also designed to
create an easily accessible, Web-searchable, digital archive of the best
of NASA\'s space imagery. We will review the Agency's partnership
arrangement with Dreamtime in the near future.

The General Accounting Office (GAO) performed an earlier review of ISS
commercialization, reported in NSIAD-99-153R, "Space Station Status of
Efforts to Determine Commercial Potential," June 30, 1999. GAO also
concluded that it was too soon to estimate whether commercial activity
would eventually reduce the cost of operations for the ISS.

## **3. Information Technology** {#information-technology .unnumbered}

During fiscal year (FY) 2000, our investigation, audit, and inspection
activities continued to find a fragmented information technology
security (ITS) program without clear lines of authority, policies,
guidelines, and enforcement. NASA continues to maintain separate
organizations to handle classified and unclassified ITS. This separation
has caused confusion and has inhibited the implementation of an
effective ITS program. Separating unclassified and classified ITS has
also led to duplication of effort. Several NASA Centers have an ITS
official in the security office who handles computer security for
classified information and another individual---usually in the office of
the Chief Information Officer (CIO)---who handles computer security for
sensitive but unclassified information. Confusion surrounding this
separation has resulted in the expenditure of significant funds when
more secure and less costly solutions were available. Additionally, this
situation tends to thwart the sharing of vital threat and risk
information against both classified and unclassified systems.

The Federal Bureau of Investigation reiterated our concerns in its
recent report that contains numerous recommendations to address ITS
weaknesses at NASA. In addition, Congress has rated NASA poorly in the
ITS area, and GAO continues to find significant deficiencies. Therefore,
IT is a significant management challenge.

**Fragmentation.** We are also concerned about fragmentation of the ITS
mission area components because NASA policies and procedures do not
effectively integrate computer and communication security. For the most
part, NASA addresses these two components separately rather than
synergistically under a single ITS program. Most of the Federal
Government has adopted the National Security Telecommunications and
Information System Security Committee (NSTISSC) definition of
Information Systems Security, which has two primary
components---computer and communications security. NASA is an observer
on the NSTISSC and is bound by its issuances.

In addition to fragmenting the ITS mission area components,
responsibilities for ITS have been divided among multiple Centers. While
the Ames Research Center (Ames) has primary responsibility for ITS,
several functions are performed elsewhere. For example, Kennedy handles
one component of communication security, while Headquarters performs all
other communication security functions. Further, Goddard Space Flight
Center (Goddard) performs incident response, Glenn Research Center
(Glenn) provides ITS training, and Marshall is responsible for
firewalls. Some of the key functions are performed by one individual at
these locations, with little or no backup support. In many cases, the
extent and complexity of these functions require a team of ITS
professionals. This multiple-Center approach leads to serious
coordination problems and a lack of corporate oversight. Center CIO's do
not report to the Agency CIO, and the roles and responsibilities are ill
defined. When the OIG Computer Crimes Division responds to incidents,
our agents are required to contact security officials at multiple
locations---none of whom have total visibility into security matters.

The NASA Administrator recently established a new organization, the NASA
Office of Security Management and Safeguards, to focus and advance the
Agency's efforts in all aspects of NASA security. Because this
organization is new, it is unclear whether it adequately addresses the
fragmentation of the ITS program. We will continue to evaluate whether
the new organization encompasses both classified and unclassified
information, addresses both computer and communications security, and
provides appropriate Headquarters authority over the Agency's security
mission.

**Planning.** Our work this year continues to identify problems with the
structure of the IT program, planning, and the implementation of IT in
NASA programs and activities. For example, the OIG identified weaknesses
in NASA's ITS planning efforts. We found that NASA did not have security
plans for many of its special management attention[^1] (SMA) systems and
many of its computers that host publicly accessible web sites. In fact,
major elements of one of NASA's five major IT investments did not have
security plans, contingency plans, or risk assessments. For some systems
that had security plans in place, NASA did not adequately address the
security planning requirements of Office of Management and Budget (OMB)
Circular A-130, \"Management of Federal Information Resources.\" Common
problems involved lack of information on system rules of behavior,
initial and periodic training, personnel controls, identifying and
reporting security incidents, continuity of service, technical security,
and system interconnection. These deficiencies have reduced the
effectiveness of NASA's ITS program and have increased security risks to
many of NASA's SMA IT systems and other IT resources. The increased
risks due to the failure to comply with Federal IT security requirements
leave NASA vulnerable to security violations, both internal and
external. We are continuing to conduct audit work in the area of IT
security planning.

**Disaster Recovery.** The OIG also conducted a series of audits that
focused on the adequacy of disaster recovery planning for NASA's
mission-critical systems. During FY 1998-2000, we reviewed 10 mission
critical systems and provided individual reports on deficiencies for
each system. In FY 2000, we summarized the findings in a consolidated
report that concluded NASA Center management had not placed a high
priority on disaster recovery planning. While all but one system had a
disaster recovery plan, each of the disaster recovery plans contained
various inadequate or missing elements. The inadequate or missing
elements included provisions for extended backup, disaster recovery
testing, risk assessments, training of key personnel, and off-site
storage. Based on our findings, it is probable that these types of
deficiencies exist within many of the NASA mission-critical systems we
have not reviewed. Inadequate disaster recovery planning leaves NASA's
mission-critical systems susceptible to internal or external threats
including natural disasters and hostile attacks.

**Clinger Cohen.** We also reviewed NASA's organizational structure for
implementing the Clinger-Cohen Act[^2]. We found that NASA can improve
its CIO organization to more effectively implement the requirements of
the Act. For example, the NASA CIO was not a full member of the Capital
Investment Council. By appointing the CIO to the Council, the Agency can
better comply with the Act and related guidance regarding the intended
authority of the CIO position. We also found that most Center CIO
representatives were not full members of Center-level program management
councils. As a result, NASA lacks assurance that IT will receive
appropriate emphasis in Center-level program oversight activities. The
NASA CIO has also not met the Clinger-Cohen Act requirement to annually
assess the knowledge and skill of senior managers in information
resources management (IRM) and has not developed specific plans to
remedy possible deficiencies in meeting established knowledge and skill
requirements. Consequently, the Agency has not yet complied with
statutory requirements and lacks assurance that executive-level
personnel are appropriately qualified in IRM. The NASA CIO concurred
with our findings and is taking corrective actions.

**Presidential Decision Directive 63.** We also reviewed NASA's planning
and implementation for Presidential Decision Directive (PDD) 63. We
found that NASA had not developed an adequate critical infrastructure
protection plan to achieve initial operating capability (IOC) by
December 31, 2000. Until NASA develops an adequate plan for achieving
IOC, the Agency lacks assurance that it is complying with PDD 63 and is
adequately protecting its critical cyber-based infrastructure assets. We
also found that NASA's list of minimum essential infrastructure (MEI)
assets contained errors and inconsistencies.[^3] As a result, NASA lacks
assurance that it can provide appropriate oversight of PDD 63 assessment
and mediation activities. Further, NASA lacks assurance that all
critical infrastructure assets will undergo appropriate assessment and
mediation activities. Finally, for those assets that were incorrectly
identified as MEI, NASA may expend limited resources on unnecessary
assessment and mediation activities. Management either concurred or
partially concurred with our findings and recommendations. We considered
management's proposed actions responsive to the recommendations.

**Program and Project Management.** In another audit, we found that NASA
lacks adequate management controls for determining whether program and
project managers should incorporate independent verification and
validation into their software development

projects. As a result, NASA is not assured that it can effectively
mitigate potential software failures. Management has either taken or
plans to take actions that are responsive to the recommendations.

**Communications Security Issues.** Our assessment of the ISS Command
and Control Communications found that NASA has not fully considered all
possible upgrade alternatives to the current ISS communications uplink
encryption algorithm. Also, the options NASA has considered to date
involve upgrades to ISS encryption technology, but do not provide an
acceptable authentication capability. Without a strong method of
authentication, the ISS could still be susceptible to receiving
unauthorized command and control instructions. We believe the
recommendations in our report may save NASA millions of dollars while
increasing security against unauthorized commanding.

The OIG also completed an assessment of problems involving the ISS
Portable Computer Systems (PCS) and the accuracy of displays developed
for the PCS. We found that there is a need for an integrated product
team and independent verification of displays. We also found that PCS
usability should be improved and made recommendations to improve static
display indicators, eliminate erroneous information, make application
commands consistent, reduce cumbersome system navigation, and provide
for increased equipment redundancy. Additionally, we found the ISS
program did not have a coordinated, well-defined process for software
engineering and software management. The lack of such a process results
in numerous problems with requirements control, configuration
management, cost and schedule estimates, and defect prevention.

**Physical Security Controls.** In prior years, the OIG identified
weaknesses in physical security controls at many of NASA's major data
centers. During FY 2000, we continued this effort and identified
weaknesses in the physical security activities of a NASA Space Flight
system and various other NASA systems that support the processing of
both mission and business and restricted technology activities that
require special management attention oversight. Specifically, NASA had
not established or implemented procedures to ensure that controlled
computing areas were adequately protected from unauthorized access.
Inadequate physical access controls increase NASA's vulnerability to
financial or operational losses in its IT environment.

Our inspections of physical security at Glenn, Marshall, and the Wallops
Flight Facility found physical security problems including weak access
controls over the facilities themselves as well as the buildings on the
facilities. For example, at one Center we found 90 percent of the
buildings unlocked during non-duty hours. Buildings and rooms housing
high-value computer and telecommunications equipment were unlocked.
Unauthorized personnel exposed vital communications systems to possible
violation. At one Center, we also found a lack of updated ITS policies
and procedures.

**Mission Critical Systems.** During FY 2000, the OIG conducted audits
of several mission-critical information systems to determine whether
NASA had implemented adequate controls at the host computer level. These
audits focussed on security and integrity controls to help protect NASA
systems, data, and information from unauthorized access from within NASA
as well as from intruders who are successful in circumventing network
and perimeter controls. The audits disclosed that NASA had not
implemented adequate basic controls in areas such as system access,
protection of critical files, system backup and restore procedures,
privileged operations controls, and system audit and monitoring
capabilities. These deficiencies increased the risk of unauthorized
access that could result in loss of mission support, loss of mission
data, and illegal use of computer systems.

**Human Capital.** In a recently completed assessment of NASA's IT
training and recruitment/retention program, the OIG found that NASA is
not moving aggressively to ensure that all individuals are appropriately
trained prior to being granted access to IT applications and systems.
Instead of creating a centralized IT training function, NASA spreads its
IT training and development responsibilities among several
organizations. The decentralized approach contributes to funding and
staffing shortfalls in the IT training program. For example, while NASA
established an Expert Center for IT Security Awareness and Training at
Glenn to develop Agency-wide IT training, the Agency has not provided
the Center with the necessary staffing or funding to carry out its
responsibilities. Instead, the Expert Center relies on a matrixed staff
consisting of personnel from other organizational components. In
addition, the Expert Center operates with limited funds provided by
other NASA organizations. The funds do not cover the costs of personnel
travel necessary to develop and evaluate training courses. The Expert
Center and NASA's Principal Center for ITS located at Ames entered into
a memorandum of understanding (MOU) that outlines the Expert Center's
work plan and resource requirements. However, the MOU does not address
the Principal Center's resource commitment and does not sufficiently
include other NASA organizational components' resource commitments.

NASA has not established training goals that meet Federal requirements.
For example, while OMB Circular A-130 envisions that employees be
trained before allowing them access to IT systems, NASA's metrics do not
meet that requirement until September 30, 2002. As a result, NASA's
workforce lacks the training and awareness necessary to minimize the
Agency's vulnerability to hostile attacks against its IT infrastructure.

NASA has acknowledged the need to increase the number of employees with
specialized IT skills. However, NASA has not fully used all the tools
currently available to ensure that IT skills are present in the right
mix and locations across the Agency. For example, NASA limits its use of
recruitment, retention, and relocation bonuses and allowances to recruit
and retain key IT skills. Given the increase in the frequency and
sophistication of hacker attacks against NASA IT systems, NASA's lack of
sufficient IT skills puts the Agency at risk and could compromise its IT
resources and information.

We identified the need to further emphasize training, developing, and
recruiting IT personnel in FY 2000. Currently, we are drafting a report
that will include recommendations that will improve NASA's ability to
train existing personnel and attract and retain highly qualified IT
personnel.

The work we have done in the IT area is supported by the prior
information security assessment conducted by GAO and by NASA's own
internal ITS review. The GAO indicated that significant management
shortcomings exist in every aspect of NASA's ITS program, including risk
management, implementing policy, monitoring and evaluating policies and
controls, training employees, and centrally coordinating responses to
security incidents. In addition to identifying deficiencies in the risk
assessment procedures, the lack of adequate coordination regarding ITS
activities, and the lack of a common structure for conducting ITS
activities, the NASA review team also noted weaknesses in ITS policies.
We believe that more work is needed in each of these areas including the
provision of more ITS coverage in other NASA policies and procedures.

4\. Procurement

Procurement continues to be a significant support process for all of
NASA's Enterprises[^4] and its overall mission. NASA's procurement
obligations continued to account for more than 87 percent of the
Agency's total obligations in FY 2000, just as they have for the last 10
years. NASA continues to procure more than \$12.5 billion in goods and
services annually, with the total amount increasing slightly in each of
the last 3 years. A number of ongoing management issues, as well as
recent results from audits, inspections, and investigations, dictate
that procurement be considered an ongoing challenge for NASA.

**Contract Management**. In 1999, GAO identified NASA contract
management as a major management challenge and program risk. The GAO
stated, in part, that NASA lacks adequate systems and processes to
oversee procurement activities and to produce accurate and reliable
management information in a timely manner. NASA planned to implement an
Integrated Financial Management Project (IFMP) computer system that
would have alleviated the GAO concern. However, the Agency had
difficulty in obtaining adequate performance by the IFMP contractor. The
contractor did not deliver the promised system, and NASA issued a stop
work order on March 10, 2000. As a result, NASA was forced to reevaluate
the entire scope and procedure for developing and implementing the IFMP,
and final implementation of the IFMP has slipped indefinitely. The GAO
continues to include NASA contract management on its high-risk list due
to the delay in implementing the IFMP.[^5]

**Human Capital.** Human capital concerns also adversely affect NASA
procurement. Since 1993, the number of NASA procurement personnel has
decreased by 28 percent. As indicated earlier, however, the procurement
obligations have consistently stayed above 87 percent of the annual NASA
total obligations, and the actual dollar amount of procurements has
increased in recent years. As a result, NASA now has significantly fewer
procurement personnel to oversee an increasing level of procurement
activity. Further, a recent NASA Office of Procurement study found that
attrition of Agencywide contracting staff could be as high as 40 percent
by the end of 2007. As a result, NASA faces losing significant
procurement expertise, which will compound the problem of providing
adequate procurement support to NASA Enterprises and individual NASA
programs.

**Outsourcing and Oversight.** NASA is also faced with increased
outsourcing of various functions and less direct procurement oversight
of its prime contractors and subcontractors. NASA is outsourcing several
IT functions, such as expert IT advice, specific applications,
education, maintenance, aspects of software/physical security, and
disaster recovery. NASA has also awarded a supplier assurance contract
to have a contractor perform quality assurance surveillance at supplier
locations. NASA also recently outsourced contract

closeouts. Outsourcing brings with it considerable risks unless the
Agency carefully provides for adequate internal controls over such
functions and the contractors that perform the service.

In addition, NASA is placing more reliance on its prime contractors and
other Government agencies to provide oversight of subcontractor
operations. NASA uses a risk-based acquisition management approach to
determine how much contractor surveillance is necessary. NASA also
relies on the Defense Contract Management Agency (DCMA) and the Defense
Contract Audit Agency (DCAA) for oversight reviews and audits of
contractors. Both agencies, however, have undergone major reductions in
staff and have, therefore, experienced a significant loss of expertise.
As a result, NASA contracting officers must remain vigilant over the
contracts for which they are responsible and request specific reviews of
areas of risk.

**Electronic Commerce.** NASA is also moving rapidly to expand
procurements that involve electronic commerce. NASA is making purchases
through the use of electronic catalogs; the Internet; purchase, fleet,
and travel credit cards; and other electronic means, such as
just-in-time (JIT) purchase systems. NASA is giving purchase authority
to individual employees as compared to using the traditional
procurement-office method of the past. NASA employees conducted more
than 400,000 credit card transactions, involving more than \$125 million
in purchases, in FY 2000. The number of transactions has increased
significantly from prior years and is expected to further increase. NASA
is also increasing the number of procurements through electronic
catalogs and JIT purchasing systems. Further, NASA is using the Internet
for rapid, low-cost, delivery of procurement information to a broad
audience. NASA is posting synopsis and solicitation information on the
Internet and is expanding its Internet services for customers. While
NASA is taking advantage of newer technology to relieve some of the
pressure from procurement downsizing, it must ensure that adequate
internal controls exist over electronic procurements that generally
involve fewer paper approvals, documented support, and supervisory
oversight.

# **Results of Audits and Other Reviews.** Recent and ongoing audits, inspections, and investigations continue to find problems in a variety of procurement areas. The problems include inadequate justifications for contractor and subcontractor noncompetitive procurements; lack of adequate market surveys, technical analyses, and cost/benefit evaluations; improper use of support service contracts; and inadequate contract audit services. For example, {#results-of-audits-and-other-reviews.-recent-and-ongoing-audits-inspections-and-investigations-continue-to-find-problems-in-a-variety-of-procurement-areas.-the-problems-include-inadequate-justifications-for-contractor-and-subcontractor-noncompetitive-procurements-lack-of-adequate-market-surveys-technical-analyses-and-costbenefit-evaluations-improper-use-of-support-service-contracts-and-inadequate-contract-audit-services.-for-example .unnumbered}

-   Audits at separate NASA prime contractors or subcontractors found
    multiple incidents of inadequate justifications for noncompetitive
    procurements.

-   Audits of two major NASA programs identified a lack of adequate cost
    analyses for significant contract actions.

-   An audit of Phase II of the Space Flight Operations Contract found
    that NASA did not perform a cost-benefit analysis. The lack of a
    cost-benefit analysis precluded proper determination of contract
    requirements and establishment of a baseline with which to later
    measure accomplishment of potential cost savings and other goals. We
    also found that NASA cannot be assured it received fair and
    reasonable pricing because the FY 1998 flight rate credit analysis
    was not fully documented in the contract file in accordance with FAR
    requirements. Consequently, NASA cannot be assured that the \$33.3
    million flight rate credit represents a full contract price
    reduction from the two cancelled flights.

-   An inspection found that a proposed NASA sole-source procurement at
    a major university lacked sufficient justification and that no
    cost/benefit analysis was performed as required by Agency policy.

-   An ongoing inspection at one NASA Center found the inappropriate use
    of contractor personnel for general administrative work through
    support service contracts.

-   An audit of six of NASA's largest contracts found that contractor
    insurance pension reviews were inadequate. According to a DCMA
    directive, costs of insurance and pension programs materially affect
    contract price and are high risk because the indirect costs of these
    programs usually exceed 50 percent of direct labor costs. Four of
    the six contractor insurance pension review reports addressing the
    six NASA contracts lacked a complete analysis of insurance costs,
    and three of the six reports were not issued in a timely manner.

-   An audit on the impact of the Boeing Company's restructuring on NASA
    identified that the Agency has not received a benefit from either
    the restructuring or a related advance agreement with the DCMA. On
    December 17, 1999, Boeing entered into an advance agreement with the
    DCMA to reorganize and restructure Boeing as a result of previous
    acquisitions and mergers. Our audit addressed the disparities
    resulting from this agreement between the savings accruing to Boeing
    and the Department of Defense (DoD) and those accruing to NASA.

    We found that NASA (1) received an inequitable share of the
    projected restructuring savings and (2) has little assurance that it
    will realize any actual savings from Boeing's restructuring. In
    addition, NASA could incur increased costs of as much as \$115
    million due to changes in accounting procedures and cost allocation
    methods related to Boeing\'s restructuring. The Agency has not
    benefited because (1) NASA does not have the legislation and
    implementing guidance similar to DoD's regarding external business
    restructurings, (2) NASA was not actively involved in reviewing and
    negotiating Boeing\'s restructuring proposal, and (3) DCMA
    considered Boeing's accounting and cost allocation changes separate
    and distinct from its restructuring efforts and did not include
    these items in negotiating the advance agreement. As a result,
    Boeing's commercial and defense customers will primarily benefit
    from its restructuring, changes in accounting practices, and cost
    allocation methods while NASA will absorb most of the costs. NASA
    has an opportunity to recover about \$64.7 million in contract
    offsets as a result of DCMA's efforts to mitigate some of these cost
    increases. The contract offsets are actual dollar savings for NASA
    and will have a positive impact on the Agency's budget. We have made
    several recommendations to improve NASA's position on this and
    future restructuring agreements.

    Further, the number of criminal investigations involving procurement
    fraud has increased in the last year. The investigations resulted in
    31 convictions or civil settlements for kickbacks (18), civil false
    claims (6), product substitution (2), cost mischarging (1) and other
    major or program fraud (4). In March 2000, for example, a NASA
    contractor agreed to settle a lawsuit involving unallowable
    sale-leaseback charges to contracts. The contractor agreed to pay
    back \$38 million. In addition, the majority of the kickback
    investigations involved buyers or other procurement officers working
    for NASA prime contractors or major subcontractors. The
    investigation results represent an increase from the prior year
    during which 22 convictions or civil settlements for procurement
    fraud were realized.

    **5. Fiscal Management.**

    Recently completed and on-going OIG audits have identified problems
    with obligations management, IFMP, and implementation of full-cost
    procedures. In additional, NASA made a significant error in
    preparing the 1999 Statement of Budgetary Resources. These problems
    indicate that fiscal management continues to be a significant
    management challenge for the Agency.

    **Obligations Management.** Our audit of Matching Disbursements to
    Obligations found that disbursements are not properly matched to the
    originating obligations. In accordance with fiscal law, NASA must
    ensure that appropriated funds are used for the purposes authorized
    by Congress and must have effective management control over
    obligations and disbursements in order to maintain appropriation
    integrity. Disbursements for contract items and services received
    should be matched to the obligations citing funds authorized to make
    the payments. We found the condition existed because (1) Agency
    financial management policies and procedures match disbursements to
    the oldest recorded obligation regardless of the correct
    appropriation and program year, (2) financial management officials
    incorrectly believe the proper cost accrual procedures ensure the
    correct appropriation is used, (3) financial management personnel
    are not provided specific accounting information to allow them to
    determine which obligations to charge, and (4) NASA policy does not
    require that obligations and disbursement be properly matched.

    Because disbursements were not properly matched to obligations,
    authorized funds may not have been used for their authorized
    purposes. Our audit found that of the 36 reviewed disbursements
    totaling about \$44.8 million, about \$44.7 million may have been
    charged to the incorrect appropriation, which may have resulted in
    violations of fiscal law. In addition, systematically liquidating
    obligations based solely on the use of oldest funds first can impact
    the Statement of Budgetary Resources because the statement is
    reported by appropriation. Therefore, disbursements as reported in
    the statement could be in error because the disbursement would not
    generally relate to the obligation charged.

    Management initially nonconcurred with our recommendations to revise
    the (1) Financial Management Manual (FMM) to require disbursements
    to be properly matched with obligations and (2) the NASA FAR
    Supplement to require contractors to submit obligation data with
    their invoices and to have procurement offices provide payment
    instructions to enable the charging of disbursements to the
    obligations consistent with the performance of work on contracts. On
    October 26, 2000, NASA management and the OIG collaborated on a
    proposed revision to the NASA FMM that addressed each of the open
    recommendations. As a result of this effort, all the recommendations
    have been resolved. One recommendation remains open pending formal
    revision of the FMM and implementation of the agreed-upon
    requirements by NASA Centers.

    Our audit of Internal Controls over Processing Deobligations found
    that financial officials at two Centers did not adequately document
    deobligation transactions for more than half of the transactions
    reviewed. GAO "Standards for Internal Control in the Federal
    Government," specify requirements for recording and documenting
    transactions. In addition, the NASA FMM requires that all
    obligations be supported by documentary evidence. However, the FMM
    has no specific documentation requirement for deobligations. In
    addition, neither of the two Centers had specific financial guidance
    for processing and documenting deobligations.

    Lack of adequate documentation to support financial transactions is
    a serious internal control weakness that can result in inaccurate
    and unreliable financial data. Because the documentation was not
    available to support the deobligation transactions, we interviewed
    accountants, budget and program analysts, and researchers associated
    with the deobligation to determine additional details. These
    personnel explained that the deobligations were made to:

-   fully obligate an expiring reimbursement from another Federal agency
    or an expiring NASA appropriation,

-   distribute obligations and costs to benefiting activities,

-   correct prior transaction errors and changes in accounting codes,

-   close out contracts, and

-   meet obligation and cost metrics.

    In many cases, NASA personnel were unable to provide sufficient
    explanations to validate the transaction. We are particularly
    concerned that some deobligations were made solely for the purpose
    of meeting Agency metrics. Management needs to ensure that
    transactions are properly authorized and adequately documented.
    Adequate documentation consists of documents such as contract
    modifications, purchase requests, or other documents that provide a
    complete, detailed narrative explanation of why the transaction is
    requested. Supporting documentation should also include evidence of
    management's approval, the approval date, and appropriate
    signatures. Because of the lack of documentation to support the
    transactions at the two Centers we reviewed, we could not attest to
    the validity and amount of deobligations valued at about \$7.4
    million.

    We made four recommendations to improve controls over processing and
    documenting deobligations. Management\'s comments on two of the
    recommendations were responsive, but the recommendations will remain
    open until NASA completes the planned corrective action. Management
    nonconcurred with the two remaining recommendations. We have asked
    management to reconsider its position and submit additional
    comments.

    Audit field work is continuing in the area of obligations
    management. We are reviewing selected obligating transactions at two
    Centers to evaluate controls over the establishment and adjustment
    of obligations. Specifically, we are evaluating the supporting
    documentation and the bona fide need for the selected transactions.
    We are also reviewing yearend transactions to identify cases of
    excessive forward funding of uncosted obligations.

    In addition, we are reviewing the cause and impact of NASA's
    overstatement of about \$643 million in recoveries of prior year
    obligations and obligations incurred as reported on the 1999
    Statement of Budgetary Resources. Our review indicated that the
    error occurred because financial management personnel reporting to
    the Chief Financial Officer (CFO) misinterpreted guidance contained
    in OMB Circular A-34, "Instructions on Budget Execution." NASA
    financial personnel made accounting entries that incorrectly include
    disbursements charged against obligations of prior year
    appropriations as recoveries of prior year obligations.
    Additionally, although NASA's independent public accounts were aware
    of the variance, they did not discover the error during their annual
    audit because they did not conduct tests to determine the validity
    of the reported amount. While the amount of the misstatement is
    material, a budgetary impact may not have resulted from the error.
    However, the error pointed out, once again, that significant
    uncertainty exists regarding how to properly manage obligations.

    **IFMP.** As stated under Challenge 4, Procurement, NASA continues
    to experience difficulty in implementing IFMP, a NASA-wide, fully
    integrated, transaction-driven financial management system intended
    to provide full-cost accounting and other budget information. NASA
    is redesigning its implementation plan and selecting its
    implementation service provider for its core financial systems
    software. Any delay in implementing the new system will result in
    continued reliance on outdated systems that do not provide the
    financial and management information that the Agency needs. Also,
    NASA will not be able to implement full-cost management as planned
    and will instead incur substantial costs to maintain legacy systems
    that the new system would replace.

    **6.** **Program and Project Management**

    The Agency faces significant challenges in program and project
    management. On

    April 3, 1998, NASA issued NASA Procedures and Guidelines (NPG)
    7120.5A, "NASA Program and Project Management Processes and
    Requirements." This new guidance substantially revised NASA
    management procedures at a time when the Agency had many programs
    and projects that were initiated under earlier procedures. NASA
    issued the new guidance to improve program and project management
    by (1) including all parties involved from the beginning of the
    program or project, from solicitation to delivery of the end item,
    and (2) placing more responsibility/risk in the hands of the
    contractor which, in turn, will reduce the amount of Agency
    oversight. Further, the intent of the new policy is to support the
    accomplishment of programs and projects (consistent with the
    Agency's strategic plan) on schedule and within budget while meeting
    the needs of stakeholders and customers. The tailoring of the NPG
    should provide a mechanism to encourage and achieve "faster, better,
    cheaper" products while meeting customer expectations.

    During this transition period (April 1998 to the present),
    considerable risk existed, and continues to exist, that a
    noncompliance could occur that could have a material impact on the
    success of NASA programs. Over the last 30 months, we have evaluated
    the causes of various program and project management issues on NASA
    contracts managed under the new NPG. From September to December
    1999, the Agency was revising the NPG when two of the Mars missions
    failed within during this same time. This resulted in NASA's
    decision to revisit the faster, better, cheaper process and to
    assess the effectiveness of NPG 7120.5A. A NASA Independent
    Assessment Team was commissioned in March 2000 to define a plan to
    mitigate the root causes of failures that were identified in various
    reports on NASA Management (including the Mars Failure reports) and
    to enhance the probability of success on future missions. We will
    continue to focus on the effectiveness and efficiencies of the
    revised NPG. We will evaluate whether the new management system
    improves cost and schedule performance for the Agency's major
    programs/acquisitions. In addition, we will recommend process
    improvements and assess their applicability to improving the
    operations of Agency functions.

    In addition, the effects of downsizing the Agency's acquisition
    workforce and increased reliance on contractor support (see
    Challenge 4, Procurement) present new challenges that NASA must
    monitor until full implementation of the new NPG.

    The revised NPG 7120.5A should emphasize contractor performance
    monitoring and technology transfer. The current NPG requirements for
    performance monitoring consist only of reporting assessments of
    contractor performance to the contractor and maintaining records in
    accordance with established policy. We believe the NPG should
    include specific requirements related to technical monitoring,
    communications, and contractor performance. Based on our FY 1996
    review of new technology reporting, we found several deficiencies in
    NASA\'s technology transfer and commercialization process. We
    recommended a complete reassessment of the new technology reporting
    process including (1) defining an active role for NASA senior
    management, (2) developing a detailed implementation strategy,
    and (3) providing sufficient resources to implement the new
    strategy. Management concurred with our recommendations and has
    implemented corrective actions. Consistent with these
    recommendations, NPG 7120.5A should be revised to incorporate the
    requirements and responsibilities of program and project managers
    regarding new technology reporting.

    NASA has established an NPG 7120.5A Working Group (Group). The Group
    is composed of various Headquarters and NASA Center personnel. The
    Group meets periodically to address recommended changes, revisions
    and suggestions to improve the overall program and project
    management guidance in NPG 7120.5A. For example, the NASA OIG has
    made formal recommendations, in several audit reports that the group
    has discussed and implemented. These are discussed below.

    While NPG 7120.5A has been issued, many other NASA directives should
    be issued or revised to support effective program management. For
    example, in 1997, NASA issued NASA Policy Directive (NPD) 9501.3,
    \"Earned Value Performance Management,\" to establish the basis for
    applying earned value management (EVM) to contracts. However, to
    effectively use EVM as a management tool, it must be an integrated
    part of program and project management. EVM is not currently
    consolidated as an overall program and project management
    responsibility. The fragmentation of the policy results in
    unnecessary separation of authority for EVM policy, which has been
    delegated to the CFO, while the day-to-day responsibility for EVM
    implementation rests with program and project managers. We
    recommended that management revise EVM procedures and issue EVM
    policy as program and project management directives and guidance.
    NASA agreed to (1) strengthen EVM guidance by revising both NPG
    7120.5 and NPD 9501.3 and (2) designate Marshall as the lead Center
    for EVM. This action satisfies the intent of our recommendations,
    which will remain open until management revises the policies. In
    addition, NPG 8840, \"NASA Procedures and Guidelines for
    Implementation of the National Environmental Policy Act (NEPA) and
    Executive Order 12114,\" when issued, will establish standard
    procedures for implementing NEPA and the Agency\'s overall
    environmental planning process. These processes and procedures are
    important for program and project management, but NPG 8840 has been
    in draft for more than a year and still has not been issued. Also,
    the Agency plans to revise the NASA FAR Supplement to include
    various risk management considerations. The change will encompass
    safety, security (including IT security), health, export control,
    and environmental protection within the acquisition process. While
    these are important program and project management considerations,
    the change will require several months to incorporate into policy
    and implement.

    We have issued several audit reports that identify program and
    project management issues that range from inadequate Contracted
    Advisory and Assistance Services from DCAA and DCMA to a lack of
    NASA oversight on its major programs and projects. These issues were
    attributable not only to contracts awarded under the new NPG but
    also to those being managed under earlier policy requirements. The
    following paragraphs discuss the types of

    program and project management issues that we reported and believe
    provide strong support that program and project management is
    considered a significant area of management concern.

    **Independent Cost Estimating Capability.** After a 1996
    reorganization, NASA lost its independent cost estimating function
    as cost estimators left and were not replaced. NASA recently took
    steps to reestablish this capability by adding eight cost estimators
    to the Independent Program Assessment Office at the Langley Research
    Center (Langley) and by establishing a Systems Management Office
    with an independent cost estimating capability at each Center.
    However, the audit found that NASA's reporting and funding structure
    for independent cost estimating may provide no assurance that
    estimates are independent in fact and/or appearance. The audit also
    showed that NASA has not identified the cost estimating and cost
    analysis function as a discipline with a specific job series, has
    not established career development plans for its cost estimators,
    and does not have a requirement to develop independent cost
    estimates at all major reviews of programs and projects.

    NASA concurred with our recommendation to require independent cost
    estimates at all major reviews and to develop core training
    requirements for cost estimators. However, management nonconcurred
    or partially nonconcurred with our recommendations to provide for
    direct reporting of independent cost estimates to the approving
    official, to establish an independent funding source for all
    independent cost estimating activities, and to identify a specific
    job services for cost estimators and analysts. We are working with
    management to resolve the issues.

    **Subcontractor Technical Performance.** Our audit determined that
    the Jet Propulsion Laboratory (JPL) needs to improve oversight of
    subcontractor technical performance. JPL has not adopted the
    practice of performing engineering and quality audits as prescribed
    in NASA policy. As a result, subcontractors have incurred excessive
    costs to correct technical problems that could have been prevented
    or mitigated to some extent. We recommended that NASA management
    direct the JPL Director to revise current project management
    policies to require project management assessment and monitoring of
    subcontractor procedures. Management partially concurred with the
    recommendation. We are working with management to resolve the
    issues.

    **Space Station Corrective Action Plans.** Boeing\'s corrective
    action plans and the Johnson Space Center's (Johnson\'s) oversight
    of the plans need improvement. The Space Station Program has
    experienced a continued deterioration in cost and schedule
    performance after a September 1997 adjustment of the contract cost
    baseline, but variance analyses and corrective action plans have not
    been effectively utilized to control the negative variances.
    Additionally, Johnson did not provide effective oversight of
    Government surveillance of the Earned Value Management System,
    including the verification of corrective actions related to cost and
    schedule variances. As a result, the Space Station Program lacked
    assurance that negative variances were identified and corrective
    actions were taken to reduce associated risk. Further, Johnson did
    not ensure that Boeing took corrective actions

    on conditions noted since at least March 1997 to properly prepare
    and submit Variance Analysis Reports. As a result, Variance Analysis
    Reports may not adequately identify cost and schedule risks. (Also
    see Challenge 3, International Space Station.)

    **Earth Observing System (EOS) Common Spacecraft Planning and
    Management.** In general, the EOS contractor-planned schedule and
    cost performance is adequate. However, program management can be
    improved in the areas of quality control and communication of award
    fee determinations. Specifically, NASA does not have assurance that
    the DCMA is performing required quality assurance services. Further,
    DCMA did not finalize and submit its Agency Quality Assurance Plan
    for contract NAS5-32954 in a timely manner. Although DCMA has
    submitted the plan, NASA has not formally approved it. Finally, DCMA
    has not submitted required status reports to the NASA Flight
    Assurance Manager at Goddard. The information is necessary to ensure
    that quality assurance issues are addressed in a timely manner.

    **X-33 Cooperative Agreement.** NASA has had limited success in the
    use of a cooperative agreement on a major program. (Also see
    Challenge 7, Launch Vehicles.) The X-33 Program cooperative
    agreement represents NASA\'s \"new way of doing business,\" that is,
    faster, better, cheaper; partnering; less documentation; fewer
    staff; and reduced oversight. While the cooperative agreement has
    provided certain benefits including faster award and greater
    flexibility in managing the X-33 Program, we found its use has
    contributed to a variety of program management problems. The
    problems have adversely affected X-33 Program planning, execution,
    resource management, and property control NPD 7120.4A,
    "Program/Project Management," and NPG 7120.5A state that the
    directives apply to all programs and projects. However, Agency
    guidance on use of cooperative agreements with commercial firms,
    NPG 5800.1D, "Grant and Cooperative Agreement Handbook," does not
    specifically require that program and project managers comply with
    program management requirements when a cooperative agreement is used
    for a major system. NPG 5800.1D guidance on the use of cooperative
    agreements with commercial firms was not designed for major (large
    dollar) programs like the X-33. Consequently, early in the X-33
    Program there was some uncertainty as to which program management
    requirements applied to the X-33 under the "new way of doing
    business." We recommended that management revise NPG 5800.1D to
    include guidance requiring that program and project managers
    entering into partnering agreements with commercial firms for the
    design and development of major systems must comply with NPD 7120.4A
    and NPG 7120.5A. Management concurred with the recommendation and is
    taking appropriate corrective actions.

    An important element of effective program and project management is
    cost analysis. As noted in Issue 5, we have reported deficiencies in
    cost analysis procedures on the X-33 Program and other Agency
    initiatives. We have made recommendations for management to modify
    NPG 5800.1D and NPG 7120.5A to include a well-supported cost
    analysis and quantification of cost risk.

# **Advanced X-RAY Astrophysics Facility (AXAF).** Overall, NASA responded adequately to the initial AXAF[^6] launch delay and has focused additional attention on contractor performance. The AXAF launch delay will increase contract costs by an estimated \$28.8 million. The initial delay was caused by problems in software development and inadequate time scheduled for integration and test activities for the AXAF flight and ground software. When software development was identified as a high risk, Project officials did not update the AXAF risk management plan NASA policy did not require the plan to be updated. Also, NASA did not assign personnel with software expertise at the contractor location. However, when the delivery delay became known, NASA management took action to minimize the impacts and adjusted the contractor award fee to reflect actual performance. We made recommendations for management to modify NPG 7120.5A to include a well-supported cost analysis and quantification of cost risk. NASA is taking action to improve cost estimating and risk analysis procedures. {#advanced-x-ray-astrophysics-facility-axaf.-overall-nasa-responded-adequately-to-the-initial-axaf-launch-delay-and-has-focused-additional-attention-on-contractor-performance.-the-axaf-launch-delay-will-increase-contract-costs-by-an-estimated-28.8-million.-the-initial-delay-was-caused-by-problems-in-software-development-and-inadequate-time-scheduled-for-integration-and-test-activities-for-the-axaf-flight-and-ground-software.-when-software-development-was-identified-as-a-high-risk-project-officials-did-not-update-the-axaf-risk-management-plan-nasa-policy-did-not-require-the-plan-to-be-updated.-also-nasa-did-not-assign-personnel-with-software-expertise-at-the-contractor-location.-however-when-the-delivery-delay-became-known-nasa-management-took-action-to-minimize-the-impacts-and-adjusted-the-contractor-award-fee-to-reflect-actual-performance.-we-made-recommendations-for-management-to-modify-npg-7120.5a-to-include-a-well-supported-cost-analysis-and-quantification-of-cost-risk.-nasa-is-taking-action-to-improve-cost-estimating-and-risk-analysis-procedures. .unnumbered}

7\. Launch Vehicles

The next-generation Reusable Launch Vehicle (RLV) concept is an attempt
to reduce the cost of access to space. The original RLV was the Space
Shuttle. As part of its Space Transportation mission, NASA is now
looking towards a second-generation RLV to reduce launch costs. The X-33
and X-34 and other Space Transportation programs will provide a number
of flight tests of key technology demonstrations needed for the
next-generation RLV system.

The X-33 Program is undergoing a major restructuring due to the failure
of the composite hydrogen tank last fall. Current plans call for the
X-33 Program to replace the failed composite tank with an aluminum tank.
In addition, lessons learned from failures in other programs have
prompted program officials to reexamine the level of insight that NASA
had into the program and the need for increased risk management. Our
audit of the X-33 Cooperative Agreement found that use of a cooperative
agreement contributed to a variety of program management problems, which
adversely affected X-33 Program planning, execution, resource
management, and property control. (Also see Challenge 6, Program and
Project Management.) Under the cooperative agreement, NASA\'s share of
the cost was fixed at \$941 million, while the industry partners were to
contribute the remaining costs of the program. NASA and Lockheed are
currently negotiating an X-33 "recovery plan." However, negotiations
have been difficult, particularly over who should pay for additional
costs to complete the program. Under the cooperative agreement, either
party can terminate the agreement if the issues are not resolved.

Our audit of the X-34 Technology Demonstrator found that Marshall had
not established mission-specific requirements for each of the 27 planned
X-34 flights, and had not properly documented numerous changes to the
proposed flight test program. Subsequent to our audit, the X-34 Project
began undergoing a major restructuring to increase the likelihood of
mission success. Project officials are proposing additional tests and
other risk mitigation factors. Project officials are also examining a
variety of enhancements as part of this restructuring. The estimated
cost of the X-34 Project (including the cost of the Fastrac engine and
approximately \$2 million in experiments) totaled about \$186 million.
However, proposed changes in the program could significantly increase
the amount of time and money needed for the project.

Low-cost space transportation remains a key enabler of a more aggressive
civil space program. Reducing the cost of access to space is one of
NASA\'s top priorities. The X-33 Program and the X-34 Project are major
efforts towards this priority. The restructuring of these programs could
increase the costs of these programs and extend the time needed to
successfully complete the efforts. NASA proposes to spend about \$4.5
billion on the second-generation RLV Program over the next 5 years. The
X-33 and X-34 will be expected to compete with other proposals for
additional funding from the second-generation RLV Program.

**Commercialization.** We recently issued a draft report on Space
Shuttle Payloads and identified a pricing issue that has implications
for commercialization of the Space Shuttle. For primary payloads, NASA
priced Space Shuttle flights for prospective commercial customers under
the "reasonable customer incentives" provision of 42 United States Code
(USC) § 2466 but has not established a pricing system as required by
that statute. Without a pricing system, NASA does not have a baseline
for determining reasonable customer incentives and, consequently, may be
offering Space Shuttle flights at prices that are less than intended by
the statute. Also, NASA has not established a definition for the "fair
value" that must be charged to Department of Defense customers in
accordance with 42 USC § 2464. In addition, for a flight offered to the
Air Force for \$200 million, NASA has not considered the value (at least
\$306.4 million) of the service to the recipient, as required by
31 USC § 9701. Without a definition of fair value, interested third
parties, such as OMB and the Congress, cannot determine whether a price
is fair and reasonable. Further, NASA may be greatly subsidizing a fully
funded Air Force mission.

We recommended that NASA analyze the statutes and directives that
address user charges; establish a pricing system with structured user
charges; and in consultation with OMB and the Congress, establish a
definition for fair value. These actions would provide prospective
customers a clear and consistent price schedule for use of the Space
Shuttle. We also recommended that NASA modify the authorization to
United Space Alliance (USA) to seek only reimbursable commercial
customers. This action would help ensure that USA does not solicit other
Government agencies as customers and offer a price lower than what NASA
would charge. In addition, we recommended that NASA accept only those
offers for Space Shuttle commercial use that meet the user fee
requirements. This action would ensure that the Agency does not recover
a lower reimbursement than intended by statute. Finally, in response to
management's comments on the draft report, we recommended that NASA
include in the pricing system its methodology for determining additive
cost as defined by 42 USC § 2466b. This action would help ensure that
the Agency does not charge less than additive cost, which could be
significantly more than the marginal cost for an added flight because of
the statutory requirement to include fixed costs.

Management did not concur with the recommendations. Management stated
that from the inception of the Space Shuttle, NASA has been involved in
fashioning the statutes, regulations, and policies governing the Space
Shuttle and has applied them appropriately in pricing Space Shuttle
launch services. The policy as it is now structured meets national goals
and customer needs and is fully consistent with statutory requirements.
Attempting to establish pricing formulas for all conceivable cases would
serve no purpose and risks compromising the needed flexibility afforded
by statute. We are attempting to resolve the recommendations with
management before issuing the final report.

8\. Technology Development

The National Aeronautics and Space Act of 1958 (Space Act) charges NASA
with "the improvement of the usefulness, performance, speed, safety, and
efficiency of aeronautical and space vehicles." To achieve this goal,
NASA, often in partnership with industry and academia, researches and
develops new aeronautics and space technologies.

The emphasis NASA has placed on technology development has varied over
time and differs among the Agency's Enterprises. For example, NASA's
aeronautics programs have a long tradition of research and technology
development in support of the aeronautics industry. Although NASA's
early space efforts were successful in developing new technologies,
NASA's focus on the Space Shuttle; ISS; and large, low-risk science
missions during the 1970's and 1980's resulted in the development of
relatively few new space technologies. During the 1990's, NASA increased
its space technology development efforts and its use of space
technologies developed by the growing commercial space industry and the
Department of Defense.

The following recent major changes have drawn our attention to NASA's
technology development activities:

-   The NASA Office of the Chief Technologist has been abolished, and
    the Agency's technology development efforts are now the
    responsibility of the Office of Aerospace Technology.

-   Consolidation in the aerospace industry has left the United States
    with only one builder of large commercial aircraft. This raises
    issues about NASA research and development in support of the
    commercial aircraft industry.

-   NASA has canceled its high-speed aeronautics research program.

-   The commercial space industry continues to thrive, driving new space
    technology development in many areas.

-   The ISS era has begun, opening up an opportunity for increased
    in-space research and technology development.

-   NASA has created an Internet-based *Technology Portal* highlighting
    commercial and educational technology development and applications

#### Our future reviews of NASA technology development activities will focus on the following themes: {#our-future-reviews-of-nasa-technology-development-activities-will-focus-on-the-following-themes .unnumbered}

-   Are appropriate controls in place on NASA's cooperative technology
    development programs (for example, Small Business Innovative
    Research, Small Business Technology Transfer Research, and
    cooperative agreements)?

-   Is NASA taking into consideration the advice of its advisory bodies
    concerning technology development?

-   Is NASA making appropriate use of technologies developed outside the
    Agency? Is NASA duplicating technology research that has been (or
    would have been) developed outside the Agency?

-   Is NASA effectively transferring the technologies it develops to
    U.S. companies?

-   Is NASA's technology development organization appropriately
    structured to ensure effective technology development? Are NASA's
    Enterprises cooperating in research and technology development?

-   Are NASA's technology demonstration programs being compromised by
    added requirements unrelated to technology demonstration?

-   Is funding intended for technology development being diverted to
    other programs?

-   Is NASA adequately ensuring that the technologies it develops are
    not misappropriated? Are trade secrets being protected? Is
    technology development information appropriately secured?

-   Are NASA technology demonstrations unfairly distorting the
    marketplace?

-   Does NASA have the human capital necessary to conduct or oversee
    technology development programs?

-   Are the Agency's technology development activities adequately
    aligned with and supportive of its expanding commercialization
    activities?

    **9. International Agreements**

    One of the goals of the National Space Policy is to promote
    international cooperative activities that are in the national
    interest. The Space Act gives NASA statutory authority to enter into
    binding agreements with foreign entities. Since its inception, NASA
    has entered into about 3,500 international agreements. These
    agreements span every NASA Enterprise and involve numerous programs
    and projects---the most notable being the ISS Program. NASA's
    international agreements also provide for foreign nationals and
    representatives to have access to NASA facilities and information.
    NASA's Office of External Relations is responsible for determining
    the appropriateness and level of that access. Inherent in a decision
    to grant foreign personnel access is the risk of sabotage or
    disclosure of information of military or economic importance.
    Several audits and other reviews have found weaknesses related to
    foreign national visitors at NASA facilities and the export of NASA
    technology. Therefore, we consider access to NASA technology and
    facilities a significant management challenge.

    **Access to Technology.** NASA is a high-priority target of unlawful
    intrusions from various sources. The OIG's past and current work has
    identified a need for NASA to strengthen its internal controls
    sufficiently to detect both internal theft and inadvertent loss of
    NASA technology and research. As a U.S. Government agency on the
    leading edge of space and aeronautics technological development and
    international cooperation, NASA must be a responsible exporter in
    its international activities. NASA\'s international activities often
    involve the transfer of commodities, software, or technologies to
    foreign partners not only by NASA, but also by its contractors. The
    transfers are generally subject to export control laws and
    regulations, regardless of whether they occur in the United States,
    overseas, or in space. Export controls are imposed on such transfers
    and activities to protect the national security and to further U.S.
    foreign policy objectives.

    We conducted an audit of contractor control of sensitive
    technologies (controlled technologies) to assess Government
    oversight of contractor processes for exporting controlled
    technologies. The audit identified that NASA personnel responsible
    for managing major programs at Goddard, Johnson, and Marshall were
    unable to readily identify the types and amounts of NASA-funded
    controlled technologies that contractors export. As a result, NASA
    lacks assurance that contractor export activities are performed in
    accordance with applicable laws and regulations. The audit also
    identified potential export violations by two of the three NASA
    contractors who were exporting NASA-funded controlled technologies
    to foreign contractors in furtherance of the ISS and Space Shuttle
    External Tank programs. NASA did not direct or seek these exports.
    Consequently, the contractors bear responsibility for full
    compliance with export laws.

    We recommended that NASA management include guidance in either a
    NASA FAR Supplement amendment, Procurement Information Circular, or
    NASA Procedures and Guidelines that all appropriate NASA contracts
    require the contractors to deliver (1) a plan for obtaining any
    required export licenses to fulfill contract requirements, (2) a
    listing of the contractor licenses obtained, and (3) a periodic
    report of the exports effected against those licenses. We also
    recommended revision of the draft NASA Policy Directive to
    incorporate the oversight responsibilities of appropriate NASA
    officials for those cases in which NASA or its contractors obtain
    export licenses on behalf of a NASA program. Management concurred
    with both recommendations and is taking responsive corrective
    actions.

    We conducted another audit to determine whether major contractors
    have established adequate controls over controlled technologies to
    preclude unauthorized or unlicensed exports. The audit identified
    that Boeing may not have complied with applicable export laws and
    regulations when exporting controlled items on behalf of the ISS
    Program. Specifically, Boeing was unable to readily produce records
    related to exports of controlled technologies. Further, on two of
    the six NASA-obtained export licenses related to the ISS, Boeing
    potentially effected exports of controlled technologies beyond the
    scope of the licenses. This condition existed because Boeing did not
    have effective company policies in place with regard to exports. In
    addition, NASA does not provide oversight of Boeing\'s export
    control program, even though NASA is the licensee for several
    ISS-related export licenses. As a result, exports of controlled
    technologies by Boeing in support of the ISS Program have been
    effected in potential noncompliance with U.S. export laws and
    regulations.

    We recommended that management require Boeing to establish an
    appropriate export control program and a detailed, company-wide
    export policy that comply with applicable laws and regulations prior
    to authorizing Boeing to utilize NASA-obtained export licenses on
    behalf of the ISS Program. We also recommended that management
    periodically review both Boeing and its subcontractors\' export
    control programs to ensure that exports effected against
    NASA-obtained licenses in support of the ISS Program are being
    accomplished in accordance with applicable U.S. export laws and
    regulations. Management questioned whether some of the examples
    detailed in the report were, in fact, export violations. We
    reaffirmed our position that the examples of export shipments
    detailed in the report could represent possible export violations
    because of the disparities in explanations provided by management
    and the inconsistencies in the available supporting documentation.
    Management concurred with both of the report\'s recommendations and
    planned responsive corrective actions.

    **Access to NASA Facilities.** The Space Act, as amended, states
    that NASA shall conduct its activities with an objective of
    cooperating with other nations. This cooperation has involved
    hosting foreign national visitors at its installations. The Space
    Act provides for the NASA Administrator to establish the necessary
    security requirements, restrictions, and safeguards for hosting
    foreign national visitors to protect the national security interests
    of the United States. The Defense Security Service reported in its
    1998 publication, "Technology Collection Trends in the U.S. Defense
    Industry," that 37 countries were associated with seeking U.S.
    technologies in 1997. The report states that the second most
    frequently used technique for collecting technological information
    was foreign national visits to U.S. facilities and that
    inappropriate conduct during visits was the second most frequently
    reported method of operation. As of April 1999, NASA had
    approximately 1,383 foreign national visitors at 11 Centers.

    An OIG audit of Foreign National Visitors at NASA Centers found that
    controls are in place over access to information by foreign national
    visitors. However, controls over access to NASA Centers by foreign
    national visitors need to be strengthened and uniformly applied on
    an Agencywide basis. The audit showed that controls over access by
    foreign national visitors varied among Ames, Goddard, Johnson, and
    Langley. Disparities among the four Centers related to (1) which
    foreign nationals were controlled, (2) the types of Government
    records checks made, (3) how visitors were escorted once on-site,
    and (4) how foreign national visitors were badged. The Agency also
    lacks a foreign national visitor management information system.
    Improvements are needed to ensure that NASA Centers and information
    are adequately protected against unauthorized access by foreign
    national visitors.

    We recommended that NASA Management (1) revise the definition of a
    foreign national in NASA policy guidance, (2) revise existing policy
    to establish NASA-wide requirements and procedures for obtaining
    National Agency Checks and for escorting foreign visitors, (3)
    establish a NASA-wide policy for badging foreign nationals, and (4)
    develop and implement a NASA-wide management information system to
    support the foreign national visitor program. Management concurred
    with the recommendations and planned responsive corrective actions.

    **10. Environmental Management.**

    Environmental Management is a significant management challenge due
    to serious concerns related to cost sharing, compliance with the
    National Environmental Policy Act (NEPA) and nuclear reactor
    decommissioning costs.

    **Cost Sharing.** In audit reports issued in 1997 and 1998, we
    recommended that NASA pursue cost sharing and cost recovery
    agreements with JPL and the Santa Susana Field Laboratory (SSFL).
    While NASA has made slow progress in negotiating cost sharing and
    cost recovery agreements for the JPL, negotiations have not begun
    for the SSFL. According to Agency management, NASA has limited
    grounds on which to require other Government agencies to negotiate
    cost sharing agreements for Resource Conservation and Recovery Act
    (RCRA) sites. Management also stated that a DCAA finding allows
    contractors to charge the environmental clean up costs to the
    Government through general and administrative (G&A) expenses.

    We disagree with management\'s position. The Comprehensive
    Environmental Response, Compensation, and Liability Act and RCRA
    laws and regulations provide bases for negotiating fair cost sharing
    agreements between Government agencies and have been used in such
    negotiations. For example, NASA negotiated fair cost sharing
    agreements with the Tennessee Valley Authority officials for an RCRA
    site in Mississippi and with the U.S. Army Corps of Engineers for a
    RCRA site at Wallops Flight Facility in Maryland. Further, DCAA
    recently reported that allowing contractors to charge environmental
    clean up costs through G&A expenses does not stop two or more
    Government agencies from negotiating a fair cost sharing agreement
    for the Government\'s share of the liability to clean up a
    contaminated site. DCAA also reported that contractors cannot charge
    environmental costs to the Government through G&A expenses if they
    have been negligent or if contractors have broken environmental laws
    and regulations. We also are exploring with the Environmental
    Protection Agency options available to agencies such as NASA for
    cost sharing and cost recovery concerning contaminated sites being
    cleaned up under RCRA laws and regulations.

    Management has also been slow in complying with Agency policies
    established as a result of a 1997 GAO report[^7] concerning the
    identification of principal responsible parties (PRP's) and
    negotiating cost sharing and cost recovery agreements. We recently
    issued a draft audit report on Cost Sharing for Environmental
    Cleanup Efforts, stating that NASA has not conducted the preliminary
    analyses necessary to start the PRP identification and cost sharing
    agreement process for many of NASA\'s contaminated sites. As a
    result, NASA has not identified all contaminated sites for which the
    Agency should be seeking cost sharing or cost recovery arrangements.
    The sites awaiting completion of a preliminary or full PRP analysis
    are currently estimated to cost about \$149.2 million to clean up,
    of which we estimate that NASA could avoid at least \$47.1 million
    through cost sharing. Further, the Institutional Program Offices[^8]
    (IPO's) generally were not involved when a preliminary or full PRP
    analysis had been performed. Omitting the IPOs from the process
    negates a key management control.

    **Compliance with NEPA.** We recently performed an audit to evaluate
    the Agency\'s compliance with NEPA. One of the first major Federal
    environmental laws enacted in the United States, NEPA is the
    national charter that established environmental goals and policies
    for the protection, maintenance, and enhancement of the environment.
    NEPA mandates that all Federal agencies consider the effects of
    their actions on the environment as early as possible and requires
    Federal agencies (1) to gather information about the environmental
    consequences of proposed actions, (2) consider the environmental
    impacts of those actions to assist in making environmental
    decisions, (3) consider alternatives that avoid or reduce adverse
    environmental impact, and (4) keep the public informed. In short,
    NEPA requires Federal agencies to examine and disclose the potential
    environmental impact of proposed actions before commencing those
    actions.

    The NEPA requirements necessitate implementation of sound management
    controls over program/project formulation and implementation
    processes to ensure that environmental impacts are appropriately
    considered. Although NASA has established procedures for
    implementing NEPA requirements, we found that 11 (85 percent) of 13
    mission-related programs/projects reviewed did not comply with NEPA
    requirements or NASA guidance. In addition, although management
    considered environmental impact for nine of the construction of
    facilities projects, two did not fully comply with NASA guidance for
    implementing NEPA. Up to \$3 billion of the program/projects we
    reviewed did not fully comply with NEPA requirements and were
    potentially exposed to increased costs, project delays, missed
    opportunities for preferable alternatives and/or public involvement,
    and adverse public perception and reaction.

    Management controls are essential not only to ensure compliance with
    environmental laws and regulations, but also to identify and
    mitigate adverse environmental impacts, risks, and costs to Agency
    programs and projects. The Agency's lack of compliance with NEPA law
    and/or NASA guidance can have adverse environmental impacts and may
    be in potential violation of Federal laws and NASA guidance.
    Specifically, noncompliance with NEPA can result in the following:

-   Unnecessary program and project delays, stoppages, and increased
    costs. Failure to complete all NEPA procedural requirements is a
    primary cause for adverse judicial decisions.

-   Lost opportunities to consider other reasonable alternatives and
    their environmental impacts early in the project planning stage.
    This occurs when NEPA compliance occurs too late or when hard
    commitments are made that limit alternatives or essentially drive
    the Agency to choose a particular alternative.

-   Limited public involvement. Failure to obtain and consider the views
    of the public hinders full and fair consideration of the
    environmental impacts of proposed actions and alternatives in those
    cases in which a significant environmental impact exists.

We made nine recommendations to improve controls over environmental
management in NASA's mission-related activities. Overall, management
stated that the audit report exaggerates the nature and scope of NEPA
violations for the programs/projects reviewed. However, management
agreed that training, guidance, and managerial controls related to NEPA
are inadequate to ensure NEPA compliance for existing and future
programs/projects. Management concurred or partially concurred with six
recommendations. Management nonconcurred with three recommendations to
report NEPA compliance as a potential material weakness, require
environmental management planning, and bring program/projects into
compliance with NEPA. In follow-up discussions with management, the
Agency has agreed to address NEPA planning in new guidance under
development and to reassess each of the projects/programs that we
reported as being NEPA noncompliant. We agreed with management that NEPA
compliance did not need to be reported as a material weakness at this
time considering the actions management has planned or already taken to
strengthen the NEPA process within the Agency.

**Nuclear Reactor Decommissioning.** Another environmental concern
relates to NASA's decommissioning of the Plum Brook Reactor Facility in
Sandusky, Ohio. In 1997, we recommended that NASA begin the process of
decommissioning the facility, thereby saving millions of dollars in
future maintenance and disposal costs. NASA agreed and has made progress
on the decommissioning. The Agency committed to the Nuclear Regulatory
Commission to submit a decommissioning plan to terminate the license for
the Reactor Facility at the end of 1999 and to complete the
decommissioning activities by the end of 2007. The decommissioning is a
sensitive issue, and the estimated costs (more than \$100 million) are
significant. NASA management is monitoring the decommissioning and is
requesting funds.

+------+-------------+-----------------------+------------------------+
| #### |             |                       |                        |
| #### |             |                       |                        |
|  Tab |             |                       |                        |
| le 1 |             |                       |                        |
|  --  |             |                       |                        |
| Safe |             |                       |                        |
| ty a |             |                       |                        |
| nd M |             |                       |                        |
| issi |             |                       |                        |
| on A |             |                       |                        |
| ssur |             |                       |                        |
| ance |             |                       |                        |
+======+=============+=======================+========================+
| *    | **          | ***Results***         | ***Recommendations     |
| **Pr | *Reports*** |                       | Pending Corrective     |
| ogra |             |                       | Action***              |
| m*** |             |                       |                        |
|      |             |                       |                        |
| **   |             |                       |                        |
| *Are |             |                       |                        |
| a*** |             |                       |                        |
+------+-------------+-----------------------+------------------------+
| Au   | Agency      | NASA initiated a      | We recommended that    |
| dits | Needs to    | major program         | NASA clarify its       |
|      | Clarify     | planning effort       | contribution toward    |
|      | Goals and   | involving industry,   | the national aviation  |
|      | Measurement | Government, and       | safety goal and revise |
|      | Baselines   | academic              | its plans, including   |
|      | for         | organizations to      | those with the FAA,    |
|      | Aviation    | define the research   | and goals accordingly  |
|      | Safety      | the Agency will       | to ensure various      |
|      | Initiative  | conduct. An audit     | Agency documents and   |
|      | (IG-00-053) | showed that NASA has  | Web sites are          |
|      |             | not portrayed its     | consistent with NASA's |
|      |             | goals and identified  | intended performance.  |
|      |             | all measurement       | We also recommended    |
|      |             | baselines for its     | that the Agency        |
|      |             | Aviation Safety       | establish baselines to |
|      |             | Initiative            | measure its            |
|      |             | consistently.         | performance relative   |
|      |             | Further, NASA has not | to established goals   |
|      |             | adequately emphasized | and place more         |
|      |             | the risks involved    | emphasis on informing  |
|      |             | with developing and   | stakeholders about the |
|      |             | implementing various  | development and        |
|      |             | safety technologies   | implementation risks   |
|      |             | and how those risks   | that could adversely   |
|      |             | affect program        | affect program         |
|      |             | success. The Agency   | success. Management    |
|      |             | has also              | concurred with the     |
|      |             | inconsistently        | recommendations and    |
|      |             | integrated its goal   | has initiated          |
|      |             | and baseline with the | responsive corrective  |
|      |             | FAA.                  | actions.               |
+------+-------------+-----------------------+------------------------+
| Au   | NASA to     | An OIG audit of       | We recommended that    |
| dits | Improve Its | contract safety       | management: (1)        |
|      | Application | requirements at       | identify all open      |
|      | of Basic    | Kennedy and Marshall  | contracts that either  |
|      | Safety      | found that NASA is    | involve potentially    |
|      | Provisions  | taking action to      | hazardous operations   |
|      | to Existing | ensure its contractor | or exceed \$1 million  |
|      | Contracts   | workforce is          | in value, and          |
|      | (IG-00-035) | supportive of and     | determine whether      |
|      |             | accountable for       | those contracts have   |
|      |             | safety. Through the   | the required safety    |
|      |             | Risk Based            | clauses and contractor |
|      |             | Acquisition           | safety plans; (2)      |
|      |             | Management            | determine the          |
|      |             | Initiative, the       | cost-effectiveness of  |
|      |             | Agency is revising    | modifying those        |
|      |             | the updated NASA FAR  | contracts determined   |
|      |             | Supplement to ensure  | deficient, assess the  |
|      |             | that risk is the core | risk of not modifying  |
|      |             | concern of all new    | the contracts, and     |
|      |             | contracting actions,  | make those             |
|      |             | except for the        | modifications deemed   |
|      |             | purchase of           | cost-effective and     |
|      |             | commercial            | necessary; and (3)     |
|      |             | off-the-shelf items.  | direct Center safety   |
|      |             | Although this is a    | offices to assist the  |
|      |             | positive step toward  | responsible Center     |
|      |             | improving the safety  | official in performing |
|      |             | practices of NASA     | an appropriate level   |
|      |             | contractors, the      | (based on assessed     |
|      |             | initiative does not   | risk) of contractor    |
|      |             | apply to existing     | surveillance for each  |
|      |             | contracts. In 15 of   | current applicable     |
|      |             | 25 existing contracts | contract. Management   |
|      |             | we reviewed, we found | concurred with the     |
|      |             | that the Agency had   | recommendations and    |
|      |             | not applied basic     | initiated responsive   |
|      |             | safety provisions     | corrective actions.    |
|      |             | such as required      |                        |
|      |             | contract safety       |                        |
|      |             | clauses, contractor   |                        |
|      |             | safety plans at       |                        |
|      |             | contract award, and   |                        |
|      |             | Center safety office  |                        |
|      |             | involvement in the    |                        |
|      |             | procurement process.  |                        |
|      |             | As a result, all NASA |                        |
|      |             | contractors,          |                        |
|      |             | including some        |                        |
|      |             | involved in hazardous |                        |
|      |             | operations, may not   |                        |
|      |             | be supporting the     |                        |
|      |             | same safety goals as  |                        |
|      |             | NASA.                 |                        |
+------+-------------+-----------------------+------------------------+
| Au   | Safety      | Ground workers in     | We recommended that    |
| dits | Concerns    | both the Space        | management (1)         |
|      | with        | Station Processing    | implement procedures,  |
|      | Kennedy     | Facility (SSPF) and   | including clarifying   |
|      | Space       | the Operations &      | work instructions and  |
|      | Center's    | Checkout building     | increased              |
|      | Payload     | were using            | surveillance, to       |
|      | Ground      | potentially hazardous | ensure the safe use of |
|      | Operations  | materials without     | Plastics, Foams, and   |
|      | (IG-00-028) | exercising proper     | Adhesives (PFAs) that  |
|      |             | control and safety    | do not meet basic      |
|      |             | precautions. Improper | standards for          |
|      |             | use of these          | flammability           |
|      |             | materials poses a     | resistance and         |
|      |             | potential hazard to   | electrostatic          |
|      |             | ground workers and    | discharge. We also     |
|      |             | increases the risk of | recommended that the   |
|      |             | damage to Shuttle     | contracting officer    |
|      |             | payloads and other    | for the payload ground |
|      |             | equipment. As a       | operations contract    |
|      |             | result, NASA lacks    | (PGOC) determine       |
|      |             | assurance that        | whether there is a     |
|      |             | associated safety     | basis to withhold      |
|      |             | risks are adequately  | contract costs and     |
|      |             | identified,           | award fee related to   |
|      |             | documented, reviewed, | noncompliant PFAs.     |
|      |             | & mitigated.          | Management concurred   |
|      |             |                       | with the               |
|      |             |                       | recommendations and    |
|      |             |                       | has taken action to    |
|      |             |                       | control PFA usage. The |
|      |             |                       | corrective actions     |
|      |             |                       | include: (1)           |
|      |             |                       | implementing new Space |
|      |             |                       | Station Processing     |
|      |             |                       | Facility work area     |
|      |             |                       | rules, (2) informing   |
|      |             |                       | all personnel as to    |
|      |             |                       | the governing          |
|      |             |                       | docu­ments controlling  |
|      |             |                       | PFA usage, (3)         |
|      |             |                       | rewriting procedures   |
|      |             |                       | regarding the          |
|      |             |                       | preparation of         |
|      |             |                       | material usage         |
|      |             |                       | agreements, and (4)    |
|      |             |                       | increased surveillance |
|      |             |                       | of contractor          |
|      |             |                       | personnel. Management  |
|      |             |                       | continues to work on   |
|      |             |                       | revising its           |
|      |             |                       | procurement procedures |
|      |             |                       | to address contractor  |
|      |             |                       | safety controls over   |
|      |             |                       | the use of PFAs.       |
+------+-------------+-----------------------+------------------------+
| Au   | Spare Parts | To improve            | \*                     |
| dits | Quality     | effectiveness, the    |                        |
|      | Assurance   | Space Shuttle Program |                        |
|      | for the     | (SSP) Manager and     |                        |
|      | Space       | NASA safety and       |                        |
|      | Shuttle     | mission assurance     |                        |
|      | (IG-00-011) | officials reduced     |                        |
|      |             | "Government Mandatory |                        |
|      |             | Inspection Points"    |                        |
|      |             | for Shuttle           |                        |
|      |             | processing and        |                        |
|      |             | vehicle manufacturing |                        |
|      |             | and took significant  |                        |
|      |             | steps to ensure the   |                        |
|      |             | safety of Shuttle     |                        |
|      |             | operations. However,  |                        |
|      |             | the SSP Manager did   |                        |
|      |             | not eliminate         |                        |
|      |             | unnecessary           |                        |
|      |             | inspection points at  |                        |
|      |             | spare parts           |                        |
|      |             | suppliers, and did    |                        |
|      |             | not consolidated      |                        |
|      |             | quality assurance     |                        |
|      |             | requirements. As a    |                        |
|      |             | result, NASA has      |                        |
|      |             | redundant Government  |                        |
|      |             | quality assurance     |                        |
|      |             | resources at some     |                        |
|      |             | locations that could  |                        |
|      |             | be used more          |                        |
|      |             | efficiently           |                        |
|      |             | elsewhere. We         |                        |
|      |             | recommended that NASA |                        |
|      |             | management establish  |                        |
|      |             | policies and          |                        |
|      |             | procedures to improve |                        |
|      |             | the efficiency of     |                        |
|      |             | quality assurance at  |                        |
|      |             | the supplier level.   |                        |
|      |             | Management concurred  |                        |
|      |             | with the report       |                        |
|      |             | finding and took      |                        |
|      |             | sufficient action to  |                        |
|      |             | disposition the       |                        |
|      |             | recommendations.      |                        |
+------+-------------+-----------------------+------------------------+
| Au   | Safety      | Goddard was making    | We made five           |
| dits | Con         | plans to implement    | recommendations for    |
|      | siderations | the requirements of   | improvement.           |
|      | at Goddard  | the Agency Safety     | Management continues   |
|      | Space       | Initiative and to     | to work to implement   |
|      | Flight      | achieve certification | corrective actions,    |
|      | Center      | under the OSHA        | including major        |
|      | (IG-99-047) | Voluntary Protection  | cultural change        |
|      |             | Program. However,     | activities to heighten |
|      |             | Goddard's various     | employee awareness and |
|      |             | safety offices were   | dedication to safety.  |
|      |             | not combined into one | All recommendations    |
|      |             | organization with a   | will remain open       |
|      |             | full-time director;   | pending management's   |
|      |             | the mishap reporting  | completion of its      |
|      |             | process did not       | corrective actions.    |
|      |             | ensure that the       |                        |
|      |             | causes of all mishaps |                        |
|      |             | were properly         |                        |
|      |             | addressed and that    |                        |
|      |             | all mishaps and       |                        |
|      |             | related information   |                        |
|      |             | were adequately       |                        |
|      |             | reported; and         |                        |
|      |             | contractor safety     |                        |
|      |             | records were not      |                        |
|      |             | evaluated prior to    |                        |
|      |             | contract award, as    |                        |
|      |             | required by the NASA  |                        |
|      |             | Safety Manual. We     |                        |
|      |             | made five             |                        |
|      |             | recommendations for   |                        |
|      |             | improvement. Goddard  |                        |
|      |             | management concurred  |                        |
|      |             | with each             |                        |
|      |             | recommendation and    |                        |
|      |             | has planned or        |                        |
|      |             | initiated responsive  |                        |
|      |             | actions. Our work     |                        |
|      |             | disclosed safety      |                        |
|      |             | risks at Goddard.     |                        |
+------+-------------+-----------------------+------------------------+
| Au   | Space       | Functional and        | \*                     |
| dits | Station     | configuration audit   |                        |
|      | Co          | processes for the     |                        |
|      | nfiguration | Space Station program |                        |
|      | Management  | were effective in     |                        |
|      | (IG-98-032) | meeting program       |                        |
|      |             | needs.                |                        |
+------+-------------+-----------------------+------------------------+
| Au   | Space       | NASA management       | \*                     |
| dits | Station     | agreed to continue    |                        |
|      | Spares      | monitoring spares     |                        |
|      | A           | availability and to   |                        |
|      | vailability | take actions needed   |                        |
|      | (M          | to provide support    |                        |
|      | -IG-98-002) | for development and   |                        |
|      |             | utilization of the    |                        |
|      |             | Space Station.        |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | Follow-up   | Determined the status | \*                     |
| pect | Assessment  | of corrective actions |                        |
| ions | on 1997     | taken by NASA         |                        |
|      | Inspection  | management in         |                        |
|      | of the NASA | response to our prior |                        |
|      | Aerospace   | ASAP report           |                        |
|      | Safety      | recommendations.      |                        |
|      | Advisory    |                       |                        |
|      | Panel       |                       |                        |
|      | (ASAP)      |                       |                        |
|      | (G-99-020)  |                       |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | NASA's      | NASA implements       | In the three reports,  |
| pect | Badging     | badging programs and  | we made a total of 35  |
| ions | Program and | physical access       | recommendations to     |
|      | Physical    | controls at each      | improve security       |
|      | Access      | Center to control     | controls and           |
|      | Controls at | access to Center      | operational            |
|      | Marshall    | facilities. We        | effectiveness. NASA    |
|      | Space       | examined those        | concurred with all 35  |
|      | Flight      | programs and controls | recommendations and    |
|      | Center      | at three Centers,     | actions are underway   |
|      |             | with a focus on       | to correct the         |
|      | (G-99-001)  | determining whether   | weaknesses. The        |
|      |             | the Centers have      | recommendations remain |
|      | Wallops     | adequate policies and | open pending           |
|      | Flight      | procedures in place   | verification of        |
|      | Facility    | to control access to  | corrective actions.    |
|      |             | mission critical      |                        |
|      | (G-99-014)  | locations and         |                        |
|      |             | facilities containing |                        |
|      | Goddard     | sensitive or          |                        |
|      | Space       | controlled            |                        |
|      | Flight      | information or        |                        |
|      | Center      | materials. At each    |                        |
|      |             | Center we found       |                        |
|      | (G-00-004)  | weaknesses in         |                        |
|      |             | physical security.    |                        |
|      |             | These reports are     |                        |
|      |             | sensitive with        |                        |
|      |             | limited distribution  |                        |
|      |             | and are not generally |                        |
|      |             | releasable to the     |                        |
|      |             | public.               |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | Comments on | The Lewis Spacecraft  | \*                     |
| pect | the Lewis   | Mishap Investigation  |                        |
| ions | Research    | Board report needed   |                        |
|      | Center      | improvement. (Lewis   |                        |
|      | (Lewis)     | is now the Glenn      |                        |
|      | Spacecraft  | Research Center.) The |                        |
|      | Mishap      | overall Agency        |                        |
|      | In          | process could be      |                        |
|      | vestigation | improved by avoiding  |                        |
|      | Board       | Board membership for  |                        |
|      | Report      | individuals, which    |                        |
|      | (Management | gives the appearance  |                        |
|      | Memorandum, | of bias or conflict   |                        |
|      | G-98-020)   | of interest;          |                        |
|      |             | increasing range of   |                        |
|      |             | expertise of Board;   |                        |
|      |             | and expanding scope   |                        |
|      |             | of interviews.        |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | Mo          | We recommended        | \*                     |
| pect | difications | process changes and   |                        |
| ions | to NASA     | technical             |                        |
|      | Safety      | modifications to      |                        |
|      | Reporting   | upgrade and modernize |                        |
|      | System      | the NASA Safety       |                        |
|      | (Management | Reporting System.     |                        |
|      | Memorandum, |                       |                        |
|      | G-98-018)   |                       |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | Assessment  | To reach flight       | We made                |
| pect | of Flight   | termination           | recommendations to     |
| ions | Termination | decisions, NASA uses  | enhance program        |
|      | Systems     | various systems       | security and to        |
|      | (FTS)       | commonly referred to  | address the Agency's   |
|      | (G-98-011)  | as FTS.               | top priority---safety. |
|      |             |                       | We made recommended    |
|      | (Security   | In addition to other  | that NASA work with    |
|      | Classified  | potential             | Federal agencies to    |
|      | --          | improvements, the     | revise national policy |
|      | Co          | Agency should use     | regarding the use of   |
|      | nfidential) | appropriate           | FTS, develop           |
|      |             | risk-based            | communications         |
|      |             | assessments to reach  | security guidelines    |
|      |             | decisions on whether  | for the application of |
|      |             | to use secure FTS's.  | encryption and         |
|      |             | This report is        | authentication,        |
|      |             | classified with       | conduct an FTS         |
|      |             | limited distribution; | technology enhancement |
|      |             | it is not generally   | study, and implement   |
|      |             | releasable to the     | interim operational    |
|      |             | public.               | security procedures    |
|      |             |                       | until a secure         |
|      |             |                       | infrastructure is      |
|      |             |                       | available. These       |
|      |             |                       | recommendations are    |
|      |             |                       | considered resolved    |
|      |             |                       | pending verification   |
|      |             |                       | of corrective actions. |
+------+-------------+-----------------------+------------------------+
| Ins  | X-33        | Assessment of the     | We recommended that    |
| pect | Program     | security for the X-33 | the X-33 program       |
| ions | Security    | reusable launch       | discontinue its plans  |
|      | Assessment  | vehicle (RLV)         | to use a non-secure    |
|      | (G-98-009)  | prototype revealed    | flight termination     |
|      |             | areas for             | system, and that the   |
|      |             | improvement.          | X-33 program apply a   |
|      |             |                       | National Security      |
|      |             |                       | Agency endorsed and    |
|      |             |                       | approved               |
|      |             |                       | communications         |
|      |             |                       | security solution to   |
|      |             |                       | protect the command    |
|      |             |                       | and control uplink.    |
|      |             |                       | Management did not     |
|      |             |                       | concur with these      |
|      |             |                       | recommendations.       |
+------+-------------+-----------------------+------------------------+
| Ins  | Shuttle-Mir | Task Force should     | \*                     |
| pect | Rendezvous  | expand the breadth of |                        |
| ions | and Docking | expertise of its      |                        |
|      | Missions    | membership and        |                        |
|      | and         | include members free  |                        |
|      | In          | of potential          |                        |
|      | ternational | conflicts or          |                        |
|      | Space       | perceived biases      |                        |
|      | Station     | because of overly     |                        |
|      | Operational | close association     |                        |
|      | Task Forces | with NASA. Perception |                        |
|      | (G-98-003)  | of bias may           |                        |
|      |             | discourage reporting  |                        |
|      |             | of safety concerns to |                        |
|      |             | the Task Forces.      |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | Timing of   | Fact gathering and    | \*                     |
| pect | Independent | recommendations to    |                        |
| ions | Team        | the Administrator on  |                        |
|      | Meetings    | flight-related issues |                        |
|      | and         | needed to occur       |                        |
|      | Com         | earlier in the        |                        |
|      | munications | process to maximize   |                        |
|      | for         | usefulness.           |                        |
|      | Shuttle-Mir |                       |                        |
|      | and         |                       |                        |
|      | In          |                       |                        |
|      | ternational |                       |                        |
|      | Space       |                       |                        |
|      | Station     |                       |                        |
|      | Missions    |                       |                        |
|      | (G-98-002)  |                       |                        |
+------+-------------+-----------------------+------------------------+
| Ins  | Letter to   | We reported           | \*                     |
| pect | Congressman | Shuttle-Mir safety    |                        |
| ions | James       | challenges including: |                        |
|      | Se          | fire, decompression,  |                        |
|      | nsenbrenner | and loss of attitude  |                        |
|      | on NASA's   | control. Oversight    |                        |
|      | Pa          | into Mir operations   |                        |
|      | rticipation | was limited because   |                        |
|      | in the      | of NASA's "guest"     |                        |
|      | Russian Mir | status rather than    |                        |
|      | Space       | partner status. Also, |                        |
|      | Program     | Russia did not        |                        |
|      | (August 29, | provide timely        |                        |
|      | 1997)       | information, and      |                        |
|      |             | ground support        |                        |
|      |             | communication was     |                        |
|      |             | inadequate. Safety    |                        |
|      |             | impact of stress      |                        |
|      |             | resulted from         |                        |
|      |             | conditions aboard the |                        |
|      |             | Mir (for example,     |                        |
|      |             | high levels of        |                        |
|      |             | potentially toxic     |                        |
|      |             | substances, high      |                        |
|      |             | temperatures, demands |                        |
|      |             | on time for           |                        |
|      |             | maintenance           |                        |
|      |             | activities, and lack  |                        |
|      |             | of communication).    |                        |
+------+-------------+-----------------------+------------------------+

######### 

+------+-------------+-----------------------+---------------------+---+
| ###  |             |                       |                     |   |
| #### |             |                       |                     |   |
| # Ta |             |                       |                     |   |
| ble  |             |                       |                     |   |
| 2 -- |             |                       |                     |   |
|  Int |             |                       |                     |   |
| erna |             |                       |                     |   |
| tion |             |                       |                     |   |
| al S |             |                       |                     |   |
| pace |             |                       |                     |   |
|  Sta |             |                       |                     |   |
| tion |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | X-38/Crew   | The United States has | We recommended that |   |
| dits | Return      | agreed to provide a   | management revise   |   |
|      | Vehicle     | crew return vehicle   | the CRV Project     |   |
|      | (CRV)       | (CRV) for the ISS.    | Plan to provide for |   |
|      | Operational | NASA\'s planned       | the contingency of  |   |
|      | Testing     | human-rating process  | CRV operational     |   |
|      |             | for the CRV did not   | testing and include |   |
|      | (IG-99-036) | include an            | CRV operational     |   |
|      |             | operational test.     | testing in the      |   |
|      |             |                       | Space Station risk  |   |
|      |             |                       | management system   |   |
|      |             |                       | as a primary risk.  |   |
|      |             |                       | Management          |   |
|      |             |                       | concurred, but the  |   |
|      |             |                       | recommendation      |   |
|      |             |                       | remains open        |   |
|      |             |                       | pending             |   |
|      |             |                       | management's        |   |
|      |             |                       | preparation of a    |   |
|      |             |                       | test plan.          |   |
|      |             |                       | Management          |   |
|      |             |                       | estimates           |   |
|      |             |                       | completion of this  |   |
|      |             |                       | action by May 2005. |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Performance | An OIG review,        | We made 14          |   |
| dits | Management  | performed at the      | recommendations to  |   |
|      | of the      | request of the NASA   | strengthen Space    |   |
|      | In          | Administrator, showed | Station performance |   |
|      | ternational | that Boeing reported  | management and      |   |
|      | Space       | unrealistically low   | minimize or         |   |
|      | Station     | estimates of          | eliminate the cost  |   |
|      | Contract    | projected cost        | impact to NASA of   |   |
|      | (IG-00-007) | overruns and          | contractor          |   |
|      |             | presented the cost    | restructuring       |   |
|      |             | data to indicate that | activities. Eight   |   |
|      |             | no additional cost    | of the              |   |
|      |             | overrun would occur.  | recommendations     |   |
|      |             | Although the Program  | were closed with    |   |
|      |             | Office was aware and  | the issuance of the |   |
|      |             | had evidence of cost  | final report. Four  |   |
|      |             | overruns and schedule | additional          |   |
|      |             | slippages, it did not | recommendations     |   |
|      |             | refute the            | were closed         |   |
|      |             | contractor\'s         | September 18, 2000. |   |
|      |             | estimate. As a        | The remaining two   |   |
|      |             | result, Boeing        | recommendations are |   |
|      |             | received unearned     | being monitored     |   |
|      |             | incentive fees        | awaiting results of |   |
|      |             | totaling \$16 million | an OIG audit and    |   |
|      |             | that the Agency later | determination by    |   |
|      |             | recouped. Also,       | the Space Station   |   |
|      |             | Boeing did not        | Program Office on   |   |
|      |             | promptly notify NASA  | what will replace   |   |
|      |             | about the potential   | the independent     |   |
|      |             | cost increases due to | annual reviews.     |   |
|      |             | Boeing's              |                     |   |
|      |             | reorganizations. NASA |                     |   |
|      |             | will be charged an    |                     |   |
|      |             | estimated \$35        |                     |   |
|      |             | million in            |                     |   |
|      |             | reorganization costs  |                     |   |
|      |             | for the ISS Program   |                     |   |
|      |             | through contract      |                     |   |
|      |             | completion.           |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Space       | The Space Station     | We recommended      |   |
| dits | Station     | Program Office had    | management          |   |
|      | Contingency | not developed an      | establish (1) a     |   |
|      | Planning    | integrated and        | Space Station       |   |
|      | for         | comprehensive plan to | contingency plan    |   |
|      | In          | address risks to the  | that complies with  |   |
|      | ternational | assembly of the Space | Agency guidance for |   |
|      | Partners    | Station because of    | effective risk      |   |
|      | (IG-99-009) | possible delay or     | manage­ment, and (2) |   |
|      |             | default by            | a process to ensure |   |
|      |             | international         | the contingency     |   |
|      |             | partners. In          | plan is kept        |   |
|      |             | addition, the         | current. Man­agement |   |
|      |             | contingency plan did  | concurred. In       |   |
|      |             | not contain or        | September 2000, we  |   |
|      |             | clearly identify      | again requested     |   |
|      |             | several critical      | that management     |   |
|      |             | elements for          | provide evidence to |   |
|      |             | effective risk        | support completion  |   |
|      |             | management.           | of the agreed-to    |   |
|      |             | Specifically, the     | actions for the     |   |
|      |             | plan did not contain  | recommendations and |   |
|      |             | cost and schedule     | are awaiting their  |   |
|      |             | impacts and did not   | response.           |   |
|      |             | clearly identify risk |                     |   |
|      |             | mitigation measures   |                     |   |
|      |             | and the primary       |                     |   |
|      |             | consequences of the   |                     |   |
|      |             | contingencies.        |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Space       | The NASA Space        | We recommended that |   |
| dits | Station     | Station contract      | management (1)      |   |
|      | Corrective  | requires the prime    | ensure adequate     |   |
|      | Action      | contractor, Boeing,   | surveillance of     |   |
|      | Plans       | to have an Earned     | Boeing's EVM        |   |
|      | (IG-99-007) | Value Management      | System, (2) require |   |
|      |             | System (EVMS) which   | DCMA to prepare     |   |
|      |             | produces an           | required contract   |   |
|      |             | assessment of cost    | administration      |   |
|      |             | and schedule          | reports, and (3)    |   |
|      |             | performance. Boeing   | improve the quality |   |
|      |             | prepares a report,    | of corrective       |   |
|      |             | which identifies the  | action plans.       |   |
|      |             | largest cost and      | Manage­ment took     |   |
|      |             | schedule variances,   | action including    |   |
|      |             | and the corresponding | assigning a budget  |   |
|      |             | cause, effect, and    | analyst to review   |   |
|      |             | the corrective action | and validate the    |   |
|      |             | plans that will be    | quality of DCMA's   |   |
|      |             | taken. However,       | monthly variance    |   |
|      |             | Boeing's corrective   | analysis reports.   |   |
|      |             | action plans and      | DCMA also took some |   |
|      |             | NASA's oversight of   | positive steps.     |   |
|      |             | the plans need        | These               |   |
|      |             | improvement.          | recommendations     |   |
|      |             |                       | will remain open    |   |
|      |             |                       | pending completion  |   |
|      |             |                       | of corrective       |   |
|      |             |                       | actions. In March   |   |
|      |             |                       | 2000, we again      |   |
|      |             |                       | requested           |   |
|      |             |                       | management provide  |   |
|      |             |                       | evidence to support |   |
|      |             |                       | completion of the   |   |
|      |             |                       | agreed-to actions   |   |
|      |             |                       | for those           |   |
|      |             |                       | recommen­dations.    |   |
|      |             |                       | Management is       |   |
|      |             |                       | working to provide  |   |
|      |             |                       | evidence to support |   |
|      |             |                       | closure of the      |   |
|      |             |                       | recommendations.    |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | In          | NASA had not          | We recommended that |   |
| pect | ternational | considered all        | NASA conduct a      |   |
| ions | Space       | possible upgrade      | thorough analysis   |   |
|      | Station     | options for the Space | of the risks        |   |
|      | Command and | Station's primary     | associated with the |   |
|      | Control     | command and control   | ISS command uplink  |   |
|      | Com         | uplink. This may      | and of the          |   |
|      | munications | result in the         | potential upgrade   |   |
|      |             | selection of a more   | options. We also    |   |
|      | (G-99-010B) | costly,               | recommended that    |   |
|      |             | insufficiently secure | NASA acquire        |   |
|      |             | option.               | permanent civil     |   |
|      |             |                       | service staff in    |   |
|      |             |                       | the area of system  |   |
|      |             |                       | security            |   |
|      |             |                       | engineering and     |   |
|      |             |                       | communications      |   |
|      |             |                       | security. NASA      |   |
|      |             |                       | concurred with the  |   |
|      |             |                       | recommendations,    |   |
|      |             |                       | but has not yet     |   |
|      |             |                       | completed           |   |
|      |             |                       | corrective actions. |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | In          | This review found     | We recommended that |   |
| pect | ternational | problems with the ISS | NASA management     |   |
| ions | Space       | on-board Portable     | work to eliminate   |   |
|      | Station     | Computer System (PCS) | erroneous           |   |
|      | Portable    | and the accuracy of   | information, make   |   |
|      | Computer    | displays developed    | application         |   |
|      | System and  | for the PCS. The PCS  | commands            |   |
|      | the Data    | is the crew's primary | consistent, and     |   |
|      | Display     | interface for command | reduce cumbersome   |   |
|      | Process     | and control of the    | system navigation.  |   |
|      |             | Station. PCS          | We also recommended |   |
|      | (G-99-010A) | usability needed to   | that NASA develop a |   |
|      |             | be improved.          | coordinated,        |   |
|      |             |                       | well-defined        |   |
|      |             |                       | process for         |   |
|      |             |                       | software            |   |
|      |             |                       | engineering and     |   |
|      |             |                       | software            |   |
|      |             |                       | management.         |   |
|      |             |                       | Management was not  |   |
|      |             |                       | completely          |   |
|      |             |                       | responsive to the   |   |
|      |             |                       | recommendations,    |   |
|      |             |                       | concurring with     |   |
|      |             |                       | four                |   |
|      |             |                       | recommendations and |   |
|      |             |                       | partially           |   |
|      |             |                       | concurring with the |   |
|      |             |                       | remaining seven     |   |
|      |             |                       | recommendations.    |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Followup    | In general, the       | \*                  |   |
| pect | Assessment  | charter service used  |                     |   |
| ions | of          | by NASA to support    |                     |   |
|      | Management  | the ISS program was   |                     |   |
|      | Alert       | not cost-effective    |                     |   |
|      | Issued      | compared to           |                     |   |
|      | February 6, | commercial air        |                     |   |
|      | 1998,       | services. We also     |                     |   |
|      | Chartered   | reported our concerns |                     |   |
|      | Flights     | regarding security,   |                     |   |
|      | Between the | procedures, and       |                     |   |
|      | United      | adherence to          |                     |   |
|      | States and  | transportation        |                     |   |
|      | Russia      | regulations. NASA     |                     |   |
|      | (G-98-014)  | management concurred  |                     |   |
|      |             | with our              |                     |   |
|      |             | recommendation to     |                     |   |
|      |             | terminate the charter |                     |   |
|      |             | service. The          |                     |   |
|      |             | termination will save |                     |   |
|      |             | the Agency            |                     |   |
|      |             | approximately         |                     |   |
|      |             | \$4.0 million in      |                     |   |
|      |             | annual costs.         |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Review of   | Although the ISS      | \*                  |   |
| pect | In          | program was late in   |                     |   |
| ions | ternational | initiating the        |                     |   |
|      | Space       | lessons learned       |                     |   |
|      | Station     | process, the transfer |                     |   |
|      | Phase I     | of knowledge and      |                     |   |
|      | Lessons     | experience acquired   |                     |   |
|      | Learned     | was being adequately  |                     |   |
|      | Activity    | addressed. With       |                     |   |
|      |             | partial concurrence   |                     |   |
|      | (G-98-012)  | on our third          |                     |   |
|      |             | recommendation,       |                     |   |
|      |             | management fully      |                     |   |
|      |             | agreed with the two   |                     |   |
|      |             | others to enhance the |                     |   |
|      |             | lessons learned       |                     |   |
|      |             | process. NASA agreed  |                     |   |
|      |             | to assess other       |                     |   |
|      |             | sources of lessons    |                     |   |
|      |             | learned, including    |                     |   |
|      |             | various historical    |                     |   |
|      |             | sources and to apply  |                     |   |
|      |             | them to the ISS       |                     |   |
|      |             | program.              |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Enhancing   | To improve safety and | \*                  |   |
| pect | Co          | mission success of    |                     |   |
| ions | mpatibility | long-duration space   |                     |   |
|      | for         | flights, NASA needs   |                     |   |
|      | Lo          | to identify           |                     |   |
|      | ng-Duration | astronauts best       |                     |   |
|      | Space       | suited for            |                     |   |
|      | Flight      | long-duration travel, |                     |   |
|      | Crews       | provide psychological |                     |   |
|      | (G-98-005)  | evaluations of        |                     |   |
|      |             | astronauts, and       |                     |   |
|      |             | improve training.     |                     |   |
|      |             | Management partially  |                     |   |
|      |             | concurred with our    |                     |   |
|      |             | recommendations.      |                     |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+----+---------+-----------------+---------------+---+-----------------+
| ## |         |                 |               |   |                 |
| ## |         |                 |               |   |                 |
| ## |         |                 |               |   |                 |
| ## |         |                 |               |   |                 |
|  T |         |                 |               |   |                 |
| ab |         |                 |               |   |                 |
| le |         |                 |               |   |                 |
|  3 |         |                 |               |   |                 |
|  - |         |                 |               |   |                 |
| -  |         |                 |               |   |                 |
| In |         |                 |               |   |                 |
| fo |         |                 |               |   |                 |
| rm |         |                 |               |   |                 |
| at |         |                 |               |   |                 |
| io |         |                 |               |   |                 |
| n  |         |                 |               |   |                 |
| Te |         |                 |               |   |                 |
| ch |         |                 |               |   |                 |
| no |         |                 |               |   |                 |
| lo |         |                 |               |   |                 |
| gy |         |                 |               |   |                 |
+====+=========+=================+===============+===+=================+
| *  | ***Rep  | ***Results***   | ***Re         |   |                 |
| ** | orts*** |                 | commendations |   |                 |
| Pr |         |                 | Pending       |   |                 |
| og |         |                 | Corrective    |   |                 |
| ra |         |                 | Action***     |   |                 |
| m* |         |                 |               |   |                 |
| ** |         |                 |               |   |                 |
|    |         |                 |               |   |                 |
| ** |         |                 |               |   |                 |
| *A |         |                 |               |   |                 |
| re |         |                 |               |   |                 |
| a* |         |                 |               |   |                 |
| ** |         |                 |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | NASA    | The desktop     | We            |   |                 |
| di | Can     | seat prices at  | recommended   |   |                 |
| ts | Expand  | JPL             | that NASA     |   |                 |
|    | and     | significantly   | ensure that   |   |                 |
|    | Improve | exceeded those  | JPL includes  |   |                 |
|    | Use of  | paid by other   | ODIN among    |   |                 |
|    | the     | NASA            | competitors   |   |                 |
|    | Outs    | installations   | when awarding |   |                 |
|    | ourcing | using the       | the           |   |                 |
|    | Desktop | Outsourcing     | i             |   |                 |
|    | Ini     | Desktop         | nstallation's |   |                 |
|    | tiative | Initiative for  | future        |   |                 |
|    | (IG-    | NASA (ODIN)     | desktop       |   |                 |
|    | 00-060) | contract.       | outsourcing   |   |                 |
|    |         | Because the JPL | contract. We  |   |                 |
|    |         | outsourcing     | also          |   |                 |
|    |         | contract was    | recommended   |   |                 |
|    |         | based on        | that the ODIN |   |                 |
|    |         | adequate price  | Program       |   |                 |
|    |         | competition, we | Manager       |   |                 |
|    |         | did not         | assess the    |   |                 |
|    |         | question the    | effectiveness |   |                 |
|    |         | basis of JPL's  | of the two    |   |                 |
|    |         | desktop seat    | seat          |   |                 |
|    |         | prices.         | assignment    |   |                 |
|    |         | However, if JPL | approaches    |   |                 |
|    |         | uses the ODIN   | and issue     |   |                 |
|    |         | contract to     | guidance to   |   |                 |
|    |         | acquire desktop | all           |   |                 |
|    |         | services after  | installations |   |                 |
|    |         | its current     | for use in    |   |                 |
|    |         | contract        | selecting an  |   |                 |
|    |         | expires, NASA   | appropriate   |   |                 |
|    |         | could put to    | approach.     |   |                 |
|    |         | better use as   | Management    |   |                 |
|    |         | much as \$33    | concurred     |   |                 |
|    |         | million over a  | with the      |   |                 |
|    |         | 3-year period.  | report        |   |                 |
|    |         | We also found   | re            |   |                 |
|    |         | that NASA had   | commendations |   |                 |
|    |         | not assessed    | and initiated |   |                 |
|    |         | the             | responsive    |   |                 |
|    |         | effectiveness   | corrective    |   |                 |
|    |         | of two          | actions.      |   |                 |
|    |         | approaches used |               |   |                 |
|    |         | in making       |               |   |                 |
|    |         | desktop seat    |               |   |                 |
|    |         | assignments or  |               |   |                 |
|    |         | issued guidance |               |   |                 |
|    |         | for determining |               |   |                 |
|    |         | seat selections |               |   |                 |
|    |         | at various      |               |   |                 |
|    |         | Agency          |               |   |                 |
|    |         | installations.  |               |   |                 |
|    |         | Accordingly,    |               |   |                 |
|    |         | NASA lacks      |               |   |                 |
|    |         | assurance that  |               |   |                 |
|    |         | it has assigned |               |   |                 |
|    |         | seats to        |               |   |                 |
|    |         | employees in    |               |   |                 |
|    |         | the most        |               |   |                 |
|    |         | efficient and   |               |   |                 |
|    |         | effective       |               |   |                 |
|    |         | manner.         |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | NASA    | Overall, NASA   | We            |   |                 |
| di | Can     | has made        | recommended   |   |                 |
| ts | Improve | progress toward | that NASA     |   |                 |
|    | Its     | protecting the  | develop a     |   |                 |
|    | P       | Agency\'s       | clear         |   |                 |
|    | lanning | critical        | definition of |   |                 |
|    | for     | infrastructure  | an initial    |   |                 |
|    | Presi   | assets.         | operating     |   |                 |
|    | dential | However, NASA   | capability    |   |                 |
|    | D       | has not         | and provide   |   |                 |
|    | ecision | identified the  | guidance and  |   |                 |
|    | Di      | actions needed  | attainable    |   |                 |
|    | rective | to achieve an   | milestones    |   |                 |
|    | 63      | initial         | for achieving |   |                 |
|    | (IG-    | operating       | it. We also   |   |                 |
|    | 00-057) | capability by   | recommended   |   |                 |
|    |         | December 31,    | that NASA     |   |                 |
|    |         | 2000, as        | issue         |   |                 |
|    |         | required by     | additional    |   |                 |
|    |         | PDD-63. Until   | guidance to   |   |                 |
|    |         | NASA identifies | ensure that   |   |                 |
|    |         | and implements  | installations |   |                 |
|    |         | needed actions, | accurately    |   |                 |
|    |         | the Agency      | and           |   |                 |
|    |         | lacks assurance | consistently  |   |                 |
|    |         | that it is      | identify      |   |                 |
|    |         | adequately      | their minimum |   |                 |
|    |         | protecting its  | essential     |   |                 |
|    |         | critical        | i             |   |                 |
|    |         | cyber-based     | nfrastructure |   |                 |
|    |         | infrastructure  | assets and    |   |                 |
|    |         | assets. Also,   | that NASA     |   |                 |
|    |         | the Agency list | eliminate     |   |                 |
|    |         | of minimum      | errors and    |   |                 |
|    |         | essential       | in            |   |                 |
|    |         | infrastructure  | consistencies |   |                 |
|    |         | assets contains | in its list   |   |                 |
|    |         | errors and      | of those      |   |                 |
|    |         | i               | assets. NASA  |   |                 |
|    |         | nconsistencies. | either        |   |                 |
|    |         | As a result,    | concurred or  |   |                 |
|    |         | NASA lacks      | partially     |   |                 |
|    |         | assurance that  | concurred     |   |                 |
|    |         | it can provide  | with the      |   |                 |
|    |         | appropriate     | findings and  |   |                 |
|    |         | oversight of    | re            |   |                 |
|    |         | PDD-63          | commendations |   |                 |
|    |         | vulnerability   | and initiated |   |                 |
|    |         | assessment and  | appropriate   |   |                 |
|    |         | risk mitigation | actions.      |   |                 |
|    |         | activities.     |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | NASA's  | NASA has not    | We            |   |                 |
| di | System  | adequately      | recommended   |   |                 |
| ts | Info    | complied with   | that NASA     |   |                 |
|    | rmation | the Computer    | management    |   |                 |
|    | Tec     | Security Act of | establish a   |   |                 |
|    | hnology | 1987 and OMB    | process to    |   |                 |
|    | S       | Circular A-130, | manage the    |   |                 |
|    | ecurity | \"Management of | development   |   |                 |
|    | P       | Federal         | and           |   |                 |
|    | lanning | Information     | i             |   |                 |
|    | Can Be  | Resources.\"    | mplementation |   |                 |
|    | I       | NASA            | of IT system  |   |                 |
|    | mproved | Headquarters    | security      |   |                 |
|    | (IG-    | and the Centers | plans and     |   |                 |
|    | 00-055) | had no IT       | revise Agency |   |                 |
|    |         | security plans  | IT security   |   |                 |
|    |         | for 17 of the   | policy on     |   |                 |
|    |         | 38 SMA systems  | personnel     |   |                 |
|    |         | and for 13 of   | screening     |   |                 |
|    |         | the 30 Web site | requirements. |   |                 |
|    |         | host computers  | We consider   |   |                 |
|    |         | in our samples. | the           |   |                 |
|    |         | JPL has no IT   | noncompliance |   |                 |
|    |         | security plans  | with the      |   |                 |
|    |         | for its IT      | Computer      |   |                 |
|    |         | systems. None   | Security Act  |   |                 |
|    |         | of the IT       | and OMB       |   |                 |
|    |         | security plans  | Circular      |   |                 |
|    |         | in either       | A-130 to be a |   |                 |
|    |         | sample fully    | potential     |   |                 |
|    |         | complied with   | material      |   |                 |
|    |         | OMB Circular    | management    |   |                 |
|    |         | A-130. In       | control       |   |                 |
|    |         | addition, there | weakness      |   |                 |
|    |         | were no         | reportable in |   |                 |
|    |         | security plans, | accordance    |   |                 |
|    |         | contingency     | with OMB      |   |                 |
|    |         | plans, or risk  | Circular      |   |                 |
|    |         | assessments for | A-123,        |   |                 |
|    |         | five major      | \"Management  |   |                 |
|    |         | elements of a   | A             |   |                 |
|    |         | major           | ccountability |   |                 |
|    |         | information     | and           |   |                 |
|    |         | system. The     | Control,\"    |   |                 |
|    |         | lack of         | and NASA      |   |                 |
|    |         | adequate IT     | policy.       |   |                 |
|    |         | security plans  |               |   |                 |
|    |         | significantly   | Management    |   |                 |
|    |         | reduces the     | concurred     |   |                 |
|    |         | effectiveness   | with 7 of the |   |                 |
|    |         | of the IT       | report\'s 10  |   |                 |
|    |         | security        | rec           |   |                 |
|    |         | programs for    | ommendations. |   |                 |
|    |         | those systems.  | Actions       |   |                 |
|    |         |                 | completed for |   |                 |
|    |         | The audit also  | three         |   |                 |
|    |         | found that      | re            |   |                 |
|    |         | initial and     | commendations |   |                 |
|    |         | periodic        | were          |   |                 |
|    |         | personnel       | sufficient to |   |                 |
|    |         | screening       | close those   |   |                 |
|    |         | requirements in | re            |   |                 |
|    |         | NASA Procedures | commendations |   |                 |
|    |         | and Guidelines  | for reporting |   |                 |
|    |         | (NPG) 2810.1,   | purposes.     |   |                 |
|    |         | \"Security of   | Management    |   |                 |
|    |         | Information     | partially     |   |                 |
|    |         | Technology,\"   | concurred     |   |                 |
|    |         | do not comply   | with          |   |                 |
|    |         | with OMB        | re            |   |                 |
|    |         | Circular A-130  | commendations |   |                 |
|    |         | requirements.   | to report the |   |                 |
|    |         | Inadequate      | Federal       |   |                 |
|    |         | personnel       | noncompliance |   |                 |
|    |         | screening may   | conditions at |   |                 |
|    |         | degrade the     | JPL, Langley, |   |                 |
|    |         | security of     | and NASA      |   |                 |
|    |         | NASA\'s IT      | Headquarters  |   |                 |
|    |         | systems.        | to the        |   |                 |
|    |         |                 | Agency\'s     |   |                 |
|    |         |                 | Internal      |   |                 |
|    |         |                 | Control       |   |                 |
|    |         |                 | Council as    |   |                 |
|    |         |                 | significant   |   |                 |
|    |         |                 | areas of      |   |                 |
|    |         |                 | concern.      |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Impleme | An audit of     | While the     |   |                 |
| di | ntation | Johnson\'s      | security      |   |                 |
| ts | of      | implementation  | software      |   |                 |
|    | S       | of external     | configuration |   |                 |
|    | ecurity | security        | was           |   |                 |
|    | S       | software used   | implemented   |   |                 |
|    | oftware | to protect a    | to protect    |   |                 |
|    | at      | mission-related | system files  |   |                 |
|    | Johnson | system          | and general   |   |                 |
|    | Space   | identified      | resources,    |   |                 |
|    | Center  | several         | improvements  |   |                 |
|    | (IG-    | weaknesses in   | needed        |   |                 |
|    | 00-031) | the areas of    | included the  |   |                 |
|    |         | access          | following     |   |                 |
|    |         | privileges and  | areas: (1)    |   |                 |
|    |         | management      | assigning     |   |                 |
|    |         | oversight.      | privileged    |   |                 |
|    |         |                 | capabilities  |   |                 |
|    |         |                 | only to those |   |                 |
|    |         |                 | individuals   |   |                 |
|    |         |                 | with a        |   |                 |
|    |         |                 | justified     |   |                 |
|    |         |                 | need for      |   |                 |
|    |         |                 | them; (2)     |   |                 |
|    |         |                 | enforcement   |   |                 |
|    |         |                 | of            |   |                 |
|    |         |                 | established   |   |                 |
|    |         |                 | naming        |   |                 |
|    |         |                 | conventions   |   |                 |
|    |         |                 | for system    |   |                 |
|    |         |                 | data sets;    |   |                 |
|    |         |                 | (3)           |   |                 |
|    |         |                 | establishing  |   |                 |
|    |         |                 | follow-up     |   |                 |
|    |         |                 | procedures    |   |                 |
|    |         |                 | for potential |   |                 |
|    |         |                 | unauthorized  |   |                 |
|    |         |                 | system        |   |                 |
|    |         |                 | access; and   |   |                 |
|    |         |                 | (4)           |   |                 |
|    |         |                 | establishing  |   |                 |
|    |         |                 | review        |   |                 |
|    |         |                 | process for   |   |                 |
|    |         |                 | security      |   |                 |
|    |         |                 | logs,         |   |                 |
|    |         |                 | privileged    |   |                 |
|    |         |                 | access to     |   |                 |
|    |         |                 | tape          |   |                 |
|    |         |                 | controls, and |   |                 |
|    |         |                 | access lists  |   |                 |
|    |         |                 | for critical  |   |                 |
|    |         |                 | files and     |   |                 |
|    |         |                 | directing the |   |                 |
|    |         |                 | contractor    |   |                 |
|    |         |                 | perform       |   |                 |
|    |         |                 | internal      |   |                 |
|    |         |                 | security      |   |                 |
|    |         |                 | software      |   |                 |
|    |         |                 | audit.        |   |                 |
|    |         |                 | Management    |   |                 |
|    |         |                 | concurred     |   |                 |
|    |         |                 | with the      |   |                 |
|    |         |                 | re            |   |                 |
|    |         |                 | commendations |   |                 |
|    |         |                 | and proposed  |   |                 |
|    |         |                 | responsive    |   |                 |
|    |         |                 | actions. We   |   |                 |
|    |         |                 | requested     |   |                 |
|    |         |                 | that          |   |                 |
|    |         |                 | management    |   |                 |
|    |         |                 | accelerate    |   |                 |
|    |         |                 | some          |   |                 |
|    |         |                 | corrective    |   |                 |
|    |         |                 | actions.      |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | UNIX    | An audit of two | We            |   |                 |
| di | Op      | host computers  | recommended   |   |                 |
| ts | erating | that use a UNIX | that Goddard  |   |                 |
|    | System  | variant called  | management    |   |                 |
|    | S       | Solaris that    | improve       |   |                 |
|    | ecurity | was developed   | personnel     |   |                 |
|    | at      | by Sun          | screening,    |   |                 |
|    | Goddard | Microsystems,   | the process   |   |                 |
|    | Space   | Incorporated    | for granting  |   |                 |
|    | Flight  | found that the  | access to     |   |                 |
|    | Center  | systems         | computer      |   |                 |
|    | (IG-    | reviewed did    | systems,      |   |                 |
|    | 00-024) | not have        | password      |   |                 |
|    |         | adequate IT     | security, and |   |                 |
|    |         | security        | protection of |   |                 |
|    |         | programs. The   | critical      |   |                 |
|    |         | deficiencies    | system files; |   |                 |
|    |         | identified      | establish     |   |                 |
|    |         | included        | policies for  |   |                 |
|    |         | inadequacies in | privileged    |   |                 |
|    |         | the access      | operations    |   |                 |
|    |         | authorization   | and system    |   |                 |
|    |         | process,        | backups; and  |   |                 |
|    |         | password        | implement     |   |                 |
|    |         | security        | proactive     |   |                 |
|    |         | controls,       | security      |   |                 |
|    |         | controls over   | monitoring.   |   |                 |
|    |         | the use of the  | While Goddard |   |                 |
|    |         | superuser       | management    |   |                 |
|    |         | account, and    | concurred     |   |                 |
|    |         | system backup   | with the      |   |                 |
|    |         | policies were.  | importance of |   |                 |
|    |         |                 | implementing  |   |                 |
|    |         |                 | proper        |   |                 |
|    |         |                 | controls, it  |   |                 |
|    |         |                 | did not       |   |                 |
|    |         |                 | provide       |   |                 |
|    |         |                 | information   |   |                 |
|    |         |                 | on corrective |   |                 |
|    |         |                 | actions       |   |                 |
|    |         |                 | planned,      |   |                 |
|    |         |                 | ongoing, and  |   |                 |
|    |         |                 | completed, or |   |                 |
|    |         |                 | the estimated |   |                 |
|    |         |                 | completion    |   |                 |
|    |         |                 | date for      |   |                 |
|    |         |                 | corrective    |   |                 |
|    |         |                 | actions. We   |   |                 |
|    |         |                 | requested     |   |                 |
|    |         |                 | that          |   |                 |
|    |         |                 | management    |   |                 |
|    |         |                 | provide       |   |                 |
|    |         |                 | additional    |   |                 |
|    |         |                 | information.  |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | General | Johnson's MCC   | We made 14    |   |                 |
| di | C       | can improve its | re            |   |                 |
| ts | ontrols | disaster        | commendations |   |                 |
|    | at      | recovery        | to improve    |   |                 |
|    | Johnson | planning and    | controls.     |   |                 |
|    | Space   | capability in   | Management    |   |                 |
|    | C       | the areas of    | concurred     |   |                 |
|    | enter's | documentation,  | with nine     |   |                 |
|    | Mission | risk            | re            |   |                 |
|    | Control | assessment,     | commendations |   |                 |
|    | Center  | extended backup | and partially |   |                 |
|    | (MCC)   | strategy,       | concurred or  |   |                 |
|    | (IG-    | testing, server | non-concurred |   |                 |
|    | 00-017) | backup and      | with others.  |   |                 |
|    |         | off-site        | We asked      |   |                 |
|    |         | storage, and    | management to |   |                 |
|    |         | training. Given | reconsider    |   |                 |
|    |         | MCC's critical  | their         |   |                 |
|    |         | importance to   | position on   |   |                 |
|    |         | the Shuttle and | certain       |   |                 |
|    |         | Space Station   | re            |   |                 |
|    |         | Programs,       | commendations |   |                 |
|    |         | system recovery | and to        |   |                 |
|    |         | delays related  | provide       |   |                 |
|    |         | to these        | additional    |   |                 |
|    |         | elements could  | comments in   |   |                 |
|    |         | affect MCC's    | response to   |   |                 |
|    |         | support of      | the final     |   |                 |
|    |         | those programs. | report.       |   |                 |
|    |         | In addition,    | Management    |   |                 |
|    |         | management      | provided a    |   |                 |
|    |         | should improve  | copy of the   |   |                 |
|    |         | MCC physical    | revised       |   |                 |
|    |         | access and      | disaster      |   |                 |
|    |         | environmental   | recovery      |   |                 |
|    |         | conditions.     | plan, which   |   |                 |
|    |         |                 | is being      |   |                 |
|    |         |                 | reviewed by   |   |                 |
|    |         |                 | the OIG. We   |   |                 |
|    |         |                 | are working   |   |                 |
|    |         |                 | with          |   |                 |
|    |         |                 | management to |   |                 |
|    |         |                 | resolve the   |   |                 |
|    |         |                 | issues.       |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | UNIX    | In December     | We made       |   |                 |
| di | Op      | 1996, NASA      | twelve        |   |                 |
| ts | erating | approved and    | re            |   |                 |
|    | System  | provided        | commendations |   |                 |
|    | S       | funding for a   | to improve    |   |                 |
|    | ecurity | major system    | controls.     |   |                 |
|    | and     | upgrade         | Management    |   |                 |
|    | In      | project. The    | either        |   |                 |
|    | tegrity | operating       | concurred or  |   |                 |
|    | at      | system          | partially     |   |                 |
|    | Kennedy | supporting the  | concurred     |   |                 |
|    | Space   | environment in  | with our      |   |                 |
|    | Center  | which           | rec           |   |                 |
|    | (IG-    | programmers     | ommendations. |   |                 |
|    | 00-014) | develop         | We consider   |   |                 |
|    |         | software for    | four of the   |   |                 |
|    |         | the project is  | twelve        |   |                 |
|    |         | UNIX-based. An  | re            |   |                 |
|    |         | OIG audit of    | commendations |   |                 |
|    |         | UNIX in the     | closed for    |   |                 |
|    |         | system          | reporting     |   |                 |
|    |         | development     | pur­poses. The |   |                 |
|    |         | environment     | remaining     |   |                 |
|    |         | identified      | eight will    |   |                 |
|    |         | weaknesses in   | remain open   |   |                 |
|    |         | the area of     | until         |   |                 |
|    |         | security        | agreed-       |   |                 |
|    |         | controls.       | to-corrective |   |                 |
|    |         | Without         | actions are   |   |                 |
|    |         | adequate UNIX   | completed and |   |                 |
|    |         | security        | we have       |   |                 |
|    |         | controls, the   | assessed      |   |                 |
|    |         | system          | their         |   |                 |
|    |         | development     | adequacy.     |   |                 |
|    |         | environment     |               |   |                 |
|    |         | could be        |               |   |                 |
|    |         | compromised by  |               |   |                 |
|    |         | an unauthorized |               |   |                 |
|    |         | source without  |               |   |                 |
|    |         | detection. We   |               |   |                 |
|    |         | found that      |               |   |                 |
|    |         | management      |               |   |                 |
|    |         | needs to review |               |   |                 |
|    |         | the weaknesses  |               |   |                 |
|    |         | identified and  |               |   |                 |
|    |         | improve         |               |   |                 |
|    |         | controls in     |               |   |                 |
|    |         | certain areas.  |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Year    | NASA requires   | \*            |   |                 |
| di | 2000    | its grant       |               |   |                 |
| ts | (Y-2K)  | recipients and  |               |   |                 |
|    | Program | cooperative     |               |   |                 |
|    | Ov      | agreement       |               |   |                 |
|    | ersight | partners to     |               |   |                 |
|    | of NASA | report          |               |   |                 |
|    | Grants  | significant     |               |   |                 |
|    | and     | Y2K-related     |               |   |                 |
|    | Coop    | problems.       |               |   |                 |
|    | erative | However, NASA   |               |   |                 |
|    | Agr     | has not         |               |   |                 |
|    | eements | established     |               |   |                 |
|    | (IG-    | timeframes for  |               |   |                 |
|    | 99-048) | such reporting. |               |   |                 |
|    |         | Also, the       |               |   |                 |
|    |         | Agency does not |               |   |                 |
|    |         | require         |               |   |                 |
|    |         | recipients to   |               |   |                 |
|    |         | report on       |               |   |                 |
|    |         | whether         |               |   |                 |
|    |         | recipient       |               |   |                 |
|    |         | computer        |               |   |                 |
|    |         | systems are Y2K |               |   |                 |
|    |         | compliant.      |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | agreed to       |               |   |                 |
|    |         | require major   |               |   |                 |
|    |         | recipients to   |               |   |                 |
|    |         | report whether  |               |   |                 |
|    |         | recipient       |               |   |                 |
|    |         | computer        |               |   |                 |
|    |         | systems are Y2K |               |   |                 |
|    |         | compliant,      |               |   |                 |
|    |         | identify        |               |   |                 |
|    |         | significant     |               |   |                 |
|    |         | Y2K-related     |               |   |                 |
|    |         | problems, and   |               |   |                 |
|    |         | require         |               |   |                 |
|    |         | appropriate     |               |   |                 |
|    |         | remedial        |               |   |                 |
|    |         | actions.        |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Year    | The OMB adopted | \*            |   |                 |
| di | 2000    | the GAO         |               |   |                 |
| ts | Impleme | contingency     |               |   |                 |
|    | ntation | planning guide  |               |   |                 |
|    | Phase   | entitled *Year  |               |   |                 |
|    | (IG-    | 2000 Computing  |               |   |                 |
|    | 99-044) | Crisis:         |               |   |                 |
|    |         | Business        |               |   |                 |
|    |         | Continuity and  |               |   |                 |
|    |         | Contingency     |               |   |                 |
|    |         | Planning*       |               |   |                 |
|    |         | (BCCP), which   |               |   |                 |
|    |         | identifies the  |               |   |                 |
|    |         | key elements    |               |   |                 |
|    |         | that a BCCP     |               |   |                 |
|    |         | plan and a      |               |   |                 |
|    |         | contingency     |               |   |                 |
|    |         | test plan       |               |   |                 |
|    |         | should contain. |               |   |                 |
|    |         | NASA            |               |   |                 |
|    |         | installations   |               |   |                 |
|    |         | had             |               |   |                 |
|    |         | incorporated    |               |   |                 |
|    |         | only some of    |               |   |                 |
|    |         | the key         |               |   |                 |
|    |         | elements        |               |   |                 |
|    |         | prescribed by   |               |   |                 |
|    |         | the GAO         |               |   |                 |
|    |         | planning guide  |               |   |                 |
|    |         | which reduces   |               |   |                 |
|    |         | NASA's          |               |   |                 |
|    |         | assurance that  |               |   |                 |
|    |         | it can          |               |   |                 |
|    |         | effectively     |               |   |                 |
|    |         | respond to      |               |   |                 |
|    |         | Y2K-related     |               |   |                 |
|    |         | failures.       |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | agreed to       |               |   |                 |
|    |         | correct the     |               |   |                 |
|    |         | deficiencies.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | D       | The NASA        | We made eight |   |                 |
| di | isaster | Automated Data  | re            |   |                 |
| ts | R       | Processing      | commendations |   |                 |
|    | ecovery | Consolidation   | to improve    |   |                 |
|    | P       | Center (NACC),  | disaster      |   |                 |
|    | lanning | at Marshall is  | recovery      |   |                 |
|    | at      | primarily       | strategies,   |   |                 |
|    | M       | responsible for | procedures,   |   |                 |
|    | arshall | computer        | and training. |   |                 |
|    | Space   | operations,     | We also       |   |                 |
|    | Flight  | systems         | recommended   |   |                 |
|    | C       | reliability,    | development   |   |                 |
|    | enter's | systems         | of a user     |   |                 |
|    | Au      | software,       | contingency   |   |                 |
|    | tomated | configuration   | plan.         |   |                 |
|    | Data    | management, and | Management is |   |                 |
|    | Pro     | strategic       | implementing  |   |                 |
|    | cessing | planning for    | corrective    |   |                 |
|    | Consol  | NASA-wide       | action for    |   |                 |
|    | idation | administrative  | these         |   |                 |
|    | Center  | systems and for | rec           |   |                 |
|    | (IG-    | several program | om­mendations, |   |                 |
|    | 99-043) | support         | and we will   |   |                 |
|    |         | systems. An     | continue to   |   |                 |
|    |         | audit showed    | monitor the   |   |                 |
|    |         | that while the  | issues.       |   |                 |
|    |         | NACC has        |               |   |                 |
|    |         | implemented a   |               |   |                 |
|    |         | disaster        |               |   |                 |
|    |         | recovery plan   |               |   |                 |
|    |         | that includes   |               |   |                 |
|    |         | most of the     |               |   |                 |
|    |         | necessary       |               |   |                 |
|    |         | provisions for  |               |   |                 |
|    |         | emergency       |               |   |                 |
|    |         | response,       |               |   |                 |
|    |         | extended backup |               |   |                 |
|    |         | operations, and |               |   |                 |
|    |         | testing;        |               |   |                 |
|    |         | improvements    |               |   |                 |
|    |         | are needed in   |               |   |                 |
|    |         | the areas of    |               |   |                 |
|    |         | disaster        |               |   |                 |
|    |         | recovery        |               |   |                 |
|    |         | strategy,       |               |   |                 |
|    |         | procedures, and |               |   |                 |
|    |         | training.       |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Ames    | The Numerical   | NASA          |   |                 |
| di | R       | Aerospace       | management    |   |                 |
| ts | esearch | Simulation      | agreed to     |   |                 |
|    | C       | (NAS) Facility  | implement and |   |                 |
|    | enter's | does not have a | maintain a    |   |                 |
|    | NAS     | mana            | NAS disaster  |   |                 |
|    | Fac     | gement-approved | recovery plan |   |                 |
|    | ilities | disaster        | that complies |   |                 |
|    | D       | recovery plan   | with Agency   |   |                 |
|    | isaster | that meets      | and Federal   |   |                 |
|    | R       | applicable      | regulations.  |   |                 |
|    | ecovery | Federal and     |               |   |                 |
|    | Plan    | NASA            |               |   |                 |
|    | (IG-    | requirements    |               |   |                 |
|    | 99-032) | for emergency   |               |   |                 |
|    |         | response        |               |   |                 |
|    |         | procedures,     |               |   |                 |
|    |         | extended backup |               |   |                 |
|    |         | operations, and |               |   |                 |
|    |         | testing.        |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Audit   | NASA guidance   | \*            |   |                 |
| di | of Year | required        |               |   |                 |
| ts | 2000    | contracting     |               |   |                 |
|    | Program | officers to     |               |   |                 |
|    | Com     | include a       |               |   |                 |
|    | pliance | clause in IT    |               |   |                 |
|    | Requi   | solicitations   |               |   |                 |
|    | rements | and new         |               |   |                 |
|    | in NASA | contracts       |               |   |                 |
|    | Info    | addressing Y2K  |               |   |                 |
|    | rmation | and to modify   |               |   |                 |
|    | Tech    | the statement   |               |   |                 |
|    | nology- | of work in      |               |   |                 |
|    | Related | existing IT     |               |   |                 |
|    | Co      | operation and   |               |   |                 |
|    | ntracts | maintenance     |               |   |                 |
|    | (IG-    | contracts.      |               |   |                 |
|    | 99-022) | However, JPL    |               |   |                 |
|    |         | had not         |               |   |                 |
|    |         | included the    |               |   |                 |
|    |         | NASA-directed   |               |   |                 |
|    |         | requirements in |               |   |                 |
|    |         | all its         |               |   |                 |
|    |         | existing IT     |               |   |                 |
|    |         | operations and  |               |   |                 |
|    |         | maintenance     |               |   |                 |
|    |         | contracts.      |               |   |                 |
|    |         | Untimely        |               |   |                 |
|    |         | incorporation   |               |   |                 |
|    |         | of the Y2K      |               |   |                 |
|    |         | compliance      |               |   |                 |
|    |         | requirements    |               |   |                 |
|    |         | increases the   |               |   |                 |
|    |         | potential for   |               |   |                 |
|    |         | noncompliant    |               |   |                 |
|    |         | Agency systems  |               |   |                 |
|    |         | on January 1,   |               |   |                 |
|    |         | 2000.           |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | established a   |               |   |                 |
|    |         | June 30, 1999,  |               |   |                 |
|    |         | target date for |               |   |                 |
|    |         | JPL to          |               |   |                 |
|    |         | incorporate the |               |   |                 |
|    |         | Y2K             |               |   |                 |
|    |         | requirements    |               |   |                 |
|    |         | into contracts  |               |   |                 |
|    |         | and agreed to   |               |   |                 |
|    |         | monitored       |               |   |                 |
|    |         | progress.       |               |   |                 |
|    |         | Corrective      |               |   |                 |
|    |         | action is       |               |   |                 |
|    |         | complete and    |               |   |                 |
|    |         | the             |               |   |                 |
|    |         | recommendation  |               |   |                 |
|    |         | is closed.      |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Audit   | Two critical    | NASA          |   |                 |
| di | of      | systems         | management    |   |                 |
| ts | D       | Kennedy, the    | did not       |   |                 |
|    | isaster | Launch          | concur with   |   |                 |
|    | R       | Processing      | the report's  |   |                 |
|    | ecovery | System (LPS)    | three         |   |                 |
|    | P       | and the Shuttle | rec           |   |                 |
|    | lanning | Processing Data | ommendations. |   |                 |
|    | at      | Management      | Our           |   |                 |
|    | Kennedy | System (SPDMS), | re            |   |                 |
|    | Space   | have            | commendations |   |                 |
|    | Center  | appropriate     | will remain   |   |                 |
|    | (IG-    | procedures for  | open pending  |   |                 |
|    | 99-017) | emergency       | Kennedy       |   |                 |
|    |         | response and    | management's  |   |                 |
|    |         | for recovering  | completion of |   |                 |
|    |         | data and        | the most      |   |                 |
|    |         | software.       | current risk  |   |                 |
|    |         | However,        | assessment    |   |                 |
|    |         | neither has an  | and related   |   |                 |
|    |         | extended backup | corrective    |   |                 |
|    |         | capability to   | actions.      |   |                 |
|    |         | recover from a  |               |   |                 |
|    |         | local disaster, |               |   |                 |
|    |         | which could     |               |   |                 |
|    |         | cause           |               |   |                 |
|    |         | significant     |               |   |                 |
|    |         | schedule and    |               |   |                 |
|    |         | mission delays  |               |   |                 |
|    |         | for the Shuttle |               |   |                 |
|    |         | Program. We     |               |   |                 |
|    |         | found that      |               |   |                 |
|    |         | Kennedy         |               |   |                 |
|    |         | management      |               |   |                 |
|    |         | needs to: (1)   |               |   |                 |
|    |         | survey other    |               |   |                 |
|    |         | NASA entities,  |               |   |                 |
|    |         | Government      |               |   |                 |
|    |         | agencies, and   |               |   |                 |
|    |         | commercial      |               |   |                 |
|    |         | enterprises to  |               |   |                 |
|    |         | determine the   |               |   |                 |
|    |         | availability of |               |   |                 |
|    |         | cost-effective  |               |   |                 |
|    |         | extended backup |               |   |                 |
|    |         | capabilities    |               |   |                 |
|    |         | for the LPS and |               |   |                 |
|    |         | SPDMS; (2)      |               |   |                 |
|    |         | develop and     |               |   |                 |
|    |         | implement       |               |   |                 |
|    |         | disaster        |               |   |                 |
|    |         | recovery plans  |               |   |                 |
|    |         | for the LPS and |               |   |                 |
|    |         | SPDMS that      |               |   |                 |
|    |         | provide for     |               |   |                 |
|    |         | extended backup |               |   |                 |
|    |         | capability; and |               |   |                 |
|    |         | (3) ensure that |               |   |                 |
|    |         | operations can  |               |   |                 |
|    |         | be restored     |               |   |                 |
|    |         | within the      |               |   |                 |
|    |         | maximum         |               |   |                 |
|    |         | acceptable      |               |   |                 |
|    |         | downtime for    |               |   |                 |
|    |         | critical LPS    |               |   |                 |
|    |         | and SPDMS       |               |   |                 |
|    |         | applications.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | NAS     | NASA had not    | \*            |   |                 |
| di | Data    | established an  |               |   |                 |
| ts | Center  | adequate        |               |   |                 |
|    | General | control         |               |   |                 |
|    | C       | structure to    |               |   |                 |
|    | ontrols | provide for a   |               |   |                 |
|    | at Ames | reliable        |               |   |                 |
|    | R       | computing       |               |   |                 |
|    | esearch | environment at  |               |   |                 |
|    | Center  | the Numerical   |               |   |                 |
|    | Nu      | Aerospace       |               |   |                 |
|    | merical | Simulation      |               |   |                 |
|    | Aer     | Facility. Major |               |   |                 |
|    | o-Space | control         |               |   |                 |
|    | Sim     | weaknesses were |               |   |                 |
|    | ulation | identified in   |               |   |                 |
|    | F       | the areas of    |               |   |                 |
|    | acility | (1) physical    |               |   |                 |
|    | (IG-    | and logical     |               |   |                 |
|    | 99-010) | access, (2)     |               |   |                 |
|    |         | computer        |               |   |                 |
|    |         | security, (3)   |               |   |                 |
|    |         | file retention, |               |   |                 |
|    |         | backup, and     |               |   |                 |
|    |         | recovery        |               |   |                 |
|    |         | management; (4) |               |   |                 |
|    |         | software change |               |   |                 |
|    |         | management,     |               |   |                 |
|    |         | (5) system      |               |   |                 |
|    |         | accounting and  |               |   |                 |
|    |         | file auditing,  |               |   |                 |
|    |         | and (6) risk    |               |   |                 |
|    |         | assessments.    |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | generally       |               |   |                 |
|    |         | concurred with  |               |   |                 |
|    |         | our             |               |   |                 |
|    |         | recommendations |               |   |                 |
|    |         | and completed   |               |   |                 |
|    |         | responsive      |               |   |                 |
|    |         | corrective      |               |   |                 |
|    |         | actions.        |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | D       | JPL provides    | The report    |   |                 |
| di | isaster | tel             | included six  |   |                 |
| ts | R       | ecommunications | re            |   |                 |
|    | ecovery | and mission     | commendations |   |                 |
|    | P       | operations      | to strengthen |   |                 |
|    | lanning | support to      | the disaster  |   |                 |
|    | at the  | space           | recovery      |   |                 |
|    | Jet     | exploration     | plan. Center  |   |                 |
|    | Pro     | missions and    | management    |   |                 |
|    | pulsion | other           | agreed to     |   |                 |
|    | Lab     | activities. JPL | implement     |   |                 |
|    | oratory | management      | actions       |   |                 |
|    | (IG-    | needs to take   | responsive to |   |                 |
|    | 99-006) | several actions | the           |   |                 |
|    |         | to improve its  | rec           |   |                 |
|    |         | disaster        | ommendations. |   |                 |
|    |         | recovery plan   | While it      |   |                 |
|    |         | including: (1)  | appears that  |   |                 |
|    |         | identifying the | the actions   |   |                 |
|    |         | applications    | taken or in   |   |                 |
|    |         | that support    | process       |   |                 |
|    |         | m               | should        |   |                 |
|    |         | ission-critical | satisfy our   |   |                 |
|    |         | functions and   | rec           |   |                 |
|    |         | the relative    | ommendations, |   |                 |
|    |         | criticality of  | the           |   |                 |
|    |         | each            | re            |   |                 |
|    |         | application,    | commendations |   |                 |
|    |         | (2) documenting | will remain   |   |                 |
|    |         | transportation  | open pending  |   |                 |
|    |         | and support     | our receipt   |   |                 |
|    |         | arrangements,   | and review of |   |                 |
|    |         | (3) updating    | appropriate   |   |                 |
|    |         | the list of key | documentation |   |                 |
|    |         | individuals     | for these     |   |                 |
|    |         | responsible for | actions.      |   |                 |
|    |         | contingency     |               |   |                 |
|    |         | operations, and |               |   |                 |
|    |         | (4) updating    |               |   |                 |
|    |         | the application |               |   |                 |
|    |         | software        |               |   |                 |
|    |         | listing to show |               |   |                 |
|    |         | the version and |               |   |                 |
|    |         | release date    |               |   |                 |
|    |         | and applied     |               |   |                 |
|    |         | vendor fixes.   |               |   |                 |
|    |         | JPL also needs  |               |   |                 |
|    |         | to develop      |               |   |                 |
|    |         | policies and    |               |   |                 |
|    |         | procedures for  |               |   |                 |
|    |         | the restoration |               |   |                 |
|    |         | of normal       |               |   |                 |
|    |         | operations and  |               |   |                 |
|    |         | include them in |               |   |                 |
|    |         | the disaster    |               |   |                 |
|    |         | recovery plan.  |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | D       | While a         | \*            |   |                 |
| di | isaster | disaster        |               |   |                 |
| ts | R       | recovery plan   |               |   |                 |
|    | ecovery | is in place,    |               |   |                 |
|    | P       | the Shuttle     |               |   |                 |
|    | lanning | Software        |               |   |                 |
|    | at      | Production      |               |   |                 |
|    | Johnson | Facility (SSPF) |               |   |                 |
|    | Space   | does not have a |               |   |                 |
|    | Center  | strategy or     |               |   |                 |
|    |         | procedures in   |               |   |                 |
|    | (IG-    | place for       |               |   |                 |
|    | 99-005) | extended backup |               |   |                 |
|    |         | operations in   |               |   |                 |
|    |         | the event of a  |               |   |                 |
|    |         | disaster, the   |               |   |                 |
|    |         | plan is not     |               |   |                 |
|    |         | tested          |               |   |                 |
|    |         | annually, and   |               |   |                 |
|    |         | SSPF            |               |   |                 |
|    |         | application     |               |   |                 |
|    |         | users have not  |               |   |                 |
|    |         | developed       |               |   |                 |
|    |         | contingency     |               |   |                 |
|    |         | plans.          |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | concurred with  |               |   |                 |
|    |         | four of the six |               |   |                 |
|    |         | recommendations |               |   |                 |
|    |         | and initiated   |               |   |                 |
|    |         | corrective      |               |   |                 |
|    |         | actions.        |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | decided to      |               |   |                 |
|    |         | accept the      |               |   |                 |
|    |         | risks           |               |   |                 |
|    |         | associated with |               |   |                 |
|    |         | (1) vendors not |               |   |                 |
|    |         | supplying       |               |   |                 |
|    |         | backup          |               |   |                 |
|    |         | resources in a  |               |   |                 |
|    |         | timely manner,  |               |   |                 |
|    |         | and (2) not     |               |   |                 |
|    |         | establishing    |               |   |                 |
|    |         | contingency     |               |   |                 |
|    |         | plans for the   |               |   |                 |
|    |         | Flight          |               |   |                 |
|    |         | Equipment       |               |   |                 |
|    |         | Interface       |               |   |                 |
|    |         | Devices.        |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Year    | NASA's Y2K      | \*            |   |                 |
| di | 2000    | Program lacks   |               |   |                 |
| ts | Program | reasonable      |               |   |                 |
|    | Ov      | assurance that  |               |   |                 |
|    | ersight | its production  |               |   |                 |
|    | of      | contractors     |               |   |                 |
|    | NASA's  | will provide    |               |   |                 |
|    | Pro     | Y2K-compliant   |               |   |                 |
|    | duction | data to support |               |   |                 |
|    | Cont    | key financial   |               |   |                 |
|    | ractors | and program     |               |   |                 |
|    |         | management      |               |   |                 |
|    | (IG-    | activities. As  |               |   |                 |
|    | 99-004) | a result, NASA  |               |   |                 |
|    |         | risks using     |               |   |                 |
|    |         | noncompliant    |               |   |                 |
|    |         | data that may   |               |   |                 |
|    |         | adversely       |               |   |                 |
|    |         | affect the      |               |   |                 |
|    |         | Agency's        |               |   |                 |
|    |         | control,        |               |   |                 |
|    |         | budgeting,      |               |   |                 |
|    |         | program         |               |   |                 |
|    |         | management, and |               |   |                 |
|    |         | cost accounting |               |   |                 |
|    |         | activities.     |               |   |                 |
|    |         | Management      |               |   |                 |
|    |         | generally       |               |   |                 |
|    |         | concurred with  |               |   |                 |
|    |         | the intent of   |               |   |                 |
|    |         | the             |               |   |                 |
|    |         | recommendations |               |   |                 |
|    |         | and initiated a |               |   |                 |
|    |         | plan to assess  |               |   |                 |
|    |         | the Y2K status  |               |   |                 |
|    |         | of NASA's major |               |   |                 |
|    |         | contractors.    |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Data    | The physical    | \*            |   |                 |
| di | Center  | access control  |               |   |                 |
| ts | C       | system used to  |               |   |                 |
|    | ontrols | protect Lewis'  |               |   |                 |
|    | at      | Research        |               |   |                 |
|    | Lewis   | Analysis Center |               |   |                 |
|    | R       | had not been    |               |   |                 |
|    | esearch | certified as    |               |   |                 |
|    | Center  | meeting         |               |   |                 |
|    | (IG-    | security        |               |   |                 |
|    | 98-039) | requirements.   |               |   |                 |
|    |         | Physical access |               |   |                 |
|    |         | procedures to   |               |   |                 |
|    |         | the facility    |               |   |                 |
|    |         | were not        |               |   |                 |
|    |         | adequate. Lewis |               |   |                 |
|    |         | has addressed   |               |   |                 |
|    |         | these issues.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | D       | The Solar       | \*            |   |                 |
| di | isaster | Heliospheric    |               |   |                 |
| ts | R       | Observatory     |               |   |                 |
|    | ecovery | Mission         |               |   |                 |
|    | P       | Operations      |               |   |                 |
|    | lanning | Center did not  |               |   |                 |
|    | at      | have computer   |               |   |                 |
|    | Goddard | contingency     |               |   |                 |
|    | Space   | capabilities in |               |   |                 |
|    | Flight  | place in the    |               |   |                 |
|    | Center  | event of a      |               |   |                 |
|    | (IG-    | disaster.       |               |   |                 |
|    | 98-036) | Additionally,   |               |   |                 |
|    |         | contingency     |               |   |                 |
|    |         | plans for a     |               |   |                 |
|    |         | data center     |               |   |                 |
|    |         | associated with |               |   |                 |
|    |         | the Tropical    |               |   |                 |
|    |         | Rainfall        |               |   |                 |
|    |         | Measurement     |               |   |                 |
|    |         | Mission were    |               |   |                 |
|    |         | incomplete.     |               |   |                 |
|    |         | Finally,        |               |   |                 |
|    |         | computer risk   |               |   |                 |
|    |         | assessments did |               |   |                 |
|    |         | not analyze the |               |   |                 |
|    |         | potential       |               |   |                 |
|    |         | effects of      |               |   |                 |
|    |         | losses caused   |               |   |                 |
|    |         | by disasters.   |               |   |                 |
|    |         | Goddard agreed  |               |   |                 |
|    |         | to implement    |               |   |                 |
|    |         | corrective      |               |   |                 |
|    |         | actions.        |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Info    | The NASA IT     | \*            |   |                 |
| di | rmation | investment      |               |   |                 |
| ts | Tec     | process does    |               |   |                 |
|    | hnology | not satisfy     |               |   |                 |
|    | (IT)    | Clinger-Cohen   |               |   |                 |
|    | Capital | Act and OMB     |               |   |                 |
|    | P       | Circular A-130, |               |   |                 |
|    | lanning | *Management of  |               |   |                 |
|    | and     | Federal         |               |   |                 |
|    | Inv     | Information     |               |   |                 |
|    | estment | Resources*,     |               |   |                 |
|    | Control | requirements    |               |   |                 |
|    |         | for post        |               |   |                 |
|    | (IG-    | implementation  |               |   |                 |
|    | 98-034) | reviews of      |               |   |                 |
|    |         | major, new IT   |               |   |                 |
|    |         | investments.    |               |   |                 |
|    |         | NASA initiated  |               |   |                 |
|    |         | process         |               |   |                 |
|    |         | improvements    |               |   |                 |
|    |         | that satisfied  |               |   |                 |
|    |         | the IT post     |               |   |                 |
|    |         | implementation  |               |   |                 |
|    |         | review          |               |   |                 |
|    |         | requirements.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Im      | NASA's          | NASA          |   |                 |
| di | proving | Consolidated    | initiated     |   |                 |
| ts | C       | Supercomputing  | responsive    |   |                 |
|    | ontrols | Management      | corrective    |   |                 |
|    | Needed  | Office (CoSMO)  | actions.      |   |                 |
|    | Over    | did not have an |               |   |                 |
|    | NASA's  | accurate        |               |   |                 |
|    | S       | inventory of    |               |   |                 |
|    | uper-Co | NASA's          |               |   |                 |
|    | mputing | supercomputers  |               |   |                 |
|    | In      | and             |               |   |                 |
|    | ventory | supercomputing  |               |   |                 |
|    |         | time purchased. |               |   |                 |
|    | (IG-    |                 |               |   |                 |
|    | 98-021) |                 |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Consol  | Cost-benefit    | \*            |   |                 |
| di | idation | analysis        |               |   |                 |
| ts | D       | prepared by     |               |   |                 |
|    | ecision | CoSMO did not   |               |   |                 |
|    | for     | adequately      |               |   |                 |
|    | Secure  | support its     |               |   |                 |
|    | Superco | decision to     |               |   |                 |
|    | mputers | relocate secure |               |   |                 |
|    |         | supercomputing  |               |   |                 |
|    | (IG-    | from Langley to |               |   |                 |
|    | 98-020) | the Naval       |               |   |                 |
|    |         | Oceanographic   |               |   |                 |
|    |         | Office at the   |               |   |                 |
|    |         | Stennis Space   |               |   |                 |
|    |         | Center. We      |               |   |                 |
|    |         | recommended     |               |   |                 |
|    |         | that the CoSMO  |               |   |                 |
|    |         | Director use    |               |   |                 |
|    |         | only current,   |               |   |                 |
|    |         | accurate,       |               |   |                 |
|    |         | complete, and   |               |   |                 |
|    |         | adequately      |               |   |                 |
|    |         | documented data |               |   |                 |
|    |         | in its          |               |   |                 |
|    |         | consolidation   |               |   |                 |
|    |         | decisions. NASA |               |   |                 |
|    |         | concurred with  |               |   |                 |
|    |         | the             |               |   |                 |
|    |         | recommendation  |               |   |                 |
|    |         | and took        |               |   |                 |
|    |         | corrective      |               |   |                 |
|    |         | action.         |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Data    | Procedures for  | \*            |   |                 |
| di | Center  | monitoring      |               |   |                 |
| ts | General | unauthorized    |               |   |                 |
|    | C       | access attempts |               |   |                 |
|    | ontrols | to the Shuttle  |               |   |                 |
|    | at      | Processing Data |               |   |                 |
|    | Kennedy | Management      |               |   |                 |
|    | Space   | System were     |               |   |                 |
|    | Center  | inadequate.     |               |   |                 |
|    | (IG-    | Kennedy took    |               |   |                 |
|    | 98-018) | corrective      |               |   |                 |
|    |         | action.         |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Data    | Computer        | \*            |   |                 |
| di | Center  | security        |               |   |                 |
| ts | General | implementation  |               |   |                 |
|    | C       | plans and       |               |   |                 |
|    | ontrols | reviews had not |               |   |                 |
|    | at Jet  | been developed  |               |   |                 |
|    | Pro     | or conducted    |               |   |                 |
|    | pulsion | for JPL's       |               |   |                 |
|    | Lab     | Institutional   |               |   |                 |
|    | oratory | Business        |               |   |                 |
|    |         | Systems (IBS)   |               |   |                 |
|    | (IG-    | as required by  |               |   |                 |
|    | 98-009) | JPL policy.     |               |   |                 |
|    |         | Additionally,   |               |   |                 |
|    |         | physical access |               |   |                 |
|    |         | controls to the |               |   |                 |
|    |         | IBS data center |               |   |                 |
|    |         | were in need of |               |   |                 |
|    |         | improvement.    |               |   |                 |
|    |         | JPL corrected   |               |   |                 |
|    |         | these           |               |   |                 |
|    |         | deficiencies.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Data    | Physical access | \*            |   |                 |
| di | Center  | controls        |               |   |                 |
| ts | General | associated with |               |   |                 |
|    | C       | the Hubble      |               |   |                 |
|    | ontrols | Telescope Data  |               |   |                 |
|    | at      | Operations      |               |   |                 |
|    | Goddard | Center and the  |               |   |                 |
|    | Space   | Hubble          |               |   |                 |
|    | Flight  | Telescope       |               |   |                 |
|    | Center  | Servicing and   |               |   |                 |
|    |         | Maintenance     |               |   |                 |
|    | (IG-    | System Facility |               |   |                 |
|    | 98-006) | were            |               |   |                 |
|    |         | inadequate.     |               |   |                 |
|    |         | Additionally,   |               |   |                 |
|    |         | computer risk   |               |   |                 |
|    |         | management      |               |   |                 |
|    |         | plans had not   |               |   |                 |
|    |         | been conducted  |               |   |                 |
|    |         | as required.    |               |   |                 |
|    |         | Goddard         |               |   |                 |
|    |         | corrected these |               |   |                 |
|    |         | deficiencies.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Data    | We found that   | \*            |   |                 |
| di | Center  | physical access |               |   |                 |
| ts | General | controls to the |               |   |                 |
|    | C       | Shuttle         |               |   |                 |
|    | ontrols | Software        |               |   |                 |
|    | at      | Production      |               |   |                 |
|    | Johnson | Facility needed |               |   |                 |
|    | Space   | improvement.    |               |   |                 |
|    | Center  | Additionally,   |               |   |                 |
|    |         | the facility    |               |   |                 |
|    | (IG-    | did not have an |               |   |                 |
|    | 98-005) | uninterruptible |               |   |                 |
|    |         | power supply    |               |   |                 |
|    |         | (UPS) as a      |               |   |                 |
|    |         | defense against |               |   |                 |
|    |         | power problems. |               |   |                 |
|    |         | Johnson         |               |   |                 |
|    |         | corrected the   |               |   |                 |
|    |         | physical access |               |   |                 |
|    |         | problem and     |               |   |                 |
|    |         | agreed to       |               |   |                 |
|    |         | conduct a       |               |   |                 |
|    |         | feasibility     |               |   |                 |
|    |         | study and       |               |   |                 |
|    |         | cost/benefit    |               |   |                 |
|    |         | analysis on the |               |   |                 |
|    |         | UPS.            |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| Au | Appl    | NASA had not    | \*            |   |                 |
| di | ication | fully satisfied |               |   |                 |
| ts | of OMB  | the cost        |               |   |                 |
|    | C       | comparison      |               |   |                 |
|    | ircular | requirements of |               |   |                 |
|    | A-76 to | OMB Circular    |               |   |                 |
|    | Desktop | A-76,           |               |   |                 |
|    | Outs    | "Performance of |               |   |                 |
|    | ourcing | Commercial      |               |   |                 |
|    | (IG-    | Activities,"    |               |   |                 |
|    | 98-001) | relative to the |               |   |                 |
|    |         | Agency's        |               |   |                 |
|    |         | desktop         |               |   |                 |
|    |         | computer        |               |   |                 |
|    |         | outsourcing     |               |   |                 |
|    |         | initiative.     |               |   |                 |
|    |         | NASA took       |               |   |                 |
|    |         | actions that    |               |   |                 |
|    |         | satisfied the   |               |   |                 |
|    |         | prerequisites   |               |   |                 |
|    |         | for exemption   |               |   |                 |
|    |         | from A-76 cost  |               |   |                 |
|    |         | comparison      |               |   |                 |
|    |         | requirements.   |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Access  | Alerted the     | \*            |   |                 |
| ns | to      | Agency to       |               |   |                 |
| pe | Shared  | ensure that     |               |   |                 |
| ct | Files   | sensitive,      |               |   |                 |
| io | (Man    | privacy act, or |               |   |                 |
| ns | agement | a               |               |   |                 |
|    | Alert,  | dministratively |               |   |                 |
|    | G-      | controlled      |               |   |                 |
|    | 00-011) | information is  |               |   |                 |
|    |         | not placed on   |               |   |                 |
|    |         | areas of local  |               |   |                 |
|    |         | area networks   |               |   |                 |
|    |         | accessible by   |               |   |                 |
|    |         | all employees.  |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Network | Alerted the     | \*            |   |                 |
| ns | Ope     | Agency to staff |               |   |                 |
| pe | rations | Network         |               |   |                 |
| ct | Centers | Operations      |               |   |                 |
| io | (Man    | Centers 24      |               |   |                 |
| ns | agement | hours a day,    |               |   |                 |
|    | Alert,  | seven days a    |               |   |                 |
|    | G       | week (24x7) or  |               |   |                 |
|    | -00-010 | make other      |               |   |                 |
|    | --      | arrangements    |               |   |                 |
|    | Sen     | for active 24x7 |               |   |                 |
|    | sitive) | monitoring of   |               |   |                 |
|    |         | network         |               |   |                 |
|    |         | activities.     |               |   |                 |
|    |         | Agency plans to |               |   |                 |
|    |         | address this    |               |   |                 |
|    |         | issue still     |               |   |                 |
|    |         | open. This      |               |   |                 |
|    |         | document is     |               |   |                 |
|    |         | sensitive with  |               |   |                 |
|    |         | limited         |               |   |                 |
|    |         | distribution;   |               |   |                 |
|    |         | it is not       |               |   |                 |
|    |         | generally       |               |   |                 |
|    |         | releasable to   |               |   |                 |
|    |         | the public.     |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Headq   | Evaluated       | Three         |   |                 |
| ns | uarters | processes used  | re            |   |                 |
| pe | Hard    | to erase user   | commendations |   |                 |
| ct | Drive   | data from hard  | were made to  |   |                 |
| io | Laptop  | drives loaned   | management:   |   |                 |
| ns | Loaner  | to Headquarters | (1) issue a   |   |                 |
|    | Pool    | employees.      | technical     |   |                 |
|    | (G-     | Determined that | modification  |   |                 |
|    | 00-008) | processes       | to the        |   |                 |
|    |         | should be       | contract for  |   |                 |
|    |         | improved to     | the           |   |                 |
|    |         | protect         | contractor to |   |                 |
|    |         | employee and    | implement     |   |                 |
|    |         | sensitive data. | effective     |   |                 |
|    |         | This report is  | clearing      |   |                 |
|    |         | sensitive with  | methods; (2)  |   |                 |
|    |         | limited         | alert users   |   |                 |
|    |         | distribution;   | of laptop     |   |                 |
|    |         | it is not       | loaners about |   |                 |
|    |         | generally       | the security  |   |                 |
|    |         | releasable to   | vu            |   |                 |
|    |         | the public.     | lnerabilities |   |                 |
|    |         |                 | attendant to  |   |                 |
|    |         |                 | their use,    |   |                 |
|    |         |                 | and (3)       |   |                 |
|    |         |                 | ensure that   |   |                 |
|    |         |                 | only licensed |   |                 |
|    |         |                 | copies of     |   |                 |
|    |         |                 | vendor        |   |                 |
|    |         |                 | software are  |   |                 |
|    |         |                 | used when     |   |                 |
|    |         |                 | clearing      |   |                 |
|    |         |                 | laptop        |   |                 |
|    |         |                 | computer hard |   |                 |
|    |         |                 | drives.       |   |                 |
|    |         |                 | Management    |   |                 |
|    |         |                 | concurred     |   |                 |
|    |         |                 | with the      |   |                 |
|    |         |                 | rec           |   |                 |
|    |         |                 | ommendations. |   |                 |
|    |         |                 | The           |   |                 |
|    |         |                 | re            |   |                 |
|    |         |                 | commendations |   |                 |
|    |         |                 | are           |   |                 |
|    |         |                 | considered    |   |                 |
|    |         |                 | resolved      |   |                 |
|    |         |                 | pending       |   |                 |
|    |         |                 | verification  |   |                 |
|    |         |                 | of the        |   |                 |
|    |         |                 | corrective    |   |                 |
|    |         |                 | actions.      |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | C       | NASA management | We            |   |                 |
| ns | learing | did not have an | recommended   |   |                 |
| pe | of Data | established     | NASA take     |   |                 |
| ct | from    | process in      | immediate     |   |                 |
| io | Cla     | place for       | action to     |   |                 |
| ns | ssified | handling        | develop       |   |                 |
|    | C       | classified      | procedures    |   |                 |
|    | omputer | computer hard   | and guidance  |   |                 |
|    | Hard    | drives in a     | for clearing  |   |                 |
|    | Drives  | transfer or     | classified    |   |                 |
|    |         | excess status.  | information   |   |                 |
|    | (G-9    | Accordingly, we | from affected |   |                 |
|    | 9-009 - | cited           | hard drives.  |   |                 |
|    | Sen     | fundamental     | Management    |   |                 |
|    | sitive) | security        | fully         |   |                 |
|    |         | concerns. This  | concurred     |   |                 |
|    |         | report is       | with the      |   |                 |
|    |         | sensitive with  | r             |   |                 |
|    |         | limited         | ecommendation |   |                 |
|    |         | distribution;   | and published |   |                 |
|    |         | and is not      | its new       |   |                 |
|    |         | generally       | procedures in |   |                 |
|    |         | available to    | March 2000.   |   |                 |
|    |         | the public.     | This          |   |                 |
|    |         |                 | r             |   |                 |
|    |         |                 | ecommendation |   |                 |
|    |         |                 | is considered |   |                 |
|    |         |                 | resolved      |   |                 |
|    |         |                 | pending       |   |                 |
|    |         |                 | further       |   |                 |
|    |         |                 | verification  |   |                 |
|    |         |                 | of the        |   |                 |
|    |         |                 | adequacy of   |   |                 |
|    |         |                 | the           |   |                 |
|    |         |                 | corrective    |   |                 |
|    |         |                 | action.       |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Ass     | NASIRC is used  | We            |   |                 |
| ns | essment | by NASA to      | recommended   |   |                 |
| pe | of the  | identify and    | that NASA     |   |                 |
| ct | N       | respond to      | should        |   |                 |
| io | ational | incidents and   | evaluate      |   |                 |
| ns | Aero    | attacks         | expanding the |   |                 |
|    | nautics | involving       | NASIRC's      |   |                 |
|    | and     | NASA\'s         | res           |   |                 |
|    | Space   | automated       | ponsibilities |   |                 |
|    | Adm     | information and | to include    |   |                 |
|    | inistra | tel             | collecting,   |   |                 |
|    | tion\'s | ecommunications | analyzing,    |   |                 |
|    | Au      | systems. Our    | and reporting |   |                 |
|    | tomated | report          | all IT        |   |                 |
|    | Systems | addressed the   | security      |   |                 |
|    | I       | adequacy of the | incidents     |   |                 |
|    | ncident | Agency\'s       | including     |   |                 |
|    | R       | incident        | security      |   |                 |
|    | esponse | reporting,      | incidents and |   |                 |
|    | Cap     | response,       | vu            |   |                 |
|    | ability | handling,       | lnerabilities |   |                 |
|    | (       | coordination,   | that threaten |   |                 |
|    | NASIRC) | and             | national      |   |                 |
|    |         | info            | security      |   |                 |
|    | (G      | rmation-sharing | systems. NASA |   |                 |
|    | -99-007 | capabilities.   | should also   |   |                 |
|    | --      | This report is  | establish an  |   |                 |
|    | Sen     | sensitive with  | Agency-level  |   |                 |
|    | sitive, | limited         | security      |   |                 |
|    | Limited | distribution;   | incident      |   |                 |
|    | Distri  | it is not       | response      |   |                 |
|    | bution) | generally       | capability,   |   |                 |
|    |         | releasable to   | in compliance |   |                 |
|    |         | the public.     | with national |   |                 |
|    |         |                 | policy. These |   |                 |
|    |         |                 | re            |   |                 |
|    |         |                 | commendations |   |                 |
|    |         |                 | are           |   |                 |
|    |         |                 | considered    |   |                 |
|    |         |                 | resolved      |   |                 |
|    |         |                 | pending the   |   |                 |
|    |         |                 | completion    |   |                 |
|    |         |                 | and           |   |                 |
|    |         |                 | verification  |   |                 |
|    |         |                 | of corrective |   |                 |
|    |         |                 | actions.      |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | NASA\'s | With the        | We made seven |   |                 |
| ns | Impleme | increasing      | re            |   |                 |
| pe | ntation | number of       | commendations |   |                 |
| ct | of a    | computer        | to NASA       |   |                 |
| io | Public  | intrusions,     | management:   |   |                 |
| ns | Key     | NASA requires   | (1) validate  |   |                 |
|    | Infrast | security,       | NASA          |   |                 |
|    | ructure | authentication, | encryption,   |   |                 |
|    | (       | and access      | a             |   |                 |
|    | PKI)(G- | controls over   | uthentication |   |                 |
|    | 99-006) | electronic      | and digital   |   |                 |
|    |         | communications  | signature     |   |                 |
|    |         | (e.g.,          | requirements  |   |                 |
|    |         | electronic      | for general   |   |                 |
|    |         | mail, data      | users; (2)    |   |                 |
|    |         | interchange,    | require that  |   |                 |
|    |         | Internet data   | market        |   |                 |
|    |         | and use, and    | research be   |   |                 |
|    |         | financial       | documented;   |   |                 |
|    |         | software). The  | (3) fully     |   |                 |
|    |         | use of a PKI is | utilize the   |   |                 |
|    |         | one important   | competitive   |   |                 |
|    |         | way to achieve  | procedures    |   |                 |
|    |         | strong security | established   |   |                 |
|    |         | by using        | within        |   |                 |
|    |         | cryptography.   | existing      |   |                 |
|    |         | NASA responded  | contracts to  |   |                 |
|    |         | to security     | obtain the    |   |                 |
|    |         | needs by        | best value    |   |                 |
|    |         | selecting       | for the       |   |                 |
|    |         | products from   | Agency; (4)   |   |                 |
|    |         | one vendor to   | precisely     |   |                 |
|    |         | meet key        | determine     |   |                 |
|    |         | requirements.   | NASA          |   |                 |
|    |         |                 | quantitative  |   |                 |
|    |         |                 | need for      |   |                 |
|    |         |                 | certificates; |   |                 |
|    |         |                 | (5) require   |   |                 |
|    |         |                 | risk and      |   |                 |
|    |         |                 | threat        |   |                 |
|    |         |                 | analyses of   |   |                 |
|    |         |                 | each system   |   |                 |
|    |         |                 | potentially   |   |                 |
|    |         |                 | requiring     |   |                 |
|    |         |                 | security      |   |                 |
|    |         |                 | above the     |   |                 |
|    |         |                 | general user  |   |                 |
|    |         |                 | level; (6)    |   |                 |
|    |         |                 | identify      |   |                 |
|    |         |                 | total costs   |   |                 |
|    |         |                 | associated    |   |                 |
|    |         |                 | with          |   |                 |
|    |         |                 | implementing  |   |                 |
|    |         |                 | and           |   |                 |
|    |         |                 | maintaining a |   |                 |
|    |         |                 | PKI to meet   |   |                 |
|    |         |                 | security      |   |                 |
|    |         |                 | requirements  |   |                 |
|    |         |                 | above the     |   |                 |
|    |         |                 | general user  |   |                 |
|    |         |                 | level; and 7) |   |                 |
|    |         |                 | establish     |   |                 |
|    |         |                 | policies and  |   |                 |
|    |         |                 | procedures    |   |                 |
|    |         |                 | for PKI in    |   |                 |
|    |         |                 | the from of a |   |                 |
|    |         |                 | NASA          |   |                 |
|    |         |                 | Procedures    |   |                 |
|    |         |                 | and           |   |                 |
|    |         |                 | Guidelines    |   |                 |
|    |         |                 | document.     |   |                 |
|    |         |                 | These         |   |                 |
|    |         |                 | re            |   |                 |
|    |         |                 | commendations |   |                 |
|    |         |                 | remain open   |   |                 |
|    |         |                 | pending       |   |                 |
|    |         |                 | verification  |   |                 |
|    |         |                 | of the        |   |                 |
|    |         |                 | adequacy of   |   |                 |
|    |         |                 | corrective    |   |                 |
|    |         |                 | actions.      |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Data    | Alerted the     | \*            |   |                 |
| ns | Re      | Agency to check |               |   |                 |
| pe | maining | for and         |               |   |                 |
| ct | on      | properly remove |               |   |                 |
| io | Tran    | data            |               |   |                 |
| ns | sferred | (particularly   |               |   |                 |
|    | and     | sensitive,      |               |   |                 |
|    | E       | privacy act, or |               |   |                 |
|    | xcessed | a               |               |   |                 |
|    | P       | dministratively |               |   |                 |
|    | ersonal | controlled      |               |   |                 |
|    | Co      | data) remaining |               |   |                 |
|    | mputers | on computer     |               |   |                 |
|    | (Man    | hard drives     |               |   |                 |
|    | agement | that are to be  |               |   |                 |
|    | Alert,  | transferred or  |               |   |                 |
|    | G-      | excessed. This  |               |   |                 |
|    | 99-003A | report is       |               |   |                 |
|    | --      | sensitive with  |               |   |                 |
|    | Sen     | limited         |               |   |                 |
|    | sitive) | distribution;   |               |   |                 |
|    |         | it is not       |               |   |                 |
|    |         | generally       |               |   |                 |
|    |         | available to    |               |   |                 |
|    |         | the public.     |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Ins     | This inspection | Three         |   |                 |
| ns | pection | determined that | re            |   |                 |
| pe | of      | more than 80    | commendations |   |                 |
| ct | Kennedy | percent of the  | were made to  |   |                 |
| io | Space   | personal        | management:   |   |                 |
| ns | Center  | computers in    | (1) alert     |   |                 |
|    | C       | the Kennedy     | installation  |   |                 |
|    | omputer | property        | officials to  |   |                 |
|    | Hard    | disposal        | the problems  |   |                 |
|    | Drives  | process had     | and risks     |   |                 |
|    | (G-     | recoverable     | associated    |   |                 |
|    | 99-003) | information on  | with the      |   |                 |
|    |         | their hard      | inadequate    |   |                 |
|    |         | drives. If      | removal of    |   |                 |
|    |         | released        | data and      |   |                 |
|    |         | outside the     | licensed      |   |                 |
|    |         | Agency, this    | software from |   |                 |
|    |         | information     | hard drive    |   |                 |
|    |         | could expose    | devices; (2)  |   |                 |
|    |         | NASA to Privacy | take          |   |                 |
|    |         | Act violations. | immediate     |   |                 |
|    |         | In addition, 76 | action to     |   |                 |
|    |         | percent of the  | wipe clean    |   |                 |
|    |         | drives tested   | computer hard |   |                 |
|    |         | were found to   | drives in the |   |                 |
|    |         | be loaded with  | property      |   |                 |
|    |         | licensed        | disposal or   |   |                 |
|    |         | software.       | excess        |   |                 |
|    |         | Management      | process; and  |   |                 |
|    |         | concurred with  | (3) determine |   |                 |
|    |         | all our report  | whether       |   |                 |
|    |         | recommendations | environmental |   |                 |
|    |         | and pledged     | and security  |   |                 |
|    |         | swift           | conditions of |   |                 |
|    |         | corrective      | the property  |   |                 |
|    |         | action. This    | disposal      |   |                 |
|    |         | report is       | warehouse are |   |                 |
|    |         | sensitive with  | adequate.     |   |                 |
|    |         | limited         | These         |   |                 |
|    |         | distribution;   | re            |   |                 |
|    |         | it is not       | commendations |   |                 |
|    |         | generally       | are           |   |                 |
|    |         | available to    | considered    |   |                 |
|    |         | the public. As  | resolved      |   |                 |
|    |         | a result of     | pending       |   |                 |
|    |         | this and other  | verification  |   |                 |
|    |         | similar         | of corrective |   |                 |
|    |         | activities, the | actions.      |   |                 |
|    |         | NASA OIG issued |               |   |                 |
|    |         | a brochure,     |               |   |                 |
|    |         | *Clearing       |               |   |                 |
|    |         | Information     |               |   |                 |
|    |         | From Your       |               |   |                 |
|    |         | Computer\'s     |               |   |                 |
|    |         | Hard Drive*, to |               |   |                 |
|    |         | heighten        |               |   |                 |
|    |         | awareness about |               |   |                 |
|    |         | this particular |               |   |                 |
|    |         | computer        |               |   |                 |
|    |         | security        |               |   |                 |
|    |         | vulnerability.  |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Dryden  | We highlighted  | \*            |   |                 |
| ns | Flight  | prudent steps   |               |   |                 |
| pe | R       | that Dryden     |               |   |                 |
| ct | esearch | took overcoming |               |   |                 |
| io | Center  | an unauthorized |               |   |                 |
| ns | Network | network         |               |   |                 |
|    | Intr    | intrusion. We   |               |   |                 |
|    | usion - | shared this     |               |   |                 |
|    | Lessons | report with     |               |   |                 |
|    | Learned | NASA computer   |               |   |                 |
|    |         | and security    |               |   |                 |
|    | (G-     | officials to    |               |   |                 |
|    | 99-002) | share lessons   |               |   |                 |
|    |         | learned from    |               |   |                 |
|    |         | the Dryden      |               |   |                 |
|    |         | experience.     |               |   |                 |
|    |         | This report is  |               |   |                 |
|    |         | sensitive with  |               |   |                 |
|    |         | limited         |               |   |                 |
|    |         | distribution;   |               |   |                 |
|    |         | it is not       |               |   |                 |
|    |         | generally       |               |   |                 |
|    |         | available to    |               |   |                 |
|    |         | the public.     |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+
| I  | Lewis   | NASA management | \*            |   |                 |
| ns | S       | concurred with  |               |   |                 |
| pe | ecurity | the             |               |   |                 |
| ct | Man     | recommendations |               |   |                 |
| io | agement | we made to      |               |   |                 |
| ns | Ins     | improve         |               |   |                 |
|    | pection | physical and    |               |   |                 |
|    | (G-     | information     |               |   |                 |
|    | 98-007) | security        |               |   |                 |
|    |         | weaknesses at   |               |   |                 |
|    |         | Lewis. This     |               |   |                 |
|    |         | report is       |               |   |                 |
|    |         | sensitive with  |               |   |                 |
|    |         | limited         |               |   |                 |
|    |         | distribution;   |               |   |                 |
|    |         | it is not       |               |   |                 |
|    |         | generally       |               |   |                 |
|    |         | available to    |               |   |                 |
|    |         | the public.     |               |   |                 |
+----+---------+-----------------+---------------+---+-----------------+

######### 

+------+-------------+-----------------------+---------------------+---+
| ###  |             |                       |                     |   |
| #### |             |                       |                     |   |
| # Ta |             |                       |                     |   |
| ble  |             |                       |                     |   |
| 4 -- |             |                       |                     |   |
|  Pro |             |                       |                     |   |
| cure |             |                       |                     |   |
| ment |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Property    | The OIG performed an  | We recommended that |   |
| dits | Adm         | audit to determine    | NASA resolve the    |   |
|      | inistration | whether NASA and its  | issues of oversight |   |
|      | Delegations | delegated agencies    | of                  |   |
|      | Should Be   | appropriately manage  | Government-ow       |   |
|      | Resolved    | Government property   | ned/contractor-held |   |
|      | (IG-00-054) | held by contractors.  | property by either  |   |
|      |             | We determined that    | delegating or       |   |
|      |             | NASA is not assured   | retaining the       |   |
|      |             | that over \$ 1.9      | property            |   |
|      |             | billion in            | administration      |   |
|      |             | contractor-held       | function. We also   |   |
|      |             | property is managed   | recommended that    |   |
|      |             | appropriately. NASA   | NASA strengthen its |   |
|      |             | can either delegate   | delegation controls |   |
|      |             | property oversight to | to ensure that      |   |
|      |             | Department of Defense | property            |   |
|      |             | agencies or it can    | administration      |   |
|      |             | retain the oversight  | functions are       |   |
|      |             | function. Property    | completed for       |   |
|      |             | administration        | future contracts    |   |
|      |             | delegations were not  | involving           |   |
|      |             | completed for the     | contractor-held     |   |
|      |             | property in question. | property.           |   |
|      |             | As a result, NASA is  | Management          |   |
|      |             | not assured that      | concurred with our  |   |
|      |             | Government property   | four                |   |
|      |             | held by contractors   | recommendations and |   |
|      |             | is appropriately      | their proposed      |   |
|      |             | managed.              | actions were        |   |
|      |             |                       | considered          |   |
|      |             |                       | responsive. The     |   |
|      |             |                       | property oversight  |   |
|      |             |                       | issues will remain  |   |
|      |             |                       | open pending formal |   |
|      |             |                       | delegation or       |   |
|      |             |                       | retention of the    |   |
|      |             |                       | property            |   |
|      |             |                       | administration      |   |
|      |             |                       | functions.          |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA's Use  | Overall, the NASA     | \*                  |   |
| dits | of SmartPay | SmartPay Purchase     |                     |   |
|      | Purchase    | Card program was      |                     |   |
|      | Cards       | effective. Management |                     |   |
|      | (IG-00-050) | had implemented       |                     |   |
|      |             | appropriate controls  |                     |   |
|      |             | over the majority     |                     |   |
|      |             | (more than 95         |                     |   |
|      |             | percent) of sampled   |                     |   |
|      |             | purchases, and the    |                     |   |
|      |             | purchases were        |                     |   |
|      |             | efficient and         |                     |   |
|      |             | cost-effective.       |                     |   |
|      |             | Center managers must  |                     |   |
|      |             | remain vigilant over  |                     |   |
|      |             | purchases, however,   |                     |   |
|      |             | because we found 8 of |                     |   |
|      |             | 234 sampled purchases |                     |   |
|      |             | were for personal     |                     |   |
|      |             | items that did not    |                     |   |
|      |             | meet the intent of    |                     |   |
|      |             | the FAR and other     |                     |   |
|      |             | Federal guidance.     |                     |   |
|      |             | With such purchases,  |                     |   |
|      |             | the proper use of     |                     |   |
|      |             | appropriated funds is |                     |   |
|      |             | not assured.          |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Health Care | NASA\'s process for   | \*                  |   |
| dits | Costs at    | controlling health    |                     |   |
|      | NASA        | care costs is through |                     |   |
|      | Contractors | reliance on           |                     |   |
|      | (IG-00-049) | contractor insurance/ |                     |   |
|      |             | pension reviews       |                     |   |
|      |             | (CIPR\'s) performed   |                     |   |
|      |             | by the DCMA with DCAA |                     |   |
|      |             | support. Our          |                     |   |
|      |             | evaluation of CIPR    |                     |   |
|      |             | reports for 6 of      |                     |   |
|      |             | NASA\'s top 20        |                     |   |
|      |             | contracts showed that |                     |   |
|      |             | 4 of the 6 reports    |                     |   |
|      |             | were incomplete and   |                     |   |
|      |             | that 3 of the 6       |                     |   |
|      |             | reports were          |                     |   |
|      |             | untimely. NASA        |                     |   |
|      |             | contracting officers  |                     |   |
|      |             | must increase their   |                     |   |
|      |             | oversight of the CIPR |                     |   |
|      |             | process to ensure     |                     |   |
|      |             | sufficient reviews of |                     |   |
|      |             | insurance and pension |                     |   |
|      |             | plans and costs,      |                     |   |
|      |             | including health care |                     |   |
|      |             | costs. The costs can  |                     |   |
|      |             | equal more than half  |                     |   |
|      |             | the direct labor      |                     |   |
|      |             | costs charged to      |                     |   |
|      |             | Government contracts. |                     |   |
|      |             | Improved oversight    |                     |   |
|      |             | should lead to more   |                     |   |
|      |             | current, accurate,    |                     |   |
|      |             | and complete CIPR\'s  |                     |   |
|      |             | and to negotiations   |                     |   |
|      |             | of fair and           |                     |   |
|      |             | reasonable contract   |                     |   |
|      |             | prices.               |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | The contract audit    | \*                  |   |
| dits | Settlement  | follow-up system at   |                     |   |
|      | of DCAA's   | Goddard did not       |                     |   |
|      | Incurred    | include complete      |                     |   |
|      | Cost Audits | records of action     |                     |   |
|      | at Goddard  | taken on findings and |                     |   |
|      | Space       | recommendations for   |                     |   |
|      | flight      | 14 of 16 sampled DCAA |                     |   |
|      | Center      | reports for which the |                     |   |
|      | (IG-00-046) | resolution and        |                     |   |
|      |             | disposition authority |                     |   |
|      |             | had been delegated to |                     |   |
|      |             | the Department of     |                     |   |
|      |             | Defense. In addition, |                     |   |
|      |             | Goddard did not meet  |                     |   |
|      |             | FAR guidelines on     |                     |   |
|      |             | closing out 10        |                     |   |
|      |             | physically completed  |                     |   |
|      |             | contracts. As a       |                     |   |
|      |             | result, Goddard       |                     |   |
|      |             | procurement personnel |                     |   |
|      |             | could not ensure that |                     |   |
|      |             | findings and          |                     |   |
|      |             | recommendations were  |                     |   |
|      |             | resolved in a timely  |                     |   |
|      |             | manner and that the   |                     |   |
|      |             | resolutions were in   |                     |   |
|      |             | NASA\'s best          |                     |   |
|      |             | interest. Also,       |                     |   |
|      |             | delays in contract    |                     |   |
|      |             | closeout could result |                     |   |
|      |             | in excess             |                     |   |
|      |             | unliquidated          |                     |   |
|      |             | obligations that      |                     |   |
|      |             | could be used for     |                     |   |
|      |             | other NASA programs.  |                     |   |
|      |             | Such delays could     |                     |   |
|      |             | also directly affect  |                     |   |
|      |             | the success of        |                     |   |
|      |             | Government            |                     |   |
|      |             | negotiations and      |                     |   |
|      |             | result in increased   |                     |   |
|      |             | workload for          |                     |   |
|      |             | contractors and       |                     |   |
|      |             | contracting officers. |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Cost        | NASA consolidated     | We recommended      |   |
| dits | Benefit     | most existing space   | that: NASA          |   |
|      | Analysis    | operations contracts  | establish           |   |
|      | and Award   | under one contract    | performance         |   |
|      | Fee         | valued at more than   | criteria for the    |   |
|      | Structure   | \$3.4 billion over    | lookback award fee  |   |
|      | I           | 10 years. Additional  | pool; after         |   |
|      | mprovements | services may be       | criteria are        |   |
|      | Needed on   | transitioned to the   | established and     |   |
|      | C           | contract through      | meaningful          |   |
|      | onsolidated | exercising one or     | evaluations can be  |   |
|      | Space       | more of the remaining | performed,          |   |
|      | Operations  | contract options. An  | reallocate \$14     |   |
|      | Contract    | audit disclosed that  | million of award    |   |
|      | (IG-00-043) | NASA did not perform  | fee that could be   |   |
|      |             | cost benefit-analyses | inappropriately     |   |
|      |             | prior to              | awarded; establish  |   |
|      |             | consolidations to     | lookback award fee  |   |
|      |             | ensure that the       | periods that do not |   |
|      |             | Consolidated Space    | exceed 12 months;   |   |
|      |             | Operations Contract   | and revise the CSOC |   |
|      |             | (CSOC) is the best    | Award Fee Plan to   |   |
|      |             | approach for          | increase emphasis   |   |
|      |             | fulfilling space      | on cost control     |   |
|      |             | operations            | that would ensure   |   |
|      |             | requirements and that | an additional \$1.6 |   |
|      |             | \$1.2 billion of      | million of fee      |   |
|      |             | savings would be      | would be placed on  |   |
|      |             | achieved. The audit   | cost control.       |   |
|      |             | also showed that      | Finally, we         |   |
|      |             | improvements are      | recommended that    |   |
|      |             | needed in the         | NASA require        |   |
|      |             | \"lookback\"          | progress report on  |   |
|      |             | provision of the CSOC | the architecture    |   |
|      |             | Award Fee Plan. In    | baseline.           |   |
|      |             | addition to 6-month   |                     |   |
|      |             | evaluations, the      | NASA concurred in   |   |
|      |             | award fee plan        | principle with our  |   |
|      |             | includes a lookback   | recommendations to  |   |
|      |             | provision to evaluate | perform a cost      |   |
|      |             | the contractor\'s     | benefit analysis    |   |
|      |             | performance on the    | prior to exercising |   |
|      |             | integrated operations | any contract        |   |
|      |             | architecture.         | options, and to     |   |
|      |             |                       | evaluate at least   |   |
|      |             |                       | annually whether    |   |
|      |             |                       | projected benefits  |   |
|      |             |                       | have been realized. |   |
|      |             |                       | NASA concurred and  |   |
|      |             |                       | initiated           |   |
|      |             |                       | corrective actions  |   |
|      |             |                       | to address progress |   |
|      |             |                       | reporting on the    |   |
|      |             |                       | architecture        |   |
|      |             |                       | baseline. NASA      |   |
|      |             |                       | nonconcurred on the |   |
|      |             |                       | four                |   |
|      |             |                       | recommendations to  |   |
|      |             |                       | improve the award   |   |
|      |             |                       | fee structure. We   |   |
|      |             |                       | reaffirmed our      |   |
|      |             |                       | position and        |   |
|      |             |                       | requested           |   |
|      |             |                       | additional comments |   |
|      |             |                       | in the final        |   |
|      |             |                       | report.             |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | The contract audit    | \*                  |   |
| dits | Contract    | follow-up system at   |                     |   |
|      | Audit       | Johnson did not       |                     |   |
|      | Follow-up   | include complete      |                     |   |
|      | System at   | records of actions    |                     |   |
|      | Johnson     | taken on findings and |                     |   |
|      | Space       | recommendations for   |                     |   |
|      | Center      | all 16 sampled DCAA   |                     |   |
|      | (IG-00-032) | audit reports for     |                     |   |
|      |             | which the resolution  |                     |   |
|      |             | and disposition       |                     |   |
|      |             | authority had been    |                     |   |
|      |             | delegated to the      |                     |   |
|      |             | Department of Defense |                     |   |
|      |             | (DoD). We separately  |                     |   |
|      |             | determined that the   |                     |   |
|      |             | DoD administrative    |                     |   |
|      |             | contracting officers  |                     |   |
|      |             | had resolved the      |                     |   |
|      |             | findings for 11 of    |                     |   |
|      |             | the 16 reports,       |                     |   |
|      |             | recovered \$1.1       |                     |   |
|      |             | million of questioned |                     |   |
|      |             | costs that were       |                     |   |
|      |             | allocated to NASA     |                     |   |
|      |             | contracts, and        |                     |   |
|      |             | negotiated indirect   |                     |   |
|      |             | rates that affected   |                     |   |
|      |             | the NASA contracts.   |                     |   |
|      |             | Further, when NASA    |                     |   |
|      |             | retained resolution   |                     |   |
|      |             | and disposition       |                     |   |
|      |             | authority for audit   |                     |   |
|      |             | findings, Johnson     |                     |   |
|      |             | contracting officers  |                     |   |
|      |             | did not track and     |                     |   |
|      |             | report four of five   |                     |   |
|      |             | reportable contract   |                     |   |
|      |             | audit reports that    |                     |   |
|      |             | identified questioned |                     |   |
|      |             | costs of \$2.4        |                     |   |
|      |             | million. As a result, |                     |   |
|      |             | the benefits of       |                     |   |
|      |             | contract audit        |                     |   |
|      |             | findings and          |                     |   |
|      |             | recommendations were  |                     |   |
|      |             | delayed and           |                     |   |
|      |             | potentially not       |                     |   |
|      |             | maximized.            |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Procurement | Prior to cessation of | \*                  |   |
| dits | Module      | activities associated |                     |   |
|      | Testing of  | with the Integrated   |                     |   |
|      | NASA's      | Financial Management  |                     |   |
|      | Integrated  | Program (IFMP), we    |                     |   |
|      | Financial   | audited procurement   |                     |   |
|      | Management  | module testing. The   |                     |   |
|      | Program     | test team developed   |                     |   |
|      | (IG-00-016) | adequate test scripts |                     |   |
|      |             | using transactions    |                     |   |
|      |             | with valid data,      |                     |   |
|      |             | however, did not      |                     |   |
|      |             | include adequate      |                     |   |
|      |             | testing of controls   |                     |   |
|      |             | over transactions     |                     |   |
|      |             | with erroneous data.  |                     |   |
|      |             | Without adequate      |                     |   |
|      |             | testing of controls   |                     |   |
|      |             | over processing of    |                     |   |
|      |             | erroneous data, NASA  |                     |   |
|      |             | has less assurance    |                     |   |
|      |             | that the procurement  |                     |   |
|      |             | module will           |                     |   |
|      |             | adequately identify,  |                     |   |
|      |             | reject, and report    |                     |   |
|      |             | erroneous data that   |                     |   |
|      |             | could corrupt the     |                     |   |
|      |             | database. We          |                     |   |
|      |             | recommended that      |                     |   |
|      |             | management ensure     |                     |   |
|      |             | internal control      |                     |   |
|      |             | testing includes      |                     |   |
|      |             | tests of erroneous    |                     |   |
|      |             | data. Management      |                     |   |
|      |             | concurred with the    |                     |   |
|      |             | recommendation and    |                     |   |
|      |             | took corrective       |                     |   |
|      |             | action.               |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | The contract audit    | We recommended that |   |
| dits | Contract    | follow-up system at   | NASA management     |   |
|      | Audit       | Marshall did not      | take actions to     |   |
|      | Follow-up   | include complete      | reemphasize Agency  |   |
|      | System at   | records of action     | and Federal         |   |
|      | Marshall    | taken on findings and | requirements to     |   |
|      | Space       | recommendations for   | ensure that NASA    |   |
|      | flight      | 16 of 19 sampled DCAA | procurement         |   |
|      | Center      | audit reports for     | officers maintain a |   |
|      | (IG-00-010) | which the resolution  | dialogue with DoD   |   |
|      |             | and disposition       | administrative      |   |
|      |             | authority had been    | contracting         |   |
|      |             | delegated to the      | officers who have   |   |
|      |             | Department of Defense | been delegated      |   |
|      |             | (DoD). As a result,   | activities on NASA  |   |
|      |             | Marshall could not    | contracts and       |   |
|      |             | ensure that audit     | resolve contract    |   |
|      |             | findings and          | audit report        |   |
|      |             | recommendations were  | recommendations     |   |
|      |             | resolved in a timely  | within 6 months of  |   |
|      |             | manner, the           | issuance of the     |   |
|      |             | resolutions equitably | report. Management  |   |
|      |             | protected NASA\'s     | concurred with the  |   |
|      |             | interests, and the    | recommendations and |   |
|      |             | funds related to      | is taking           |   |
|      |             | unresolved audit      | corrective action.  |   |
|      |             | findings could be     |                     |   |
|      |             | reallocated to        |                     |   |
|      |             | benefit other NASA    |                     |   |
|      |             | programs.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Electronic  | Some NASA             | We made two         |   |
| dits | Commerce    | installations are not | recommendations to  |   |
|      | NASA's      | using the most        | ensure that         |   |
|      | Acquisition | cost-efficient method | installations use   |   |
|      | of Office   | to acquire office     | the most            |   |
|      | Supplies    | supplies. Total NASA  | cost-efficient      |   |
|      | (IG-00-008) | expenditures for      | method to obtain    |   |
|      |             | office supplies       | office supplies.    |   |
|      |             | exceed \$17 million   | Management          |   |
|      |             | annually. While some  | concurred with the  |   |
|      |             | installations are     | recommendations and |   |
|      |             | using the General     | initiated steps to  |   |
|      |             | Services              | effect the          |   |
|      |             | Administration's      | corrective actions. |   |
|      |             | electronic commerce   |                     |   |
|      |             | application to obtain |                     |   |
|      |             | office supplies,      |                     |   |
|      |             | others have           |                     |   |
|      |             | negotiated their own  |                     |   |
|      |             | contracts with        |                     |   |
|      |             | vendors to obtain     |                     |   |
|      |             | those supplies. In    |                     |   |
|      |             | addition, several     |                     |   |
|      |             | installations are     |                     |   |
|      |             | using purchase cards  |                     |   |
|      |             | to acquire supplies.  |                     |   |
|      |             | Further, at least two |                     |   |
|      |             | installations have    |                     |   |
|      |             | been operating supply |                     |   |
|      |             | stores for the        |                     |   |
|      |             | convenience of their  |                     |   |
|      |             | employees. As a       |                     |   |
|      |             | result, installations |                     |   |
|      |             | are incurring         |                     |   |
|      |             | unnecessary costs for |                     |   |
|      |             | the acquisition of    |                     |   |
|      |             | office supplies and   |                     |   |
|      |             | for the               |                     |   |
|      |             | administration and    |                     |   |
|      |             | maintenance of        |                     |   |
|      |             | separate office       |                     |   |
|      |             | supply catalogs and   |                     |   |
|      |             | other support         |                     |   |
|      |             | services.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Raytheon    | Raytheon provides     | \*                  |   |
| dits | Subcontract | development,          |                     |   |
|      | Management  | maintenance,          |                     |   |
|      | (IG-00-002) | operations, and       |                     |   |
|      |             | sustaining            |                     |   |
|      |             | engineering for the   |                     |   |
|      |             | Space Station         |                     |   |
|      |             | Training Facilities   |                     |   |
|      |             | and the Part Task     |                     |   |
|      |             | Trainer under a cost  |                     |   |
|      |             | plus award fee        |                     |   |
|      |             | contract. The         |                     |   |
|      |             | contract requires     |                     |   |
|      |             | Raytheon to           |                     |   |
|      |             | subcontract on a      |                     |   |
|      |             | competitive basis to  |                     |   |
|      |             | the maximum practical |                     |   |
|      |             | extent. Because       |                     |   |
|      |             | Raytheon purchasing   |                     |   |
|      |             | policy did not        |                     |   |
|      |             | require its personnel |                     |   |
|      |             | to keep supporting    |                     |   |
|      |             | documentation to      |                     |   |
|      |             | justify               |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | procurements,         |                     |   |
|      |             | Raytheon officials    |                     |   |
|      |             | did not always        |                     |   |
|      |             | maintain adequate     |                     |   |
|      |             | documentation to      |                     |   |
|      |             | support               |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | awards. Additionally, |                     |   |
|      |             | Government oversight  |                     |   |
|      |             | reviews of the        |                     |   |
|      |             | contractor's          |                     |   |
|      |             | procurement system    |                     |   |
|      |             | did not include       |                     |   |
|      |             | examinations of       |                     |   |
|      |             | supporting            |                     |   |
|      |             | documentation for     |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | procurements;         |                     |   |
|      |             | therefore, NASA had   |                     |   |
|      |             | reduced assurance     |                     |   |
|      |             | that the contractor   |                     |   |
|      |             | maximized the         |                     |   |
|      |             | competition of its    |                     |   |
|      |             | subcontracts. We      |                     |   |
|      |             | recommended that NASA |                     |   |
|      |             | management direct     |                     |   |
|      |             | Raytheon to maintain  |                     |   |
|      |             | adequate              |                     |   |
|      |             | documentation to      |                     |   |
|      |             | support               |                     |   |
|      |             | justifications for    |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | procurements. We also |                     |   |
|      |             | recommended that      |                     |   |
|      |             | management ask the    |                     |   |
|      |             | NASA Contracting      |                     |   |
|      |             | Officer and the DCMA  |                     |   |
|      |             | to include reviews    |                     |   |
|      |             | for supporting        |                     |   |
|      |             | documentation in      |                     |   |
|      |             | their next purchasing |                     |   |
|      |             | system reviews.       |                     |   |
|      |             | Management concurred  |                     |   |
|      |             | with the              |                     |   |
|      |             | recommendations and   |                     |   |
|      |             | completed corrective  |                     |   |
|      |             | actions.              |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | Technical analysts    | \*                  |   |
| dits | Non         | did not always        |                     |   |
|      | competitive | adequately support    |                     |   |
|      | P           | their conclusions     |                     |   |
|      | rocurements | about price           |                     |   |
|      | (IG-99-056) | reasonableness of     |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | procurements and      |                     |   |
|      |             | contracting officers  |                     |   |
|      |             | (CO's) did not always |                     |   |
|      |             | support the           |                     |   |
|      |             | reasonableness of     |                     |   |
|      |             | prices paid for       |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | purchase orders. NASA |                     |   |
|      |             | agreed to have the    |                     |   |
|      |             | CO's (1) work closely |                     |   |
|      |             | with the technical    |                     |   |
|      |             | analysts to ensure    |                     |   |
|      |             | that the technical    |                     |   |
|      |             | analyses are          |                     |   |
|      |             | supportable and well  |                     |   |
|      |             | documented and (2)    |                     |   |
|      |             | provide refresher     |                     |   |
|      |             | training on the       |                     |   |
|      |             | required price        |                     |   |
|      |             | support for purchase  |                     |   |
|      |             | order awards.         |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Al          | Allied-Signal did not | \*                  |   |
| dits | lied-Signal | maintain supporting   |                     |   |
|      | Subcontract | documentation for     |                     |   |
|      | Management  | three out of the four |                     |   |
|      | (IG-99-042) | justifications for    |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | procurements that we  |                     |   |
|      |             | reviewed. As a        |                     |   |
|      |             | result, NASA has      |                     |   |
|      |             | reduced assurance     |                     |   |
|      |             | that the contractor   |                     |   |
|      |             | maximized the         |                     |   |
|      |             | competition of its    |                     |   |
|      |             | subcontracts. NASA    |                     |   |
|      |             | agreed to direct      |                     |   |
|      |             | Allied-Signal to      |                     |   |
|      |             | maintain improved     |                     |   |
|      |             | documentation of      |                     |   |
|      |             | justifications for    |                     |   |
|      |             | noncompetitive        |                     |   |
|      |             | procurements and to   |                     |   |
|      |             | request that the DCMC |                     |   |
|      |             | review supporting     |                     |   |
|      |             | documentation in its  |                     |   |
|      |             | next purchasing       |                     |   |
|      |             | system reviews.       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Contractor  | NASA's management of  | Management has      |   |
| dits | Leased      | facility leasing can  | requested that DCAA |   |
|      | Facilities  | be improved. A        | review specific     |   |
|      | at Marshall | significant number of | leases.             |   |
|      | Space       | contractor facilities |                     |   |
|      | Flight      | were not effectively  |                     |   |
|      | Center      | used, and some        |                     |   |
|      | (IG-99-053) | contractor leases     |                     |   |
|      | ^\*^        | were not correctly    |                     |   |
|      | Contract    | classified as capital |                     |   |
|      | or-Acquired | leases.               |                     |   |
|      | Facilities  |                       |                     |   |
|      | at Johnson  |                       |                     |   |
|      | Space       |                       |                     |   |
|      | Center      |                       |                     |   |
|      | (IG-99-008) |                       |                     |   |
|      | ^\*^        |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Commercial  | An audit showed that, | Management          |   |
| dits | Use of the  | contrary to the FAR,  | initially concurred |   |
|      | Santa       | Marshall authorized a | with the report\'s  |   |
|      | Susana      | contractor to use     | four                |   |
|      | Field       | NASA-owned production | recommendations.    |   |
|      | Laboratory  | property at the Santa | However, the        |   |
|      | (SSFL)      | Susana facility on a  | contractor          |   |
|      | (IG-98-038) | rent-free basis in    | continued to use    |   |
|      |             | support of a          | the NASA-owned      |   |
|      |             | commercial launch     | property rent-free  |   |
|      |             | vehicle effort. We    | and presented data  |   |
|      |             | recommended that      | to NASA, DCMA,      |   |
|      |             | Marshall charge rent  | DCAA, and the OIG   |   |
|      |             | to a contractor for   | in a July 2000      |   |
|      |             | both its past and     | presentation. The   |   |
|      |             | future commercial use | data supported      |   |
|      |             | of the NASA-owned     | their position that |   |
|      |             | production property   | the Government had  |   |
|      |             | at the Santa Susana   | received adequate   |   |
|      |             | facility. Marshall    | consideration to    |   |
|      |             | had authorized        | support rent-free   |   |
|      |             | rent-free usage based | use of the          |   |
|      |             | upon the Commercial   | NASA-owned          |   |
|      |             | Space Launch Act.     | facilities for the  |   |
|      |             |                       | contractor\'s       |   |
|      |             |                       | commercial          |   |
|      |             |                       | business. On        |   |
|      |             |                       | September 28, 2000, |   |
|      |             |                       | the NASA            |   |
|      |             |                       | contracting officer |   |
|      |             |                       | formally provided   |   |
|      |             |                       | the Agency's        |   |
|      |             |                       | request to close    |   |
|      |             |                       | the recommendation  |   |
|      |             |                       | based on the        |   |
|      |             |                       | contractor          |   |
|      |             |                       | response. We are    |   |
|      |             |                       | reviewing this      |   |
|      |             |                       | latest information, |   |
|      |             |                       | as well as NASA's   |   |
|      |             |                       | request, before     |   |
|      |             |                       | deciding how to     |   |
|      |             |                       | disposition this    |   |
|      |             |                       | matter.             |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | Four NASA Centers     | \*                  |   |
| dits | Gene        | reviewed had          |                     |   |
|      | ral-Purpose | excessive vehicles.   |                     |   |
|      | Vehicles    | Two Centers also      |                     |   |
|      | Acquisition | continued to purchase |                     |   |
|      | and Use     | vehicles, rather than |                     |   |
|      | (IG-98-035) | lease vehicles        |                     |   |
|      |             | through the General   |                     |   |
|      |             | Services              |                     |   |
|      |             | Administration (GSA). |                     |   |
|      |             | NASA completed action |                     |   |
|      |             | to eliminate          |                     |   |
|      |             | underutilized         |                     |   |
|      |             | vehicles and convert  |                     |   |
|      |             | to leasing when       |                     |   |
|      |             | beneficial to NASA.   |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Si          | NASA has not          | We recommended and  |   |
| dits | ngle-Source | adequately developed  | management          |   |
|      | Suppliers   | analyses of critical, | concurred that the  |   |
|      | for         | single-source         | (1) Shuttle Program |   |
|      | Critical    | suppliers of          | Manager revise      |   |
|      | Items       | industrial materials. | analyses and        |   |
|      | (IG-98-030) |                       | re­porting           |   |
|      |             |                       | requirements for    |   |
|      |             |                       | critical,           |   |
|      |             |                       | single-source       |   |
|      |             |                       | suppliers; (2)      |   |
|      |             |                       | Shuttle Program     |   |
|      |             |                       | Manager include the |   |
|      |             |                       | revised             |   |
|      |             |                       | requirements in     |   |
|      |             |                       | appropri­ate         |   |
|      |             |                       | contracts; and      |   |
|      |             |                       | (3) Headquar­ters    |   |
|      |             |                       | Chief Engineer      |   |
|      |             |                       | revise NPG 7120.5A  |   |
|      |             |                       | to include a        |   |
|      |             |                       | requirement for     |   |
|      |             |                       | performing rigorous |   |
|      |             |                       | analyses of and     |   |
|      |             |                       | reporting on all    |   |
|      |             |                       | critical            |   |
|      |             |                       | single-source       |   |
|      |             |                       | suppliers, making   |   |
|      |             |                       | no distinction      |   |
|      |             |                       | between logistics   |   |
|      |             |                       | and production      |   |
|      |             |                       | suppliers. This     |   |
|      |             |                       | last recommendation |   |
|      |             |                       | remains open        |   |
|      |             |                       | pending publication |   |
|      |             |                       | of the revised NPG, |   |
|      |             |                       | which is expected   |   |
|      |             |                       | by January 2001.    |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Costs Not   | Our audit of the      | We recommended that |   |
| dits | Recovered   | SPACEHAB contract     | management develop  |   |
|      | for         | found that because    | guidance for        |   |
|      | Commercial  | NASA has no clear     | cal­culating         |   |
|      | Payloads    | guidance on how to    | transportation fees |   |
|      | Flown on    | determine             | for non-NASA        |   |
|      | the         | consideration for     | payloads flown on   |   |
|      | SPACEHAB    | transportation costs  | the Shuttle's       |   |
|      | Module      | allocable for         | SPACEHAB module.    |   |
|      | (IG-98-028) | non-NASA shared       | Management          |   |
|      |             | payload capacity on   | concurred with the  |   |
|      |             | Shuttle missions, the | rec­ommendation. We  |   |
|      |             | Agency has no         | continue to monitor |   |
|      |             | assurance that        | management's        |   |
|      |             | sufficient            | activities toward   |   |
|      |             | consideration was     | final disposition   |   |
|      |             | received.             | of the              |   |
|      |             |                       | recommendation.     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Jet         | A series of reviews   | **\***              |   |
| dits | Propulsion  | found that NASA's     |                     |   |
|      | Laboratory  | federally-funded      |                     |   |
|      | Contract    | research and          |                     |   |
|      | Issues:     | development           |                     |   |
|      | NASA Costs  | contractor had        |                     |   |
|      | Paid to     | adequate documented   |                     |   |
|      | Rehired     | policies and          |                     |   |
|      | Former JPL  | procedures, but       |                     |   |
|      | Employees   | failed to follow      |                     |   |
|      | (IG-98-027) | them, resulting in    |                     |   |
|      | ^\*^        | increased costs to    |                     |   |
|      |             | NASA. Such incidences |                     |   |
|      |             | have occurred in      |                     |   |
|      |             | payments for travel,  |                     |   |
|      |             | early retirement,     |                     |   |
|      |             | billings, rehired     |                     |   |
|      |             | former employees, and |                     |   |
|      |             | employee charges for  |                     |   |
|      |             | materials purchased   |                     |   |
|      |             | for the Laboratory.   |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Risks       | A cost/benefit study  | \*                  |   |
| dits | Associated  | to support NASA's     |                     |   |
|      | with Ames   | acquisition of        |                     |   |
|      | Research    | housing units did not |                     |   |
|      | Center      | fully identify and    |                     |   |
|      | Acquisition | consider all costs    |                     |   |
|      | of Military | associated with the   |                     |   |
|      | Family      | housing. In addition, |                     |   |
|      | Housing     | all legal and         |                     |   |
|      | (IG-98-022) | environmental issues  |                     |   |
|      |             | had not been          |                     |   |
|      |             | resolved. NASA        |                     |   |
|      |             | completed actions to  |                     |   |
|      |             | address the above     |                     |   |
|      |             | issues and located a  |                     |   |
|      |             | Department of Defense |                     |   |
|      |             | military organization |                     |   |
|      |             | to retain             |                     |   |
|      |             | responsibility for    |                     |   |
|      |             | the housing.          |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA's      | NASA's credit card    | \*                  |   |
| dits | In          | program was generally |                     |   |
|      | ternational | effective; however,   |                     |   |
|      | Merchant    | improvements in       |                     |   |
|      | Purchase    | property              |                     |   |
|      | Card        | accountability, split |                     |   |
|      | Program     | purchases, cards used |                     |   |
|      | (IG-98-011) | by someone other than |                     |   |
|      |             | the cardholder, and   |                     |   |
|      |             | purchase and payment  |                     |   |
|      |             | controls were         |                     |   |
|      |             | necessary. Management |                     |   |
|      |             | took corrective       |                     |   |
|      |             | action.               |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Tracking    | NASA is understating  | \*                  |   |
| dits | and Data    | the TDRSS single      |                     |   |
|      | Relay       | access service        |                     |   |
|      | Satellite   | reimbursable rate for |                     |   |
|      | System      | services provided to  |                     |   |
|      | (TDRSS)     | other U.S. Government |                     |   |
|      | Single      | customers. NASA       |                     |   |
|      | Access      | reexamined both rates |                     |   |
|      | System      | and policies.         |                     |   |
|      | R           |                       |                     |   |
|      | eimbursable |                       |                     |   |
|      | Rate        |                       |                     |   |
|      |             |                       |                     |   |
|      | (IG-98-008) |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA Single | NASA needed address   | \*                  |   |
| dits | Process     | inconsistent Center   |                     |   |
|      | Initiative  | implementation,       |                     |   |
|      | Block       | minimal cost savings, |                     |   |
|      | Change      | and inadequate        |                     |   |
|      | Process     | resources for         |                     |   |
|      | Imp         | staffing and          |                     |   |
|      | lementation | implementing the      |                     |   |
|      | (           | initiative. NASA      |                     |   |
|      | P&A-98-002) | improved the benefits |                     |   |
|      |             | realized by the       |                     |   |
|      |             | single process        |                     |   |
|      |             | initiative.           |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Progress    | Conducted a review of | \*                  |   |
| pect | Payments    | procedures used to    |                     |   |
| ions | under       | authorize and         |                     |   |
|      | Fixed-Price | document progress     |                     |   |
|      | C           | payments under        |                     |   |
|      | onstruction | fixed-price           |                     |   |
|      | Contracts   | construction          |                     |   |
|      | (G-00-014)  | contracts. We found   |                     |   |
|      |             | that in some          |                     |   |
|      |             | instances Federal and |                     |   |
|      |             | NASA procurement      |                     |   |
|      |             | regulations were not  |                     |   |
|      |             | adhered to. The       |                     |   |
|      |             | Office of Procurement |                     |   |
|      |             | concurred with both   |                     |   |
|      |             | recommendations for   |                     |   |
|      |             | improvements.         |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Contractor  | Based on alleged      | \*                  |   |
| pect | Use of      | misuse of Government  |                     |   |
| ions | General     | vehicles at the       |                     |   |
|      | Services    | facility, we          |                     |   |
|      | Adm         | inspected the use of  |                     |   |
|      | inistration | GSA vehicles by       |                     |   |
|      | Vehicles at | contractors at the    |                     |   |
|      | the         | Goldstone Complex.    |                     |   |
|      | Goldstone   | NASA contractor       |                     |   |
|      | Deep Space  | employees used GSA    |                     |   |
|      | Com         | vehicles for          |                     |   |
|      | munications | work-to-home          |                     |   |
|      | Complex     | commuting purposes.   |                     |   |
|      |             | Such practice was     |                     |   |
|      | (G-98-013)  | contrary to NASA      |                     |   |
|      |             | policy and Federal    |                     |   |
|      |             | regulations, but in   |                     |   |
|      |             | accordance with       |                     |   |
|      |             | collective bargaining |                     |   |
|      |             | agreements. NASA      |                     |   |
|      |             | management concurred  |                     |   |
|      |             | with our two          |                     |   |
|      |             | recommendations to    |                     |   |
|      |             | discontinue current   |                     |   |
|      |             | practices until       |                     |   |
|      |             | contractors submitted |                     |   |
|      |             | appropriate           |                     |   |
|      |             | justifications to     |                     |   |
|      |             | obtain required       |                     |   |
|      |             | Administrator         |                     |   |
|      |             | authorizations and to |                     |   |
|      |             | review similar        |                     |   |
|      |             | practices of other    |                     |   |
|      |             | contractors to ensure |                     |   |
|      |             | the appropriate use   |                     |   |
|      |             | of GSA vehicles. A    |                     |   |
|      |             | follow-up review is   |                     |   |
|      |             | planned regarding     |                     |   |
|      |             | implementation of     |                     |   |
|      |             | planned corrective    |                     |   |
|      |             | actions.              |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Assessment  | The excess property   | \*                  |   |
| pect | of Property | outsourcing pilot     |                     |   |
| ions | Disposal    | program at Marshall   |                     |   |
|      | Outsourcing | did not comply with   |                     |   |
|      |             | Federal Property      |                     |   |
|      | (G-98-008)  | Management            |                     |   |
|      |             | Regulations. NASA     |                     |   |
|      |             | initiated actions to  |                     |   |
|      |             | improve the program.  |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Shuttle-Mir | The effectiveness of  | \*                  |   |
| pect | Rendezvous  | external task forces  |                     |   |
| ions | and Docking | related to the Mir    |                     |   |
|      | Missions    | and the ISS could be  |                     |   |
|      | and         | improved. We          |                     |   |
|      | In          | recommended           |                     |   |
|      | ternational | restructuring the     |                     |   |
|      | Station     | process used by the   |                     |   |
|      | Readiness   | task forces to obtain |                     |   |
|      | Task Forces | contract support.     |                     |   |
|      |             |                       |                     |   |
|      | (G-98-003)  |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+------+-------------+-----------------------+---------------------+---+
| #    |             |                       |                     |   |
| #### |             |                       |                     |   |
| ###  |             |                       |                     |   |
| Tabl |             |                       |                     |   |
| e 5  |             |                       |                     |   |
| -- F |             |                       |                     |   |
| isca |             |                       |                     |   |
| l Ma |             |                       |                     |   |
| nage |             |                       |                     |   |
| ment |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | I           | Financial management  | We recommended that |   |
| dits | nsufficient | officials at Langley  | criteria for        |   |
|      | Supporting  | and Marshall          | processing and      |   |
|      | Do          | processed             | documenting         |   |
|      | cumentation | deobligations in a    | deobligations be    |   |
|      | for         | timely manner;        | added to the        |   |
|      | De          | however, of the 60    | Financial           |   |
|      | obligations | statistically sampled | Management Manual   |   |
|      | (IG-00-061) | deobligations, 33 (55 | and Center          |   |
|      |             | percent) were not     | financial           |   |
|      |             | adequately documented | management          |   |
|      |             | to support the        | procedures. We also |   |
|      |             | transactions. We also | recommended that    |   |
|      |             | found that 8 (44      | the Centers review  |   |
|      |             | percent) of the 18    | the unsupported     |   |
|      |             | judgmentally selected | transactions        |   |
|      |             | deobligations         | identified in this  |   |
|      |             | reviewed were not     | report to ensure    |   |
|      |             | adequately documented | that they are valid |   |
|      |             | to support the        | and adequately      |   |
|      |             | transactions.         | documented.         |   |
|      |             | Financial management  | Management          |   |
|      |             | officials were not    | concurred with the  |   |
|      |             | adequately            | recommendations on  |   |
|      |             | documenting           | establishing        |   |
|      |             | transactions because  | criteria and their  |   |
|      |             | neither the NASA      | proposed actions    |   |
|      |             | Financial Management  | were considered     |   |
|      |             | Manual nor the        | responsive.         |   |
|      |             | Center-specific       |                     |   |
|      |             | financial procedures  |                     |   |
|      |             | provide adequate      |                     |   |
|      |             | guidance for          |                     |   |
|      |             | processing and        |                     |   |
|      |             | documenting           |                     |   |
|      |             | deobligations. As a   |                     |   |
|      |             | result, we could not  |                     |   |
|      |             | attest to the         |                     |   |
|      |             | validity of 17 (28    |                     |   |
|      |             | percent) of the 60    |                     |   |
|      |             | deobligations, valued |                     |   |
|      |             | at about \$3.4        |                     |   |
|      |             | million. In addition, |                     |   |
|      |             | we could not attest   |                     |   |
|      |             | to the validity of 2  |                     |   |
|      |             | (22 percent) of the 9 |                     |   |
|      |             | deobligations         |                     |   |
|      |             | judgmentally selected |                     |   |
|      |             | at Marshall and       |                     |   |
|      |             | valued at \$4         |                     |   |
|      |             | million.              |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Transfer of | In February 1997, the | We recommended that |   |
| dits | External    | Center Directors of   | management: (1)     |   |
|      | Tank        | Kennedy and Stennis   | reimburse the       |   |
|      | Display to  | Space Center          | Stennis Exchange    |   |
|      | Kennedy     | (Stennis) entered     | from appropriated   |   |
|      | Space       | into a bilateral      | funds, an amount    |   |
|      | Center      | agreement whereby     | equal to all        |   |
|      | Visitor     | Stennis agreed to     | nonappropriated     |   |
|      | Complex     | transfer a full-scale | funds obligated by  |   |
|      | (IG-00-044) | replica Space Shuttle | the Stennis         |   |
|      |             | external tank mock-up | Exchange that were  |   |
|      |             | display from the      | used to augment     |   |
|      |             | Stennis Visitor       | NASA\'s             |   |
|      |             | Center to the Kennedy | appropriation; (2)  |   |
|      |             | Visitor Complex for   | refund the          |   |
|      |             | use as a major        | \$500,000 payment   |   |
|      |             | exhibit. In return    | received for the    |   |
|      |             | for the external      | external tank       |   |
|      |             | tank, Kennedy         | transfer and the    |   |
|      |             | directed its Visitor  | accumulated         |   |
|      |             | Complex               | interest to         |   |
|      |             | Concessionaire,       | Delaware North; and |   |
|      |             | Delaware North Parks  | (3) direct Delaware |   |
|      |             | Services of           | North to redeposit  |   |
|      |             | Spaceport, Inc.       | the \$500,000 and   |   |
|      |             | (Delaware North), to  | the accumulated     |   |
|      |             | pay \$500,000 in      | interest received   |   |
|      |             | nonappropriated funds | from the Stennis    |   |
|      |             | to the Stennis        | Exchange.           |   |
|      |             | Exchange. An OIG      | Management          |   |
|      |             | audit of the          | nonconcurred with   |   |
|      |             | transaction found     | the report's        |   |
|      |             | that senior           | findings,           |   |
|      |             | management officials  | conclusions, and    |   |
|      |             | at Kennedy and        | recommendations.    |   |
|      |             | Stennis did not       | Management stated   |   |
|      |             | follow established    | that the OIG used a |   |
|      |             | policies for          | narrow              |   |
|      |             | transferring property | interpretation of   |   |
|      |             | between NASA Centers  | the broad authority |   |
|      |             | without reimbursement | given to the Agency |   |
|      |             | of property cost.     | in the Space Act    |   |
|      |             | Consequently,         | and disputes the    |   |
|      |             | Delaware North made   | underlying premise  |   |
|      |             | an unauthorized       | of the report.      |   |
|      |             | payment of \$500,000  | Management stated   |   |
|      |             | in nonappropriated    | that the transfer   |   |
|      |             | funds to the Stennis  | of the external     |   |
|      |             | Exchange. The Stennis | tank to Kennedy and |   |
|      |             | Public Affairs Office | the payment of      |   |
|      |             | used the \$500,000 to | nonappropriated     |   |
|      |             | fund a construction   | funds to the        |   |
|      |             | project and           | Stennis Exchange    |   |
|      |             | additional public     | were two separate   |   |
|      |             | exhibits at the       | transactions. We do |   |
|      |             | Stennis Visitor       | not agree with      |   |
|      |             | Center, which         | management\'s       |   |
|      |             | resulted in an        | position and        |   |
|      |             | unauthorized          | believe it is based |   |
|      |             | augmentation of       | on an overly broad  |   |
|      |             | NASA\'s               | and liberal         |   |
|      |             | appropriation.        | interpretation of   |   |
|      |             |                       | not only the Space  |   |
|      |             |                       | Act, but also of    |   |
|      |             |                       | Kennedy\'s          |   |
|      |             |                       | concession          |   |
|      |             |                       | agreement with      |   |
|      |             |                       | Delaware North. The |   |
|      |             |                       | documentation       |   |
|      |             |                       | supporting this     |   |
|      |             |                       | transaction clearly |   |
|      |             |                       | shows that the      |   |
|      |             |                       | payment of          |   |
|      |             |                       | \$500,000 to the    |   |
|      |             |                       | Stennis Exchange    |   |
|      |             |                       | was dependent on    |   |
|      |             |                       | delivery of the     |   |
|      |             |                       | external tank to    |   |
|      |             |                       | Kennedy and was, in |   |
|      |             |                       | substance, a single |   |
|      |             |                       | transaction rather  |   |
|      |             |                       | than two separate   |   |
|      |             |                       | and unrelated       |   |
|      |             |                       | events. We          |   |
|      |             |                       | reaffirmed our      |   |
|      |             |                       | position with       |   |
|      |             |                       | respect to both the |   |
|      |             |                       | findings and        |   |
|      |             |                       | recommendations in  |   |
|      |             |                       | the final report    |   |
|      |             |                       | and requested       |   |
|      |             |                       | management to       |   |
|      |             |                       | reconsider its      |   |
|      |             |                       | position and        |   |
|      |             |                       | provide additional  |   |
|      |             |                       | comments.           |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Quality     | The Stennis Exchange  | We recommended that |   |
| dits | Control     | inadequately managed  | the Exchange (1)    |   |
|      | Review of   | Exchange financial    | require that annual |   |
|      | the H.      | reporting activities. | audits be performed |   |
|      | Larry       | Specifically, the     | in accordance with  |   |
|      | Jordan      | Stennis Exchange (1)  | government auditing |   |
|      | Review of   | retained an           | standards by the    |   |
|      | Stennis     | accountant to conduct | established due     |   |
|      | Space       | a review, rather than | date and that the   |   |
|      | Center      | an audit as required  | engagement for the  |   |
|      | Exchange    | by NASA policy, and   | audit be            |   |
|      | Financial   | did not specify that  | competitively       |   |
|      | Statements  | professional          | awarded to          |   |
|      | for Fiscal  | standards be          | Certified Public    |   |
|      | Year Ended  | followed; (2)         | Accountants         |   |
|      | September   | submitted the         | licensed to         |   |
|      | 30, 1998    | required statements   | practice in the     |   |
|      | (IG-00-023) | and auditor reports   | State of            |   |
|      |             | late; (3) did not     | Mississippi; (2)    |   |
|      |             | provide adequate      | follow established  |   |
|      |             | financial statement   | accounting          |   |
|      |             | disclosures; (4) has  | principles in       |   |
|      |             | not established a     | providing adequate  |   |
|      |             | constitution or       | disclosures in the  |   |
|      |             | bylaws in accordance  | notes accompanying  |   |
|      |             | with NASA policy.     | the financial       |   |
|      |             |                       | statements; and (3) |   |
|      |             |                       | establish a         |   |
|      |             |                       | constitution and    |   |
|      |             |                       | bylaws at the       |   |
|      |             |                       | Exchange.           |   |
|      |             |                       | Management          |   |
|      |             |                       | nonconcurred with   |   |
|      |             |                       | recommendations 1   |   |
|      |             |                       | and 3. We requested |   |
|      |             |                       | that management     |   |
|      |             |                       | reconsider its      |   |
|      |             |                       | position.           |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Quality     | To fulfill our        | \*                  |   |
| dits | Control     | oversight             |                     |   |
|      | Review of   | responsibilities, the |                     |   |
|      | Arthur      | OIG performed a       |                     |   |
|      | Andersen    | quality control       |                     |   |
|      | LLP Audit   | review of Arthur      |                     |   |
|      | of NASA     | Andersen's audit,     |                     |   |
|      | Financial   | including the audit   |                     |   |
|      | Statements  | reports and related   |                     |   |
|      | for Fiscal  | working papers, to    |                     |   |
|      | Year Ended  | determine whether the |                     |   |
|      | September   | audit was performed   |                     |   |
|      | 30, 1999    | in accordance with    |                     |   |
|      | (IG-00-022) | applicable standards  |                     |   |
|      |             | and requirements. The |                     |   |
|      |             | review showed that    |                     |   |
|      |             | Arthur Andersen       |                     |   |
|      |             | conducted the audit   |                     |   |
|      |             | in accordance with    |                     |   |
|      |             | government auditing   |                     |   |
|      |             | standards and         |                     |   |
|      |             | provisions of OMB     |                     |   |
|      |             | Bulletin 98-08.       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Johnson     | The Johnson Exchange  | \*                  |   |
| dits | Space       | used \$5,800 in       |                     |   |
|      | Center      | appropriated funds to |                     |   |
|      | Exchange    | pay for the fee of    |                     |   |
|      | Use of      | the financial         |                     |   |
|      | A           | statement audit of    |                     |   |
|      | ppropriated | the Johnson Exchange. |                     |   |
|      | funds for   | In response to our    |                     |   |
|      | Exchange    | audit, NASA           |                     |   |
|      | Activities  | management agreed to  |                     |   |
|      | (IG-00-019) | clarify Agency policy |                     |   |
|      |             | on the use of         |                     |   |
|      |             | appropriated funds to |                     |   |
|      |             | pay for exchange      |                     |   |
|      |             | audits.               |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Matching    | NASA financial        | We recommended that |   |
| dits | Di          | management personnel  | procurement offices |   |
|      | sbursements | did not properly      | provide payment     |   |
|      | to          | match disbursements   | instruction to NASA |   |
|      | Obligations | to obligations.       | financial           |   |
|      | (IG-99-059) | Therefore, authorized | management          |   |
|      |             | funds may not have    | activities so that  |   |
|      |             | been used for their   | disbursement can be |   |
|      |             | authorized purpose.   | properly matched to |   |
|      |             |                       | obligations.        |   |
|      |             |                       | Management has      |   |
|      |             |                       | agreed to revise    |   |
|      |             |                       | its financial       |   |
|      |             |                       | instructions to     |   |
|      |             |                       | address the         |   |
|      |             |                       | recommendation. The |   |
|      |             |                       | recommendation      |   |
|      |             |                       | remains open until  |   |
|      |             |                       | the financial       |   |
|      |             |                       | instructions are    |   |
|      |             |                       | finalized.          |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | A-76 Study  | An audit of an OMB    | \*                  |   |
| dits | of NASA-3   | Circular No. A-76     |                     |   |
|      | Aircraft    | study conducted at    |                     |   |
|      | (IG-99-057) | Marshall of NASA-3, a |                     |   |
|      |             | mission management    |                     |   |
|      |             | aircraft used by      |                     |   |
|      |             | Marshall, found that  |                     |   |
|      |             | NASA\'s use of the    |                     |   |
|      |             | aircraft to transport |                     |   |
|      |             | personnel and         |                     |   |
|      |             | equipment did not     |                     |   |
|      |             | qualify as one of the |                     |   |
|      |             | purposes for which    |                     |   |
|      |             | Federal policies      |                     |   |
|      |             | authorize agencies to |                     |   |
|      |             | own or lease          |                     |   |
|      |             | aircraft. We          |                     |   |
|      |             | estimated that the    |                     |   |
|      |             | costs for using       |                     |   |
|      |             | commercial airlines   |                     |   |
|      |             | is \$2.9 million less |                     |   |
|      |             | than the costs for    |                     |   |
|      |             | operating NASA-3 over |                     |   |
|      |             | the 5-year period     |                     |   |
|      |             | covered by the A-76   |                     |   |
|      |             | study. We also found  |                     |   |
|      |             | that NASA was         |                     |   |
|      |             | evaluating a plan to  |                     |   |
|      |             | replace three mission |                     |   |
|      |             | management aircraft,  |                     |   |
|      |             | including NASA-3, and |                     |   |
|      |             | to upgrade a fourth   |                     |   |
|      |             | aircraft. Management  |                     |   |
|      |             | had not yet performed |                     |   |
|      |             | an A-76 study         |                     |   |
|      |             | supporting the        |                     |   |
|      |             | proposed aircraft     |                     |   |
|      |             | purchase and upgrade, |                     |   |
|      |             | which would cost      |                     |   |
|      |             | \$43.9 million. We    |                     |   |
|      |             | recommended that      |                     |   |
|      |             | management dispose of |                     |   |
|      |             | NASA-3 and use        |                     |   |
|      |             | commercial airlines   |                     |   |
|      |             | to satisfy            |                     |   |
|      |             | Marshall\'s           |                     |   |
|      |             | transportation        |                     |   |
|      |             | requirements, revise  |                     |   |
|      |             | Agency policy to      |                     |   |
|      |             | conform with OMB      |                     |   |
|      |             | requirements,         |                     |   |
|      |             | evaluate commercial   |                     |   |
|      |             | airlines and other    |                     |   |
|      |             | aviation services     |                     |   |
|      |             | when conducting A-76  |                     |   |
|      |             | studies for aircraft, |                     |   |
|      |             | and terminate plans   |                     |   |
|      |             | to replace the        |                     |   |
|      |             | existing mission      |                     |   |
|      |             | management aircraft.  |                     |   |
|      |             | Management either     |                     |   |
|      |             | nonconcurred or       |                     |   |
|      |             | proposed              |                     |   |
|      |             | nonresponsive actions |                     |   |
|      |             | to the report\'s five |                     |   |
|      |             | recommendations. The  |                     |   |
|      |             | Audit Followup        |                     |   |
|      |             | Official issued a     |                     |   |
|      |             | management decision   |                     |   |
|      |             | that nonconcurred     |                     |   |
|      |             | with the OIG's        |                     |   |
|      |             | position.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Imp         | The IFMP contractor   | We recommended the  |   |
| dits | lementation | did not fulfill its   | Agency take steps   |   |
|      | of NASA's   | agreement to deliver  | to protect its      |   |
|      | Integrated  | a fully integrated    | interests and       |   |
|      | Financial   | management system by  | receive adequate    |   |
|      | Management  | July 1, 1999. This    | consideration due   |   |
|      | Project     | delay will cause NASA | to the contractor's |   |
|      | (IFMP)      | to (1) be less than   | nonperformance, and |   |
|      | (IG-99-026) | fully compliant with  | that NASA test the  |   |
|      |             | Federal laws and      | final software to   |   |
|      |             | Agency requirements   | ensure it meets all |   |
|      |             | and (2) incur         | Federal             |   |
|      |             | additional contract   | requirements.       |   |
|      |             | costs and maintenance | Management          |   |
|      |             | costs for legacy      | concurred and has   |   |
|      |             | systems that would    | initiated           |   |
|      |             | otherwise be avoided  | corrective actions. |   |
|      |             | through IFMP          | We closed two of    |   |
|      |             | implementation.       | our three           |   |
|      |             |                       | recommendations. We |   |
|      |             |                       | will continue to    |   |
|      |             |                       | monitor NASA's      |   |
|      |             |                       | negotiations with   |   |
|      |             |                       | the contractor.     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Audit of    | NASA is               | We recommended that |   |
| dits | NASA's      | satisfactorily        | NASA (1) develop a  |   |
|      | Full-Cost   | progressing in its    | methodology for     |   |
|      | Initiative  | efforts to implement  | distributing the    |   |
|      | Imp         | full-cost accounting  | costs of the Space  |   |
|      | lementation | using alternative     | Shuttle program, as |   |
|      | (IG-99-024) | methods and to        | well as other       |   |
|      |             | integrate full-cost   | service-oriented    |   |
|      |             | concepts into the     | programs, to        |   |
|      |             | Agency's new          | programs that       |   |
|      |             | financial management  | benefit from the    |   |
|      |             | system still being    | services and (2)    |   |
|      |             | developed. However,   | consistently use    |   |
|      |             | NASA is not planning  | the methodology     |   |
|      |             | to distribute the     | developed.          |   |
|      |             | costs of the Space    | Management did not  |   |
|      |             | Shuttle Program to    | concur with our     |   |
|      |             | other NASA programs   | recommended         |   |
|      |             | that benefit from     | actions. In         |   |
|      |             | Shuttle services. As  | September 1999,     |   |
|      |             | a result, the         | NASA's Chief        |   |
|      |             | financial statement   | Financial Officer   |   |
|      |             | presentations for     | initiated an        |   |
|      |             | NASA programs that    | interim approach to |   |
|      |             | use Shuttle services  | implementation of   |   |
|      |             | will not fairly       | full-cost           |   |
|      |             | present the full      | management,         |   |
|      |             | costs of these other  | budgeting, and      |   |
|      |             | programs.             | accounting          |   |
|      |             |                       | throughout the      |   |
|      |             |                       | Agency. We are      |   |
|      |             |                       | continuing to       |   |
|      |             |                       | analyze the interim |   |
|      |             |                       | approach and        |   |
|      |             |                       | strategy being      |   |
|      |             |                       | pursued by          |   |
|      |             |                       | management and will |   |
|      |             |                       | determine whether   |   |
|      |             |                       | this issue needs to |   |
|      |             |                       | be forwarded to the |   |
|      |             |                       | NASA Administrator  |   |
|      |             |                       | for a final Agency  |   |
|      |             |                       | determination.      |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Obligations | To comply with        | \*                  |   |
| dits | and         | statutory             |                     |   |
|      | Adjustments | requirements, NASA is |                     |   |
|      | --          | required to establish |                     |   |
|      | Recording   | procedures to         |                     |   |
|      | Obligations | promptly record and   |                     |   |
|      | and         | adjust all incurred   |                     |   |
|      | Adjustments | obligations. In       |                     |   |
|      | (IG-99-021) | addition to the legal |                     |   |
|      |             | requirements,         |                     |   |
|      |             | managers rely on      |                     |   |
|      |             | recorded obligation   |                     |   |
|      |             | information for       |                     |   |
|      |             | decisionmaking. At    |                     |   |
|      |             | four Centers we       |                     |   |
|      |             | reviewed, an          |                     |   |
|      |             | estimated 17 percent  |                     |   |
|      |             | of obligations was    |                     |   |
|      |             | not recorded against  |                     |   |
|      |             | applicable allotments |                     |   |
|      |             | within 15 working     |                     |   |
|      |             | days. Also, the       |                     |   |
|      |             | Centers did not make  |                     |   |
|      |             | necessary adjustments |                     |   |
|      |             | to obligations in a   |                     |   |
|      |             | timely manner. NASA   |                     |   |
|      |             | managers concurred    |                     |   |
|      |             | with our findings and |                     |   |
|      |             | implemented           |                     |   |
|      |             | corrective actions.   |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | X-33        | NASA established an   | Management agreed   |   |
| dits | Funding     | arrangement with      | to study the        |   |
|      | Issues      | Lockheed-Martin       | appropriateness of  |   |
|      |             | within the X-33       | existing funding    |   |
|      | (IG-99-001) | cooperative agreement | and payment         |   |
|      |             | to delay billing for  | practices and to    |   |
|      |             | completed and         | take corrective     |   |
|      |             | Government-accepted   | actions deemed      |   |
|      |             | milestones until the  | appropriate.        |   |
|      |             | following fiscal      | However,            |   |
|      |             | year. As a result of  | management's        |   |
|      |             | this practice, NASA   | analysis did not    |   |
|      |             | had unrecorded        | indicate what       |   |
|      |             | yearend obligations,  | further actions     |   |
|      |             | costs, and            | would be taken. We  |   |
|      |             | liabilities totaling  | are working with    |   |
|      |             | \$22 million in       | management to       |   |
|      |             | FY 1996 and \$34      | resolve the issues. |   |
|      |             | million in FY 1997.   |                     |   |
|      |             | This resulted in      |                     |   |
|      |             | Agency reports and    |                     |   |
|      |             | the financial         |                     |   |
|      |             | statements not being  |                     |   |
|      |             | accurate. According   |                     |   |
|      |             | to management's       |                     |   |
|      |             | analysis, funding     |                     |   |
|      |             | practices might have  |                     |   |
|      |             | violated the bona     |                     |   |
|      |             | fide needs rule (31   |                     |   |
|      |             | U.S.C. 1502(a)) but   |                     |   |
|      |             | not the               |                     |   |
|      |             | Anti-deficiency Act   |                     |   |
|      |             | (31 U.S.C. 1341(a)).  |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA's IFMP | NASA concurred with   | \*                  |   |
| dits | Time and    | our recommendation to |                     |   |
|      | Atten       | develop a policy and  |                     |   |
|      | dance/Labor | assess the risks      |                     |   |
|      | D           | associated with the   |                     |   |
|      | istribution | planned deployment of |                     |   |
|      | Module      | the Integrated        |                     |   |
|      |             | Financial Management  |                     |   |
|      | (IG-98-004) | Project Time and      |                     |   |
|      |             | Attendance module     |                     |   |
|      |             | through the World     |                     |   |
|      |             | Wide Web. NASA        |                     |   |
|      |             | developed necessary   |                     |   |
|      |             | management controls   |                     |   |
|      |             | for several high-risk |                     |   |
|      |             | areas that we         |                     |   |
|      |             | identified in the     |                     |   |
|      |             | planned module        |                     |   |
|      |             | (modifying and        |                     |   |
|      |             | certifying data,      |                     |   |
|      |             | prior period          |                     |   |
|      |             | adjustments, and      |                     |   |
|      |             | access to personnel   |                     |   |
|      |             | and payroll data).    |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Interg      | We reviewed the       | We recommended      |   |
| pect | overnmental | Intergovernmental     | that: (1) NASA seek |   |
| ions | Personnel   | Personnel Act (IPA)   | legislative         |   |
|      | Act         | Mobility Program as   | authority to apply  |   |
|      | Assignments | it relates to         | the same financial  |   |
|      | to NASA     | assignments to NASA.  | disclosure          |   |
|      |             | We found that while   | requirements and    |   |
|      | (G-99-018)  | many individuals      | related sanctions   |   |
|      |             | assigned to NASA      | to persons          |   |
|      |             | under this program    | temporarily         |   |
|      |             | hold key              | employed under the  |   |
|      |             | decision-making       | IPA as apply to     |   |
|      |             | positions, they are   | permanent Agency    |   |
|      |             | not required to file  | employees in        |   |
|      |             | financial disclosure  | equivalent          |   |
|      |             | reports by law or     | positions; and (2)  |   |
|      |             | Agency practices.     | NASA, until such    |   |
|      |             | Also, neither are     | authorization is    |   |
|      |             | they required to      | approved, require   |   |
|      |             | attend ethics         | individuals         |   |
|      |             | briefings nor to      | detailed to NASA as |   |
|      |             | discuss their         | IPAs to discuss     |   |
|      |             | financial issues and  | financial interests |   |
|      |             | outside activities    | and outside         |   |
|      |             | with an Agency Ethics | activities with     |   |
|      |             | Counselor.            | their Ethics        |   |
|      |             |                       | Counselor on an     |   |
|      |             |                       | annual basis.       |   |
|      |             |                       | Management          |   |
|      |             |                       | partially concurred |   |
|      |             |                       | with the first      |   |
|      |             |                       | recommendation and  |   |
|      |             |                       | did not concur with |   |
|      |             |                       | the second          |   |
|      |             |                       | recommendation.     |   |
|      |             |                       | However, the NASA   |   |
|      |             |                       | Administrator       |   |
|      |             |                       | recently directed   |   |
|      |             |                       | that certain        |   |
|      |             |                       | counseling and      |   |
|      |             |                       | disclosure          |   |
|      |             |                       | practices be        |   |
|      |             |                       | mandated for IPA    |   |
|      |             |                       | detailees.          |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+------+-------------+-----------------------+---------------------+---+
| ##   |             |                       |                     |   |
| #### |             |                       |                     |   |
| ## T |             |                       |                     |   |
| able |             |                       |                     |   |
|  6 - |             |                       |                     |   |
| - Pr |             |                       |                     |   |
| ogra |             |                       |                     |   |
| m an |             |                       |                     |   |
| d Pr |             |                       |                     |   |
| ojec |             |                       |                     |   |
| t Ma |             |                       |                     |   |
| nage |             |                       |                     |   |
| ment |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Status of   | In 1996, when the     | We recommended that |   |
| dits | NASA's      | Systems and Cost      | NASA: (1) provide   |   |
|      | Independent | Analysis Division was | direct reporting of |   |
|      | Cost        | moved to Langley, the | independent cost    |   |
|      | Estimating  | cost estimators       | estimating to the   |   |
|      | Capability  | remained at           | approving official, |   |
|      | (IG-00-045) | Headquarters.         | (2) establish an    |   |
|      |             | Eventually, as the    | independent funding |   |
|      |             | cost estimator        | and reporting       |   |
|      |             | positions at          | structure for the   |   |
|      |             | Headquarters were     | independent cost    |   |
|      |             | vacated, NASA lost    | estimate function,  |   |
|      |             | its capability to     | (3) revise NPG      |   |
|      |             | develop independent   | 7120.5A to require  |   |
|      |             | cost estimates. NASA  | an independent cost |   |
|      |             | recently took steps   | estimate for each   |   |
|      |             | to reestablish its    | major review,       |   |
|      |             | independent cost      | (4) identify a      |   |
|      |             | estimating capability | specific job series |   |
|      |             | by adding eight cost  | for cost            |   |
|      |             | estimators to the     | e                   |   |
|      |             | Independent Program   | stimators/analysts, |   |
|      |             | Assessment Office     | and (5) develop     |   |
|      |             | (IPAO) at Langley and | career development  |   |
|      |             | establishing a        | plans for the       |   |
|      |             | Systems Management    | profession.         |   |
|      |             | Office (SMO) with     |                     |   |
|      |             | independent cost      | NASA concurred with |   |
|      |             | estimating capability | our recommendation  |   |
|      |             | at each Center. A     | to require          |   |
|      |             | review disclosed that | independent cost    |   |
|      |             | the planned           | estimates for all   |   |
|      |             | organizational        | major reviews and   |   |
|      |             | structures for the    | to develop core     |   |
|      |             | independent cost      | training            |   |
|      |             | estimating function   | requirements for    |   |
|      |             | in the IPAO at        | cost estimators.    |   |
|      |             | Langley and the SMO   | NASA nonconcurred   |   |
|      |             | at each Center may    | or partially        |   |
|      |             | not provide for       | nonconcurred with   |   |
|      |             | independent reporting | our recommendations |   |
|      |             | of findings directly  | to provide for      |   |
|      |             | to the approving      | direct reporting of |   |
|      |             | official unless the   | independent cost    |   |
|      |             | report is             | estimates to the    |   |
|      |             | specifically          | approving official  |   |
|      |             | requested by the      | and to establish an |   |
|      |             | approving official.   | independent funding |   |
|      |             | Also, the IPAO and    | source for all      |   |
|      |             | SMO\'s are funded     | independent cost    |   |
|      |             | through the           | estimating          |   |
|      |             | Centers---a process   | activities.         |   |
|      |             | that may hinder the   | Although the IPAO   |   |
|      |             | offices\'             | is funded as a      |   |
|      |             | independence.         | Headquarters        |   |
|      |             | Consequently, the     | function through    |   |
|      |             | Agency has no         | the Center by the   |   |
|      |             | assurance that the    | Office of the Chief |   |
|      |             | opinions,             | Engineer (Code AE), |   |
|      |             | conclusions, and      | and funds are       |   |
|      |             | recommendations made  | earmarked for the   |   |
|      |             | to the Administrator  | IPAO, Code AE has   |   |
|      |             | on acquisitions for   | no way to determine |   |
|      |             | Agency programs and   | how the funds are   |   |
|      |             | projects are          | distributed. The    |   |
|      |             | independent in fact   | Center is           |   |
|      |             | and appearance. The   | accountable to Code |   |
|      |             | review also showed    | AE only at the end  |   |
|      |             | that NASA had not     | of the year and may |   |
|      |             | identified the cost   | move funds among    |   |
|      |             | estimating and cost   | programs. Centers   |   |
|      |             | analysis function as  | are only required   |   |
|      |             | a discipline with a   | to notify           |   |
|      |             | specific job series,  | Headquarters when   |   |
|      |             | had not established   | more than 10        |   |
|      |             | career development    | percent of the      |   |
|      |             | plans for its cost    | funds are moved     |   |
|      |             | estimators, and did   | among programs.     |   |
|      |             | not have a            | Management also     |   |
|      |             | requirement to        | nonconcurred with   |   |
|      |             | develop independent   | our recommendation  |   |
|      |             | cost estimates for    | to identify a       |   |
|      |             | all major reviews.    | specific job series |   |
|      |             |                       | for cost estimators |   |
|      |             |                       | and analysts. We    |   |
|      |             |                       | reaffirmed our      |   |
|      |             |                       | position and        |   |
|      |             |                       | requested           |   |
|      |             |                       | additional comments |   |
|      |             |                       | to the final        |   |
|      |             |                       | report.             |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Research    | A review of research  | We recommended that |   |
| dits | Flight      | flight operations at  | NASA suspend its    |   |
|      | Operations  | the Glenn indicated   | plans to transfer   |   |
|      | Terminated  | that NASA prematurely | aircraft from Glenn |   |
|      | Prematurely | terminated research   | until management    |   |
|      | (IG-00-037) | flight operations at  | performs a          |   |
|      |             | Glenn without         | cost-benefit        |   |
|      |             | adequately evaluating | analysis of the     |   |
|      |             | all of the            | alternatives and    |   |
|      |             | alternatives,         | prepares a          |   |
|      |             | performing            | long-term plan for  |   |
|      |             | cost-benefit          | conducting the      |   |
|      |             | analyses, or          | icing research      |   |
|      |             | developing a          | project.            |   |
|      |             | long-term plan for    |                     |   |
|      |             | conducting its icing  | NASA management     |   |
|      |             | research program.     | continues working   |   |
|      |             | Management stated     | to complete the     |   |
|      |             | that they terminated  | corrective actions  |   |
|      |             | flight operations     | necessary to close  |   |
|      |             | because the former    | all four            |   |
|      |             | Associate             | recommendations.    |   |
|      |             | Administrator for the | Glenn continues to  |   |
|      |             | Office of Aerospace   | fly proficiency     |   |
|      |             | Technology was        | flights of two      |   |
|      |             | concerned that the    | aircraft. A         |   |
|      |             | reduced number of     | cost-benefit        |   |
|      |             | aircraft and the      | analysis was        |   |
|      |             | lower flight rate at  | conducted by Glenn  |   |
|      |             | the Center would      | and presented to    |   |
|      |             | create safety         | NASA Headquarters   |   |
|      |             | problems. However, as | management.         |   |
|      |             | a result stopping     | Management decided  |   |
|      |             | research flight       | that NASA officials |   |
|      |             | operations before     | outside of Glenn    |   |
|      |             | adequately evaluating | would conduct an    |   |
|      |             | the impacts on the    | independent         |   |
|      |             | research and          | assessment. The     |   |
|      |             | evaluating            | draft long-term     |   |
|      |             | alternatives may      | plan for icing      |   |
|      |             | result in increased   | research should be  |   |
|      |             | costs for that        | completed before    |   |
|      |             | research and          | December 2000.      |   |
|      |             | decreased research    |                     |   |
|      |             | productivity.         |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Validating  | The OIG performed an  | \*                  |   |
| dits | FY 1999     | audit to evaluate the |                     |   |
|      | Performance | accuracy and          |                     |   |
|      | Data to Be  | reliability of NASA's |                     |   |
|      | Reported    | performance           |                     |   |
|      | Under the   | information under     |                     |   |
|      | Government  | GPRA. Of the 23       |                     |   |
|      | Performance | performance targets   |                     |   |
|      | Results Act | we reviewed, 5 (22    |                     |   |
|      | (GPRA)      | percent) had written  |                     |   |
|      | (IG-00-020) | assessments of        |                     |   |
|      |             | performance that did  |                     |   |
|      |             | not accurately        |                     |   |
|      |             | reflect supporting    |                     |   |
|      |             | data and actual       |                     |   |
|      |             | results. Since the    |                     |   |
|      |             | planned reported      |                     |   |
|      |             | performance on the    |                     |   |
|      |             | five targets we       |                     |   |
|      |             | reviewed cannot be    |                     |   |
|      |             | considered fully      |                     |   |
|      |             | reliable, this may    |                     |   |
|      |             | limit its usefulness  |                     |   |
|      |             | to NASA, OMB, and the |                     |   |
|      |             | Congress for          |                     |   |
|      |             | decision-making.      |                     |   |
|      |             | Consequently, the     |                     |   |
|      |             | reliability of        |                     |   |
|      |             | reported performance  |                     |   |
|      |             | for some of the 122   |                     |   |
|      |             | targets not reviewed  |                     |   |
|      |             | might also be         |                     |   |
|      |             | unreliable. We        |                     |   |
|      |             | recommended several   |                     |   |
|      |             | actions including     |                     |   |
|      |             | establishing formal   |                     |   |
|      |             | policies for          |                     |   |
|      |             | developing            |                     |   |
|      |             | performance goals and |                     |   |
|      |             | targets and           |                     |   |
|      |             | validating data on    |                     |   |
|      |             | actual achievements.  |                     |   |
|      |             | Management concurred  |                     |   |
|      |             | with all              |                     |   |
|      |             | recommendations and   |                     |   |
|      |             | their proposed        |                     |   |
|      |             | actions were          |                     |   |
|      |             | responsive and closed |                     |   |
|      |             | upon issuance of our  |                     |   |
|      |             | final report.         |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Space       | The Associate         | To ensure that NASA |   |
| dits | Flight      | Administrator of the  | makes the best      |   |
|      | Operations  | NASA Office of Space  | decision about      |   |
|      | Contract    | Flight directed the   | further             |   |
|      | Phase II -- | consolidation of      | consolidation, we   |   |
|      | Cost        | Space Shuttle         | recommended that    |   |
|      | Benefit     | contracts in 1995     | NASA perform a      |   |
|      | Analysis    | without a formal      | cost-benefit        |   |
|      | (IG-00-015) | cost-benefit          | analysis and annual |   |
|      |             | analysis. NASA        | verification of the |   |
|      |             | consolidated the      | estimated benefits  |   |
|      |             | prior prime Shuttle   | of consolidation.   |   |
|      |             | contracts into the    | NASA agreed to      |   |
|      |             | new prime contract    | perform the         |   |
|      |             | with United Space     | analysis and annual |   |
|      |             | Alliance in two       | verification of the |   |
|      |             | phases over several   | estimated benefits. |   |
|      |             | years. Significant    |                     |   |
|      |             | contracts identified  |                     |   |
|      |             | to be consolidated in |                     |   |
|      |             | Phase II have not     |                     |   |
|      |             | been consolidated,    |                     |   |
|      |             | specifically Space    |                     |   |
|      |             | Shuttle main engines, |                     |   |
|      |             | external tanks, and   |                     |   |
|      |             | reusable solid rocket |                     |   |
|      |             | motors.               |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | X-38/Crew   | As part of an         | Management          |   |
| dits | Return      | international         | concurred with the  |   |
|      | Vehicle     | memorandum of         | recommendation. The |   |
|      | Project     | understanding, the    | X-38/CRV Project    |   |
|      | Management  | United States has     | Office developed    |   |
|      | (IG-00-005) | agreed to provide a   | entry/exit criteria |   |
|      |             | crew-return           | for progressing     |   |
|      |             | capability for the    | through the major   |   |
|      |             | ISS. Generally,       | Project phases but  |   |
|      |             | management of the     | has not documented  |   |
|      |             | X-38/CRV Project has  | the criteria in the |   |
|      |             | been effective, but   | project plan.       |   |
|      |             | the Project\'s rapid  | During the next     |   |
|      |             | prototyping strategy  | reporting period,   |   |
|      |             | entails significant   | we will evaluate    |   |
|      |             | risk in return for a  | management's        |   |
|      |             | potentially high      | corrective action.  |   |
|      |             | payoff as compared to |                     |   |
|      |             | the traditional       |                     |   |
|      |             | approach of           |                     |   |
|      |             | sequential design,    |                     |   |
|      |             | development, test,    |                     |   |
|      |             | and                   |                     |   |
|      |             | en                    |                     |   |
|      |             | gineering/evaluation. |                     |   |
|      |             | To reduce risk and    |                     |   |
|      |             | increase assurance of |                     |   |
|      |             | meeting the           |                     |   |
|      |             | crew-return           |                     |   |
|      |             | capability            |                     |   |
|      |             | commitment, the lead  |                     |   |
|      |             | Center needed to      |                     |   |
|      |             | develop criteria by   |                     |   |
|      |             | which to measure      |                     |   |
|      |             | readiness to progress |                     |   |
|      |             | through major Project |                     |   |
|      |             | phases.               |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Earned      | Earned value          | We recommended that |   |
| dits | Value       | management            | NASA (1) issue EVM  |   |
|      | Management  | information provides  | policy as program   |   |
|      | (EVM) at    | insight into the      | and project         |   |
|      | NASA        | status of a program   | management          |   |
|      | (IG-99-058) | or project and        | directives,         |   |
|      |             | pro-vides valid,      | (2) establish       |   |
|      |             | timely, and auditable | procedures for      |   |
|      |             | contract performance  | reporting           |   |
|      |             | information on which  | comprehensive EVM   |   |
|      |             | to base management    | information to      |   |
|      |             | decisions. The        | senior management,  |   |
|      |             | authority to          | and (3) delegate    |   |
|      |             | implement EVM policy  | authority to        |   |
|      |             | should be aligned     | implement EVM       |   |
|      |             | with the              | policy to the       |   |
|      |             | responsibility for    | Associate           |   |
|      |             | program and project   | Administrators or   |   |
|      |             | management rather     | Center Directors.   |   |
|      |             | than with the fiscal  | Management          |   |
|      |             | chain of command and  | nonconcurred with   |   |
|      |             | fiscal policy         | recommendation 1    |   |
|      |             | directives.           | and did not respond |   |
|      |             |                       | to either 2 or 3.   |   |
|      |             |                       | We met with NASA    |   |
|      |             |                       | management on the   |   |
|      |             |                       | open issues in June |   |
|      |             |                       | 2000 and continue   |   |
|      |             |                       | to work with them   |   |
|      |             |                       | to resolve the open |   |
|      |             |                       | recommendations.    |   |
|      |             |                       | NASA management     |   |
|      |             |                       | stated that the     |   |
|      |             |                       | issues would be     |   |
|      |             |                       | addressed by        |   |
|      |             |                       | December 2000.      |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | The Government        | Management agreed   |   |
| dits | Imp         | Performance and       | to correct the      |   |
|      | lementation | Results Act (GPRA)    | deficiencies. The   |   |
|      | of the      | requires Federal      | recommendation to   |   |
|      | Government  | agencies to focus on  | revise a policy     |   |
|      | Performance | program performance   | guide to address    |   |
|      | and Results | and results. NASA has | senior management   |   |
|      | Act         | made substantial      | oversight will      |   |
|      | (IG-99-055) | progress in           | remain open pending |   |
|      |             | implementing the Act, | completed action.   |   |
|      |             | including preparing   |                     |   |
|      |             | and updating its      |                     |   |
|      |             | Strategic Plan and    |                     |   |
|      |             | issuing Performance   |                     |   |
|      |             | Plans for FY 1999 and |                     |   |
|      |             | FY 2000. However,     |                     |   |
|      |             | Senior management has |                     |   |
|      |             | not (1) provided      |                     |   |
|      |             | adequate oversight of |                     |   |
|      |             | overall progress on   |                     |   |
|      |             | the established FY    |                     |   |
|      |             | 1999 performance      |                     |   |
|      |             | targets and (2)       |                     |   |
|      |             | established           |                     |   |
|      |             | appropriate           |                     |   |
|      |             | procedures to ensure  |                     |   |
|      |             | the data would be     |                     |   |
|      |             | used and were         |                     |   |
|      |             | accurate and          |                     |   |
|      |             | reliable.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | JPL         | JPL's most            | We recommended the  |   |
| dits | Management  | significant           | NASA Management     |   |
|      | of          | subcontracts were not | Office direct JPL   |   |
|      | Su          | subjected to adequate | to revise policies  |   |
|      | bcontractor | surveillance.         | to require project  |   |
|      | Technical   | Subcontractor data    | management          |   |
|      | Performance | disclosed problems in | assessment and      |   |
|      | (IG-99-054) | the designing,        | monitoring of       |   |
|      |             | building, and         | subcontractors to   |   |
|      |             | safeguarding of       | ensure procedures   |   |
|      |             | hardware and employee | are designed and    |   |
|      |             | noncompliance with    | functioning to      |   |
|      |             | quality system        | prevent, detect,    |   |
|      |             | procedures. JPL did   | and correct         |   |
|      |             | not act on these      | technical problems. |   |
|      |             | problems in a timely  | Management          |   |
|      |             | manner, in part, due  | partially concurred |   |
|      |             | to the lack of        | with the            |   |
|      |             | surveillance          | recommendations but |   |
|      |             | activity.             | did not identify    |   |
|      |             |                       | specific corrective |   |
|      |             |                       | actions. The OIG    |   |
|      |             |                       | granted an          |   |
|      |             |                       | extension for       |   |
|      |             |                       | management to       |   |
|      |             |                       | respond until the   |   |
|      |             |                       | Mars Polar Lander   |   |
|      |             |                       | and Mars Climate    |   |
|      |             |                       | Observer            |   |
|      |             |                       | investigative       |   |
|      |             |                       | re­ports are issued  |   |
|      |             |                       | and summarized and  |   |
|      |             |                       | recommendations by  |   |
|      |             |                       | the NASA            |   |
|      |             |                       | Independent         |   |
|      |             |                       | Assessment Team are |   |
|      |             |                       | agreed upon.        |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Performance | The ECS contractor's  | \*                  |   |
| dits | Evaluation  | performance was not   |                     |   |
|      | Plan for    | linked to the         |                     |   |
|      | the Earth   | contract's            |                     |   |
|      | Observing   | Performance           |                     |   |
|      | System      | Evaluation Plan. The  |                     |   |
|      | (EOS) Data  | award fee plan relied |                     |   |
|      | and         | on subjective         |                     |   |
|      | Information | evaluations by        |                     |   |
|      | System Core | Government personnel  |                     |   |
|      | System      | as the basis for      |                     |   |
|      | (ECS)       | award fee             |                     |   |
|      | Contract    | determinations. The   |                     |   |
|      | (IG-99-038) | plan did not contain  |                     |   |
|      |             | objective measures of |                     |   |
|      |             | performance and,      |                     |   |
|      |             | therefore, did not    |                     |   |
|      |             | sufficiently link     |                     |   |
|      |             | performance           |                     |   |
|      |             | objectives to the     |                     |   |
|      |             | award fee. Management |                     |   |
|      |             | revised the           |                     |   |
|      |             | Performance           |                     |   |
|      |             | Evaluation Plan to    |                     |   |
|      |             | link award fee        |                     |   |
|      |             | payments to specific  |                     |   |
|      |             | cost, schedule, and   |                     |   |
|      |             | performance           |                     |   |
|      |             | objectives in the     |                     |   |
|      |             | restructured ECS      |                     |   |
|      |             | contract.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Earned      | NASA can improve the  | Management agreed   |   |
| dits | Value       | use of EVM on the ECS | to review and       |   |
|      | Management  | contract by           | appropriately       |   |
|      | at          | performing an         | revise its Program  |   |
|      | NASA---ECS  | integrated baseline   | and Project         |   |
|      | Performance | review to             | Management guidance |   |
|      | Measurement | substantiate the      | and to perform a    |   |
|      | Baseline    | validity of the       | baseline review for |   |
|      | (IG-99-037) | contractor's          | the restructured    |   |
|      |             | performance           | ECS contract.       |   |
|      |             | measurement baseline. |                     |   |
|      |             | Without a valid       |                     |   |
|      |             | baseline, variances   |                     |   |
|      |             | may not be detected   |                     |   |
|      |             | and addressed with    |                     |   |
|      |             | corrective action     |                     |   |
|      |             | plans.                |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Audit of    | NASA has had limited  | We made nine        |   |
| dits | X-33        | success using a       | recommendations to  |   |
|      | Cooperative | cooperative agreement | improve program     |   |
|      | Agreement   | on the X-33 Program.  | management and to   |   |
|      | (IG-99-019) | However, using a      | ensure effective    |   |
|      |             | cooperative agreement | program management  |   |
|      |             | contributed to        | practices are       |   |
|      |             | program management    | followed on future  |   |
|      |             | problems such as (1)  | cooperative         |   |
|      |             | program plans,        | agreements.         |   |
|      |             | internal agreements,  | Management actions  |   |
|      |             | and guidance          | were responsive to  |   |
|      |             | documents either were | all but two         |   |
|      |             | not prepared or were  | recommendations. We |   |
|      |             | not timely; (2)       | reaffirmed our      |   |
|      |             | industry partners did | position on the     |   |
|      |             | not provide required  | need for (1) an     |   |
|      |             | analyses of their     | Agency-unique risk  |   |
|      |             | cost estimates or     | assessment plan,    |   |
|      |             | submit monthly        | and (2) periodic    |   |
|      |             | reports on resource   | Estimate at         |   |
|      |             | contributions; (3)    | Completion          |   |
|      |             | Center practices for  | Analyses.           |   |
|      |             | controlling and       | Management          |   |
|      |             | reporting costs       | subsequently        |   |
|      |             | require improvement;  | concurred with      |   |
|      |             | and (4) ownership of  | these two           |   |
|      |             | the X-33 flight       | recommendations. We |   |
|      |             | vehicle upon program  | will continue to    |   |
|      |             | completion has not    | monitor             |   |
|      |             | been determined.      | management\'s       |   |
|      |             |                       | actions on the six  |   |
|      |             |                       | recommendations     |   |
|      |             |                       | that remain open.   |   |
|      |             |                       | The failure of the  |   |
|      |             |                       | composite hydrogen  |   |
|      |             |                       | tank and other      |   |
|      |             |                       | program problems    |   |
|      |             |                       | has resulted in the |   |
|      |             |                       | restructuring of    |   |
|      |             |                       | the X-33 Program.   |   |
|      |             |                       | These activities    |   |
|      |             |                       | have impacted the   |   |
|      |             |                       | completion of the   |   |
|      |             |                       | recommended         |   |
|      |             |                       | actions.            |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Advanced    | Launch of the Chandra | We recommended that |   |
| dits | X-ray       | X-ray Observatory was | management (1)      |   |
|      | A           | delayed because of    | revise the new      |   |
|      | strophysics | problems in software  | Program and Project |   |
|      | Facility    | development and       | Management policy   |   |
|      |             | inadequate time       | to require program  |   |
|      | (IG-99-016) | scheduled for         | managers to update  |   |
|      |             | integration and test  | Risk Management     |   |
|      |             | activities for the    | Plans as high-risk  |   |
|      |             | observatory's flight  | issues arise, and   |   |
|      |             | and ground software.  | (2) assign          |   |
|      |             | Although software     | personnel with      |   |
|      |             | development was       | necessary expertise |   |
|      |             | identified as a high  | to be on-site at    |   |
|      |             | risk, the             | contractor          |   |
|      |             | observatory's Risk    | locations when a    |   |
|      |             | Management Plan was   | particular area     |   |
|      |             | not updated because   | becomes a           |   |
|      |             | it was not required   | significant         |   |
|      |             | by NASA policy.       | management risk.    |   |
|      |             |                       | The OIG provided    |   |
|      |             |                       | input for changes   |   |
|      |             |                       | to the planned      |   |
|      |             |                       | policy revision.    |   |
|      |             |                       | The revised policy  |   |
|      |             |                       | is to be issued in  |   |
|      |             |                       | February 2001.      |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | EOS Common  | Program management    | \*                  |   |
| dits | Spacecraft  | for the EOS           |                     |   |
|      | Planning    | spacecraft designated |                     |   |
|      | and         | as PM-1 and CHEM-1    |                     |   |
|      | Management  | can be improved in    |                     |   |
|      |             | the areas of quality  |                     |   |
|      | (IG-99-011) | control and           |                     |   |
|      |             | communication of      |                     |   |
|      |             | award fee             |                     |   |
|      |             | determinations. DCMA  |                     |   |
|      |             | did not submit an     |                     |   |
|      |             | approved Quality      |                     |   |
|      |             | Assurance Plan and    |                     |   |
|      |             | periodic status       |                     |   |
|      |             | reports to the NASA   |                     |   |
|      |             | Flight Assurance      |                     |   |
|      |             | Manager. In addition, |                     |   |
|      |             | NASA event            |                     |   |
|      |             | coordinators made     |                     |   |
|      |             | significant changes   |                     |   |
|      |             | in the contractor's   |                     |   |
|      |             | award fee scores      |                     |   |
|      |             | without discussing    |                     |   |
|      |             | the changes with the  |                     |   |
|      |             | event monitors.       |                     |   |
|      |             | Management concurred  |                     |   |
|      |             | and completed         |                     |   |
|      |             | corrective actions.   |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Earth       | One of ten contracts  | \*                  |   |
| dits | Science     | awarded for Phase I   |                     |   |
|      | Commercial  | of this program       |                     |   |
|      | Data Buy    | duplicated an         |                     |   |
|      | Program     | existing NASA         |                     |   |
|      | (IG-98-025) | capability to access  |                     |   |
|      |             | the same data through |                     |   |
|      |             | current Agency        |                     |   |
|      |             | agreements. Cost      |                     |   |
|      |             | projections show that |                     |   |
|      |             | NASA could            |                     |   |
|      |             | unnecessarily spend   |                     |   |
|      |             | an additional         |                     |   |
|      |             | \$576,000 during      |                     |   |
|      |             | Phase II. We          |                     |   |
|      |             | recommended that NASA |                     |   |
|      |             | not award a Phase II  |                     |   |
|      |             | contract. Management  |                     |   |
|      |             | concurred, and NASA   |                     |   |
|      |             | will not pursue a     |                     |   |
|      |             | Phase II contract.    |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA's      | Our audit disclosed   | \*                  |   |
| dits | Plans to    | that budget cuts      |                     |   |
|      | S           | would affect NASA's   |                     |   |
|      | uccessfully | ability to achieve    |                     |   |
|      | Achieve the | its original EOS      |                     |   |
|      | Earth       | Program goals. The    |                     |   |
|      | Observing   | Agency partially      |                     |   |
|      | System      | concurred with our    |                     |   |
|      | Scientific  | recommendation to     |                     |   |
|      | Objectives  | reevaluate the EOS    |                     |   |
|      | (IG-98-010) | goals when it         |                     |   |
|      |             | addresses the Earth   |                     |   |
|      |             | Science Enterprise's  |                     |   |
|      |             | overall science       |                     |   |
|      |             | requirements. The EOS |                     |   |
|      |             | goals were            |                     |   |
|      |             | reevaluated as part   |                     |   |
|      |             | of the Office of      |                     |   |
|      |             | Earth Science's       |                     |   |
|      |             | research strategy     |                     |   |
|      |             | that was completed in |                     |   |
|      |             | May 2000. This action |                     |   |
|      |             | satisfied our         |                     |   |
|      |             | recommendation.       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Earth       | NASA did not perform  | \*                  |   |
| dits | Observing   | a cost/benefit        |                     |   |
|      | System Data | analysis prior to     |                     |   |
|      | and         | initiating the pilot  |                     |   |
|      | Information | program to broaden    |                     |   |
|      | System      | participation in the  |                     |   |
|      | (EOSDIS)    | distribution of       |                     |   |
|      | Federation  | EOSDIS information    |                     |   |
|      | Plan        | products through a    |                     |   |
|      | (IG-98-002) | federation of         |                     |   |
|      |             | partners. The Agency  |                     |   |
|      |             | concurred with our    |                     |   |
|      |             | recommendation and    |                     |   |
|      |             | completed corrective  |                     |   |
|      |             | action to conduct the |                     |   |
|      |             | analysis before       |                     |   |
|      |             | making a decision     |                     |   |
|      |             | regarding moving to a |                     |   |
|      |             | federated plan.       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Glenn       | The Glenn Exchange,   | We made 12          |   |
| pect | Research    | an instrumentality of | recommendations to  |   |
| ions | Center      | the Government, is    | improve the review, |   |
|      | Exchange    | responsible for       | approval and use of |   |
|      | Activities  | operating activities  | Exchange funds; to  |   |
|      |             | that contribute to    | improve the         |   |
|      | (G-99-016)  | the efficiency,       | supporting          |   |
|      |             | welfare, and morale   | documentation and   |   |
|      |             | of Glenn employees.   | controls over       |   |
|      |             | We found that Glenn   | expenditures of     |   |
|      |             | Exchange funds were   | funds; to ensure    |   |
|      |             | provided to Center    | compliance with the |   |
|      |             | management for        | Randolph-Sheppard   |   |
|      |             | activities for which  | Act; to develop an  |   |
|      |             | appropriated funds    | appropriate         |   |
|      |             | were available. We    | constitution and    |   |
|      |             | also found weaknesses | by-laws; to fully   |   |
|      |             | in the documentation  | implement prior     |   |
|      |             | of and controls over  | audit               |   |
|      |             | expenditures;         | recommendations; to |   |
|      |             | concerns over         | implement a         |   |
|      |             | compliance with the   | standard meeting    |   |
|      |             | Randolph-Sheppard     | schedule; and to    |   |
|      |             | Act; and needed       | amend the           |   |
|      |             | improvements in other | Exchange's          |   |
|      |             | administrative and    | insurance coverage  |   |
|      |             | operating areas       | to add the United   |   |
|      |             | regarding the         | States as an        |   |
|      |             | Exchange.             | additional insured. |   |
|      |             |                       | Management          |   |
|      |             |                       | concurred to the    |   |
|      |             |                       | recommendations and |   |
|      |             |                       | is in the process   |   |
|      |             |                       | of taking           |   |
|      |             |                       | corrective actions. |   |
|      |             |                       | The recommendations |   |
|      |             |                       | are considered      |   |
|      |             |                       | resolved pending    |   |
|      |             |                       | verification of     |   |
|      |             |                       | corrective actions. |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Assessment  | The Triana mission is | \*                  |   |
| pect | of the      | a relatively new NASA |                     |   |
| ions | Triana      | project to build,     |                     |   |
|      | Mission     | launch, and operate a |                     |   |
|      | (G-99-013)  | spacecraft that will  |                     |   |
|      |             | take pictures of the  |                     |   |
|      |             | sunlit side of the    |                     |   |
|      |             | Earth and transmit    |                     |   |
|      |             | them to the Internet  |                     |   |
|      |             | 24 hours a day. Total |                     |   |
|      |             | cost for Triana       |                     |   |
|      |             | increased             |                     |   |
|      |             | considerably as the   |                     |   |
|      |             | focus changed from    |                     |   |
|      |             | education to science. |                     |   |
|      |             | Based on a            |                     |   |
|      |             | circumscribed peer    |                     |   |
|      |             | review process, we    |                     |   |
|      |             | reported that the     |                     |   |
|      |             | added scientific      |                     |   |
|      |             | capabilities may not  |                     |   |
|      |             | be the best           |                     |   |
|      |             | expenditure of NASA's |                     |   |
|      |             | limited science       |                     |   |
|      |             | funding. We also      |                     |   |
|      |             | reported that the     |                     |   |
|      |             | Triana spacecraft,    |                     |   |
|      |             | originally conceived  |                     |   |
|      |             | as a cooperative      |                     |   |
|      |             | effort among          |                     |   |
|      |             | university students,  |                     |   |
|      |             | industry, and         |                     |   |
|      |             | Government, is        |                     |   |
|      |             | essentially being     |                     |   |
|      |             | built, launched, and  |                     |   |
|      |             | operated by NASA. In  |                     |   |
|      |             | addition, NASA's      |                     |   |
|      |             | major role in         |                     |   |
|      |             | developing and        |                     |   |
|      |             | launching the         |                     |   |
|      |             | spacecraft did not    |                     |   |
|      |             | appear to further the |                     |   |
|      |             | goals of the National |                     |   |
|      |             | Space Policy of 1996  |                     |   |
|      |             | and the Commercial    |                     |   |
|      |             | Space Act of 1998,    |                     |   |
|      |             | which direct NASA to  |                     |   |
|      |             | acquire spacecraft    |                     |   |
|      |             | and launch vehicles   |                     |   |
|      |             | from the private      |                     |   |
|      |             | sector whenever       |                     |   |
|      |             | possible. We          |                     |   |
|      |             | recommended that NASA |                     |   |
|      |             | reassess and modify   |                     |   |
|      |             | its approach to the   |                     |   |
|      |             | Triana mission. NASA  |                     |   |
|      |             | management did not    |                     |   |
|      |             | concur with our       |                     |   |
|      |             | recommendation.       |                     |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+------+-------------+-----------------------+---------------------+---+
| ###  |             |                       |                     |   |
| #### |             |                       |                     |   |
| # Ta |             |                       |                     |   |
| ble  |             |                       |                     |   |
| 7 -- |             |                       |                     |   |
|  Lau |             |                       |                     |   |
| nch  |             |                       |                     |   |
| Vehi |             |                       |                     |   |
| cles |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | 1998        | NASA cannot be        | We recommended that |   |
| dits | Shuttle     | assured it received   | the Center          |   |
|      | Flight Rate | fair and reasonable   | Director, determine |   |
|      | Credit      | pricing on the Space  | whether Johnson     |   |
|      | Analysis    | Flight Operations     | should continue to  |   |
|      | Not Fully   | Contract (SFOC)       | use activity-based  |   |
|      | Documented  | because the FY 1998   | costing. If         |   |
|      | (IG-00-039) | flight rate credit    | activity-based      |   |
|      |             | analysis was not      | costing is to be    |   |
|      |             | fully documented in   | used, management    |   |
|      |             | the contract file in  | should establish    |   |
|      |             | accordance with FAR   | policies and        |   |
|      |             | requirements.         | procedures that     |   |
|      |             | Specifically, the     | explain how that    |   |
|      |             | SFOC file did not     | process can be used |   |
|      |             | contain the evidence  | to comply with FAR  |   |
|      |             | of technical, price,  | requirements;       |   |
|      |             | or cost analysis, or  | perform an adequate |   |
|      |             | verification of       | technical, cost, or |   |
|      |             | direct and indirect   | price analysis on   |   |
|      |             | rates that the        | each SFOC pricing   |   |
|      |             | contracting officer   | action and document |   |
|      |             | should have used to   | the analysis in the |   |
|      |             | determine whether the | contract file; and  |   |
|      |             | FY 1998 flight rate   | verify that the     |   |
|      |             | credit of             | appropriate forward |   |
|      |             | \$33.3 million was    | pricing rates are   |   |
|      |             | fair and reasonable.  | used in the FY 1999 |   |
|      |             | Absent documentation  | flight rate credit  |   |
|      |             | for activity-based    | proposal, and       |   |
|      |             | costing, there is no  | document the        |   |
|      |             | basis on which to     | verification in the |   |
|      |             | conclude that         | SFOC contract file. |   |
|      |             | adequate technical,   | Management          |   |
|      |             | price, or cost        | concurred with all  |   |
|      |             | analysis was          | recommendations.    |   |
|      |             | performed. As a       | The Center Director |   |
|      |             | result, NASA cannot   | determined that the |   |
|      |             | be assured that the   | activity-based      |   |
|      |             | \$33.3 million credit | costing process is  |   |
|      |             | negotiated with       | a viable option,    |   |
|      |             | United Space Alliance | has begun the       |   |
|      |             | represented a full    | process of updating |   |
|      |             | contract price        | and expanding       |   |
|      |             | reduction from two    | guidance for        |   |
|      |             | cancelled flights.    | activity-based      |   |
|      |             | Consequently, NASA    | costing, agreed to  |   |
|      |             | may be paying United  | strengthen the      |   |
|      |             | Space Alliance more   | contract file       |   |
|      |             | incentive fee than    | documentation, and  |   |
|      |             | necessary.            | will verify that    |   |
|      |             |                       | the contractor has  |   |
|      |             |                       | used the correct    |   |
|      |             |                       | forward pricing     |   |
|      |             |                       | rates in its flight |   |
|      |             |                       | rate credit         |   |
|      |             |                       | proposal for FY     |   |
|      |             |                       | 1999.               |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | X-34        | The Headquarters      | We recommended      |   |
| dits | Technology  | Office of Aerospace   | strategic planning  |   |
|      | D           | Technology and        | be improved,        |   |
|      | emonstrator | Marshall lead the     | program             |   |
|      | (IG-00-029) | Agency's search for a | documentation be    |   |
|      |             | second-generation     | completed timely,   |   |
|      |             | Reusable Launch       | flight test         |   |
|      |             | Vehicle (RLV) to      | requirements be     |   |
|      |             | reduce launch costs.  | revalidated, and    |   |
|      |             | The \$200 million     | any unnecessary     |   |
|      |             | X-34 Project is one   | flight tests or     |   |
|      |             | of several existing   | engines be          |   |
|      |             | and planned           | eliminated.         |   |
|      |             | technol­ogy            | Management          |   |
|      |             | demonstrator          | concurred with all  |   |
|      |             | (X-vehicle) programs  | 16 recommendations, |   |
|      |             | being pursued to      | agreeing to         |   |
|      |             | mature required       | implement           |   |
|      |             | technologies needed   | recommended         |   |
|      |             | for the               | actions, which      |   |
|      |             | next-generation RLV.  | should              |   |
|      |             | An audit showed NASA  | significantly       |   |
|      |             | has not adequately    | improve the overall |   |
|      |             | performed strategic   | effectiveness of    |   |
|      |             | planning for the      | Agency management   |   |
|      |             | Space Transportation  | of Space            |   |
|      |             | mission.              | Transportation      |   |
|      |             | Specifically,         | programs and        |   |
|      |             | improvements are      | projects. Three of  |   |
|      |             | needed at all levels  | the recommendations |   |
|      |             | in preparing          | have been closed.   |   |
|      |             | effective strategic   | We will continue to |   |
|      |             | plans and in the      | monitor             |   |
|      |             | procedures for        | manage­ment\'s       |   |
|      |             | managing those        | actions on the 13   |   |
|      |             | technologies          | recommenda­tions     |   |
|      |             | necessary in          | that remain open.   |   |
|      |             | developing the        | The X-34 Project is |   |
|      |             | next-generation RLV.  | currently being     |   |
|      |             |                       | restructured. These |   |
|      |             |                       | activities have     |   |
|      |             |                       | impacted completing |   |
|      |             |                       | the recommended     |   |
|      |             |                       | actions.            |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Staffing of | An OIG audit showed   | We recommended that |   |
| dits | the         | that management       | management (1)      |   |
|      | Expendable  | oversight of staffing | establish clear and |   |
|      | Launch      | plans during and      | realistic staffing  |   |
|      | Vehicle     | following the         | goals that align    |   |
|      | Program     | consolidation of the  | with the strategic  |   |
|      | office at   | ELV Program Office to | performance goals   |   |
|      | the Kennedy | Kennedy was           | of the ELV Program  |   |
|      | Space       | inadequate and will   | Office at Kennedy;  |   |
|      | Center      | affect Kennedy's      | (2) develop         |   |
|      | (IG-00-009) | ability to meet       | strategic human     |   |
|      |             | strategic goals and   | resources           |   |
|      |             | may adversely affect  | management          |   |
|      |             | the cost and          | strategies to       |   |
|      |             | scheduling of future  | ensure continuity   |   |
|      |             | Earth Science and     | of needed skills    |   |
|      |             | Space Science         | and abilities; and  |   |
|      |             | missions.             | (3) incorporate     |   |
|      |             |                       | these strategies    |   |
|      |             |                       | into NPG 7120.5A.   |   |
|      |             |                       | NASA has completed  |   |
|      |             |                       | corrective actions  |   |
|      |             |                       | for two of the      |   |
|      |             |                       | three               |   |
|      |             |                       | recommendations. A  |   |
|      |             |                       | corrective action   |   |
|      |             |                       | for the open        |   |
|      |             |                       | recommendation      |   |
|      |             |                       | requires            |   |
|      |             |                       | coordination among  |   |
|      |             |                       | several             |   |
|      |             |                       | organizational      |   |
|      |             |                       | elements. We will   |   |
|      |             |                       | continue to monitor |   |
|      |             |                       | management's        |   |
|      |             |                       | actions.            |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Follow-up   | NASA could save \$7.6 | \*                  |   |
| dits | on Audit of | million per OMDP by   |                     |   |
|      | Orbiter     | performing            |                     |   |
|      | Maintenance | maintenance at        |                     |   |
|      | Down        | Kennedy, but would    |                     |   |
|      | Periods     | incur significant     |                     |   |
|      | (OMDP)      | risk. The Agency      |                     |   |
|      | (IG-98-016) | reevaluated where     |                     |   |
|      |             | OMDP's are performed  |                     |   |
|      |             | after the ISS is      |                     |   |
|      |             | complete and a less   |                     |   |
|      |             | aggressive Shuttle    |                     |   |
|      |             | Manifest exists.      |                     |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+------+-------------+-----------------------+---------------------+---+
| #    |             |                       |                     |   |
| #### |             |                       |                     |   |
| ###  |             |                       |                     |   |
| Tabl |             |                       |                     |   |
| e 8  |             |                       |                     |   |
| -- R |             |                       |                     |   |
| esea |             |                       |                     |   |
| rch  |             |                       |                     |   |
| and  |             |                       |                     |   |
| Tech |             |                       |                     |   |
| nolo |             |                       |                     |   |
| gy D |             |                       |                     |   |
| emon |             |                       |                     |   |
| stra |             |                       |                     |   |
| tion |             |                       |                     |   |
| /App |             |                       |                     |   |
| lica |             |                       |                     |   |
| tion |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | X-33 Cost   | NASA is using a       | We recommended that |   |
| dits | Estimating  | cooperative agreement | NASA improve its    |   |
|      | Process     | for the X-33 Program, | evaluation          |   |
|      | (IG-99-052) | a first for a major   | processes for cost  |   |
|      |             | technology program    | reasonableness and  |   |
|      |             | (\$1.1 billion).      | cost risk. The      |   |
|      |             | Under the terms of    | estimate to         |   |
|      |             | the cooperative       | complete the        |   |
|      |             | agreement, NASA will  | program should be   |   |
|      |             | provide about 80      | updated to reflect  |   |
|      |             | percent of the funds  | cost uncertainties  |   |
|      |             | and Lockheed Martin   | and determinations  |   |
|      |             | Skunkworks will       | made of how         |   |
|      |             | invest at least 20    | remaining work will |   |
|      |             | percent to            | be funded.          |   |
|      |             | demonstrate the X-33. | Management issued a |   |
|      |             | However, NASA did not | Grant Information   |   |
|      |             | adequately address    | Circular requiring  |   |
|      |             | cost reasonableness   | an analysis be      |   |
|      |             | and cost risk for the | performed using     |   |
|      |             | X-33 Program. Cost    | proposal analysis   |   |
|      |             | overruns put NASA\'s  | techniques found in |   |
|      |             | investment in the     | the FAR. (Circular  |   |
|      |             | X-33 Program at risk. | applies to          |   |
|      |             | Since this is a       | cooperative         |   |
|      |             | cooperative           | agreements with     |   |
|      |             | agreement, the        | commercial firms in |   |
|      |             | recipient may end its | which the recipient |   |
|      |             | partnership or        | does not share at   |   |
|      |             | request that NASA     | least 50 percent of |   |
|      |             | invest more money     | the cost or the     |   |
|      |             | should cost overruns  | total value of the  |   |
|      |             | become too            | agreement is        |   |
|      |             | burdensome.           | greater than \$5    |   |
|      |             |                       | million.) Two       |   |
|      |             |                       | recommendations     |   |
|      |             |                       | remain open.        |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Advanced    | The AATT project has  | \*                  |   |
| dits | Air         | developed and the     |                     |   |
|      | Tran        | Federal Aviation      |                     |   |
|      | sport-ation | Administration (FAA)  |                     |   |
|      | T           | has deployed three    |                     |   |
|      | echnologies | decision support      |                     |   |
|      | (AATT)      | tools: Traffic        |                     |   |
|      | Project     | Management Advisor,   |                     |   |
|      | (IG-99-030) | Surface Movement      |                     |   |
|      |             | Advisor, and Passive  |                     |   |
|      |             | Final Approach        |                     |   |
|      |             | Spacing Tool. Because |                     |   |
|      |             | the technology is so  |                     |   |
|      |             | complicated, the      |                     |   |
|      |             | transfer of these     |                     |   |
|      |             | tools cannot be       |                     |   |
|      |             | accomplished          |                     |   |
|      |             | successfully without  |                     |   |
|      |             | NASA's assistance.    |                     |   |
|      |             | Therefore, we         |                     |   |
|      |             | emphasized the        |                     |   |
|      |             | importance of NASA    |                     |   |
|      |             | assisting the FAA to  |                     |   |
|      |             | ensure the decision   |                     |   |
|      |             | support tools are     |                     |   |
|      |             | successfully          |                     |   |
|      |             | deployed. To ease the |                     |   |
|      |             | transition, NASA      |                     |   |
|      |             | developed a           |                     |   |
|      |             | technology transfer   |                     |   |
|      |             | plan that will        |                     |   |
|      |             | provide for           |                     |   |
|      |             | coordination with the |                     |   |
|      |             | FAA.                  |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | National    | The NTTC fosters NASA | We recommended that |   |
| dits | Technology  | and Federal           | NASA (1) clearly    |   |
|      | Transfer    | technology transfers  | define the NTTC's   |   |
|      | Center's    | with U.S. industry    | mission, (2)        |   |
|      | (NTTC)      | and provides business | acquire serv­ices    |   |
|      | Mission     | with access to        | using the           |   |
|      | Needs to Be | information,          | appropriate award   |   |
|      | Defined     | expertise, and        | instrument, (3)     |   |
|      | (IG-98-031) | facilities. Our audit | revise monthly      |   |
|      |             | showed that when NASA | report format to    |   |
|      |             | directed a shift in   | include sufficient  |   |
|      |             | technology transfer   | performance         |   |
|      |             | focus from national   | information, and    |   |
|      |             | to strictly NASA      | (4) recover         |   |
|      |             | without formally      | \$19,500 of         |   |
|      |             | defining NTTC's       | unallowable costs   |   |
|      |             | revised mission, its  | to the NASA         |   |
|      |             | mission became        | cooperative         |   |
|      |             | similar to that of    | agreement with      |   |
|      |             | NASA's Regional       | Wheeling Jesuit     |   |
|      |             | Technology Transfer   | University (site of |   |
|      |             | Centers. Also, NTTC   | the NTTC). Two      |   |
|      |             | is not fully          | recommendations     |   |
|      |             | integrated into       | remain open.        |   |
|      |             | NASA's technology     |                     |   |
|      |             | transfer              |                     |   |
|      |             | organization.         |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Audit of    | The NASA CRSPO has    | \*                  |   |
| dits | Commercial  | not leveraged the     |                     |   |
|      | Remote      | commercial remote     |                     |   |
|      | Sensing     | sensing industry to   |                     |   |
|      | Program     | provide products that |                     |   |
|      | Office      | meet baseline         |                     |   |
|      | (CRSPO)     | scientific            |                     |   |
|      | (IG-99-023) | requirements.         |                     |   |
|      |             | Therefore, NASA has   |                     |   |
|      |             | not been able to      |                     |   |
|      |             | reduce the costs of   |                     |   |
|      |             | remote sensing        |                     |   |
|      |             | science and           |                     |   |
|      |             | technology programs   |                     |   |
|      |             | through competition   |                     |   |
|      |             | within the commercial |                     |   |
|      |             | remote sensing        |                     |   |
|      |             | industry. We          |                     |   |
|      |             | recommended that NASA |                     |   |
|      |             | (1) publish a         |                     |   |
|      |             | baseline of           |                     |   |
|      |             | scientific            |                     |   |
|      |             | requirements to       |                     |   |
|      |             | foster competition    |                     |   |
|      |             | within the commercial |                     |   |
|      |             | remote sensing        |                     |   |
|      |             | industry and (2) use  |                     |   |
|      |             | this baseline in      |                     |   |
|      |             | initiatives to        |                     |   |
|      |             | fulfill NASA's Earth  |                     |   |
|      |             | Science objectives at |                     |   |
|      |             | the lowest cost. NASA |                     |   |
|      |             | implemented actions   |                     |   |
|      |             | that satisfied the    |                     |   |
|      |             | intent of the         |                     |   |
|      |             | recommendations.      |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Management  | We found that NASA    | \*                  |   |
| dits | Controls in | misused \$385,000 of  |                     |   |
|      | Earth       | research and          |                     |   |
|      | Systems     | development funds for |                     |   |
|      | Sciences    | construction          |                     |   |
|      | Building    | (Construction of      |                     |   |
|      | Contract    | Facilities funds      |                     |   |
|      | (IG-98-015) | should have been      |                     |   |
|      |             | used). NASA corrected |                     |   |
|      |             | the mistake.          |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Di          | Earth Observing       | \*                  |   |
| dits | ssemination | System information    |                     |   |
|      | of Earth    | was not reaching four |                     |   |
|      | Science     | of the five intended  |                     |   |
|      | Program     | user groups: (1)      |                     |   |
|      | Data and    | education, (2) public |                     |   |
|      | Information | sector, (3)           |                     |   |
|      | (IG-98-013) | technology, and (4)   |                     |   |
|      |             | commercial. NASA      |                     |   |
|      |             | completed corrective  |                     |   |
|      |             | actions to ensure     |                     |   |
|      |             | these four groups as  |                     |   |
|      |             | well as the           |                     |   |
|      |             | scientific users have |                     |   |
|      |             | access.               |                     |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+------+-------------+-----------------------+---------------------+---+
| #### |             |                       |                     |   |
| #### |             |                       |                     |   |
|  Tab |             |                       |                     |   |
| le 9 |             |                       |                     |   |
|  --  |             |                       |                     |   |
| Inte |             |                       |                     |   |
| rnat |             |                       |                     |   |
| iona |             |                       |                     |   |
| l Ag |             |                       |                     |   |
| reem |             |                       |                     |   |
| ents |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Exports on  | NASA\'s international | We recommended that |   |
| dits | Behalf of   | activities often      | management require  |   |
|      | Space       | involve the transfer  | Boeing to establish |   |
|      | Station     | of commodities,       | an appropriate      |   |
|      | Program May | software, or          | export control      |   |
|      | Not Be in   | technologies to       | program and a       |   |
|      | Compliance  | foreign partners not  | detailed            |   |
|      | with        | only by NASA, but     | company-wide export |   |
|      | Applicable  | also by its           | policy that comply  |   |
|      | Laws and    | contractors. The      | with applicable     |   |
|      | Regulations | transfers are         | laws and            |   |
|      | (IG-00-048) | generally subject to  | regulations prior   |   |
|      |             | export control laws   | to authorizing      |   |
|      |             | and regulations,      | Boeing to utilize   |   |
|      |             | regardless of whether | NASA-obtained       |   |
|      |             | they occur in the     | export licenses on  |   |
|      |             | United States,        | behalf of the ISS   |   |
|      |             | overseas, or in       | Program. We also    |   |
|      |             | space. NASA\'s        | recommended that    |   |
|      |             | contractors are       | management          |   |
|      |             | responsible for       | periodically review |   |
|      |             | following the same    | both Boeing and     |   |
|      |             | U.S. export laws and  | Boeing              |   |
|      |             | regulations. An OIG   | subcontractors\'    |   |
|      |             | audit found that      | export control      |   |
|      |             | Boeing Space and      | programs to ensure  |   |
|      |             | Communications Group  | that exports        |   |
|      |             | (Boeing) might not    | effected against    |   |
|      |             | have complied with    | NASA-obtained       |   |
|      |             | applicable export     | licenses in support |   |
|      |             | laws and regulations  | of the ISS Program  |   |
|      |             | when exporting        | are being           |   |
|      |             | controlled items on   | accomplished in     |   |
|      |             | behalf of the ISS     | accordance with     |   |
|      |             | program. NASA,        | applicable U.S.     |   |
|      |             | therefore, lacks      | export laws and     |   |
|      |             | assurance that        | regulations.        |   |
|      |             | Boeing\'s export      | Management          |   |
|      |             | activities on behalf  | concurred with both |   |
|      |             | of the Agency for the | of the report\'s    |   |
|      |             | ISS Program are being | recommendations and |   |
|      |             | performed in full     | planned corrective  |   |
|      |             | compliance with       | actions that were   |   |
|      |             | applicable export     | responsive.         |   |
|      |             | laws and regulations. |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Controls    | NASA has a            | We recommended that |   |
| dits | Over Access | responsibility under  | management: (1)     |   |
|      | to NASA     | the National          | revise the          |   |
|      | Centers by  | Aeronautics and Space | definition of a     |   |
|      | Foreign     | Act of 1958 to        | foreign national in |   |
|      | Visitors    | cooperate with other  | NASA policy         |   |
|      | Need        | nations in the        | guidance to ensure  |   |
|      | S           | conduct of its        | controls are in     |   |
|      | trengthened | activities. NASA      | effect at NASA      |   |
|      | (IG-00-034) | hosts foreign         | Centers for all     |   |
|      |             | national visitors to: | visitors who are    |   |
|      |             | attend meetings or    | not U.S. citizens,  |   |
|      |             | conferences, perform  | (2) revise existing |   |
|      |             | intermittent or       | policy to establish |   |
|      |             | regular work on a     | NASA-wide           |   |
|      |             | program related to an | requirements and    |   |
|      |             | international         | procedures for      |   |
|      |             | agreement, conduct    | obtaining National  |   |
|      |             | scientific research   | Agency Checks and   |   |
|      |             | under a cooperative   | for escorting       |   |
|      |             | educational program,  | foreign visitors,   |   |
|      |             | or work for a support | and (3) establish a |   |
|      |             | contractor. An OIG    | NASA-wide policy    |   |
|      |             | audit of foreign      | for badging foreign |   |
|      |             | national visitors at  | nationals. We also  |   |
|      |             | NASA Centers found    | recommended the     |   |
|      |             | controls over access  | Agency develop and  |   |
|      |             | to NASA Centers by    | implement a         |   |
|      |             | these visitors needed | NASA-wide           |   |
|      |             | to be strengthened    | management          |   |
|      |             | and uniformly applied | information system  |   |
|      |             | on an Agency-wide     | to support the      |   |
|      |             | basis. Controls over  | foreign national    |   |
|      |             | access by foreign     | visitor program.    |   |
|      |             | national visitors     | Management          |   |
|      |             | varied among the four | concurred with each |   |
|      |             | Centers (Ames,        | recommendation and  |   |
|      |             | Goddard, Johnson, and | planned responsive  |   |
|      |             | Langley). Disparities | corrective actions. |   |
|      |             | among the four        |                     |   |
|      |             | Centers related to:   |                     |   |
|      |             | (1) which foreign     |                     |   |
|      |             | nationals were        |                     |   |
|      |             | controlled, (2) the   |                     |   |
|      |             | types of Government   |                     |   |
|      |             | records checks made,  |                     |   |
|      |             | (3) how visitors were |                     |   |
|      |             | escorted on-site, and |                     |   |
|      |             | (4) how foreign       |                     |   |
|      |             | national visitors     |                     |   |
|      |             | were badged. The      |                     |   |
|      |             | audit also showed     |                     |   |
|      |             | that the Agency lacks |                     |   |
|      |             | a foreign national    |                     |   |
|      |             | visitor management    |                     |   |
|      |             | information system.   |                     |   |
|      |             | Improvements are      |                     |   |
|      |             | needed to ensure that |                     |   |
|      |             | NASA Centers and      |                     |   |
|      |             | information are       |                     |   |
|      |             | adequately protected  |                     |   |
|      |             | against unauthorized  |                     |   |
|      |             | access by foreign     |                     |   |
|      |             | national visitors.    |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA        | An audit found that   | We recommended that |   |
| dits | Oversight   | NASA export, program, | management issue    |   |
|      | of          | and contracting       | guidance that all   |   |
|      | Contractor  | personnel at three    | appropriate NASA    |   |
|      | Exports of  | Centers could not     | contracts require   |   |
|      | controlled  | readily identify the  | the contractors to  |   |
|      | T           | types and amounts of  | deliver (1) a plan  |   |
|      | echnologies | NASA-funded           | for obtaining any   |   |
|      | (IG-00-018) | controlled            | required export     |   |
|      |             | technologies that     | licenses to fulfill |   |
|      |             | contractors export in | contract            |   |
|      |             | support of NASA       | requirements, (2) a |   |
|      |             | programs. Therefore,  | listing of the      |   |
|      |             | NASA does not have    | contractor licenses |   |
|      |             | assurance that        | obtained, and (3) a |   |
|      |             | contractors are       | periodic report of  |   |
|      |             | exporting controlled  | the exports         |   |
|      |             | technologies in       | effected against    |   |
|      |             | accordance with       | those licenses. We  |   |
|      |             | applicable U.S.       | also recommended    |   |
|      |             | export laws and       | that the draft NASA |   |
|      |             | regulations.          | Policy Directive    |   |
|      |             |                       | concerning the      |   |
|      |             |                       | export control      |   |
|      |             |                       | program be revised  |   |
|      |             |                       | to incorporate the  |   |
|      |             |                       | oversight           |   |
|      |             |                       | responsibilities of |   |
|      |             |                       | appropriate NASA    |   |
|      |             |                       | officials.          |   |
|      |             |                       | Management          |   |
|      |             |                       | concurred with each |   |
|      |             |                       | recommendation and  |   |
|      |             |                       | initiated           |   |
|      |             |                       | corrective actions. |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | NASA Teams  | A representative from | \*                  |   |
| dits | to Review   | the OIG Audit staff   |                     |   |
|      | Payments to | participated on a     |                     |   |
|      | the Russian | NASA team established |                     |   |
|      | Government  | to determine whether  |                     |   |
|      | (IG-00-006; | NASA funds paid for   |                     |   |
|      | IG-00-027)  | the Russian Space     |                     |   |
|      |             | Station Mir and the   |                     |   |
|      |             | ISS were properly     |                     |   |
|      |             | routed through the    |                     |   |
|      |             | Bank of New York to   |                     |   |
|      |             | the Russian Space     |                     |   |
|      |             | Agency (RSA),         |                     |   |
|      |             | appropriately         |                     |   |
|      |             | converted into        |                     |   |
|      |             | Russian rubles, and   |                     |   |
|      |             | promptly paid to      |                     |   |
|      |             | Russian               |                     |   |
|      |             | subcontractors to     |                     |   |
|      |             | support               |                     |   |
|      |             | accomplishment of     |                     |   |
|      |             | contract milestones.  |                     |   |
|      |             | The team concluded    |                     |   |
|      |             | that U.S. dollars     |                     |   |
|      |             | paid by NASA from     |                     |   |
|      |             | June 27, 1997,        |                     |   |
|      |             | through June 30,      |                     |   |
|      |             | 1999, were received   |                     |   |
|      |             | by RSA, properly      |                     |   |
|      |             | converted to Russian  |                     |   |
|      |             | rubles, and           |                     |   |
|      |             | appropriately paid to |                     |   |
|      |             | first-tier            |                     |   |
|      |             | subcontractors.       |                     |   |
|      |             |                       |                     |   |
|      |             | A representative of   |                     |   |
|      |             | the OIG Audit staff   |                     |   |
|      |             | also participated on  |                     |   |
|      |             | a separate NASA team, |                     |   |
|      |             | formed at the request |                     |   |
|      |             | of the Associate      |                     |   |
|      |             | Administrator for     |                     |   |
|      |             | Space Flight, to      |                     |   |
|      |             | determine whether     |                     |   |
|      |             | NASA funds that the   |                     |   |
|      |             | RSA paid to           |                     |   |
|      |             | Biopreparat, a major  |                     |   |
|      |             | Russian               |                     |   |
|      |             | pharmaceutical firm,  |                     |   |
|      |             | were properly used    |                     |   |
|      |             | for space             |                     |   |
|      |             | biotechnology         |                     |   |
|      |             | scientific research.  |                     |   |
|      |             | The team reviewed the |                     |   |
|      |             | funding process for   |                     |   |
|      |             | biotechnology         |                     |   |
|      |             | research under the    |                     |   |
|      |             | NASA contract with    |                     |   |
|      |             | RSA. The NASA team    |                     |   |
|      |             | saw no indication     |                     |   |
|      |             | that the funds were   |                     |   |
|      |             | used for other than   |                     |   |
|      |             | the intended purpose. |                     |   |
|      |             | The Inspections       |                     |   |
|      |             | staff, however, has   |                     |   |
|      |             | examined NASA's       |                     |   |
|      |             | controls for the      |                     |   |
|      |             | oversight of the      |                     |   |
|      |             | funds. See G-00-007.  |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Management  | As of May 1999, NASA  | We recommended that |   |
| dits | and         | had about 3,200       | NASA management     |   |
|      | Adm         | non-reimbursable and  | establish controls  |   |
|      | inistration | 300 reimbursable      | to ensure the (1)   |   |
|      | of          | international         | completeness and    |   |
|      | In          | agreements. An OIG    | accuracy of         |   |
|      | ternational | audit identified that | documentation and   |   |
|      | Agreements  | documentation on      | information in the  |   |
|      | at NASA     | NASA's international  | international       |   |
|      | (IG-00-004) | agreements were       | agreements library  |   |
|      |             | incomplete and        | and database, (2)   |   |
|      |             | inaccurate. For       | promptly review and |   |
|      |             | example, over 20      | disposition the     |   |
|      |             | percent of the        | funds in the        |   |
|      |             | agreements listed in  | foreign deposit     |   |
|      |             | the International     | account, and (3)    |   |
|      |             | Agreements database   | identify other      |   |
|      |             | were not on file in   | reimbursable        |   |
|      |             | the External          | accounts with no    |   |
|      |             | Relations             | recent cost         |   |
|      |             | International         | activity.           |   |
|      |             | Agreements Library.   | Management          |   |
|      |             | In addition,          | concurred with the  |   |
|      |             | agreements related to | recommendations and |   |
|      |             | the Space Station,    | initiated           |   |
|      |             | one of NASA's most    | responsive          |   |
|      |             | significant           | corrective actions. |   |
|      |             | international         | Management          |   |
|      |             | programs, were not in | completed actions   |   |
|      |             | the library and were  | on recommendations  |   |
|      |             | not recorded in the   | 1 and 2. Management |   |
|      |             | database. As a        | identified an       |   |
|      |             | result, the Agency is | additional 120      |   |
|      |             | relying on incomplete | international       |   |
|      |             | and inaccurate        | agreements which    |   |
|      |             | information when      | had an earnest      |   |
|      |             | drafting new          | money deposit on    |   |
|      |             | international         | hand, and no cost   |   |
|      |             | agreements or         | activity since      |   |
|      |             | responding to         | receipt of the      |   |
|      |             | inquiries.            | initial deposit.    |   |
|      |             |                       | Management          |   |
|      |             |                       | determined that     |   |
|      |             |                       | seven agreements    |   |
|      |             |                       | should be cancelled |   |
|      |             |                       | and requested a     |   |
|      |             |                       | legal opinion from  |   |
|      |             |                       | the NASA General    |   |
|      |             |                       | Counsel on the      |   |
|      |             |                       | remaining active    |   |
|      |             |                       | agreements to       |   |
|      |             |                       | determine whether   |   |
|      |             |                       | the deposits can be |   |
|      |             |                       | used to finance     |   |
|      |             |                       | current program     |   |
|      |             |                       | costs, even though  |   |
|      |             |                       | the specific        |   |
|      |             |                       | payload may not fly |   |
|      |             |                       | until a future      |   |
|      |             |                       | year. This          |   |
|      |             |                       | recommendation will |   |
|      |             |                       | remain open.        |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Audit of    | NASA (1) has not      | We recommended that |   |
| dits | NASA        | identi­fied all        | management ensure   |   |
|      | Control of  | export-controlled     | that all sensitive  |   |
|      | Export      | technologies related  | technologies are    |   |
|      | -Controlled | to its major          | identified and      |   |
|      | T           | programs, (2) does    | protected, only     |   |
|      | echnologies | not maintain a        | qualified personnel |   |
|      | (IG-99-020) | catalog of            | perform export      |   |
|      |             | classifications for   | control audits, and |   |
|      |             | transfers of those    | NASA employees are  |   |
|      |             | technologies, and (3) | trained in properly |   |
|      |             | needs improved        | classifying and     |   |
|      |             | over­sight of training | protecting          |   |
|      |             | for personnel in the  | sensitive           |   |
|      |             | Export Control        | technologies.       |   |
|      |             | Program.              | Management          |   |
|      |             |                       | concurred and has   |   |
|      |             |                       | begun corrective    |   |
|      |             |                       | actions. All        |   |
|      |             |                       | recommendations     |   |
|      |             |                       | remain open pending |   |
|      |             |                       | publication of a    |   |
|      |             |                       | NASA Policy         |   |
|      |             |                       | Directive (NPD) and |   |
|      |             |                       | an NPG on export    |   |
|      |             |                       | control. We will    |   |
|      |             |                       | continue to monitor |   |
|      |             |                       | management's        |   |
|      |             |                       | actions.            |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | NASA        | We reviewed NASA's    | \*                  |   |
| pect | Oversight   | support of Russian    |                     |   |
| ions | of Russian  | biotechnology         |                     |   |
|      | Bi          | research from 1994 to |                     |   |
|      | otechnology | 1997. We found that   |                     |   |
|      | Research    | the contract between  |                     |   |
|      |             | NASA and the Russian  |                     |   |
|      | (G-00-007)  | Space Agency was well |                     |   |
|      |             | designed in some      |                     |   |
|      |             | aspects and efficient |                     |   |
|      |             | in transferring       |                     |   |
|      |             | funding to Russian    |                     |   |
|      |             | research institutes.  |                     |   |
|      |             | We found that the     |                     |   |
|      |             | State Department did  |                     |   |
|      |             | not discourage NASA   |                     |   |
|      |             | from working with     |                     |   |
|      |             | Russian biotechnology |                     |   |
|      |             | institutes that had   |                     |   |
|      |             | been part of the      |                     |   |
|      |             | Soviet biological     |                     |   |
|      |             | weapons program.      |                     |   |
|      |             | However, when the     |                     |   |
|      |             | State Department      |                     |   |
|      |             | provided NASA with    |                     |   |
|      |             | guidelines on working |                     |   |
|      |             | with potential        |                     |   |
|      |             | dual-use              |                     |   |
|      |             | biotechnology         |                     |   |
|      |             | research, NASA did    |                     |   |
|      |             | not follow these      |                     |   |
|      |             | guidelines. Moreover, |                     |   |
|      |             | NASA exerted minimal  |                     |   |
|      |             | oversight over the    |                     |   |
|      |             | research program.     |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Ins  | Assessment  | In evaluating support | \*                  |   |
| pect | of NASA's   | of cosmonauts flying  |                     |   |
| ions | Financial   | on U.S. missions      |                     |   |
|      | Assistance  | pursuant to           |                     |   |
|      | to Foreign  | agreements between    |                     |   |
|      | Visitors    | NASA and the Russian  |                     |   |
|      | (G-98-006)  | Space Agency, we      |                     |   |
|      |             | recommended, among    |                     |   |
|      |             | other steps and       |                     |   |
|      |             | measures, that NASA   |                     |   |
|      |             | factor payments by    |                     |   |
|      |             | the foreign           |                     |   |
|      |             | governments into      |                     |   |
|      |             | calculations of       |                     |   |
|      |             | compensation by NASA  |                     |   |
|      |             | (management           |                     |   |
|      |             | disagreed). NASA      |                     |   |
|      |             | agreed that the       |                     |   |
|      |             | foreign visitor bank  |                     |   |
|      |             | accounts should not   |                     |   |
|      |             | be held jointly with  |                     |   |
|      |             | civil servants.       |                     |   |
+------+-------------+-----------------------+---------------------+---+

######### 

+------+-------------+-----------------------+---------------------+---+
| #    |             |                       |                     |   |
| #### |             |                       |                     |   |
| ###  |             |                       |                     |   |
| Tabl |             |                       |                     |   |
| e 10 |             |                       |                     |   |
|  --  |             |                       |                     |   |
| Envi |             |                       |                     |   |
| ronm |             |                       |                     |   |
| enta |             |                       |                     |   |
| l Ma |             |                       |                     |   |
| nage |             |                       |                     |   |
| ment |             |                       |                     |   |
+======+=============+=======================+=====================+===+
| *    | **          | ***Results***         | ***Recommendations  |   |
| **Pr | *Reports*** |                       | Pending Corrective  |   |
| ogra |             |                       | Action***           |   |
| m*** |             |                       |                     |   |
|      |             |                       |                     |   |
| **   |             |                       |                     |   |
| *Are |             |                       |                     |   |
| a*** |             |                       |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Compliance  | Of 13 mission-related | We made nine        |   |
| dits | with the    | programs/projects     | recommendations     |   |
|      | National    | reviewed at three     | addressing needed   |   |
|      | En          | NASA Centers, 11 (85  | improvements in     |   |
|      | vironmental | percent) did not      | NEPA planning,      |   |
|      | Policy Act  | consider              | oversight, and      |   |
|      | (IG-00-030) | environmental impacts | training.           |   |
|      |             | as required by NEPA   | Management has      |   |
|      |             | and NASA guidance. In | proposed corrective |   |
|      |             | addition, two of nine | actions that        |   |
|      |             | construction of       | resolve all of the  |   |
|      |             | facilities projects   | recommendations.    |   |
|      |             | did not fully comply  | Seven of the        |   |
|      |             | with NASA guidance    | recommendations     |   |
|      |             | for implementing      | remain open pending |   |
|      |             | NEPA. The             | completion of       |   |
|      |             | programs/projects     | management's        |   |
|      |             | that did not comply   | corrective actions. |   |
|      |             | with NEPA, valued at  |                     |   |
|      |             | about \$3 billion,    |                     |   |
|      |             | potentially were      |                     |   |
|      |             | exposed to increased  |                     |   |
|      |             | costs, project        |                     |   |
|      |             | delays, missed        |                     |   |
|      |             | opportunities for     |                     |   |
|      |             | preferable            |                     |   |
|      |             | alternatives and/or   |                     |   |
|      |             | public involvement,   |                     |   |
|      |             | and adverse public    |                     |   |
|      |             | perception and        |                     |   |
|      |             | reaction.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | En          | The production of the | We recommended that |   |
| dits | vironmental | external tank for the | management (1)      |   |
|      | Aspects of  | Space Shuttle still   | modify the current  |   |
|      | the         | presents the          | external tank       |   |
|      | External    | potential for         | contract, if        |   |
|      | Tank        | environmental impact. | economically        |   |
|      | Contract    | The current external  | feasible, to        |   |
|      | NAS8-36200  | tank contract has not | include a           |   |
|      | (IG-99-051) | been modified to      | requirement for the |   |
|      |             | incorporate the       | contractor to       |   |
|      |             | Federal waste         | establish a waste   |   |
|      |             | reduction program as  | reduction program   |   |
|      |             | set forth under FAR   | that complies with  |   |
|      |             | part 52.223-10.       | the FAR             |   |
|      |             | Consequently, adverse | requirements; and   |   |
|      |             | environmental impact  | (2) ensure that the |   |
|      |             | may not be minimized  | requirement for a   |   |
|      |             | and potential         | waste reduction     |   |
|      |             | recycling benefits    | program is included |   |
|      |             | cannot be realized.   | in the Space Flight |   |
|      |             |                       | Operations Contract |   |
|      |             |                       | (SFOC). Management  |   |
|      |             |                       | concurred with the  |   |
|      |             |                       | intent of both      |   |
|      |             |                       | recommendations.    |   |
|      |             |                       | Both                |   |
|      |             |                       | recommendations     |   |
|      |             |                       | remain open pending |   |
|      |             |                       | completion of       |   |
|      |             |                       | corrective actions. |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Cost        | Environmental laws    | The OIG made four   |   |
| dits | Sharing for | require past and      | recommendations     |   |
|      | Santa       | present owners,       | concerning a cost   |   |
|      | Susana      | operators, and        | sharing agreement,  |   |
|      | Field       | generators of         | recovery of costs,  |   |
|      | Laboratory  | hazardous waste to    | and allocation of   |   |
|      | (SSFL)      | clean up the waste    | future preventive   |   |
|      | Cleanup     | sites. The Rocketdyne | costs. We have      |   |
|      | Activities  | contaminated portions | closed the two      |   |
|      |             | of the SSFL during    | recommendations     |   |
|      | (IG-98-024) | the performance of    | that address        |   |
|      |             | past Air Force        | preventive costs.   |   |
|      |             | contracts. NASA has   | NASA has completed  |   |
|      |             | not negotiated cost   | its analysis of     |   |
|      |             | sharing agreements    | recommendations     |   |
|      |             | with responsible      | ad­dressing          |   |
|      |             | parties and may have  | preventive costs    |   |
|      |             | overpaid \$16.4       | and plans to        |   |
|      |             | million in            | recommend closure   |   |
|      |             | remediation costs.    | of these            |   |
|      |             | Rocketdyne may also   | recommendations.    |   |
|      |             | have overcharged NASA | NASA has not begun  |   |
|      |             | \$4.7 million in      | negotiations of a   |   |
|      |             | preventative costs    | cost sharing        |   |
|      |             | through potential     | agreement for       |   |
|      |             | Cost Accounting       | remediation costs   |   |
|      |             | Standards             | and plans to        |   |
|      |             | non-compliant         | recommend closure   |   |
|      |             | allocation practices. | of these            |   |
|      |             | NASA could continue   | recommendations     |   |
|      |             | to overpay \$13.7     | without negotiating |   |
|      |             | million annually.     | a cost sharing      |   |
|      |             |                       | agreement. NASA's   |   |
|      |             |                       | current position is |   |
|      |             |                       | that the Agency has |   |
|      |             |                       | no legal basis for  |   |
|      |             |                       | recovering          |   |
|      |             |                       | remediation costs   |   |
|      |             |                       | due to the nature   |   |
|      |             |                       | of the laws under   |   |
|      |             |                       | which cleanup       |   |
|      |             |                       | actions have        |   |
|      |             |                       | commenced. In       |   |
|      |             |                       | addition, NASA      |   |
|      |             |                       | admits to having a  |   |
|      |             |                       | liability for       |   |
|      |             |                       | cleaning up only    |   |
|      |             |                       | one of the four     |   |
|      |             |                       | contaminated sites  |   |
|      |             |                       | at the facility.    |   |
|      |             |                       | The remaining sites |   |
|      |             |                       | are the             |   |
|      |             |                       | responsibility of   |   |
|      |             |                       | other parties. The  |   |
|      |             |                       | two recommendations |   |
|      |             |                       | that address cost   |   |
|      |             |                       | sharing are         |   |
|      |             |                       | unresolved. We are  |   |
|      |             |                       | working with        |   |
|      |             |                       | management to       |   |
|      |             |                       | resolve the issues. |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Kennedy     | In evaluating         | \*                  |   |
| dits | Space       | Kennedy's efforts to  |                     |   |
|      | Center's    | maximize recycling,   |                     |   |
|      | Recycling   | we found that the     |                     |   |
|      | Efforts     | Center's annual       |                     |   |
|      | (IG-98-017) | progress reports for  |                     |   |
|      |             | recycling goals and   |                     |   |
|      |             | objectives contained  |                     |   |
|      |             | inaccurate and        |                     |   |
|      |             | inconsistent data,    |                     |   |
|      |             | preventing reasonable |                     |   |
|      |             | measurements of       |                     |   |
|      |             | program               |                     |   |
|      |             | accomplishments. In   |                     |   |
|      |             | addition, Kennedy     |                     |   |
|      |             | lacked procedures to  |                     |   |
|      |             | retain proceeds from  |                     |   |
|      |             | its recycling         |                     |   |
|      |             | program, which could  |                     |   |
|      |             | be used to promote    |                     |   |
|      |             | the Center's          |                     |   |
|      |             | recycling goals and   |                     |   |
|      |             | objectives.           |                     |   |
|      |             | Management concurred  |                     |   |
|      |             | with our              |                     |   |
|      |             | recommendations and   |                     |   |
|      |             | implemented           |                     |   |
|      |             | corrective actions.   |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Lewis       | We found internal     | \*                  |   |
| dits | Research    | control weaknesses in |                     |   |
|      | Center's    | Lewis' hazardous      |                     |   |
|      | Hazardous   | waste manifest        |                     |   |
|      | Waste       | process that could    |                     |   |
|      | Manifest    | prevent the Center    |                     |   |
|      | Process     | from ensuring full    |                     |   |
|      | (IG-98-014) | regulatory compliance |                     |   |
|      |             | and minimizing its    |                     |   |
|      |             | liability when        |                     |   |
|      |             | disposing of          |                     |   |
|      |             | hazardous waste. The  |                     |   |
|      |             | manifest is the key   |                     |   |
|      |             | document used to      |                     |   |
|      |             | track the waste       |                     |   |
|      |             | throughout the        |                     |   |
|      |             | disposal process.     |                     |   |
|      |             | Center management     |                     |   |
|      |             | concurred with our    |                     |   |
|      |             | recommendations and   |                     |   |
|      |             | implemented           |                     |   |
|      |             | corrective actions to |                     |   |
|      |             | strengthen its        |                     |   |
|      |             | controls.             |                     |   |
+------+-------------+-----------------------+---------------------+---+
| Au   | Efforts to  | NASA's Shuttle        | \*                  |   |
| dits | Eliminate   | Program has           |                     |   |
|      | Ozone       | proactively reduced   |                     |   |
|      | Depleting   | its use of ODC's by   |                     |   |
|      | Chemicals   | 90 percent by finding |                     |   |
|      | (ODC's)     | replacement           |                     |   |
|      | from Space  | substances and        |                     |   |
|      | Shuttle     | processes. Although   |                     |   |
|      | Operations  | the Agency has taken  |                     |   |
|      | (February   | positive steps to     |                     |   |
|      | 25, 1998)   | reduce ODC's, we      |                     |   |
|      |             | identified seven      |                     |   |
|      |             | areas in which the    |                     |   |
|      |             | Agency could improve  |                     |   |
|      |             | its control over      |                     |   |
|      |             | ODC's. NASA has taken |                     |   |
|      |             | or proposed actions   |                     |   |
|      |             | that are responsive   |                     |   |
|      |             | to our suggestions.   |                     |   |
+------+-------------+-----------------------+---------------------+---+
| In   | P           | As a result of a      | \*                  |   |
| vest | artnerships | joint investigation   |                     |   |
| igat | With State, | by NASA Office of     |                     |   |
| ions | Local and   | Inspector General and |                     |   |
|      | Federal Law | other Federal and     |                     |   |
|      | Enforcement | state law enforcement |                     |   |
|      | Agencies    | agencies, a           |                     |   |
|      | Targeting   | contractor pled       |                     |   |
|      | En          | guilty to a criminal  |                     |   |
|      | vironmental | information for       |                     |   |
|      | Crimes      | improperly storing    |                     |   |
|      |             | and disposing of      |                     |   |
|      |             | hazardous waste. The  |                     |   |
|      |             | company paid \$6.5    |                     |   |
|      |             | million in fines. The |                     |   |
|      |             | OIG and other         |                     |   |
|      |             | agencies are pursuing |                     |   |
|      |             | civil claims.         |                     |   |
+------+-------------+-----------------------+---------------------+---+

[^1]: \"Special management attention\" is a NASA term for information
    systems that are considered to be the most important to NASA in
    accomplishing its mission. Increased oversight of these IT systems
    is required due to the risk and magnitude of harm that would result
    from the loss, misuse, unauthorized access to, or modification of
    the data in a system.

[^2]: In February 1996, Congress enacted the Clinger-Cohen Act to reform
    and improve the way Federal agencies acquire and manage IT
    resources. The law requires each agency

    head to establish clear accountability for IT management activities
    by appointing an agency CIO with the visibility and management
    responsibilities necessary to carry out the specific provisions of
    the Act.

[^3]: MEI is the minimum infrastructure necessary for an agency to
    conduct its core mission(s). MEI includes, but is not limited to,
    critical physical assets, information technology systems, and
    information collected, processed, transmitted, stored, or
    disseminated electronically. We found errors in NASA's MEI list. For
    example, wind tunnels at three NASA Centers were listed as physical
    assets. The wind tunnels should have been classified as combined
    physical/cyber-based assets. The MEI list also contained
    inconsistencies. For example, six Centers included their telephone
    system as an MEI asset, while four Centers did not.

[^4]: NASA Enterprises are: Aerospace Technology, Biological and
    Physical Science, Earth Science, Human Exploration and Development
    of Space, and Space Science.

[^5]: The GAO discusses NASA's contract management in "Observations on
    the National Aeronautics and Space Administration's FY 1999
    Performance Report and FY 2001 Performance Plan," B-285486,
    June 30, 2000.

[^6]: AXAF was renamed the *Chandra X-ray Observatory*.

[^7]: GAO issued Audit Report GAO/NSID-97-98, "Environmental Cleanup
    Costs: NASA is Making Progress in Identifying Contamination, but
    More Effort Is Needed," in June 1997.

[^8]: Institutional Program Offices are the Office Aerospace Technology,
    Office of Space Flight, Office of Earth Science, and Office of Space
    Science.