prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: The Secret Service plays a critical role in protecting the President, Vice President, their immediate families, and national leaders, among others  In addition, the component is responsible for safeguarding the nation’s currency and financial payment systems  To accomplish its mission, Secret Service officials reported that, as of June 2018, the component had approximately 7,100 employees (including the Uniformed Division, special agents, and administrative, professional, and technical staff)  These employees were assigned to the component’s headquarters in Washington, D C , and 133 field offices located throughout the world (including 115 domestic offices and 18 international offices)  The Secret Service’s employees are heavily dependent on the component’s IT infrastructure and communications systems to perform their daily duties  According to data reported on the Office of Management and Budget’s IT Dashboard, the component planned to spend approximately $104 8 million in fiscal year 2018 to modernize and maintain its IT environment  To manage this IT environment, the Secret Service hired a full-time CIO in November 2015  In addition, in an effort to improve its management structure, the component consolidated all IT staff and assets under this new CIO in March 2017  OCIO officials stated that these staff include the government employees who provide direct and indirect support of the day-to-day operations of the Secret Service’s enterprise systems and services  According to Secret Service officials, the component’s IT workforce included 190 staff, as of July 2018  These officials stated that 166 of these employees were located in the component’s headquarters in Washington, D C , and 24 were located in domestic field offices  The officials also reported that these July 2018 staffing levels were below their current approved staffing level of 220 staff (which included 44 positions in domestic field offices)  Secret Service IT staff also deploy to other locations, as necessary, to provide support for certain security activities  For example, the Secret Service reported that, in 2017, OCIO deployed over 79 staff to New York, N Y , to provide communications support during the United Nations General Assembly  As a component of DHS, the Secret Service must follow the department’s policies and processes for managing acquisitions, including IT acquisitions  DHS categorizes its acquisition programs according to three levels that are determined by the life cycle costs of the programs  These levels then determine the extent of required program and project management and the acquisition decision authority (the individual responsible for management and oversight of the acquisition)  The department also categorizes its acquisition programs as major or non- major based on expected cost  Table 1 describes the levels of DHS’s acquisition programs and their associated acquisition decision authorities  DHS’s policies and processes for managing major acquisition programs are primarily set forth in its Acquisition Management Directive 102-01 and Acquisition Management Instruction 102-01-001  In particular, these policies establish that a major acquisition program’s decision authority is to review the program at a series of predetermined acquisition decision events to assess whether the program is ready to proceed through the acquisition life cycle phases  Figure 1 depicts the acquisition life cycle established in DHS acquisition management policy  DHS’s Acquisition Management Directive and Instruction do not establish an acquisition life cycle framework for the department’s non-major acquisition programs  Instead, according to the Instruction, Component Acquisition Executives (i e , the senior acquisition official within a component that is responsible for implementation, management, and oversight of the component’s acquisition process) are required to establish component-specific non-major acquisition policies and guidance that support the “spirit and intent” of the department’s acquisition policies  To that end, the Secret Service developed a policy that establishes an acquisition life cycle framework for its non-major acquisition programs  This acquisition framework for the component’s non-major acquisition programs is consistent with the acquisition framework that DHS established for its major acquisition programs  In particular, the Secret Service’s framework includes the same phases and decision events as DHS’s framework (e g , acquisition decision event 2A, the point at which the acquisition decision authority determines whether a program may proceed into the obtain phase)  In addition, DHS’s Systems Engineering Life Cycle Instruction and Guidebook outline a framework of major systems engineering activities and technical reviews that are to be conducted by all DHS programs and projects, both major and non-major  This framework is intended to ensure that appropriate systems engineering activities are planned and implemented, and that a program’s development effort is meeting the business need  In particular, the systems engineering life cycle framework consists of nine major activities (e g , requirements definition, integration, and testing) and a set of related technical reviews (e g , preliminary design review) and artifacts (e g , requirements documents)  DHS policy allows programs to tailor these activities, technical reviews, and artifacts based on the unique characteristics of the program (e g , scope, complexity, and risk)  For example, a program may combine systems engineering technical reviews and artifacts, or add additional reviews  This tailored approach must be documented in a program’s systems engineering life cycle tailoring plan  The systems engineering technical reviews are intended to provide DHS the opportunity to determine how well a program has completed the necessary systems engineering activities  Each technical review includes a minimum set of exit criteria that must be satisfied before a program may move on to the next systems engineering activity  At the end of the technical review, the program manager must develop a technical review completion letter that documents the outcome of the review, including stakeholder concurrence that the exit criteria were satisfied  Moreover, DHS’s agile instruction, which was first issued in April 2016 and updated in April 2018, identifies agile as the preferred development approach for the department’s IT programs and projects  Agile is a type of incremental (i e , modular) development, which calls for the rapid delivery of software in small, short increments rather than in the typically long, sequential phases of a traditional waterfall approach  DHS’s agile instruction also states that component CIOs are to set modular (i e , incremental) outcomes and target measures to monitor progress in achieving agile implementation for IT programs and projects  To that end, the department identified core metrics that its agile IT programs are to use to monitor progress, including the number of story points completed per release and the number of releases per quarter  Further, DHS policy and guidance have established an acquisition (i e , contract) review process that is intended to enable the DHS CIO to review and effectively guide the department’s IT expenditures  According to the department’s IT acquisition review guidance, DHS components with a CIO (which includes the Secret Service) are to submit to DHS OCIO for review, IT acquisitions that (1) have total estimated procurement values of $2 5 million or more; and (2) are funded by a level 1, 2, or 3 program with a life cycle cost estimate of at least $50 million (i e , a major investment, as defined by DHS’s capital planning and investment control guidance)  DHS policies and guidance also establish numerous responsibilities for the department’s component-level CIOs that are aimed at ensuring proper oversight and management of the components’ IT investments  Among other things, these component-level CIO responsibilities relate to topics such as IT budgeting, portfolio management, and oversight of programs’ systems engineering life cycles  Table 2 identifies 14 selected IT oversight responsibilities for DHS’s component CIOs  The Secret Service acquires IT infrastructure and services that are intended to improve its ability to execute its investigation and protection missions  According to data reported on the Office of Management and Budget’s IT Dashboard, the Secret Service planned to spend about $104 8 million on IT in fiscal year 2018, which included approximately $34 6 million for the development and modernization of its IT infrastructure and services, and about $70 2 million for the operations and maintenance of this infrastructure (including 21 existing IT systems)  Also according to data reported on the IT Dashboard, as of April 2018, the Secret Service had one major IT investment (called the Information Integration and Technology Transformation and discussed in more detail later in this report), seven non-major IT investments, and one non- standard infrastructure investment  Figure 2 depicts the Secret Service’s planned IT spending for fiscal year 2018  The Secret Service has faced long-standing challenges in managing its IT infrastructure  For example, A National Security Agency audit of the Secret Service’s IT environment in 2008 identified network and system vulnerabilities that needed immediate remediation to protect the component’s systems and electronic information  The Secret Service determined in 2010 that it had IT capability gaps associated with three key areas: network security, information sharing and situational awareness, and operational communications  The component reported that it required a significant IT modernization effort with sustained investment of resources to replace dated and restrictive network and communications capabilities  The Secret Service also reported in 2010 that it had 42 mission- support applications that were operating on a 1980’s mainframe that lacked multi-level security (i e , the ability to view classified information from two security levels, such as secret and top secret, at the same time), was beyond its equipment life cycle, and was at risk of failing  Further, in 2011, DHS’s Office of Inspector General reported that the Secret Service’s existing infrastructure did not meet current operational requirements  According to the Secret Service, this dated infrastructure was unable to support newer technologies (e g , Internet protocol), share common DHS enterprise services, or migrate to the department’s consolidated data centers  To address challenges with its IT environment, in 2009, the Secret Service initiated the IITT investment, which is intended to modernize and enhance the component’s infrastructure, communications systems, applications, and processes  In particular, IITT is a portfolio of programs and projects that are meant to, among other things, improve systems availability in support of the Secret Service’s business operations, increase interoperability with other government systems and networks, enhance the component’s system and network security, and enable scalability to support growth  From 2010 to July 2018, according to OCIO officials, the Secret Service spent approximately $392 million on IITT  In fiscal year 2018, the component had planned to spend approximately $42 7 million on IITT (i e , about 40 percent of its total planned IT spending for the fiscal year), according to data reported on the Office of Management and Budget’s IT Dashboard  In total, the planned life cycle cost estimate for IITT is at least $811 million  As of June 2018, IITT was a major investment comprised of two programs (one of which included three projects) and one standalone project (i e , it was not part of another program) that had capabilities that were in planning or development and modernization  These programs and project were the Enabling Capabilities program, Enterprise Resource Management System program (which included three projects that were each being implemented using an agile methodology: Uniformed Division Resource Management System, Events Management, and Enterprise-wide Scheduling), and the Multi-Level Security project  Table 3 describes the IITT programs and projects that had capabilities that were in planning or development and modernization, as of June 2018  The table also includes the associated level, acquisition decision authority, estimated life cycle costs, and planned or actual dates of operational capability for each of the programs and projects  (Appendix II also provides additional information on these programs and projects ) The Enabling Capabilities program within IITT is designated as a major acquisition program  As such, its acquisition decision authority is the DHS Under Secretary for Management, and both DHS and the Secret Service provide oversight to this program  IITT’s other program and project—the Enterprise Resource Management System program (which includes three projects, as discussed earlier) and Multi-Level Security project—are designated non-major acquisition programs  In June 2011, DHS’s Under Secretary for Management delegated acquisition decision authority for this non-major program and project to the Secret Service Component Acquisition Executive  As such, oversight of the Enterprise Resource Management System program (including its three projects) and the Multi- Level Security project is conducted primarily at the component level  The Secret Service also implemented other capabilities that are now in operations and maintenance (i e , the capabilities have been fielded and are operational) as part of the IITT investment, such as a capability to move data between systems in separate classification levels (e g , top secret and secret) and communications interoperability  Table 4 describes IITT capabilities that are in operations and maintenance  DHS, including the Secret Service, has faced long-standing challenges in effectively managing its workforce  In January 2003, we designated the implementation and transformation of DHS as high risk, including its management of human capital, because it had to transform 22 agencies—several with major management challenges—into one department  This represented an enormous and complex undertaking that would require time to achieve in an effective and efficient manner  Since that time, the department has made important progress in strengthening and integrating its management functions  Nevertheless, we have continued to report that significant work remains for DHS to improve these management functions  Among other things, we previously reported that the department had lower average employee morale than the average for the rest of the federal government  We also reported that, in 2011, based on employee responses to the Office of Personnel Management’s Federal Employee Viewpoint Survey—a tool that measures employees’ perceptions of whether and to what extent conditions characterizing successful organizations are present in their agency—DHS was ranked 31st out of 33 large agencies on the Partnership for Public Service’s Best Places to Work in the Federal Government rankings  The most recent results of these surveys in 2017 showed that DHS continues to maintain its low rankings  DHS’s Office of Inspector General has reported on challenges that the Secret Service has faced in managing its IT workforce  Specifically, in October 2016, the Inspector General reported that the Secret Service CIO did not have oversight of, or authority over, all IT resources, including the workforce; in particular, almost all of the component’s IT employees were located in a division outside of OCIO; and the Secret Service had vacancies in key positions responsible for managing IT, including not having a full-time CIO from December 2014 through November 2015  As previously discussed, the Secret Service has taken actions to address these two issues with the management of its IT workforce  These actions included hiring its full-time CIO in November 2015 and consolidating the workforce and all IT assets under this CIO in March 2017  Of the 14 selected responsibilities established for component-level CIOs in DHS’s IT management policies, the Secret Service CIO had fully implemented 11 responsibilities and had partially implemented 3 responsibilities  Table 5 summarizes the extent to which the Secret Service CIO had implemented each of the 14 responsibilities  The Secret Service CIO fully implemented 11 of the 14 selected component-level CIO responsibilities  Examples of the responsibilities that the CIO fully implemented are as follows: Develop, implement, and maintain a detailed IT strategic plan  Consistent with DHS’s IT Integration and Management directive, in January 2017, the Secret Service CIO developed an IT strategic plan that outlined the CIO’s strategic IT goals and objectives, as well as tasks intended to meet the goals and objectives  The CIO maintained this strategic plan, to include updating it in January 2018  The CIO also took steps to implement the tasks identified within the strategic plan, such as working to develop an IT training program  In particular, as part of this effort to develop an IT training program, OCIO identified recommended training for the office’s various IT workforce groups (discussed in more detail later in this report)  Concur with each program’s and/or project’s systems engineering life cycle tailoring plan  In accordance with DHS’s Systems Engineering Life Cycle instruction, the Secret Service CIO concurred with the systems engineering life cycle tailoring plan for one program and three projects included in the Secret Service’s IITT investment  Specifically, the CIO documented his approval via his signature on the tailoring plans for IITT’s Enabling Capabilities program, and Multi-Level Security, Uniformed Division Resource Management System, and Events Management projects  Participate on DHS’s CIO Council, Enterprise Architecture Board, or other councils/boards as appropriate, and appoint employees to serve when necessary  As required by DHS’s IT Integration and Management directive, the Secret Service CIO participated on two required DHS-level councils/boards, and appointed a delegate to serve in his place, when necessary  Specifically, the Secret Service CIO or the CIO’s delegate—the Deputy CIO—attended bi-monthly meetings of the DHS CIO Council  In addition, another Secret Service CIO appointee—the component’s Chief Architect—attended an ad hoc meeting of the Enterprise Architecture Board in June 2017  In addition, the Secret Service CIO had partially implemented three component-level CIO responsibilities, as follows  Manage the component IT investment portfolio, including establishing a component-level IT acquisition review process that enables component and DHS review of component acquisitions (i e , contracts) that contain IT  As directed in DHS’s Capital Planning and Investment Control directive and guidebook, the Secret Service CIO took steps to manage the component’s IT investment portfolio, including reviewing certain contracts containing IT  For example, among our random sample of 33 IT contracts that the Secret Service awarded between October 1, 2016, and June 30, 2017, we found that the CIO or the CIO’s delegate had reviewed 31 of these contracts  However, the CIO had not established and documented a defined process for reviewing contracts containing IT, which may have contributed to why the CIO or the CIO’s delegate did not review 2 of the 33 contracts in our sample  OCIO officials were unable to explain why neither of these officials reviewed the 2 contracts, which had a combined planned total procurement value of approximately $1 75 million  In particular, one of the contracts, with a planned total procurement value of about $1,122,934, was to provide credentialing services for the 2017 Presidential Inauguration  The other contract, with a planned total procurement value of about $629,337, was to provide maintenance support for a logistics system  The OCIO officials acknowledged that both contracts should have been approved by one of these officials  Without establishing and documenting an IT acquisition review process that ensures that the CIO or the CIO’s delegate reviews all contracts containing IT, as appropriate, the CIO’s ability to analyze the contracts to ensure that they are a cost-effective use of resources and are aligned with the component’s missions and goals is limited  Ensure all component IT policies are in compliance and alignment with DHS IT directives and instructions  As required by DHS’s IT Integration and Management directive, the Secret Service CIO had ensured that certain component IT policies were in compliance and alignment with DHS IT directives and instructions  For example, in alignment with the department’s IT Integration and Management directive, the Secret Service’s Investment Governance for IT policy specifies that the component CIO (in conjunction with each Secret Service Office) is responsible for developing the component IT spend plan, as well as developing and maintaining an IT strategic plan  However, the Secret Service’s enterprise governance policy was not in compliance with DHS’s IT Integration and Management directive  Specifically, while the department’s policy states that the Secret Service CIO is responsible for developing and reviewing the component’s IT budget formulation and execution, the Secret Service’s enterprise governance policy does not specify this as the CIO’s responsibility  According to OCIO officials, the Secret Service CIO participates in the development and review of the IT budget formulation and execution as a member of the Executive Resources Board (the Secret Service’s highest-level governing body, which has the final decision authority and responsibility for enterprise governance), and the Secret Service Deputy CIO is a voting member of the Enterprise Governance Council (the Secret Service’s second-level governance body and advisory council to the Executive Resources Board)  However, the Secret Service’s enterprise governance policy has not been updated to reflect these roles  The Secret Service did not update its enterprise governance policy to properly reflect the CIO’s and Deputy CIO’s roles on the Executive Resources Board or Enterprise Governance Council because OCIO officials were not aware that these roles were not properly documented in the component’s policy until we identified this issue during our review  Further compounding the issue of the Secret Service’s enterprise governance policy not properly reflecting the CIO’s and Deputy CIO’s roles and responsibilities on the component’s governance boards is that the Secret Service has not developed a charter for its Executive Resources Board  We have previously reported that a best practice for effective investment management is to define and document the board’s membership, roles, and responsibilities  One such way to do so is via a charter  According to Secret Service officials, the component does not have a charter for the board because, while the Secret Service has established the board pursuant to law, there is little statutory guidance on how the board must be formalized, including whether a charter is required  The officials acknowledged that development of a board charter is a best practice  They stated that, in response to our review, the component has begun efforts to develop a charter for the Executive Resources Board, but they did not know when it would be completed  Until the Secret Service updates its enterprise governance policy to specify (1) the CIO’s current role and responsibilities on the Executive Resources Board, to include developing and reviewing the IT budget formulation and execution, and (2) the Deputy CIO’s role and responsibilities on the Enterprise Governance Council, the CIO’s ability to develop and review the component’s IT budget may be limited  Further, until the Secret Service develops a charter for its Executive Resources Board that specifies the roles and responsibilities of all board members, including the CIO, the Secret Service will not be effectively positioned to ensure that all members understand their roles and responsibilities on the board and will perform them as expected  Set modular outcomes and target measures to monitor the progress in achieving agile implementation for IT programs and/or projects within their component  Consistent with DHS policy, the Secret Service CIO has set modular outcomes and target measures to monitor the progress of two IITT projects that the component is implementing using an agile methodology—Uniformed Division Resource Management System and Events Management  For example, the modular outcomes set for these projects included measuring planned and actual burndown (i e , the number of user stories completed)  In addition, the projects were to measure their velocity (i e , the rate of work completed) for each sprint (i e , a set period of time during which the development team is expected to complete tasks related to developing a piece of working software)  However, the modular outcomes and target measures did not include product quality or post-deployment user satisfaction, although such measures are leading practices for managing agile projects  According to Secret Service OCIO officials, the component does not mandate the specific metrics that its agile projects are to use; instead, each project is to determine the metrics based on stakeholder requirements and unique project characteristics  The officials further stated that these metrics are to be documented in an acquisition program baseline and program management plan; this baseline and program management plan are then to be approved by the CIO  To its credit, the component’s one agile project that, as of May 2018, had deployed its system to users—the Uniformed Division Resource Management System—did measure product quality  OCIO officials also stated that they regularly receive verbal, undocumented feedback from users on the system and they plan to conduct a documented user satisfaction survey on this system by September 2018  Nevertheless, without ensuring that product quality and post- deployment user satisfaction metrics are included in the modular outcomes and target measures that the CIO sets for monitoring agile projects, the Secret Service lacks assurance that the Events Management project or other future agile projects will measure product quality or post-deployment user satisfaction  Without guidance specifying that agile projects track these metrics, the projects may not do so and the CIO may be limited in his knowledge of the progress being made on these projects  Workforce planning and management is essential for ensuring that federal agencies have the talent, skill, and experience mix they need to execute their missions and program goals  To help agencies effectively conduct workforce planning and management, the Office of Personnel Management, the Chief Human Capital Officers Council, DHS, the Secret Service, and we have identified numerous leading practices related to five workforce areas: strategic planning, recruitment and hiring, training and development, employee morale, and performance management  Table 6 identifies the five workforce areas and 15 selected leading practices associated with these areas (3 practices within each area)  Of the five selected workforce planning and management areas, the Secret Service had substantially implemented two of the areas and minimally implemented three of the areas for its IT workforce  In addition, of the 15 selected leading practices associated with these workforce planning and management areas, the Secret Service had fully implemented 3 practices, partly implemented 8 practices, and did not implement any aspects of 4 practices  Table 7 summarizes the extent to which the Secret Service had implemented for its IT workforce the five selected workforce planning and management areas and 15 selected leading practices associated with those areas, as of June 2018  Strategic workforce planning is an essential activity that an agency needs to conduct to ensure that its human capital program aligns with its current and emerging mission and programmatic goals, and that the agency is able to meet its future needs  We previously identified numerous leading practices related to IT strategic workforce planning, including that an organization should (1) establish and maintain a strategic workforce planning process, including developing all competency and staffing needs; (2) regularly assess competency and staffing needs, and analyze the IT workforce to identify gaps in those areas; and (3) develop strategies and plans to address gaps in competencies and staffing  The Secret Service minimally implemented the three selected leading practices associated with the IT strategic workforce planning area  Specifically, the component partly implemented two of the practices and did not implement one practice  Table 8 lists these selected leading practices and provides our assessment of the Secret Service’s implementation of the practices  Establish and maintain a strategic workforce planning process, including developing all competency and staffing needs—partly implemented  The Secret Service took steps to establish a strategic workforce planning process for its IT workforce  For example, the Secret Service CIO developed and maintained a plan that identified strategic workforce planning tasks, to include analyzing the staffing requirements of the IT workforce  In addition, the Secret Service defined general core competencies (e g , communication and customer service) for its workforce, including IT staff  However, OCIO did not identify all required knowledge and skills needed to support this office’s functions  In particular, while OCIO identified certain technical competencies that its IT workforce needs, such as cybersecurity, the office did not identify and document all of the technical competencies that it needs  OCIO officials stated that they did not identify and document the technical competencies that the office needs because the Secret Service was focused on reorganizing the IT workforce under a single, centralized reporting chain within the CIO’s office  Consequently, the officials stated that they had not completed the work to identify all required IT knowledge and skills necessary to support the office  Yet, the Secret Service completed the IT workforce reorganization effort over a year ago, in March 2017 and, since then, OCIO has not identified all of the required IT knowledge and skills that the office needs  OCIO officials told us that they plan to identify all of the technical competency needs for the IT workforce, but they were unable to specify a time frame for when these needs would be fully identified  Until OCIO identifies all of the required knowledge and skills for the IT workforce, the office will be limited in its ability to identify and address any competency gaps associated with this workforce  In addition, the Secret Service did not reliably determine the number of IT staff that it needs in order to support OCIO’s functions  Specifically, in January 2017, an independent review of the staffing model that the component used to identify its IT workforce staffing needs found that the model was not based on any verifiable underlying data  In late August 2018, Office of Human Resources officials reported that they had hired a contractor in early August 2018 to update the staffing model to improve the quality of the data  These officials expected the contractor to finish updating the model by August 2019  The officials plan to use the updated model to identify the Secret Service’s IT workforce staffing needs for fiscal year 2021  Updating the staffing model to incorporate verifiable workload data should increase the likelihood that the Secret Service is able to appropriately identify its staffing needs for its IT workforce  Regularly assess competency and staffing needs, and analyze the IT workforce to identify gaps in those areas—not implemented  The Secret Service regularly assessed the competency and staffing needs for 1 of the occupational series within its IT workforce (i e , the 2210 IT Specialist series)  However, it did not regularly assess the competency and staffing needs for the remaining 11 occupational series that are associated with the component’s IT workforce, nor identify any gaps that it had in those areas  OCIO officials stated that they had not assessed these needs or identified competency or staffing gaps because, among other things, the Secret Service was focused on reorganizing the IT workforce under a single, centralized reporting chain within the CIO’s office  However, as previously mentioned, the component completed this effort in March 2017, but OCIO did not subsequently assess its competency and staffing needs, nor identify gaps in those areas  OCIO officials reported that they plan to assess the competencies of the IT workforce to identify any gaps that may exist; however, they were unable to identify a specific date by which they expect to have the capacity to complete this assessment  Until OCIO regularly analyzes the IT workforce to identify its competency needs and any gaps it may have, OCIO will be limited in its ability to determine whether its IT workforce has the necessary knowledge and skills to meet its mission and goals  Further, Office of Human Resources officials reported that they plan to update the staffing model that they use to identify their IT staffing needs to include more reliable workload data  However, as discussed earlier, the Secret Service had not yet developed that updated model to determine its IT staffing needs  Office of Human Resources officials reported that once they update the staffing model they plan to re- evaluate the Secret Service’s IT staffing needs  The officials also stated that, going forward, they plan to reassess these needs each year as part of the annual budget cycle  Regular assessments of the IT workforce’s staffing needs should increase the likelihood that the Secret Service is able to appropriately identify the number of IT staff it needs to meet its mission and programmatic goals  Develop strategies and plans to address gaps in competencies and staffing—partly implemented  The Secret Service developed recruiting and hiring strategies to address certain competency and staffing needs (e g , cybersecurity) for its IT workforce  These strategies included, among other things, participating in DHS-wide recruiting events and using special hiring authorities  However, because OCIO did not identify all of its IT competency and staffing needs, and lacked a current analysis of its entire IT workforce, the Secret Service could not provide assurance that the recruiting and hiring strategies it developed were specifically targeted towards addressing current OCIO competency and staffing gaps  For example, without an analysis of the IT workforce’s skills, OCIO did not know the extent to which it had gaps in areas such as device management and cloud computing  As a result, the Secret Service’s recruiting strategies may not have been targeted to address any gaps in those areas  Until the Secret Service updates its recruiting and hiring strategies and plans to address all IT competency and staffing gaps identified (after OCIO completes its analysis of the entire IT workforce, as discussed earlier), the Secret Service will be limited in its ability to effectively recruit and hire staff to fill those gaps  According to the Office of Personnel Management, the Chief Human Capital Officers Council, and our prior work, once an agency has determined the critical skills and competencies that it needs to achieve programmatic goals, and identifies any competency or staffing gaps in its current workforce, the agency should be positioned to build effective recruiting and hiring programs  It is important that an agency has these programs in place to ensure that it can effectively recruit and hire employees with the appropriate skills to meet its various mission requirements  The Office of Personnel Management, the Chief Human Capital Officers Council, and we have also identified numerous leading practices associated with effective recruitment and hiring programs  Among these practices, an agency should (1) implement recruiting and hiring activities to address skill and staffing gaps by using the strategies and plans developed during the strategic workforce planning process; (2) establish and track metrics to monitor the effectiveness of the recruitment program and hiring process, including their effectiveness at addressing skill and staffing gaps, and report to agency leadership on progress addressing those gaps; and (3) adjust recruitment plans and hiring activities based on recruitment and hiring effectiveness metrics  The Secret Service minimally implemented the selected three leading practices associated with the recruitment and hiring workforce area  Specifically, the component partly implemented one of the three practices and did not implement the other two practices  Table 9 lists these selected practices and provides our assessment of the Secret Service’s implementation of the practices  Implement recruiting and hiring activities to address skill and staffing gaps by using the strategies and plans developed during the strategic workforce planning process—partly implemented  OCIO officials implemented the activities identified in the Secret Service’s recruiting and hiring plans  For example, as identified in its recruiting plan, OCIO participated in a February 2017 career fair to recruit job applicants at a technology conference  In addition, in August 2017, OCIO participated in a DHS-wide recruiting event  Secret Service officials reported that, during this event, they conducted four interviews for positions in OCIO  However, as previously discussed, OCIO did not identify all of its IT competency and staffing needs, and lacked a current analysis of its entire IT workforce  Without complete knowledge of its current IT competency and staffing gaps, the Secret Service could not provide assurance that the recruiting and hiring strategies that it had implemented fully addressed these gaps  Establish and track metrics to monitor the effectiveness of the recruitment program and hiring process, including their effectiveness at addressing skill and staffing gaps, and report to agency leadership on progress addressing those gaps—not implemented  The Secret Service had not established and tracked metrics for monitoring the effectiveness of its recruitment and hiring activities for the IT workforce  Officials in the Office of Human Resources attributed this to staffing constraints and said their priority was to address existing staffing gaps associated with the Secret Service’s law enforcement groups  In June 2018, Office of Human Resources officials stated that they plan to implement metrics to monitor the effectiveness of the hiring process for the IT workforce by October 2018  The officials also stated that they were in the process of determining (1) the metrics that are to be used to monitor the effectiveness of their workforce recruiting efforts and (2) whether they need to acquire new technology to support this effort  However, the officials did not know when they would implement the metrics for assessing the effectiveness of the recruitment activities and whether they would report the results to leadership  Until the Office of Human Resources (1) develops and tracks metrics to monitor the effectiveness of the Secret Service’s recruitment activities for the IT workforce, including their effectiveness at addressing skill and staffing gaps; and (2) reports to component leadership on those metrics, the Secret Service and the Office of Human Resources will be limited in their ability to analyze the recruitment program to determine whether the program is effectively addressing IT skill and staffing gaps  Further, Secret Service leadership will lack the information necessary to make effective recruitment decisions  Adjust recruitment plans and hiring activities based on recruitment and hiring effectiveness metrics—not implemented  While the Secret Service CIO stated in June 2018 that he planned to adjust the office’s recruiting and hiring strategies to focus on entry- level staff rather than mid-career employees, this planned adjustment was not based on metrics that the Secret Service was tracking  Instead, the CIO stated that he planned to make this change because his office determined that previous mid-career applicants were often unwilling or unable to wait for the Secret Service’s lengthy, required background investigation process to be completed  However, as previously mentioned, the Secret Service did not develop and implement any metrics for assessing the effectiveness of the recruitment and hiring activities for the IT workforce  As a result, the Office of Human Resources and OCIO were not able to use such metrics to inform adjustments to their recruiting and hiring plan and activities, thus, reducing their ability to target potential candidates for hiring  Until the Office of Human Resources and OCIO adjust their recruitment and hiring plans and activities as necessary, after establishing and tracking metrics for assessing the effectiveness of these activities for the IT workforce, the Secret Service will be limited in its ability to ensure that its recruiting plans and activities are appropriately targeted to potential candidates  In addition, the component will lack assurance that these plans and activities will effectively address skill and staffing gaps within its IT workforce  An organization should invest in training and developing its employees to help ensure that its workforce has the information, skills, and competencies that it needs to work effectively  In addition, training and development programs are an integral part of a learning environment that can enhance an organization’s ability to attract and retain employees with the skills and competencies needed to achieve cost-effective and timely results  DHS, the Secret Service, and we have previously identified numerous leading training and development-related practices  Among those practices, an organization should (1) establish a training and development program to assist the agency in achieving its mission and goals; (2) use tracking and other control mechanisms to ensure that employees receive appropriate training and meet certification requirements, when applicable; and (3) collect and assess performance data (including qualitative or quantitative measures, as appropriate) to determine how the training program contributes to improved performance and results  The Secret Service minimally implemented the selected three leading practices associated with the training and development workforce area  Specifically, the component partly implemented two of the three practices and did not implement one practice  Table 10 lists these selected leading practices and provides our assessment of the Secret Service’s implementation of the practices  Establish a training and development program to assist the agency in achieving its mission and goals—partly implemented  OCIO was in the process of developing a training program for its IT workforce  For example, OCIO developed a draft training plan that identified recommended training for the office’s various IT workforce groups (e g , voice communications employees)  However, the office had not defined the required training for each IT workforce group  In addition, OCIO officials had not yet determined which activities they would implement as part of the training program (e g , soliciting employee feedback after training is completed and evaluating the effectiveness of specific training courses), nor did they implement those activities  OCIO officials stated that they had not yet fully implemented a training program because their annual training budget for fiscal year 2018 was not sufficient to implement such a program  However, resource constrained programs especially benefit from identifying and prioritizing training activities to inform training budget decisions  Until OCIO (1) defines the required training for each IT workforce group, (2) determines the activities that it will include in its IT workforce training and development program based on its available training budget, and (3) implements those activities, the office may be limited in its ability to ensure that the IT workforce has the necessary knowledge and skills for their respective positions  Use tracking and other control mechanisms to ensure that employees receive appropriate training and meet certification requirements, when applicable—partly implemented  OCIO used a training system to track that the managers for IITT’s programs had met certain certification requirements for their respective positions  In addition, OCIO manually tracked the technical training that certain IT staff took  However, as discussed earlier, OCIO did not define the required training for each IT workforce group  As such, the office was unable to ensure that IT staff received the appropriate training relevant to their respective positions  Until it ensures that IT staff complete training specific to their positions (after defining the training required for each workforce group), OCIO will have limited assurance that the workforce has the necessary knowledge and skills  Collect and assess performance data (including qualitative or quantitative measures, as appropriate) to determine how the training program contributes to improved performance and results—not implemented  As previously discussed, OCIO did not fully implement a training program for the IT workforce; as such, the office was unable to collect and assess performance data related to such a program  OCIO officials stated that, once they fully implement a training program, they intend to collect and assess data on how this program contributes to improved performance  However, the officials were unable to specify a time frame for when they would do so  Until OCIO collects and assesses performance data (including qualitative or quantitative measures, as appropriate) to determine how the IT training program contributes to improved performance and results (once the training program is implemented), the office may be limited in its knowledge of whether the training program is contributing to improved performance and results  Employee morale is important to organizational performance and an organization’s ability to retain talent to perform its mission  We have previously identified numerous leading practices for improving employee morale  Among other things, we have found that an organization should (1) determine root causes of employee morale problems by analyzing employee survey results using techniques such as comparing demographic groups, benchmarking against similar organizations, and linking root cause findings to action plans; and develop and implement action plans to improve employee morale; (2) establish and track metrics of success for improving employee morale, and report to agency leadership on progress improving morale; and (3) maintain leadership support and commitment to ensure continued progress in improving employee morale, and demonstrate sustained improvement in morale  With regard to its IT workforce, the Secret Service substantially implemented the selected three practices associated with the employee morale workforce area  Specifically, the component fully implemented two of the selected practices and partly implemented one practice  Table 11 lists these selected practices and provides our assessment of the Secret Service’s implementation of the practices  Determine root causes of employee morale problems by analyzing employee survey results using techniques such as comparing demographic groups, benchmarking against similar organizations, and linking root cause findings to action plans  Develop and implement action plans to improve employee morale—fully implemented  The Secret Service used survey analysis techniques to determine the root causes of its low employee morale, on which we have previously reported  For example, the component conducted a benchmarking exercise where it compared the morale of the Secret Service’s employees, including IT staff, to data on the morale of employees at other agencies, including the U S  Capitol Police, U S  Coast Guard, and the Drug Enforcement Administration
Report 2:  CMS has taken steps to identify some fraud risks through several control activities that target areas the agency has designated as higher risk within Medicare and Medicaid, including specific provider types, such as home health agencies, and specific geographic locations  As discussed earlier, CMS officials told us that CPI initially focused on developing control activities for Medicare FFS and considers these activities to be the most mature of all CPI efforts to address fraud risks  CMS has identified fraud risks in the following selected examples, which are not an exhaustive list of its control activities  Data analytics to assist investigations in Medicare FFS  In 2011, CMS implemented FPS, a data-analytic system that screens all Medicare FFS claims to identify health-care providers with suspect billing patterns for further investigation  Medicare FFS contractors—ZPICs and UPICs— have used FPS to identify and prioritize leads for investigations of potential fraud by high-risk Medicare FFS providers  Contractors told us that FPS allows them to quickly identify and triage leads  CMS’s guidance requires contractors to prioritize investigations with the greatest program impact or urgency and identifies required criteria for prioritizing investigations, such as patient abuse or harm, multistate fraud, and high dollar amount of potential overpayments  One contractor we interviewed developed a risk-prioritization model that incorporated CMS’s required criteria, such as patient harm, as well as additional criteria, such as provider spikes in billing, into a tool that automatically creates a provider risk score to help the contractor focus and prioritize investigative resources  Prior authorization for Medicare FFS services or supplies  CMS published a final rule in December 2015 that identifies a master list of durable medical equipment, prosthetics, orthotics, and supplies for which CMS can require prior authorization before suppliers submit a Medicare FFS claim  In this rule, CMS identified 135 items that are frequently subject to unnecessary utilization and stated that the agency expects the final rule to result in savings in the form of reduced unnecessary utilization, fraud, waste, and abuse  Under this program, prior authorization is a condition of payment for claims  CMS can choose which items on the master list to subject to prior authorization  For example, in March 2017, it began requiring prior authorization for selected power wheelchairs in four states and expanded the prior authorization program for these items to all states in July 2017  CMS also began to test the use of prior authorization on a voluntary basis through a series of fixed-length demonstrations for items and services that have been associated with high levels of improper payments, including high incidences of fraud in some cases, and unnecessary utilization in certain geographic areas  For example, CMS began implementing a voluntary prior authorization demonstration in September 2012 for other power mobility devices, such as power scooters, in seven states where historically there has been extensive evidence of fraud and improper payments  CMS expanded the demonstration to an additional 12 states in October 2014, for a total of 19 states  According to the initial Federal Register notice, CMS planned to use the demonstration to develop improved methods for investigation and prosecution of fraud to protect federal funds from fraudulent actions and the resulting improper payments  Under the demonstration, providers and suppliers are encouraged—but not required—to submit a request for prior authorization for certain items before they provide the item to the beneficiary and submit a claim for payment  Revised provider screening and enrollment processes for Medicare FFS and Medicaid FFS  In response to PPACA, in 2011 CMS implemented a revised screening process for providers and suppliers who enroll in Medicare and Medicaid based on identified provider risk categories  CMS placed all Medicare provider and supplier types into one of three risk categories—limited, moderate, or high—based on its assessment of the potential risk of fraud, waste, and abuse each provider and supplier type poses  For example, CMS designated prospective (newly enrolling) home health agencies and prospective suppliers of durable medical equipment, prosthetics, orthotics, and supplies in the high-risk category  According to the final rule and our interviews with CMS officials, CMS developed these risk-based categories based on its review and synthesis of various information sources about the fraud risks posed by each provider and supplier type, including (1) the agency’s experience with claims data used to identify potentially fraudulent billing practices, (2) expertise of contractors responsible for investigating and identifying Medicare fraud, and (3) GAO and OIG reports  CMS designated specific screening activities for each risk category, with increased requirements for moderate- and high-risk provider and supplier types  For example, moderate- and high-risk providers and suppliers must receive preenrollment site visits, and high-risk providers and suppliers also are subject to fingerprint-based criminal-background checks  As part of the revised screening process, beginning in September 2011, CMS also undertook its first program-wide effort to rescreen, or revalidate, the enrollment records of about 1 5 million existing Medicare FFS providers and suppliers, to determine whether they remain eligible to bill Medicare  Temporary provider enrollment moratoriums for certain providers and geographic areas for Medicare FFS and Medicaid FFS  CMS identified certain provider types and geographic areas as high risk for fraud and used its authority under PPACA to implement temporary moratoriums to suspend enrollment of such Medicare and Medicaid providers in those areas  For example, in July 2016, CMS extended temporary moratoriums statewide on the enrollment of new Medicare Part B nonemergency ambulance suppliers and Medicare home health agencies statewide in six states, as applicable  The statewide moratoriums also apply to Medicaid  According to the Federal Register notice, CMS imposed the temporary moratoriums based on qualitative and quantitative factors suggesting a high risk of fraud, waste, or abuse, such as law-enforcement expertise with emerging fraud trends and investigations  CMS’s data analysis also confirmed the agency’s determination of a high risk of fraud, waste, and abuse for these provider and supplier types within certain geographic areas, according to the notice  Medicaid state program integrity reviews and desk reviews  CMS tailored state Medicaid program-integrity reviews to areas it identified as high risk for improper payments, such as personal care services, which may also be at high risk for fraud  In March 2017, we reported that, from fiscal years 2014 through 2016, CMS conducted focused reviews of state program-integrity efforts in 31 states, reviewing 10 or 11 states annually  For each state, CMS tailored its focused reviews to the state’s managed care plans and relevant other high-risk areas, including provider enrollment and screening, nonemergency medical transportation, and personal care services  CMS and state officials we spoke with as part of that work told us that the tailored oversight had been beneficial and helped identify areas for improvement  CMS has also initiated desk reviews of state program-integrity efforts  According to CMS, these desk reviews allow the agency to provide states with customized program- integrity oversight  Vulnerability tracking system for Medicare  CPI recently initiated an effort to centralize and formalize a vulnerability tracking process for Medicare, which could support identification of specific fraud risks, both in Medicare and possibly Medicaid  As described by CPI officials, the process aims to collect information on fraud-related vulnerabilities from CMS employees, contractors, and other sources, such as GAO and HHS OIG reports  The assess component of the Fraud Risk Framework calls for federal managers to plan regular fraud risk assessments and assess risks to determine a fraud risk profile  Furthermore, federal internal control standards call for agency management to assess the internal and external risks their entities face as they seek to achieve their objectives  The standards state that, as part of this overall assessment, management should consider the potential for fraud when identifying, analyzing, and responding to risks  The Fraud Risk Framework states that, in planning the fraud risk assessment, effective managers tailor the fraud risk assessment to the program by, among other things, identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process  Fraud risk assessments that align with the Fraud Risk Framework involve (1) identifying inherent fraud risks affecting the program, (2) assessing the likelihood and impact of those fraud risks, (3) determining fraud risk tolerance, (4) examining the suitability of existing fraud controls and prioritizing residual fraud risks, and (5) documenting the results  (See fig  6 ) Although, as discussed earlier, CMS has identified some fraud risks posed by providers in Medicare FFS and, to a lesser degree, Medicaid FFS, the agency has not conducted a fraud risk assessment for either the Medicare or Medicaid program  Such a risk assessment would provide the detailed information and insights needed to create a fraud risk profile, which, in turn, is the basis for creating an antifraud strategy  According to CMS officials, CMS has not conducted a fraud risk assessment for Medicare or Medicaid because, within CPI’s broader approach of preventing and eliminating improper payments, its focus has been on addressing specific vulnerabilities among provider groups that have shown themselves particularly prone to fraud, waste, and abuse  With this approach, however, it is unlikely that CMS will be able to design and implement the most-appropriate control activities to respond to the full portfolio of fraud risks  A fraud risk assessment consists of discrete activities that build upon each other  Specifically: Identifying inherent fraud risks affecting the program  As discussed earlier, CMS has taken steps to identify fraud risks  However, CMS has not used a process to identify inherent fraud risks from the universe of potential vulnerabilities facing Medicare and Medicaid programs, including threats from various sources  According to CPI officials, most of the agency’s fraud control activities are focused on fraud risks posed by providers  The Fraud Risk Framework discusses fully considering inherent fraud risks from internal and external sources in light of fraud risk factors such as incentives, opportunities, and rationalization to commit fraud  For example, according to CMS officials, the inherent design of the Medicare Part C program may pose fraud risks that are challenging to detect  A fraud risk assessment would help CMS identify all sources of fraudulent behaviors, beyond threats posed by providers, such as those posed by health-insurance plans, contractors, or employees  Assessing the likelihood and impact of fraud risks and determining fraud risk tolerance  CMS has taken steps to prioritize fraud risks in some areas, but it has not assessed the likelihood or impact of fraud risks or determined fraud risk tolerance across all parts of Medicare and Medicaid  Assessing the likelihood and impact of inherent fraud risks would involve consideration of the impact of fraud risks on program finances, reputation, and compliance  Without assessing the likelihood and impact of risks in Medicare or Medicaid or internally determining which fraud risks may fall under the tolerance threshold, CMS cannot be certain that it is aware of the most-significant fraud risks facing these programs and what risks it is willing to tolerate based on the programs’ size and complexity  Examining the suitability of existing fraud controls and prioritizing residual fraud risks  CMS has not assessed existing control activities or prioritized residual fraud risks  According to the Fraud Risk Framework, managers may consider the extent to which existing control activities—whether focused on prevention, detection, or response—mitigate the likelihood and impact of inherent risks and whether the remaining risks exceed managers’ tolerance  This analysis would help CMS to prioritize residual risks and to determine mitigation approaches  For example, CMS has not established preventive fraud control activities in Medicare Part C  Using a fraud risk assessment for Medicare Part C and closely examining existing fraud control activities and residual risks, CMS could be better positioned to address fraud risks facing this growing program and develop preventive control activities  Further, without assessing existing fraud control activities and prioritizing residual fraud risks, CMS cannot be assured that its current control activities are addressing the most-significant risks  Such analysis would also help CMS determine whether additional, preferably preventive, fraud controls are needed to mitigate residual risks, make adjustments to existing control activities, and potentially scale back or remove control activities that are addressing tolerable fraud risks  Documenting the risk-assessment results in a fraud risk profile  CMS has not developed a fraud risk profile that documents key findings and conclusions of the fraud risk assessment  According to the Fraud Risk Framework, the risk profile can also help agencies decide how to allocate resources to respond to residual fraud risks  Given the large size and complexity of Medicare and Medicaid, a documented fraud risk profile could support CMS’s resource-allocation decisions as well as facilitate the transfer of knowledge and continuity across CMS staff and changing administrations  Senior CPI officials told us that the agency plans to start a fraud risk assessment for Medicare and Medicaid after it completes a separate fraud risk assessment of the federally facilitated marketplace  This fraud risk assessment for the federally facilitated marketplace eligibility and enrollment process is being conducted in response to a recommendation we made in February 2016  In April 2017, CPI officials told us that this fraud risk assessment was largely completed, although in September 2017 CPI officials told us that the assessment was undergoing agency review  CPI officials told us that they have informed CM and CMCS officials that there will be future fraud risk assessments for Medicare and Medicaid; however, they could not provide estimated timelines or plans for conducting such assessments, such as the order or programmatic scope of the assessments  Once completed, CMS could use the federally facilitated marketplace fraud risk assessment and apply any lessons learned when planning for and designing fraud risk assessments for Medicare and Medicaid  According to the Fraud Risk Framework, factors such as size, resources, maturity of the agency or program, and experience in managing risks can influence how the entity plans the fraud risk assessment  Additionally, effective managers tailor the fraud risk assessment to the program when planning for it  The large scale and complexity of Medicare and Medicaid as well as time and resources involved in conducting a fraud risk assessment underscore the importance of a well-planned and tailored approach to identifying the assessment’s programmatic scope  Planning and tailoring may involve decisions to conduct a fraud risk assessment for Medicare and Medicaid programs as a whole or divided into several subassessments to reflect their various component parts (e g , Medicare FFS, Medicaid managed care) as well as determining the timing and order of assessments (e g , concurrently or consecutively for Medicare and Medicaid)  CMS’s existing fraud risk identification efforts as well as communication channels with stakeholders could serve as a foundation for developing a fraud risk assessment for Medicare and Medicaid  The leading practices identified in the Fraud Risk Framework discuss the importance of identifying appropriate tools, methods, and sources for gathering information about fraud risks and involving relevant stakeholders in the assessment process  CMS’s fraud risk identification efforts discussed earlier could provide key information about fraud risks and their likelihood and impact  Further, existing relationships and communication channels across CMS and its extensive network of stakeholders could support building a comprehensive understanding of known and potential fraud risks for the purposes of a fraud risk assessment  For example, the fraud vulnerabilities identified through data analysis and information sharing with states, health-insurance plans, law-enforcement organizations, and contractors through the HFPP could inform a fraud risk assessment  CPI’s Command Center missions—facilitated collaboration sessions that bring together experts from various disciplines to improve the processes for fraud prevention in Medicare and Medicaid—could bring together experts to identify potential or emerging fraud vulnerabilities or to brainstorm approaches to mitigate residual fraud risks  As CMS makes plans to move forward with a fraud risk assessment for Medicare and Medicaid, it will be important to consider the frequency with which the fraud risk assessment would need to be updated  While, according to the Fraud Risk Framework, the time intervals between updates can vary based on the programmatic and operating environment, assessing fraud risks on an ongoing basis is important to ensure that control activities are continuously addressing fraud risks  The constantly evolving fraud schemes, the size of the programs in terms of beneficiaries and expenditures, as well as continual changes in Medicare and Medicaid programs—such as development of innovative payment models and increasing managed-care enrollment—call for constant vigilance and regular updates to the fraud risk assessment  The design and implement component of the Fraud Risk Framework calls for federal managers to design and implement a strategy with specific control activities to mitigate assessed fraud risks and collaborate to help ensure effective implementation  According to the Fraud Risk Framework, effective managers develop and document an antifraud strategy that describes the program’s approach for addressing the prioritized fraud risks identified during the fraud risk assessment, also referred to as a risk-based antifraud strategy  A risk- based antifraud strategy describes existing fraud control activities as well as any new fraud control activities a program may adopt to address residual fraud risks  In developing a strategy and antifraud control activities, effective managers focus on fraud prevention over detection, develop a plan for responding to identified instances of fraud, establish collaborative relationships with stakeholders, and create incentives to help effectively implement the strategy  Additionally, as part of a documented strategy, management identifies roles and responsibilities of those involved in fraud risk management activities; describes control activities as well as plans for monitoring and evaluation, creates timelines, and communicates the antifraud strategy to employees and stakeholders, among other things  As discussed earlier, CMS has some control activities in place to identify fraud risk in Medicare and Medicaid, particularly in the FFS program  However, CMS has not developed and documented a risk-based antifraud strategy to guide its design and implementation of new antifraud activities and to better align and coordinate its existing activities to ensure it is targeting and mitigating the most-significant fraud risks  Antifraud strategy  CMS officials told us that CPI does not have a documented risk-based antifraud strategy  Although CMS has developed several documents that describe efforts to address fraud, the agency has not developed a risk-based antifraud strategy for Medicare and Medicaid because, as discussed earlier, it has not conducted a fraud risk assessment that would serve as a foundation for such strategy  In 2016, CPI identified five strategic objectives for program integrity, which include antifraud elements and an emphasis on prevention  However, according to CMS officials, these objectives were identified from discussions with CMS leadership and various stakeholders and not through a fraud risk assessment process to identify inherent fraud risks from the universe of potential vulnerabilities, as described earlier and called for in the leading practices  These strategic objectives were presented at an antifraud conference in 2016, but were not announced publicly until the release of the Annual Report to Congress on the Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June 2017  Stakeholder relationships and communication  CMS has established relationships and communicated with stakeholders, but, without an antifraud strategy, stakeholders we spoke with lacked a common understanding of CMS’s strategic approach  Prior work on practices that can help federal agencies collaborate effectively calls for a strategy that is shared with stakeholders to promote trust and understanding  Once an antifraud strategy is developed, the Fraud Risk Framework calls for managers to collaborate to ensure effective implementation  Although some CMS stakeholders were able to describe various CMS program- integrity priorities and activities, such as home health being a fraud risk priority, the stakeholders could not communicate, articulate, or cite a common CMS strategic approach to address fraud risks in its programs  Incentives  The Fraud Risk Framework discusses creating incentives to help ensure effective implementation of the antifraud strategy once it is developed  Currently, some incentives within stakeholder relationships may complicate CMS’s antifraud efforts  As discussed earlier, CMS is a partner and provides oversight to states’ program-integrity functions  Officials from one state told us that they were reluctant to share their program vulnerabilities because CMS would use this information to later audit the state  Among contractors, CMS encourages information sharing through conferences and workshops; however, competition for CMS business among contractors can be a disincentive to information sharing  CMS officials acknowledged this concern and said that they expect contractors to share information related to fraud schemes, outcomes of investigations, and tips for addressing fraud, but not proprietary information such as algorithms to risk-score providers  Without developing and documenting an antifraud strategy based on a fraud risk assessment, as called for in the design and implement component of the Fraud Risk Framework, CMS cannot ensure that it has a coordinated approach to address the range of fraud risks and to appropriately target and allocate resources for the most-significant risks  Considering fraud risks to which the Medicare and Medicaid programs are most vulnerable, in light of the malicious intent of those who aim to exploit the programs, would help CMS to examine its current control activities and potentially design new ones with recognition of fraudulent behavior it aims to prevent  This focus on fraud is distinct from a broader view of program integrity and improper payments by considering the intentions and incentives of those who aim to deceive rather than well-intentioned providers who make mistakes  Also, continued growth of the programs, such as growth of Medicare Part C and Medicaid managed care, call for consideration of preventive fraud control activities across the entire network of entities involved  Further, considering the large size and complexity of Medicare and Medicaid and the extensive stakeholder network involved in managing fraud in the programs, a strategic approach to managing fraud risks within the programs is essential to ensure that a number of existing control activities and numerous stakeholder relationships and incentives are being aligned to produce desired results  Once developed, an antifraud strategy that is clearly articulated to various CMS stakeholders would help CMS to address fraud risks in a more coordinated and deliberate fashion  Thinking strategically about existing control activities, resources, tools, and information systems could help CMS to leverage resources while continuing to integrate Medicare and Medicaid program-integrity efforts along functional lines  A strategic approach grounded in a comprehensive assessment of fraud risks could also help CMS to identify future enhancements for existing control activities, such as new preventive capabilities for FPS or additional fraud factors in provider enrollment and revalidation, such as provider risk scoring, to stay in step with evolving fraud risks  The evaluate and adapt component of the Fraud Risk Framework calls for federal managers to evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management  Furthermore, according to federal internal control standards, managers should establish and operate monitoring activities to monitor the internal control system and evaluate the results, which may be compared against an established baseline  Ongoing monitoring and periodic evaluations provide assurances to managers that they are effectively preventing, detecting, and responding to potential fraud  CMS has established monitoring and evaluation mechanisms for its program-integrity activities that it could incorporate into an antifraud strategy  In Medicare, CMS has taken steps to measure the rate of fraud in a particular service area  We have previously reported that agencies may face challenges measuring outcomes of fraud risk management activities in a reliable way  These challenges include the difficulty of measuring the extent of deterred fraud, isolating potential fraud from legitimate activity or other forms of improper payments, and determining the amount of undetected fraud  Despite these challenges, CMS has taken steps to estimate a fraud baseline—meaning the rate of probable fraud—in the home health benefit  In fiscal year 2016, CMS conducted a pretest in the Miami-Dade area of Florida to evaluate its potential measurement approach that could later be used in a nationwide study of probable fraud among home health agencies  The pretest was not a random sample and was not intended to produce a rate of fraud, but instead was intended to test the interview instruments and data-collection methodology CMS might use in a study nationwide  CMS and its contractor collected information from home health agencies, the attending providers, and Medicare beneficiaries in the Miami-Dade area in order to test these interview instruments  CMS completed this pretest, but, according to CMS officials, the agency does not yet have plans to roll out a nationwide study that would estimate a probable fraud rate for the Medicare FFS home health benefit  In its 2015 annual report to Congress, CMS stated that “documenting the baseline amount of fraud in Medicare is of critical importance, as it allows officials to evaluate the success of ongoing fraud prevention activities ” CMS officials working on the pilot told us that having an estimate of the rate of fraud in home health benefits would allow CMS to reliably assess its efforts at eliminating or reducing fraud  Without a baseline, officials said, the agency cannot know whether its antifraud efforts are as effective as they could be  We previously reported that the lack of a baseline for the amount of health-care fraud that exists limits CMS’s ability to determine whether its activities are effectively reducing health care fraud and abuse  A baseline estimate could provide an understanding of the extent of fraud and, with additional information on program activities, could help to inform decision making related to allocation of resources to combat health-care fraud  As described in the Fraud Risk Framework, in the absence of a fraud baseline, agencies can gather additional information on the short-term or intermediate outcomes of some antifraud initiatives, which may be more readily measured  For example, CMS has developed some performance measures to provide a basis for monitoring its progress towards meeting the program-integrity goals set in the HHS Strategic Plan and Annual Performance Plan  Specifically, CMS measures whether it is meeting its goal of “increasing the percentage of Medicare FFS providers and suppliers identified as high risk that receive an administrative action ” CMS does not set specific antifraud goals for other parts of Medicare or Medicaid; other CMS performance measures relate to measuring or reducing improper payments in CHIP, Medicaid, and the various parts of Medicare  CMS uses return-on-investment and savings estimates to measure the effectiveness of its Medicare program-integrity activities and FPS  For example, CMS uses return-on-investment to measure the effectiveness of FPS and, in response to a recommendation we made in 2012, CMS developed outcome-based performance targets and milestones for FPS  CMS has also conducted individual evaluations of its program-integrity activities, such as an interim evaluation of the prior-authorization demonstration for power mobility devices that began in 2012 and is currently implemented in 19 states  Commensurate with greater maturity of control activities in Medicare FFS compared to other parts of Medicare and Medicaid, monitoring and evaluation activities for Medicare Parts C and D and Medicaid are more limited  For example, CMS calculates savings for its program-integrity activities in Medicare Parts C and D, but not a full return-on-investment  CMS officials told us that calculating costs for specific activities is challenging because of overlapping activities among contractors  CMS officials said they continue to refine methods and develop new savings estimates for additional program-integrity activities  According to the Fraud Risk Framework, effective managers develop a strategy and evaluate outcomes using a risk-based approach  In developing an effective strategy and antifraud activities, managers consider the benefits and costs of control activities  Ongoing monitoring and periodic evaluations provide reasonable assurance to managers that they are effectively preventing, detecting, and responding to potential fraud  Monitoring and evaluation activities can also support managers’ decisions about allocating resources, and help them to demonstrate their continued commitment to effectively managing fraud risks  As CMS takes steps to develop an antifraud strategy, it could include plans for refining and building on existing methods such as return-on- investment or savings measures, and setting appropriate targets to evaluate the effectiveness of all of CMS’s antifraud efforts  Such a strategy would help CMS to efficiently allocate program-integrity resources and to ensure that the agency is effectively preventing, detecting, and responding to potential fraud  For example, while doing so would involve challenges, CMS’s strategy could detail plans to advance efforts to measure a potential fraud rate through baseline and periodic measures  Fraud rate measurement efforts could also inform risk assessment activities, identify currently unknown fraud risks, align resources to priority risks, and develop effective outcome metrics for antifraud controls  Such a strategy would also help CMS ensure that it has effective performance measures in place to assess its antifraud efforts beyond those related to providers in Medicare FFS, and establish appropriate targets to measure the agency’s progress in addressing fraud risks  As CMS makes plans to move forward with a strategy and to further develop evaluation and monitoring mechanisms, it will be important to share its efforts with stakeholders  The Fraud Risk Framework states that effective managers communicate lessons learned from fraud risk management activities to stakeholders  For example, CMS could be a leader to states in measuring the effectiveness of program-integrity efforts  Officials in three of the four states we spoke with expressed interest in receiving CMS guidance on how to measure the effectiveness of their Medicaid program-integrity efforts, such as by providing models for how to calculate return-on-investment  Medicare and Medicaid provide health insurance to over 129 million Americans, but the size—in terms of number of beneficiaries and amount of expenditures—as well as complexity of these programs make them inherently susceptible to fraud and improper payments  CMS currently manages these risks across its programs as part of a broader approach to identifying and controlling for multiple sources of improper payments and by developing relationships with an extensive network of stakeholders  In Medicare and Medicaid specifically, we note that CMS has taken many important steps toward implementing a strategic approach for managing fraud  However, the agency could benefit by more fully aligning its efforts with the four components of the Fraud Risk Framework  CMS is well positioned to leverage its fraud risk management efforts— such as demonstrated leadership for combating fraud, existing control activities, and stakeholder relationships—to provide additional antifraud training, as well as to develop an antifraud strategy based on fraud risk assessments for Medicare and Medicaid  We recognize that the effort may be challenging, given the size and complexity of Medicare and Medicaid, and the need to balance antifraud activities with CMS’s other mission priorities  However, by not employing the actions identified in the Fraud Risk Framework and incorporating them in its approach to managing fraud risks, CMS is missing a significant opportunity to better ensure employee vigilance against fraud, and to organize and focus its many antifraud and program-integrity activities and related resources into a comprehensive strategy  Such a strategy would (1) provide reasonable assurance that CMS is targeting the most-significant fraud risks in its programs and (2) help protect the government’s substantial and growing investments in these programs  We are making the following three recommendations to CMS: The Administrator of CMS should provide fraud-awareness training relevant to risks facing CMS programs and require new hires to undergo such training and all employees to undergo training on a recurring basis  (Recommendation 1) The Administrator of CMS should conduct fraud risk assessments for Medicare and Medicaid to include respective fraud risk profiles and plans for regularly updating the assessments and profiles  (Recommendation 2) The Administrator of CMS should, using the results of the fraud risk assessments for Medicare and Medicaid, create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks  This strategy should include an approach for monitoring and evaluation  (Recommendation 3) We provided a draft of this report to HHS and DOJ for comment  HHS provided written comments, which are reprinted in appendix I  DOJ did not have comments  HHS and DOJ also provided technical comments, which we incorporated as appropriate  In commenting on this report, HHS agreed with our three recommendations  Specifically, in response to our first recommendation to provide required fraud-awareness training to all employees, HHS stated that it will develop and implement a fraud-awareness training plan to ensure all CMS employees receive training  Regarding our second recommendation to conduct fraud risk assessments for Medicare and Medicaid, HHS stated that it is currently conducting a fraud risk assessment on the federally facilitated marketplace and, when this assessment is complete, will apply the lessons learned in assessing this program to fraud risk assessments of Medicare and Medicaid  In response to our third recommendation to create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks, HHS stated that it will develop respective risk-based antifraud strategies after completing fraud risk assessments for Medicare and Medicaid  We are sending copies of this report to the Acting Secretary of Health and Human Services, the Administrator of CMS, the Assistant Attorney General for Administration at DOJ, as well as appropriate congressional committees and other interested parties  In addition, this report is available at no charge on the GAO website at http://www gao gov  If you or your staff members have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made contributions to this report are listed in appendix II  In addition to the contact named above, Tonita Gillich (Assistant Director), Irina Carnevale (Analyst-in-Charge), Michael Duane, Laura Sutton Elsberg, and Catrin Jones made key contributions to this report  Also contributing to the report were Lori Achman, James Ashley, Colin Fallon, Leslie V  Gordon, Maria McMullen, Sabrina Streagle, and Shana Wallace 

ground_truth: The Purple Heart is one of the oldest and most recognized American military medals, awarded to servicemembers who were killed or wounded by enemy action. The conflicts 2001 to the present have greatly increased the number of Purple Hearts awarded to servicemembers. Events over the past few years have spurred debate on the eligibility criteria for the Purple Heart. Shootings on U.S. soil and medical conditions such as traumatic brain injury (TBI) and post-traumatic stress disorder (PTSD) have prompted changes to the eligibility requirements for the Purple Heart. Some critics believe that these changes may lessen the value of the medal and the sacrifices of past recipients on the battlefield. In the past, efforts to modify the Purple Heart's eligibility requirements were contentious, and veterans groups were vocal concerning eligibility changes. While medal requirements are often left to the military and executive branch to decide, Congress is involved in Purple Heart eligibility, utilizing its constitutional power "To Make Rules for the Government and Regulation of the land and naval Forces" (U.S. Constitution, Article I, Section 8, clause 14). The Carl Levin and Howard P. "Buck" McKeon National Defense Authorization Act for Fiscal Year 2015 (P.L. 113-291) included language that expands eligibility for the Purple Heart. Previous debates have raised several questions about the Purple Heart. In some respects, how an event is defined can determine eligibility: Is a servicemember the victim of a crime or a terrorist attack? Conversely, arguing that killed or wounded servicemembers "should" be eligible for the Purple Heart can redefine an event: Is the servicemember an advisor to a foreign military or a combatant? Are PTSD and other mental health conditions adequate injuries to warrant the Purple Heart? These are questions that Congress might consider if it chooses to act on this issue.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Requirements for military awards and decorations can change over time  New events and changes in military, political, or social conditions can generate debate over who is eligible for various military awards  These changes tend to be controversial, especially with veterans groups  Congress has considered several pieces of legislation that would change who would be eligible to receive the Purple Heart, and under what conditions  The wars in Iraq and Afghanistan have greatly increased the number of servicemembers receiving the Purple Heart award as well as the potential conditions under which they receive the award  Increasingly acknowledged conditions, such as traumatic brain injuries (TBI) and post-traumatic stress disorder (PTSD), as well as accidents and other events while deployed, bring up new questions as to when a servicemember deserves a Purple Heart  The July 17, 2015, shooting of servicemembers at a Marine recruiting office and a naval reserve center in Chattanooga, TN, again prompted questions about applying the Purple Heart to terrorist attacks versus criminal acts  Veterans groups often voice their views when Congress or the President proposes making changes to expand eligibility for the Purple Heart  These groups argue, for example, that a servicemember who acquires PTSD may not always deserve the same recognition as a servicemember killed or wounded in direct combat, while others contend that these medical conditions can debilitate servicemembers just as much as physical injuries and can have lasting effects on servicemembers' lives  Determining which actions and events make a servicemember qualified for receiving a Purple Heart, and whether expanding eligibility does a disservice to those who have already earned the award, are contentious elements of this debate  Although Congress has traditionally left many military award requirements to the executive branch, the Constitution does allow Congress to act in this area, and events have prompted changes regarding eligibility for the Purple Heart  On December 19, 2014, Congress passed The Carl Levin and Howard P  "Buck" McKeon National Defense Authorization Act (NDAA) for Fiscal Year 2015  Section 571 of the NDAA for FY2015 expanded eligibility by redefining what should be considered an attack by a "foreign terrorist organization" for purposes of determining eligibility for the Purple Heart  As a result, servicemembers wounded and killed in the 2009 shootings in Little Rock, AR, and at Fort Hood, TX, were awarded Purple Hearts in 2015  Congressional offices often receive questions about Purple Heart eligibility from constituents, especially when eligibility rules change  The number of these questions is likely to increase as servicemembers return from conflicts around the world and if eligibility requirements are again changed  This report will examine the history of the Purple Heart and changes in eligibility over time as well as current issues facing Congress  In 1782, George Washington created the Badge of Military Merit to reward "any singularly meritorious action" displayed by a soldier, noncommissioned officer, or officer in the Continental Army  This award was intended to encourage gallantry and fidelity among soldiers, and would later become known as the Purple Heart  The Badge of Military Merit was designed as a purple heart of cloth edged with a narrow lace  Records are incomplete and researchers debate how many soldiers received this award  According to Military Order of the Purple Heart, three soldiers from Connecticut were the first to receive the Badge of Military Merit during the American Revolutionary War  All three were noncommissioned officers and the only recipients who received the award from General Washington  The soldiers were Sergeant William Brown, 5 th Connecticut Regiment of the Connecticut Line on May 3, 1783; Sergeant Elijah Churchill, 2 nd Continental Light Dragoons on May 3, 1783; and Sergeant Daniel Bissell, 2 nd Connecticut Regiment of the Connecticut Line, on June 10, 1783  However, the Badge of Military Merit fell into disuse shortly after its conception  The Badge of Military Merit was not seriously considered again until General Douglas MacArthur (then Army Chief of Staff) revived the award on February 22, 1932, the 200 th anniversary of George Washington's birth  This award, renamed the "Purple Heart," was redesigned to its modern appearance: a purple heart-shaped medal with bronze border and George Washington's coat of arms between two green spray leaves  See Figure 1   General MacArthur also redefined the eligibility requirements to those who received Meritorious Service Citation certificates from World War I or those authorized to wear wound chevrons by Army Regulation (AR) 600-8-22, Military Awards   It was at this point that the Purple Heart became focused on soldiers killed and wounded in combat, rather than "any singularly meritorious act " In 1942, President Franklin Roosevelt extended the Purple Heart award, which to this point was exclusively an Army award, to Navy, Marine Corps, and Coast Guard members serving in World War II  In 1952, President Truman retroactively awarded Purple Hearts to personnel in the Navy, Marine Corps, and Coast Guard that qualified after April 5, 1917, thus including World War I veterans of all services  From 1962 until 1998, eligibility for the Purple Hearts was changed on several occasions  President Kennedy authorized Purple Hearts to all servicemembers, and civilians serving with the Armed Forces, who were engaged in armed conflict against an opposing military or hostile foreign force  This expansion was written to permit U S  servicemembers, and the civilians that accompanied them, who were killed or wounded in Vietnam to receive the Purple Heart, as many of those servicemembers were officially considered advisors to the Republic of Vietnam, rather than combatants  Purple Heart eligibility was expanded again by President Reagan to include military personnel and government civilians killed or wounded in international terrorist attacks after March 28, 1973, or those serving in peacekeeping operations outside of the United States  This expansion was in response to increased terrorist attacks against U S  servicemembers abroad, namely the Marine Corps Barracks bombing in Beirut, Lebanon, in 1983  The NDAA for Fiscal Year 1996 expanded eligibility to prisoners of war injured or wounded in captivity prior to 1962, a group of servicemembers previously not covered for Purple Heart eligibility by President Kennedy's executive order  In 1997, President Clinton signed the NDAA for Fiscal Year 1998, which limited future awards of the Purple Heart to military personnel  It has since remained a military-only award  The Department of Defense does not maintain a record of the number of Purple Heart recipients  However, some military historians estimated more than 1 million Purple Hearts have been awarded mostly to soldiers since 1932  Likewise, the National Purple Heart Hall of Honor estimates 1 8 million Purple Hearts have been awarded since the medal was established by the Army in 1932  During the 115 th Congress (2017-2018), H R  7097 was introduced as the "Find our Hearts Act " It would have amended Title 10, United States Code, to require the establishment of a searchable database containing the names and citations of members of the Armed Forces who have been awarded the Purple Heart  H R  7097 was referred to the House Armed Services Committee but saw no further action  See Table 1 for current Purple Heart legislation  Currently, the Purple Heart is authorized for any member of the U S  Armed Forces who has been wounded or died from wounds sustained under one of the following conditions: (1) In accordance with E O  11016, subject to the provisions of Sections 1129, 1129a, and 1131 of Title 10, U S C , and P L  104-106 , the Secretary of a Military Department, will, in the name of the President of the United States, award the PH, with suitable ribbons and appurtenances, to any Service member under the jurisdiction of that Department who, after April 5, 1917, has been wounded, killed, or who has died or may hereafter die of wounds received under any of the following circumstances: (a) In action against an opposing armed force of a foreign country in which U S  Armed Forces are or have been engaged  (b) In any action with an opposing armed force of a foreign country in which the Military Services are or have been engaged  (c) While serving with friendly foreign forces engaged in armed conflict against an opposing armed force in which the United States is not a belligerent party  (d) As a result of an act of any such enemy or opposing armed forces  (e) As the result of an act of any hostile foreign force  (f) After March 28, 1973, as a result of an international terrorist attack against the United States or a foreign nation friendly to the United States, recognized as such an attack for purposes of award of the PH by the Secretary of the Military Department concerned, or jointly by the Secretaries of the Military Departments concerned if members from more than one Military Department are wounded in the attack  The Secretary of the Military Department concerned shall notify the Under Secretary for Personnel and Readiness USD(P&R) prior to awarding the PH for an international terrorist attack that occurs in the United States or its territories  (g) After March 28, 1973, as a result of military operations while serving outside the territory of the United States as part of a peacekeeping force  (h) On or after December 7, 1941, pursuant to Section 1129 of Title 10, U S C , a service member who is killed or wounded in action as the result of action by friendly weapon fire while directly engaged in combat, other than as a result of an act of an enemy of the United States, unless (in the case of a wound) the wound is the result of willful misconduct of the member  (i) Before April 25, 1962, pursuant to Section 521 of P L  104-106 which held as a prisoner of war (POW), or while being taken captive in the same manner as a former POW who is wounded on or after that date while held as a POW  A person will be considered to be a former POW if the person is eligible for the POW Medal under Section 1128 of Title 10, U S C  (j) On or after December 7, 1941, to a Service member who is killed or dies while in captivity as a prisoner of war (POW) under circumstances establishing eligibility for the POW medal pursuant to section 1128 of Title 10, U S C , and Volume 2 of DoD Manual 1348 33, Manual of Military Decorations and Awards , unless compelling evidence is presented that shows that the member's death was not the result of enemy action  (k) After September 11, 2001, pursuant to section 1129a of Title 10, U S C , to a Service member on active duty who is killed or wounded in an attack by a foreign terrorist organizations in circumstances where the death or wound is the result of an attack targeted on the member due to such member's status as a member of the armed forces  An attack by an individual or entity shall be considered to be a foreign terrorist attack if the individual or entity was in communication with the foreign terrorist organization before the attack and the attack was inspired or motivated by the foreign terrorist organization  An award is not authorized if the death or wound was the result of the willful misconduct of the Service member  To assist in making a PH determination pursuant to section 1129a of Title 10, U S C , the Military Department Secretary concerned may request an intelligence assessment from the Defense Intelligence Agencies' Defense Combating Terrorism Center (DCTC)  The DCTC assessment of potential foreign terrorist attacks by an individual or entity will assess whether the individual or entity was in communication with the foreign terrorist organization before the attack, and if the attack was inspired or motivated by the foreign terrorist organization  The assessment shall include supporting citations and rationale  (2) A wound for which the award is made must have been of such severity that it required treatment, not just examination, by a military medical officer  (a) Treatment must be noted in the Servicemember's medical record  (b) Award may be made of wounds treated by a medical professional other than a medical officer provided a medical officer issues a statement in the Service member's medical record that the extent of the wounds were such that the wounds would have required treatment from a medical officer if one had one been available to treat the wounds  (3) After May 17, 1998, pursuant to Section 1131 of Title 10, U S C , the PH may only be awarded to a person who is a Service member at the time the person is killed or wounded under circumstances otherwise qualifying that person for award of the PH  Before this date, the Secretary of the Military Department concerned was authorized to award the PH to U S  civilian nationals who were serving under competent authority in any capacity with the armed forces of that department  For deceased servicemembers, the Purple Heart may be given to the representatives of the deceased as the individual Service Secretary considers appropriate  Servicemembers can be awarded multiple Purple Hearts for separate incidents  The servicemember receives the Purple Heart medal for the first award  Subsequent awards are indicated with oak leaf clusters or 5/16 inch service stars, depending on the rules of the recipient's service  Purple Hearts may not be awarded to foreign military personnel  Although the decision to award medals and other military decorations traditionally rests with the executive branch, Congress has been expanding its role in this area in recent decades, exercising its constitutional power "To Make Rules for the Government and Regulation of the land and naval forces " Previously, Congress took the lead and adjusted Purple Heart eligibility in both the NDAA for FY1996 and the NDAA for FY1998  See Appendix A   In response to some mass shootings in recent years, Congress passed a provision in the NDAA for FY2015 that expanded the Purple Heart's eligibility requirements  On June 1, 2009, a man who was allegedly angry over the killing of Muslims in Iraq and Afghanistan opened fire on two U S  Army soldiers near a recruiting station in Little Rock, AR, killing one and wounding the other  On November 5, 2009, an Army major opened fire at Ft  Hood, TX, killing 13 and wounding 29, many of them servicemembers  Both men were charged with murder and other crimes  Federal and local law enforcement authorities initially considered these acts to be crimes, and the Defense Department reports the Fort Hood shooting as "workplace violence," not acts perpetrated by an enemy or hostile force, which made them ineligible for the Purple Heart  However, some believed these acts should be viewed as acts of war or domestic terrorism because they involved Muslim perpetrators angered over U S  actions in Iraq and Afghanistan  Section 571 of the NDAA for FY2015 ( P L  113-291 ) expanded the eligibility for the Purple Heart by redefining what should be considered an attack by a "foreign terrorist organization" for purposes of determining eligibility for the Purple Heart  The law states that an event should be considered an attack by a foreign terrorist organization if the perpetrator of the attack "was in communication with the foreign terrorist organization before the attack" and "the attack was inspired or motivated by the foreign terrorist organization " Still, some are opposed to awarding the Purple Heart for terrorist acts that were initially deemed "workplace violence" by the Department of Defense (DOD) or a criminal act, and not earned on a battlefield  This act arguably sets a precedent for the future and could make Purple Heart eligibility more subjective, allowing public sentiment to determine what events are worthy of a Purple Heart  On April 10, 2015, then-Army Secretary John McHugh and Army Lieutenant General Sean MacFarland, 3 rd Corps and Fort Hood commanding general, presented Purple Hearts to the families of the 10 servicemembers killed and to the 26 servicemembers wounded during the attack  Defense of Freedom Medals were also awarded to DOD civilians killed and wounded during the attack  In a memorandum, Secretary McHugh directed the Army to "expedite certain other benefits for which soldiers receiving the Purple Heart are traditionally eligible " In addition to the victims of the Fort Hood shooting, the two victims of the June 2009, shooting at a recruiting station in Little Rock, Arkansas, received Purple Hearts on July 1, 2015  Army Private William Andrew "Andy" Long was killed and Army Private Quinton Ezeagwula was wounded in that attack by Abdulhakim Muhammad, who was convicted and sentenced to life in prison without the possibility of parole  Encouraged by the expanded eligibility provision in the NDAA for FY2015, legislation was introduced during the 114 th Congress to award Purple Hearts to other military victims of domestic terrorism  Section 583 of the House-passed version of H R  1735 , the NDAA for FY2016, would have awarded the Purple Heart to servicemembers who were victims of the April 19, 1995, Oklahoma City, Oklahoma bombing  Supporters for awarding the Purple Heart to the victims of the Oklahoma City bombing refer to the FY2015 NDAA as precedent  However, critics contend that the bombing was an act of domestic terrorism and does not meet the current eligibility requirements of the assailant being inspired by or motivated by an international terrorist organization  The final version of the FY2016 NDAA ( P L  114-92 ) did not include this provision  On July 16, 2015, Muhammad Youssef Abdulazeez shot at a Marine Corps recruiting center and Naval Reserve Center in Chattanooga, TN  This incident again raised congressional interest regarding the eligibility for the Purple Heart for servicemembers killed and wounded during an attack inspired by or motivated by international terrorist organizations  Four marines were killed and one was injured during the rampage, and the lone sailor later died from his injuries  The FBI investigation later concluded that Abdulazeez was "motivated by foreign terrorist organization propaganda," but that it was difficult to determine which terrorist group may have inspired him  On December 16, 2015, then-Secretary of the Navy Ray Mabus announced that the Purple Heart would be awarded to five servicemembers killed and one wounded in the July 2015 shootings at two naval centers in Chattanooga, Tennessee  Secretary Mabus stated that "following an extensive investigation, the FBI and NCIS have determined that this attack was inspired by a foreign terrorist group, the final criteria required for the awarding of the Purple Heart to this Sailor and these Marines " On January 14, 2016, then-Navy Vice Admiral Robin Braun presented the Purple Heart to the family of Logistics Specialist 2 nd Class Randall Smith at the Navy Operational Support Center Chattanooga  Brigadier General Terry V  Williams presented the Purple Heart on January 26, 2016, to Sergeant DeMonte R  Cheeley, who survived the attack, at a ceremony in Chattanooga  On April 20, 2016, Lieutenant General Rex McMillian, then-head of Marine Corps Forces Reserve, presented Purple Hearts to the families of Gunnery Sergeant Thomas Sullivan, Staff Sergeant David Wyatt, Sergeant Carson Holmquist, and Lance Corporal Squire "Skip" Wells in a ceremony at the Hunter Museum of American Art in Chattanooga  U S  Airman 1 st Class Spencer Stone was onboard a train from Amsterdam to Paris with two friends, Anthony Sadler and Alek Skarlatos, when they subdued a heavily armed gunman who attempted to fire an AK-47 at the passengers  Stone was stabbed in the face and neck by the gunman as the trio restrained him before he could discharge his weapon  The vacationing Americans were hailed as heroes and awarded the French Legion of Honor on August 24, 2015  On September 14, 2015, Air Force Secretary Deborah Lee James announced that Stone would receive the Purple Heart along with the Airman's Medal, the Air Force's highest noncombat award  At the Pentagon on September 17, 2015, then-Defense Secretary Ash Carter presented Stone the Purple Heart and Airman's Medal  During the ceremony, Carter presented the Soldier's Medal to Oregon National Guard Specialist Alek Skarlatos, and civilian Anthony Sadler received the Secretary of Defense Medal for Valor  On June 12, 2016, a security guard, Omar Mateen, killed 49 people and wounded 53 others in an attack inside Pulse, a gay nightclub in Orlando, Florida  Army Reserve Captain Antonio Davon Brown was one of the 49 people killed and may be eligible for the Purple Heart depending on the outcome of the FBI investigation  According to the FBI, Mateen had pledged allegiance to the Islamic State group after his attack in a call to 911  At this time, it is unclear if the Army will make a decision regarding Captain Brown's eligibility for the Purple Heart  On September 28, 2016, H R  6234 was introduced to amend Title 18, U S C , to provide for penalties for the sale of any Purple Heart awarded to a member of the Armed Forces  This legislation would have made selling the medal punishable by fines and up to six months in prison  H R  6234 would have placed the Purple Heart into a new protected category, keeping it away from not just con artists but also memorabilia collectors  The measure was named for Private Corrado Piccoli, a World War II infantryman killed in action in 1944, whose Purple Heart was found for sale at an antique store in 2009  This bill was referred to the House Judiciary Subcommittee on Crime, Terrorism, Homeland Security, and Investigations but saw no further action in the 114 th Congress  This legislation was reintroduced in the 115 th Congress on January 13, 2017, as H R  544 , the Private Corrado Piccoli Purple Heart Preservation Act of 2017, and a related bill, S  765 , was passed by the Senate on August 3, 2017  Both bills were referred to committee in the House but saw no further action  On January 15, 2019, S  122 , Private Corrado Piccoli Purple Heart Preservation Act, was introduced in the 116 th Congress  The bill was read twice and referred to the Senate Judiciary Committee  The House version of the National Defense Authorization Act (NDAA) for FY2019, H R  5515 , included a provision (Section 629) that would extend certain morale, welfare, and recreation (MWR) privileges to certain veterans, including Purple Hearts recipients, and their caregivers  This bill became P L  115-232 on August 13, 2018  Section 621 of the enacted bill adopted House Section 629, which extends eligibility of certain MWR and commissary privileges to certain veterans, including Purple Heart recipients, and their caregivers starting in 2020  For additional information see section, "Defense Commissary System," in CRS Report R45343, FY2019 National Defense Authorization Act: Selected Military Personnel Issues   For bill summaries of Purple Heart legislation in the 116 th Congress as introduced, see Table 1   The large number of veterans with invisible wounds returning from Iraq and Afghanistan has the Department of Defense (DOD) reevaluating Purple Heart eligibility for traumatic brain injuries (TBI) and mental conditions such as post-traumatic stress disorder (PTSD)  DOD considers some TBIs eligible for the Purple Heart, as many of those injuries can be diagnosed using brain scans and other objective medical tests  However, there is continued debate on the inclusion of mental conditions, such as PTSD, as part of the appropriate criteria for the Purple Heart  Congress, as well as various executive agencies and departments, is funding and conducting studies regarding PTSD  The National Alliance on Mental Illness, a national grassroots advocacy group representing families and people affected by mental illness, is advocating that the Purple Heart be awarded for psychological wounds including PTSD to eliminate stigma and encourage servicemembers to seek care  At this time, DOD does not consider servicemembers with PTSD eligible for the Purple Heart  Army Regulation 600-8-22 allows "concussion injuries caused as a result of enemy generated explosions" but specifically disqualifies post-traumatic stress disorders  Army guidance emphasizes "the degree to which the enemy caused the injury" when determining eligibility and places PTSD in a column of noneligible injuries  The Marine Corps defines PTSD as a "severe combat stress injury" and says that combat stress injuries are "not directly caused by the enemy's intentional use of an outside force or agent," and thus do not qualify  Servicemembers are divided on this issue  Some servicemembers believe that mental injuries such as PTSD should be eligible for the Purple Heart, while others believe that it would dishonor those who have received Purple Hearts for physical injuries  Proponents argue that some veterans are less likely to seek help for their mental-health injuries because of the stigma associated with PTSD, and that stigma could be lessened by recognizing their injuries as real  Opponents, including some veterans from the Military Order of the Purple Heart and Veterans of Foreign Wars, are resistant to accepting PTSD as grounds for eligibility  A representative of The Military Order of the Purple Heart stated, "We believe strongly in and support the criteria that the wound or death should be sustained in combat at the hands of the enemies of the United States " In addition, the national spokesman for the Veterans of Foreign Wars, Joseph E  Davis, said, "Medals aren't awarded for illness or disease, but for 'achievement and valor '" Appendix A  Timeline of Purple Heart Eligibility August 7, 1782: George Washington creates the Badge of Military Merit  Awarded to several Continental soldiers but it quickly falls from use  February 22, 1932: Army Chief of Staff General Douglas MacArthur revives the Badge of Military Merit as an Army award, renamed "the Purple Heart," and retroactively awarded to wounded WWI veterans  December 3, 1942: Executive Order 9277—President Franklin Roosevelt expands Purple Heart eligibility to include U S  Navy, Marine Corps, and Coast Guard  Retroactively awards Purple Hearts to December 6, 1941  November 12, 1952: Executive Order 10409—President Truman retroactively awards Purple Hearts to U S  Navy, Marine Corps, and Coast Guard veterans after April 5, 1917  April 25, 1962: Executive Order 11016—President Kennedy extends eligibility to civilians serving with military forces  February 23, 1984: Executive Order 12464—President Reagan awards Purple Hearts to those killed and wounded in terrorist attacks after March 28, 1973, or on peacekeeping missions outside the United States  February 10, 1996: National Defense Authorization Act for Fiscal Year 1996 (Section 521, P L  104-106 ) includes "prisoners of war wounded before April 25, 1962, while held as a prisoner of war (or while being taken captive) in the same manner as a former prisoner of war who is wounded on or after that date while held as a prisoner of war (or while being taken captive) " November 18, 1997: National Defense Authorization Act for Fiscal Year 1998 (Section 571, P L  105-85 ) limits future Purple Heart awards to members of the Armed Forces  October 17, 2006: National Defense Authorization Act for Fiscal Year 2007 (Section 556, P L  109-364 ) includes prisoners of war captured after December 7, 1941  April 30, 2008: Purple Heart Family Equity Act of 2007 ( P L  110-207 ) revises the congressional charter of the Military Order of the Purple Heart to authorize associate membership for the spouse and siblings of a recipient of the Purple Heart medal  December 19, 2014: National Defense Authorization Act for Fiscal Year 2015 (Section 571, P L  113-291 ) expands eligibility for the Purple Heart by redefining what should be considered an attack by a foreign terrorist organization, and awards Purple Heart medals to servicemembers wounded or killed during the 2009 shootings at Ft  Hood, Texas, and Little Rock, Arkansas  Appendix B  Staffer Instructions for Medal Requests Members of Congress are able to directly request that a Service Secretary consider awarding military decorations to individuals or groups  Upon receiving a request from a Member's office, the Service Secretary concerned will review the proposal for the award or presentation of a decoration (or the upgrading of a decoration)  Based on that review, the Secretary shall determine the merits of approving the award or presentation of the decoration and other necessary determinations  The Secretary shall submit a notice to the requesting Member, the Senate Armed Services Committee, and the House Armed Services Committee with one of the following results: (1) The award or presentation of the decoration does not warrant approval on the merits  A statement explaining the Secretary's reason will be included  (2) The award or presentation of the decoration warrants approval and a waiver by law of time restrictions prescribed by law is recommended  (3) The award or presentation of the decoration warrants approval on the merits and has been approved as an exception to policy  (4) The award or presentation of the decoration warrants approval on the merits, but a waiver of the time restrictions prescribed in law is not recommended  A statement explaining the Secretary's reason will be included  Source: Compiled from the National Defense Authorization Act for Fiscal Year 1996 ( P L  104-106 , §526), February 10, 1996 


Report 2:  As part of this exercise, the Secret Service also compared its employee work-life offerings (e g , on-site childcare and telework program) to those available at other agencies  In addition, the Secret Service developed and implemented action plans for improving employee morale  Among these action plans, for example, the component implemented a student loan repayment program and expanded its tuition assistance program’s eligibility requirements  Establish and track metrics of success for improving employee morale, and report to agency leadership on progress improving morale—fully implemented  The Secret Service tracked metrics for improving employee morale and reported the results to leadership  For example, the component tracked metrics on the percentage of the workforce, including IT staff, that participated in the student loan repayment and tuition assistance programs  In addition, the Chief Strategy Officer reported to the Chief Operating Officer the results related to meeting those metrics  Maintain leadership support and commitment to ensure continued progress in improving employee morale, and demonstrate sustained improvement in morale—partly implemented  Secret Service leadership developed and implemented initiatives that demonstrated their commitment to improving the morale of the Secret Service’s workforce  For example, since 2014, the Secret Service had worked with a contractor to identify ways to improve the morale of its entire workforce, including IT staff  However, as of June 2018, the Secret Service was unable to demonstrate that it had sustained improvement in the morale of the component’s IT staff  In particular, the component was only able to provide IT workforce-specific results from one employee morale assessment that was conducted subsequent to the consolidation of this workforce into OCIO in March 2017  These results were from an assessment conducted by the component’s Inspection Division in December 2017 (the assessment found that the majority of the Secret Service’s IT employees rated their morale as “very good” or “excellent ”) While the component also provided certain employee morale results from the Office of Personnel Management’s Federal Employee Viewpoint Survey in 2017, these results were not specific to the IT workforce  Instead, this workforce’s results were combined with those from staff in another Secret Service division  According to OCIO officials, the results were combined because, at the time of the survey, the IT workforce was administratively identified as being part of that other division  OCIO officials stated that, going forward, they plan to continue to assess the morale of the IT workforce on an annual basis as part of the Federal Employee Viewpoint Survey  In addition, the officials stated that OCIO-specific results may be available as part of the 2018 survey results, which the officials expect to receive by September 2018  By measuring employee satisfaction on an annual basis, the Secret Service should have increased knowledge of whether its initiatives that are aimed at improving employee morale are in fact increasing employee satisfaction  Agencies can use performance management systems as a tool to foster a results-oriented organizational culture that links individual performance to organizational goals  We have previously identified numerous leading practices related to performance management that are intended to enhance performance and ensure individual accountability  Among the performance management practices, agencies should (1) establish a performance management system that differentiates levels of staff performance and defines competencies in order to provide a fuller assessment of performance, (2) explicitly align individual performance expectations with organizational goals to help individuals see the connection between their daily activities and organizational goals, and (3) periodically provide individuals with regular performance feedback  The Secret Service substantially implemented the selected three leading practices associated with the performance management workforce area  Specifically, the component fully implemented one of the three practices and partly implemented the other two practices  Table 12 lists these selected leading practices and provides our assessment of the Secret Service’s implementation of the practices  Establish a performance management system that differentiates levels of staff performance and defines competencies in order to provide a fuller assessment of performance—partly implemented  The Secret Service’s performance management process requires leadership to make meaningful distinctions between levels of staff performance  In particular, the component’s performance plans for IT staff, which are developed by the Office of Human Resources and tailored by OCIO, as necessary, specify the criteria that leadership use to determine if an individual has met or exceeded the expectations associated with each competency identified in their respective performance plan  The performance plans include pre-established, department-wide competencies that are set by DHS, as well as occupational series-specific goals that may be updated by the Secret Service  However, because OCIO did not fully define and document all of its technical competency needs for the IT workforce, as discussed earlier, the Secret Service’s performance plans for IT staff did not include performance expectations related to the full set of technical competencies required for their respective positions  In addition, because OCIO officials were unable to specify a time frame for when they will identify all of the technical competency needs for the IT workforce (as previously discussed), the officials were also unable to specify a time frame for when they would update the IT workforce’s performance plans to include those relevant technical competencies  Until OCIO updates the performance plans for each occupational series within the IT workforce to include the relevant technical competencies, once identified, against which IT staff performance should be assessed, the office will be limited in its ability to provide IT staff with a complete assessment of their performance  In addition, Secret Service management will have limited knowledge of the extent to which IT staff are meeting all relevant technical competencies  Explicitly align individual performance expectations with organizational goals to help individuals see the connection between their daily activities and organizational goals—partly implemented  The Secret Service’s performance plans for IT staff identified certain goals that appeared to be related to organizational goals and objectives  For example, the performance plan for the Telecommunications Specialist occupational series (which is one of the series included in OCIO’s IT workforce) identified a goal for staff to support the voice, wireless, radio, satellite, and video systems serving the Secret Service’s protective and investigative mission  This performance plan goal appeared to be related to the component’s strategic goal on Advanced Technology, which included an objective to create the infrastructure needed to fulfill mission responsibilities  However, the Secret Service was unable to provide documentation that explicitly showed how individual employee performance links to organizational goals, such as a mapping of the goals identified in employee performance plans to organizational goals  Specifically, while Office of Human Resources officials stated that each Secret Service directorate is responsible for ensuring that employee goals map to high-level organizational goals, OCIO officials stated that they did not complete this mapping  The officials were unable to explain why they did not align the goals in their employees’ performance plans to the component’s high-level goals  According to the officials, the Secret Service is in the process of implementing a new automated tool that will require each office to explicitly align individual performance expectations to organizational goals  The officials stated that OCIO plans to use this tool to create employees’ fiscal year 2019 performance plans  By explicitly demonstrating how individual performance expectations align with organizational goals, the Secret Service’s IT staff should have a better understanding of how their daily activities contribute towards achieving the Secret Service’s goals  Periodically provide individuals with regular performance feedback—fully implemented  Secret Service leadership periodically provided their IT staff with performance feedback  Specifically, on an annual basis, OCIO staff received feedback during a mid-year and end-of-year performance feedback assessment  In our prior work, we have stressed that candid and constructive feedback can help individuals maximize their contribution and potential for understanding and realizing the goals and objectives of an organization  Further, this feedback is one of the strongest drivers of employee engagement  According to leading practices of the Software Engineering Institute, effective program oversight includes monitoring program performance and conducting reviews at predetermined checkpoints or milestones  This is done by, among other things, comparing actual cost, schedule, and performance data with estimates in the program plan and identifying significant deviations from established targets or thresholds for acceptable performance levels  In addition, the Software Engineering Institute previously identified leading practices for effectively monitoring the performance of agile projects  According to the Institute, agile development methods focus on delivering usable, working software frequently; as such, it is important to measure the value delivered during each iteration of these projects  To that end, the Institute reported that agile projects should be measured on velocity (i e , number of story points completed per sprint or release), development progression (e g , the number of user stories planned and accepted), product quality (e g , number of defects), and post-deployment user satisfaction  DHS and the Secret Service had fully implemented the selected leading practice for monitoring the performance of one program and three projects within the IITT investment, and conducting reviews of this program and these projects at predetermined checkpoints  In addition, with regard to the selected leading practice for monitoring agile projects, the Secret Service had fully implemented this practice for one of its two projects being implemented using agile and had partially implemented this practice for the other project  Table 13 provides a summary of DHS’s and the Secret Service’s implementation of these leading practices, as relevant for one program and three projects within IITT  Monitor program performance and conduct reviews at predetermined checkpoints or milestones  Consistent with leading practices, DHS and the Secret Service monitored the performance of IITT’s program and projects by comparing actual cost, schedule, and performance information against planned targets and conducting reviews at predetermined checkpoints  For example, within the Secret Service: The Enabling Capabilities program and Multi-Level Security project monitored their contractors’ costs spent to-date on a monthly basis and compared them to the total contract amounts  OCIO used integrated master schedules to monitor the schedule performance of the Enabling Capabilities program and Multi-Level Security project  OCIO also monitored the cost, schedule, and performance of the Uniformed Division Resource Management System and Events Management projects during monthly status reviews  In addition, DHS and the Secret Service conducted acquisition decision event reviews and systems engineering life cycle technical reviews of IITT’s program and projects at predetermined checkpoints and, when applicable, identified deviations from established cost, schedule, and performance targets  For example: Secret Service OCIO met with DHS’s Office of Program Accountability and Risk Management in February 2017, and with DHS’s Acting Under Secretary for Management in June 2017, to discuss a schedule breach for the Enabling Capabilities program  In particular, the Enabling Capabilities program informed DHS that the program needed to change the planned date for acquisition decision event 3 (the point at which a decision is made to fully deploy the system) in order to conduct tests in an operational environment prior to that decision event  This delay was due to the Secret Service misunderstanding the tests that it was required to conduct prior to that decision event  Specifically, the Enabling Capabilities program had conducted tests on “production representative” systems, but these tests were not sufficient to meet the requirements for acquisition decision event 3  The project team for Multi-Level Security identified that certain technical issues they had experienced would delay system deployment and full operational capability (the point at which an investment becomes fully operational)  As such, in October 2017, the project notified the Secret Service Component Acquisition Executive of these expected delays  In particular, the web browser that was intended to provide users on “Sensitive But Unclassified” workstations the ability to view information from different security levels, experienced technical delays in meeting personal identity verification requirements  The project team also described for the executive how the schedule delay would affect the project’s performance metrics and funding, and subsequently updated the project plan accordingly  Measure and monitor agile projects on, among other things, velocity (i e , number of story points completed per sprint or release), development progression (e g , the number of features and user stories planned and accepted), product quality (e g , number of defects), and post-deployment user satisfaction  Secret Service OCIO measured its two agile projects—Uniformed Division Resource Management System and Events Management— using certain agile metrics  In particular, OCIO officials measured the Uniformed Division Resource Management System and Events Management projects using key metrics related to velocity and development progression  For example, the officials measured development progression for both projects on a daily basis  In addition, OCIO officials monitored each project’s progress against these metrics during bi-weekly reviews that they conducted with each project team  The OCIO officials also tracked product quality metrics for the Uniformed Division Resource Management System  For example, on a monthly basis, the officials tracked the number of helpdesk tickets that had been resolved related to the system  In addition, on a quarterly basis, they tracked the number of Uniformed Division Resource Management System defects that (1) had been fixed and (2) were in the backlog  However, while OCIO officials received certain post-deployment user satisfaction information from end-users of the Uniformed Division Resource Management System by, among other things, tracking the number of helpdesk tickets related to the system and via daily verbal, undocumented feedback from certain Uniformed Division officers, OCIO officials had not fully measured and documented post- deployment user satisfaction with the system, such as via a survey of employees who use the system  The officials stated that they had not conducted and documented a survey because they were focused on (1) addressing software performance issues that occurred after they deployed the system to a limited number of users, and (2) continuing system deployment to the remaining users after they addressed the performance issues  OCIO officials stated that they plan to conduct such a documented survey by the end of September 2018  The results of the user satisfaction survey should provide OCIO with important information on whether the Uniformed Division Resource Management System is meeting users’ needs  The Secret Service’s full implementation of 11 of 14 component-level CIO responsibilities constitutes a significant effort to establish CIO oversight for the component’s IT portfolio  Additional efforts to fully implement the remaining 3 responsibilities, including ensuring that all IT contracts are reviewed, as appropriate; ensuring that the Secret Service’s enterprise governance policy appropriately specifies the CIO’s role in developing and reviewing the component’s IT budget formulation and execution; and ensuring agile projects measure product quality and post-deployment user satisfaction, will further position the CIO to effectively manage the Secret Service’s IT portfolio  When effectively implemented, IT workforce planning and management activities can facilitate the successful accomplishment of an agency’s mission  However, the Secret Service had not fully implemented all of the 15 selected practices for its IT workforce for any of the five areas— strategic planning, recruitment and hiring, training and development, employee morale, and performance management  The Secret Service’s lack of (1) a strategic workforce planning process, including the identification of all required knowledge and skills, assessment of competency gaps, and targeted strategies to address specific gaps in competencies and staffing; (2) targeted recruiting activities, including metrics to monitor the effectiveness of the recruitment program and adjustment of the recruitment program and hiring efforts based on metrics; (3) a training program, including the identification of required training for IT staff, ensuring that staff take required training, and assessment of performance data regarding the training program; and (4) a performance management system that includes all relevant technical competencies, greatly limits its ability to ensure the timely and effective acquisition and maintenance of the Secret Service’s IT infrastructure and services  On the other hand, by monitoring program performance and conducting reviews at predetermined checkpoints for one program and three projects associated with the IITT investment, in accordance with leading practices, the Secret Service and DHS provided important oversight needed to guide that program and those projects  Measuring projects on leading agile metrics also provided the Secret Service CIO with important information on project performance  We are making the following 13 recommendations to the Director of the Secret Service: The Director should ensure that the CIO establishes and documents an IT acquisition review process that ensures the CIO or the CIO’s delegate reviews all contracts containing IT, as appropriate  (Recommendation 1) The Director should update the enterprise governance policy to specify (1) the CIO’s current role and responsibilities on the Executive Resources Board, to include developing and reviewing the IT budget formulation and execution; and (2) the Deputy CIO’s role and responsibilities on the Enterprise Governance Council  (Recommendation 2) The Director should ensure that the Secret Service develops a charter for its Executive Resources Board that specifies the roles and responsibilities of all board members, including the CIO  (Recommendation 3) The Director should ensure that the CIO includes product quality and post-deployment user satisfaction metrics in the modular outcomes and target measures that the CIO sets for monitoring agile projects  (Recommendation 4) The Director should ensure that the CIO identifies all of the required knowledge and skills for the IT workforce  (Recommendation 5) The Director should ensure that the CIO regularly analyzes the IT workforce to identify its competency needs and any gaps it may have  (Recommendation 6) The Director should ensure that, after OCIO completes an analysis of the IT workforce to identify any competency and staffing gaps it may have, the Secret Service updates its recruiting and hiring strategies and plans to address those gaps, as necessary  (Recommendation 7) The Director should ensure that the Office of Human Resources (1) develops and tracks metrics to monitor the effectiveness of the Secret Service’s recruitment activities for the IT workforce, including their effectiveness at addressing skill and staffing gaps; and (2) reports to component leadership on those metrics  (Recommendation 8) The Director should ensure that the Office of Human Resources and OCIO adjust their recruitment and hiring plans and activities, as necessary, after establishing and tracking metrics for assessing the effectiveness of these activities for the IT workforce  (Recommendation 9) The Director should ensure that the CIO (1) defines the required training for each IT workforce group, (2) determines the activities that OCIO will include in its IT workforce training and development program based on its available training budget, and (3) implements those activities  (Recommendation 10) The Director should ensure that the CIO ensures that the IT workforce completes training specific to their positions (after defining the training required for each workforce group)  (Recommendation 11) The Director should ensure that the CIO collects and assesses performance data (including qualitative or quantitative measures, as appropriate) to determine how the IT training program contributes to improved performance and results (once the training program is implemented)  (Recommendation 12) The Director should ensure that the CIO updates the performance plans for each occupational series within the IT workforce to include the relevant technical competencies, once identified, against which IT staff performance should be assessed  (Recommendation 13) DHS provided written comments on a draft of this report, which are reprinted in appendix III  In its comments, the department concurred with all 13 of our recommendations and provided estimated completion dates for implementing each of them  For example, with regard to recommendation 2, the department stated that the Secret Service would update its enterprise governance policy and related policies to outline the roles and responsibilities of the CIO and Deputy CIO, among others, by March 31, 2019  In addition, for recommendation 13, the department stated that the Secret Service OCIO will include relevant technical competencies in performance plans, as appropriate, in the next performance cycle that starts in July 2019  If implemented effectively, these actions should address the weaknesses we identified  The department also identified a number of other actions that it said had been taken to address our recommendations  For example, in response to recommendation 8, which calls for the Office of Human Resources to (1) develop and track metrics to monitor the effectiveness of the Secret Service’s recruitment activities for the IT workforce and (2) report to component leadership on those metrics, DHS stated that the Secret Service’s Office of Human Resources’ Outreach Branch provides to the department metrics on recruitment efforts toward designated priority mission-critical occupations  However, for fiscal year 2017, only 1 of the 12 occupational series associated with the Secret Service’s IT workforce was designated as a mission-critical occupation for the component (i e , the 2210 IT Specialist series)  The 11 other occupational series were not designated as mission- critical occupations  In addition, for fiscal year 2018, none of these 12 occupational series were designated as mission-critical occupations  As such, metrics on recruiting for these IT series may not have been reported to DHS leadership  Moreover, while we requested documentation of the recruiting metrics for the Secret Service’s IT workforce and, during the course of our review, had multiple subsequent discussions with the Secret Service regarding such metrics, the component did not provide documentation that demonstrated it had established recruiting metrics for its IT workforce  Tracking such metrics and reporting the results to Secret Service leadership, as we recommended, would provide management with important information necessary to make effective recruitment decisions  Further, in response to recommendation 10, which among other things, calls for the CIO to define the required training for each IT workforce group, the department stated that the Secret Service OCIO recently developed training requirements for each workforce group, which were issued during our audit  However, while during our audit OCIO provided a list of recommended training courses, the office did not identify them as being required courses  Defining training that is required for each IT workforce group, as we recommended, would inform OCIO of the necessary training for each position and enable the office to prioritize this training, to ensure that its staff have the needed knowledge and skills  In addition to the aforementioned comments, we received technical comments from DHS and Secret Service officials, which we incorporated, as appropriate  We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, the Director of the Secret Service, and other interested parties  In addition, this report is available at no charge on the GAO website at http://www gao gov  Should you or your staffs have any questions on information discussed in this report, please contact me at (202) 512-4456 or HarrisCC@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made major contributions to this report are listed in appendix IV  Our objectives were to evaluate the extent to which: (1) the U S  Secret Service (Secret Service) Chief Information Officer (CIO) has implemented selected information technology (IT) oversight responsibilities, (2) the Secret Service has implemented leading workforce planning and management practices for its IT workforce, and (3) the Secret Service and the Department of Homeland Security (DHS) have implemented selected performance and progress monitoring practices for the Information Integration and Technology Transformation (IITT) investment  To address the first objective, we analyzed DHS’s policies and guidance on IT management to identify the responsibilities that were to be implemented by the component-level CIO related to overseeing the Secret Service’s IT portfolio, including existing systems, acquisitions, and investments  From the list of 33 responsibilities that we identified, we then excluded the responsibility that was associated with information security, which is expected to be addressed as part of a separate, subsequent GAO review  We also excluded those responsibilities that were significantly large in scope (e g , implement an enterprise architecture) or that, in our professional judgment, lacked specificity (e g , provide timely delivery of mission IT services)  As a result, we excluded from consideration for this review a total of 10 CIO responsibilities  For the 23 that remained, we then combined certain responsibilities that overlapped with other related responsibilities  For example, we combined related responsibilities on the component CIO’s review of IT contracts  As a result, we identified 14 responsibilities for review  We validated with the acting DHS CIO that these responsibilities were key responsibilities for the department’s component-level CIOs  We then included all 14 of the responsibilities in our review  The 14 selected component-level CIO responsibilities were: 1  Develop and review the component IT budget formulation and execution  2  Manage the component IT investment portfolio, including establishing an IT acquisition review process that enables component and DHS review of component acquisitions (i e , contracts) that contain IT  3  Develop, implement, and maintain a detailed IT strategic plan  4  Ensure all component IT policies are in compliance and alignment with DHS IT directives and instructions  5  Concur with each program’s and/or project’s systems engineering life cycle tailoring plan  6  Support the Component Acquisition Executive to ensure processes are established that enable systems engineering life cycle technical reviews and that they are adhered to by programs and/or projects  7  Ensure that all systems engineering life cycle technical review exit criteria are satisfied for each of the component’s IT programs and/or projects  8  Ensure the necessary systems engineering life cycle activities have been satisfactorily completed as planned for each of the component’s IT programs and/or projects  9  Concur with the systems engineering life cycle technical review completion letter for each of the component’s IT programs and/or projects  10  Maintain oversight of their component’s agile development approach for IT by appointing the responsible personnel, identifying investments for adoption, and reviewing artifacts  11  With Component Acquisition Executives, evaluate and approve the application of agile development for IT programs consistent with the component’s agile development approach  12  Set modular outcomes and target measures to monitor the progress in achieving agile implementation for IT programs and/or projects within their component  13  Participate on DHS’s CIO Council, Enterprise Architecture Board, or other councils/boards as appropriate, and appoint employees to serve when necessary  14  Meet the IT competency requirements established by the DHS CIO, as required in the component CIO’s performance plan  To determine the extent to which the Secret Service CIO has implemented these responsibilities, we obtained and assessed relevant component documentation and compared it to the responsibilities  Specifically, we obtained and analyzed documentation including evidence of the CIO’s participation on the Secret Service governance board that has final decision authority and responsibility for enterprise governance, including the IT budget; monthly program management reports showing the CIO’s oversight of IT programs, projects, and systems; monthly status reports on program spending; the Secret Service’s IT strategic plan; the Secret Service’s enterprise governance policy; meeting minutes from the DHS board and council on which the CIO participated (i e , the CIO Council and Enterprise Architecture Board); and documentation demonstrating whether the CIO met the IT competency requirements  In addition, we obtained and analyzed relevant documentation related to the CIO’s oversight of the major IT investments on which the Secret Service was spending development, modernization, and enhancement funds during fiscal year 2017  As of July 2017, the component had one investment—IITT—that met this criterion  IITT is a portfolio investment that, as of July 2017, included two programs (one of which included three projects) and one standalone project (i e , it was not part of another program) that had capabilities that were in planning or development and modernization: the Enabling Capabilities program, Enterprise Resource Management System program (which included three projects, called Uniformed Division Resource Management System, Events Management, and Enterprise-wide Scheduling), and Multi-Level Security project  In particular, we obtained and analyzed documentation related to the CIO’s oversight of the systems engineering life cycles for IITT’s Enabling Capabilities program and the Uniformed Division Resource Management System, Events Management, and Multi-Level Security projects  This documentation included acquisition program baselines, systems engineering life cycle tailoring plans, and systems engineering life cycle technical review briefings and completion letters  We then compared the documentation against the five selected systems engineering life cycle oversight responsibilities (responsibilities 5, 6, 7, 8, and 9)  We also obtained and analyzed documentation related to the CIO’s oversight of two projects that the Secret Service was implementing using an agile methodology—Uniformed Division Resource Management System and Events Management  Specifically, we obtained and assessed documentation of (1) the CIO’s approval for these projects to be implemented using an agile methodology and (2) the agile development metrics that the CIO established for each of these projects  We then compared this documentation to the three agile development-related component-level CIO responsibilities (responsibilities 10, 11, and 12)  Further, to determine the extent to which the Secret Service CIO had established an IT acquisition (i e , contract) review process that enabled component and DHS review of component contracts that contain IT (which is part of responsibility 2), we first asked Secret Service officials to provide us with a list of all new, unclassified IT contracts that the component awarded between October 1, 2016, and June 30, 2017  The Secret Service officials provided a list of 54 contracts  We validated that these were contracts for IT or IT services by: (1) searching for them in the Federal Procurement Data System – Next Generation; (2) identifying their associated product or service codes, as reported in that system; and (3) determining whether those codes were included in the universe of 79 IT product or service codes identified by the Category Management Leadership Council  In validating the list of 54 contracts provided by the Secret Service, we determined that 5 of the contracts were not associated with an IT product or service code  As such, we removed those contracts from the list  In addition, we found that three other items identified by the component were not in the Federal Procurement Data System – Next Generation  Secret Service officials subsequently confirmed that these three items were not contracts  We therefore removed these three items from the list  As such, the final list of validated contracts identified by the Secret Service included 46 IT contracts  In addition, to identify any IT contracts that were not included in the list provided by the Secret Service, we conducted a search of the Federal Procurement Data System – Next Generation to identify all unclassified contracts that (1) the component awarded between October 1, 2016, and June 30, 2017; (2) were not a modification of a contract; and (3) were associated with 1 of the 79 IT product or service codes identified by the Category Management Leadership Council  Based on these criteria, we identified 144 Secret Service IT contracts in the Federal Procurement Data System – Next Generation (these 144 contracts included the 46 contracts previously identified by Secret Service officials)  We then asked Secret Service officials to validate the accuracy, completeness, and reliability of these data, which they did  From each of these two lists of IT contracts (i e , the list of 46 IT contracts identified by the Secret Service and the list of 144 IT contracts that we identified from the Federal Procurement Data System – Next Generation), we then selected random, non-generalizable samples of contracts, as described below  First, from the list of 46 IT contracts identified by Secret Service officials, we removed 4 contracts that had total values of less than $10,000  To ensure that we selected across all contract sizes, we randomly selected 12 contracts from the remaining list of 42 contracts, using the following cost ranges: $10,000 to $50,000 (4 contracts), more than $50,000 to less than $250,000 (4 contracts), and more than $250,000 (4 contracts)  Second, from our list of 144 IT contracts that we identified from the Federal Procurement Data System – Next Generation, we removed the 46 contracts identified by Secret Service officials  We also removed 12 contracts that had total values of less than $10,000  To ensure that we selected across all contract sizes, we randomly selected 21 contracts from the remaining list of 86 contracts, using the following cost ranges: $10,000 to $50,000 (7 contracts), more than $50,000 to less than $250,000 (7 contracts), and more than $250,000 (7 contracts)  In total, we selected 33 IT contracts for review  We separated the contracts into the three cost ranges identified above in order to ensure that contracts of different value levels had been selected  This enabled us to determine the extent to which the CIO appropriately reviewed contracts of all values  To determine the extent to which the CIO had established an IT contract approval process that enabled the Secret Service and DHS, as appropriate, to review IT contracts, we first asked Secret Service Office of the CIO (OCIO) officials for documentation of their IT contract approval process  These officials were unable to provide such documentation  Instead, the officials stated that the Secret Service CIO or the CIO’s delegate approves all IT contracts prior to award  The officials also provided documentation that identified four staff to whom the CIO had delegated his approval authority  Further, the officials stated that, in accordance with DHS’s October 2016 IT acquisition review guidance, they submitted to DHS OCIO for approval any IT contracts that met DHS’s thresholds for review, including those that (1) had total estimated procurement values of $2 5 million or more, and (2) were associated with a major investment  Based on the IT acquisition review process that Secret Service OCIO officials described, we then obtained and analyzed each of the 33 selected IT contracts and associated approval documentation to determine whether or not the Secret Service CIO or the CIO’s delegate had approved each of the contracts  In particular, we (1) reviewed the name of the contract approver on the approval documentation, and (2) compared the signature dates that were on the contracts to the signature dates that were identified on the associated approval documentation  In addition, to determine whether or not the Secret Service CIO submitted to DHS OCIO for approval the IT contracts that (1) had total estimated procurement values of $2 5 million or more, and (2) were associated with major investments, we first analyzed the 144 Secret Service IT contracts that we had previously pulled from the Federal Procurement Data System – Next Generation to determine which contracts met the $2 5 million threshold  We identified 4 contracts that met this threshold  We then requested that OCIO identify the levels (i e , major or non-major) of the investments associated with these contracts  According to OCIO officials, 3 of the 4 contracts were associated with non-major investments and 1 was not associated with an investment  As such, based on DHS’s October 2016 IT acquisition review guidance, none of these contracts needed to be submitted to DHS OCIO for review  We also interviewed Secret Service officials, including the CIO and Deputy CIO, regarding the CIO’s implementation of the 14 selected component-level responsibilities  We assessed the evidence against the selected responsibilities to determine the extent to which the CIO had implemented them  To address the second objective—determining the extent to which the Secret Service had implemented leading workforce planning and management practices for its IT workforce—we first identified seven topic areas associated with human capital management based on the following sources: The Office of Personnel Management’s Human Capital Framework  Office of Personnel Management and the Chief Human Capital Officers Council Subcommittee for Hiring and Succession Planning, End-to-End Hiring Initiative  GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts Needed on Others  GAO, IT Workforce: Key Practices Help Ensure Strong Integrated Program Teams; Selected Departments Need to Assess Skill Gaps  GAO, Department of Homeland Security: Taking Further Action to Better Determine Causes of Morale Problems Would Assist in Targeting Action Plans  GAO, Human Capital: A Guide for Assessing Strategic Training and Development Efforts in the Federal Government  GAO, Results-Oriented Cultures: Creating a Clear Linkage between Individual Performance and Organizational Success  DHS acquisition guidance  Secret Service acquisition guidance  Among these topic areas, we then selected five areas that, in our professional judgment, were of particular importance to successful workforce planning and management  They were also previously identified as part of our high-risk and key issues work on human capital management  These areas include: (1) strategic planning, (2) recruitment and hiring, (3) training and development, (4) employee morale, and (5) performance management  We also reviewed these same sources and identified numerous leading practices associated with the five topic areas  Among these leading practices, we then selected three leading practices within each of the five areas (for a total of 15 selected practices)  The selected practices were foundational practices that, in our professional judgment, were of particular importance to successful workforce planning and management  Table 14 identifies the five selected workforce areas and 15 selected associated practices  To determine the extent to which the Secret Service had implemented the selected leading workforce planning and management practices for its IT workforce, we obtained and assessed documentation and compared it against the 15 selected practices  In particular, we analyzed the Secret Service’s human capital strategic plan, human capital staffing plan, IT strategic plan, documentation of the component’s staffing model that it used to determine the number of IT staff needed, an independent verification and validation report on the component’s staffing models, documentation of the current number of IT staff, the Secret Service’s recruitment and outreach plans, documentation of DHS’s hiring authorities (which are applicable to the Secret Service), the Secret Service’s training strategic plan, IT workforce training plan, action plans for improving employee morale, and templates used for measuring and reporting employee performance  We also interviewed Secret Service officials—including the CIO, Deputy CIO, and workforce planning staff—about the component’s workforce- related policies and documentation  Further, we discussed with the officials the Secret Service’s efforts to implement the selected workforce practices for its IT workforce  Regarding our assessments of the Secret Service’s implementation of the 15 selected workforce planning and management practices, we assessed a practice as being fully implemented if component officials provided supporting documentation that demonstrated all aspects of the practice  We assessed a practice as not implemented if the officials did not provide any supporting documentation for that practice, or if the documentation provided did not demonstrate any aspect of the practice  We assessed a practice as being partly implemented if the officials provided supporting documentation that demonstrated some, but not all, aspects of the selected practice  In addition, related to our assessments of the Secret Service’s implementation of the five selected overall workforce areas, we assessed each area as follows, based on the implementation of the three selected practices within each area: Fully implemented: The Secret Service provided evidence that it had fully implemented all three of the selected practices within the workforce area; Substantially implemented: The Secret Service provided evidence that it had either fully implemented two selected practices and partly implemented the remaining one selected practice within the workforce area, or fully implemented one selected practice and partly implemented the remaining two selected practices within the workforce area; Partially implemented: The Secret Service provided evidence that it had partly implemented each of the three selected practices within the workforce area; Minimally implemented: The Secret Service provided evidence that it partly implemented two selected practices and not implemented the remaining one selected practice within the workforce area, or partly implemented one selected practice and not implemented the remaining two selected practices within the workforce area; or Not implemented: The Secret Service did not provide evidence that it had implemented any of the three selected practices within the workforce area  To address the third objective—determining the extent to which the Secret Service and DHS have implemented selected performance and progress monitoring practices for IITT—we reviewed leading project monitoring practices and guidance from the Software Engineering Institute  First, we reviewed the practices within the Project Monitoring and Control process area of the Institute’s Capability Maturity Model Integration® for Acquisition  Based on our review, we identified four practices associated with monitoring program performance and progress  In our professional judgment, all four of these practices were of significance to managing the IITT investment given the phase of the life cycle that the investment was in  As such, we elected to include all four of these practices in our review, and combined them into one practice, as follows: Monitor program performance and conduct reviews at predetermined checkpoints or milestones by, among other things, comparing actual cost, schedule, and performance data with estimates in the program plan and identifying significant deviations from established targets or thresholds for acceptable performance levels  Next, given the agile development methodology that the Secret Service was using for certain projects within IITT, we reviewed the Software Engineering Institute’s technical note on the progress monitoring of agile contractors  Based on our review, and in consultation with an internal expert, we selected four agile metrics that the Institute identified as important for successful agile implementations and that, in our professional judgment, were of most significance to monitoring the performance of IITT’s agile projects  We then combined these four metrics into one practice, as follows: Measure and monitor agile projects on velocity (i e , number of story points completed per sprint or release), development progression (e g , the number of features and user stories planned and accepted), product quality (e g , number of defects), and post-deployment user satisfaction  To determine the extent to which DHS and the Secret Service had implemented the first selected practice, we analyzed relevant program management and governance documentation for IITT’s Enabling Capabilities program, and Multi-Level Security, Uniformed Division Resource Management System, and Events Management projects  In particular, we analyzed acquisition program baselines, DHS acquisition decision event memorandums, artifacts from DHS and Secret Service program oversight reviews, cost monitoring reports, program integrated master schedules, and program status briefings, and compared this documentation to the selected practice  We also interviewed Secret Service OCIO officials regarding the Secret Service’s and DHS’s efforts to monitor the IITT investment’s performance and progress  To determine the extent to which the Secret Service had implemented the second selected practice related to measuring and monitoring agile projects on agile metrics (i e , velocity, development progression, product quality, and post-deployment user satisfaction), we obtained and analyzed agile-related documentation for the two projects that the Secret Service was implementing using an agile methodology—Uniformed Division Resource Management System and Events Management  Specifically, to determine the extent to which the Secret Service was measuring and monitoring these two projects on metrics for velocity and development progression, we obtained and analyzed documentation, such as sprint burndown charts and monthly program status reports, and compared it to the selected practice  In addition, the agile metrics for product quality and post-deployment user satisfaction were only applicable to projects that had been deployed to users  As such, these metrics were applicable to the Uniformed Division Resource Management System (which the Secret Service had deployed to users) and were not applicable to Events Management (which the Secret Service had not yet deployed to users, as of early May 2018)  We therefore obtained and analyzed documentation demonstrating that Secret Service OCIO measured product defects for the Uniformed Division Resource Management System  We also requested documentation demonstrating that OCIO had measured and monitored post-deployment user satisfaction for this project, including via a survey  OCIO officials stated that they had not conducted such a survey and were unable to provide documentation demonstrating they had measured post- deployment user satisfaction for the Uniformed Division Resource Management System  To assess the reliability of the cost, schedule, and agile-related data that were in DHS and the Secret Service’s program management and governance documentation for the IITT investment, we (1) analyzed related documentation and assessed the data against existing agency records to identify consistency in the information, and (2) examined the data for obvious outliers, incomplete, or unusual entries  We determined that the data in these documents were sufficiently reliable for our purpose, which was to evaluate the extent to which DHS and the Secret Service had implemented processes for monitoring the IITT investment’s performance and progress  We conducted this performance audit from May 2017 to November 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  As of June 2018, the Secret Service’s Information Integration and Technology Transformation (IITT) investment included two programs (one of which included three projects) and one project that had capabilities that were in planning or development and modernization, as described below: Enabling Capabilities  This program is intended to, among other things, (1) modernize and enhance the Secret Service’s information technology (IT) network infrastructure, including increasing bandwidth and improving the speed and reliability of the Secret Service’s IT system performance; (2) enhance cybersecurity to protect against potential intrusions and viruses; and (3) provide counterintelligence and data mining capabilities to improve officials’ ability to perform the Secret Service’s investigative mission  Enterprise Resource Management System  This program comprises three projects that are intended to provide: a system that will enable the Secret Service’s Uniformed Division to efficiently and effectively plan, provision, and schedule missions (this project is referred to as Uniformed Division Resource Management System), a system that will unify the logistical actions (e g , assigning personnel) surrounding special events that Secret Service agents need to protect, such as the United Nations General Assembly (this project is referred to as Events Management), and a capability for creating schedules for Secret Service agents and administrative, professional, and technical staff, as well as the ability to generate reports on information such as monthly hours worked (this project is referred to as Enterprise-wide Scheduling)  Multi-Level Security  This project is intended to enable authorized Secret Service users to view two levels of classified information on a single workstation  Previously, data at various security levels were contained and used in multiple disparate systems  Multi-Level Security is intended to streamline users’ access to information at different security levels in order to enable them to more quickly and effectively perform their duties  Table 15 provides the planned life cycle cost and schedule estimates (threshold values) for each IITT program and project that had capabilities in planning or development and modernization, as of June 2018  In addition, the table describes any changes in those cost and schedule estimates, as well as the key reasons for any changes, as identified by officials from the Secret Service’s Office of the Chief Information Officer  In addition to the contact named above, the following staff made key contributions to this report: Shannin O’Neill (Assistant Director), Emily Kuhn (Analyst-in-Charge), Quintin Dorsey, Rebecca Eyler, Javier Irizarry, and Paige Teigen 

ground_truth: Commonly known for protecting the President, the Secret Service also plays a leading role in investigating and preventing financial and electronic crimes. To accomplish its mission, the Secret Service relies heavily on the use of IT infrastructure and systems. In 2009, the component initiated the IITT investment—a portfolio of programs and projects that are intended to, among other things, improve systems availability and security in support of the component's business operations. GAO was asked to review the Secret Service's oversight of its IT portfolio and workforce. This report discusses the extent to which the (1) CIO implemented selected IT oversight responsibilities, (2) Secret Service implemented leading IT workforce planning and management practices, and (3) Secret Service and DHS implemented selected performance monitoring practices for IITT. GAO assessed agency documentation against 14 selected component CIO responsibilities established in DHS policy; 15 selected leading workforce planning and management practices within 5 topic areas; and two selected leading industry project monitoring practices that, among other things, were, in GAO's professional judgment, of most significance to managing IITT. The U.S. Secret Service (Secret Service) Chief Information Officer (CIO) fully implemented 11 of 14 selected information technology (IT) oversight responsibilities, and partially implemented the remaining 3. The CIO partially implemented the responsibilities to establish a process that ensures the Secret Service reviews IT contracts; ensure that the component's IT policies align with the Department of Homeland Security's (DHS) policies; and set incremental targets to monitor program progress. Additional efforts to fully implement these 3 responsibilities will further position the CIO to effectively manage the IT portfolio. Of the 15 selected practices within the 5 workforce planning and management areas, the Secret Service fully implemented 3 practices, partly implemented 8, and did not implement 4 (see table). Within the strategic planning area, the component partly implemented the practice to, among other things, develop IT competency needs. While the Secret Service had defined general core competencies for its workforce, the Office of the CIO (OCIO) did not identify all of the technical competencies needed to support its functions. As a result, the office was limited in its ability to address any IT competency gaps that may exist. Also, while work remains to improve morale across the component, the Secret Service substantially implemented the employee morale practices for its IT staff. Secret Service officials said the gaps in implementing the workforce practices were due to, among other things, their focus on reorganizing the IT workforce within OCIO. Until the Secret Service fully implements these practices for its IT workforce, it may be limited in its ability to ensure the timely and effective acquisition and maintenance of the component's IT infrastructure and services. Of the two selected IT project monitoring practices, DHS and the Secret Service fully implemented the first practice to monitor the performance of the Information Integration and Technology Transformation (IITT) investment. In addition, for the second practice—to monitor projects on incremental development metrics—the Secret Service fully implemented the practice on one of IITT's projects and partially implemented it on another. In particular, OCIO did not fully measure post-deployment user satisfaction with the system on one project. OCIO plans to conduct a user satisfaction survey of the system by September 2018, which should inform the office on whether the system is meeting users' needs. GAO is making 13 recommendations, including that the Secret Service establish a process that ensures the CIO reviews all IT contracts, as appropriate; and identify the skills needed for its IT workforce. DHS concurred with all recommendations and provided estimated dates for implementing each of them.