prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: A complicated body of rules, precedents, and practices governs the legislative process on the floor of the House of Representatives  The official manual of House rules is more than 1,000 pages long and is supplemented by 30 volumes of precedents, with more volumes to be published in coming years  Yet there are two reasons why gaining a fundamental understanding of the House's legislative procedures is not as difficult as the sheer number and size of these documents might suggest  First, the ways in which the House applies its rules are largely predictable, at least in comparison with the Senate  Some rules are certainly more complex and more difficult to interpret than others, but the House tends to follow similar procedures under similar circumstances  Even the ways in which the House frequently waives, supplants, or supplements its standing rules with special, temporary procedures generally fall into a limited number of recognizable patterns  Second, underlying most of the rules that Representatives may invoke and the procedures the House may follow is a fundamentally important premise—that a majority of Members should ultimately be able to work their will on the floor  Although House rules generally recognize the importance of permitting any minority—partisan or bipartisan—to present its views and sometimes propose its alternatives, the rules do not enable that minority to filibuster or use other parliamentary devices to prevent the majority from prevailing without undue delay  This principle provides an underlying coherence to the various specific procedures discussed in this report  Article I of the Constitution imposes a few restrictions on House (and Senate) procedures—for example, requirements affecting quorums and roll-call votes—but otherwise the Constitution authorizes each house of Congress to determine for itself the "Rules of its Proceedings" (Article 1, Section 5)  This liberal grant of authority has several important implications  First, the House can amend its rules unilaterally; it need not consult with either the Senate or the President  Second, the House is free to suspend, waive, or ignore its rules whenever it chooses to do so  By and large, the Speaker or whatever Representative is presiding usually does not enforce the rules at his or her own initiative  Instead, Members must protect their own rights by affirmatively making points of order whenever they believe the rules are about to be violated  In addition, House rules include several formal procedures for waiving or suspending certain other rules, and almost any rule can be waived by unanimous consent  Thus, the requirements and restrictions discussed in this report generally apply only if the House chooses to enforce them  If for no other reason than the size of its membership, the House has found it necessary to limit the opportunities for each Representative to participate in floor deliberations  Whenever a Member is recognized to speak on the floor, there is always a time limit on his or her right to debate  The rules of the House never permit a Representative to hold the floor for more than one hour  Under some parliamentary circumstances, there are more stringent limits, with Members being allowed to speak for no more than 5 minutes, 20 minutes, or 30 minutes  Furthermore, House rules sometimes impose a limit on how long the entire membership of the House may debate a motion or measure  Most bills and resolutions, for instance, are considered under a set of procedures called "suspension of the rules" (discussed later in this report) that limits all debate on a measure to a maximum of 40 minutes  Under other conditions, when there is no such time limit imposed by the rules, the House (and to some extent, the Committee of the Whole as well) can impose one by simple majority vote  These debate limitations and debate-limiting devices generally prevent a minority of the House from thwarting the will of the majority  House rules also limit debate in other important respects  First, all debate on the floor must be germane to whatever legislative business the House is conducting  Representatives may speak on other subjects only in one-minute speeches most often made at the beginning of each day's session, special order speeches occurring after the House has completed its legislative business for the day, and during morning hour debates that are scheduled on certain days of the week  Second, all debate on the floor must be consistent with certain rules of courtesy and decorum  For example, a Member should not question or criticize the motives of a colleague  When a House committee reports a public bill or resolution that had been referred to it, the measure is placed on the House Calendar or the Union Calendar  In general, tax, authorization, and appropriations bills are placed on the Union Calendar; all others go to the House Calendar  In effect, the calendars are catalogues of measures that have been approved, with or without proposed amendments, by one or more House committees and are now available for consideration on the floor  Placement on a calendar does not guarantee that a measure will receive floor consideration at a specified time or at all  Because it would be impractical or undesirable for the House to take up measures in the chronological order in which they are reported and placed on one of the calendars, there must be some procedures for deciding the order in which measures are to be brought from the calendars to the House floor—in other words, procedures for determining the order of business  Clause 1 of Rule XIV lists the daily order of business on the floor, beginning with the opening prayer, the approval of the Journal (the official record of House proceedings required by the Constitution), and the Pledge of Allegiance  Apart from these routine matters, however, the House never follows the order of business laid out in this rule  Instead, certain measures and actions are privileged, meaning they may interrupt the regular order of business  In practice, all the legislative business that the House conducts comes to the floor by interrupting the order of business under Rule XIV, either by unanimous consent or under the provisions of another House rule  Every bill and resolution that cannot be considered by unanimous consent must become privileged business if it is going to reach the floor at all  There is no one single set of procedures that the House always follows when it considers a public bill or resolution on the floor  Instead, there are several modes of consideration, or different sets of procedural rules, that the House uses  In some cases, House rules require that certain kinds of bills be considered in certain ways  By various means, however, the House chooses to use whichever mode of consideration is most appropriate for a given bill  Which of these modes the House uses depends on such factors as the importance and potential cost of the bill and the amount of controversy the bill has generated among Members  The differences among these sets of procedures rest largely on the balance that each strikes between the opportunities for Members to debate and propose amendments, on the one hand, and the ability of the House to act promptly, on the other  Regardless of which procedure the House uses to consider legislation, the House majority party leadership generally tries to post the text of measures coming to the chamber floor in advance on an internet website created for that purpose  The House most frequently resorts to a set of procedures that enables it to act quickly on bills that enjoy overwhelming but not unanimous support  Although this set is called "suspension of the rules," clause 1 of Rule XV provides for these procedures as an alternative to the other modes of consideration  The essential components of suspension of the rules are (1) a 40-minute limit on debate, (2) a prohibition against floor amendments, and (3) a two-thirds vote of those present and voting for passage  On every Monday, Tuesday, and Wednesday—and at other times by special arrangement—the Speaker may recognize Members to move to suspend the rules and pass a particular bill (or take some other action, such as agreeing to the Senate's amendments to a House bill)  Once such a motion is made, the motion and the bill itself together are debatable for a maximum of 40 minutes  Half of the time is controlled by the Representative making the motion, often the chair of the committee with jurisdiction over the bill; the other half is usually controlled by the ranking minority member of the committee (or sometimes the subcommittee) of jurisdiction, especially when he or she opposes the motion  The suspension motion itself may propose to pass the bill with certain amendments, but no Member may propose an amendment from the floor  During the debate, the two Members who control the time yield parts of it to other Members who wish to speak  Once the 40 minutes is either used or yielded back, a single vote occurs on suspending the rules and simultaneously passing the bill  If two-thirds of the Members present vote "Aye," the motion is agreed to and the bill is passed  If the motion fails, the House may debate the bill again at another time, perhaps under another mode of consideration that permits floor amendments and more debate and requires only a simple majority vote for passage  The House frequently considers several suspension motions on the same day, which could result in a series of electronically recorded votes taking place at 40-minute intervals if such votes are requested  For the convenience of the House, therefore, clause 8 of Rule XX permits the Speaker to postpone electronic votes that Members have demanded on motions to suspend the rules until a later time on the same day or the following day  When the votes do take place, they are clustered together, occurring one after the other without intervening debate  One of the ironies of the legislative process on the House floor is that the House does relatively little business under the basic rules of the House  Instead, most of the debate and votes on amendments to major bills occur in Committee of the Whole (discussed below)  This is largely because of the rule that generally governs debate in the House itself  The rule controlling debate during meetings of the House (as opposed to meetings of the Committee of the Whole) is clause 2 of Rule XVII, which states in part that a "Member, Delegate, or Resident Commissioner may not occupy more than one hour in debate on a question in the House " In theory, this rule permits each Representative to speak for as much as an hour on each bill, on each amendment to each bill, and on each of the countless debatable motions that Members could offer  Thus, there could be more than four hundred hours of debate on each such question, a situation that would make it virtually impossible for the House to function effectively  In practice, however, this "hour rule" usually means that each measure considered "in the House" is debated by all Members for no more than a total of only one hour before the House votes on passing it  The reason for this dramatic difference between the rule in theory and the rule in practice lies in the consequences of a parliamentary motion to order what is called the "previous question " When a bill or resolution is called up for consideration in the House—and, therefore, under the hour rule—the Speaker recognizes the majority floor manager to control the first hour of debate  The majority floor manager is usually the chair of the committee or subcommittee with jurisdiction over the measure and most often supports its passage without amendment  This Member will yield part of his or her time to other Members and may allocate control of half of the hour to the minority floor manager (usually the ranking minority member of the committee or subcommittee)  However, the majority floor manager almost always yields to other Representatives "for purposes of debate only " Thus, no other Member may propose an amendment or make any motion during that hour  During the first hour of debate, or at its conclusion, the majority floor manager invariably "moves the previous question " This nondebatable motion asks the House if it is ready to vote on passing the bill  If a majority votes for the motion, no more debate on the bill is in order, nor can any amendments to it be offered; after disposing of the motion, the House usually votes immediately on whether to pass the bill  If the House defeats the previous question, however, opponents of the bill would then be recognized to control the second hour of debate, and might use that time to try to amend the measure  Because of this, it is unusual for the House not to vote for the previous question—the House disposes of most measures considered in the House, under the hour rule, after no more than one hour of debate and with no opportunity for amendment from the floor  These are not very flexible and accommodating procedural ground rules for the House to follow in considering most legislation  Debate on a bill is usually limited to one hour, and only one or two Members control this time  Before an amendment to the bill can even be considered, the House must first vote against a motion to order the previous question  For these reasons, most major bills are not considered in the House under the hour rule  In current practice, the most common type of legislation considered under the hour rule in the House are procedural resolutions reported by the House Committee on Rules that are commonly referred to as "special rules" (discussed below)  Much of the legislative process on the floor occurs not "in the House" but in a committee of the House known as the Committee of the Whole (formally, the Committee of the Whole House on the State of the Union)  Every Representative is a member of the Committee of the Whole, and it is in this committee, meeting in the House chamber, that many major bills are debated and amended before being passed or defeated by the House itself  Most bills are first referred to, considered in, and reported by a standing legislative committee of the House before coming to the floor  In much the same way, once bills do reach the floor, many of them then are referred to a second committee, the Committee of the Whole, for further debate and for the consideration of amendments  The Speaker presides over meetings of the House but not over meetings of the Committee of the Whole  Instead, the Speaker appoints another Member of the majority party to serve as the chair of the Committee of the Whole during the time the committee is considering a particular bill or resolution  In addition, the rules that apply in Committee of the Whole are somewhat different from those that govern meetings of the House itself  The major differences are discussed in the following sections of this report  In general, the combined effect of these differences is to make the procedures in Committee of the Whole—especially the procedures for offering and debating amendments—considerably more flexible than those of the House  Clause 3 of Rule XVIII requires that most bills affecting federal taxes and spending be considered in Committee of the Whole before the House votes on passing them  Most other major bills are also considered in this way  Most commonly, the House adopts a resolution, reported by the Rules Committee, that authorizes the Speaker to declare the House "resolved" into Committee of the Whole to consider a particular bill  There are two distinct stages to consideration in Committee of the Whole  First, there is a period for general debate, which is routinely limited to an hour  Each of the floor managers usually controls half the time, yielding parts of it to other Members who want to participate in the debate  During general debate, the two floor managers and other Members discuss the bill, the conditions prompting the committee to recommend it, and the merits of its provisions  Members may describe and explain the reasons for the amendments that they intend to offer, but no amendments can actually be proposed at this time  During or after general debate, the majority floor manager may move that the committee "rise"—in other words, that the committee transform itself back into the House  When the House agrees to this motion, it may resolve into Committee of the Whole again at another time to resume consideration of the bill  Alternatively, the Committee of the Whole may proceed immediately from general debate to the next stage of consideration: the amending process  The Committee of the Whole may consider a bill for amendment section by section or, in the case of appropriations measures, paragraph by paragraph  Amendments to each section or of the bill are in order after the part they would amend has been read or designated and before the next section is read or designated  Alternatively, the bill may be open to amendment at any point, usually by unanimous consent  The first amendments considered to each part of the bill are those (if any) recommended by the committee that reported it  Thereafter, members of the committee are usually recognized before other Representatives to offer their own amendments  All amendments must be germane to the text they would amend  Germaneness is a subject matter standard more stringent than one of relevancy and reflects a complex set of criteria that have developed by precedent over the years  The Committee of the Whole votes only on amendments; it does not vote directly on the bill as a whole  And like the standing committees of the House, the Committee of the Whole does not actually amend the bill; it only votes to recommend amendments to the House  The motion to order the previous question may not be made in Committee of the Whole, so, under a purely open amendment process, Members may offer whatever germane amendments they wish  After voting on the last amendment to the last portion of the bill, the committee rises and reports the bill back to the House with whatever amendments it has agreed to  Purely open amendment processes have been rare in recent Congresses; the amendment process is far more frequently structured by the terms of a special rule reported by the Rules Committee and adopted by the House  This process is discussed in the next section of this report  An amendment to a bill is a first-degree amendment  After such an amendment is offered, but before the committee votes on it, another Member may offer a perfecting amendment to make some change in the first degree amendment  In current floor practice, this is rare  A perfecting amendment to a first-degree amendment is a second-degree amendment  After debate, the committee first votes on the second-degree perfecting amendment and then on the first-degree amendment as it may have been amended  Clause 6 of Rule XVI also provides that a Member may offer a substitute for the first-degree amendment before or after a perfecting amendment is offered, and this substitute may also be amended  Although a full discussion of these possibilities is beyond the scope of this report, it is important to note that the amending process can become complicated, with Members proposing several competing policy choices before the Committee of the Whole votes on any of them  Debate on amendments in Committee of the Whole is governed by the five-minute rule, not the hour rule that regulates debate in the House  The Member offering each amendment (or the majority floor manager, in the case of a committee amendment) is first recognized to speak for five minutes  Then a Member opposed to the amendment may claim five minutes for debate  Other Members may also speak for five minutes each by offering a motion "to strike the last word " Technically, this motion is an amendment that proposes to strike out the last word of the amendment being debated  But it is a "pro forma amendment" that is offered merely to secure time for debate and so is not voted on when the five minutes expire  In this way, each Representative may speak for five minutes on each amendment  However, a majority of the Members can vote (or agree by unanimous consent) to end the debate on an amendment immediately or at some specified time  Also, as mentioned, if the amendment process is governed by a special rule reported by the Rules Committee and adopted by the House, that resolution will limit the number, order, and form of amendments that can be considered  When the committee finally rises and reports the bill back to the House, the House proceeds to vote on the amendments the committee has adopted  It usually approves all these amendments by one voice vote, though Members can demand separate votes on any or all of them as a matter of right  After a formal and routine stage called "third reading and engrossment" (when only the title of the bill is read), there is then an opportunity for a Member, virtually always from the minority party, to offer a motion to recommit the bill to committee  If the House agrees to a "simple" or "straight" motion to recommit, which only proposes to return the bill to committee, the bill is taken from the floor and returned to committee  Although the committee technically has the power to re-report the bill, in practice, the adoption of a straight motion to recommit is often characterized as effectively "killing" the measure  "Straight" motions to recommit are rare  Alternatively, motions to recommit far more frequently include instructions that the committee report the bill back to the House "forthwith" with an amendment that is stated in the motion  If the House agrees to such a motion, which is debatable for 10 minutes, evenly divided, it then immediately votes on the amendment itself, so a motion to recommit with instructions is really a final opportunity for the minority party to amend the bill before the House votes on whether to pass it  Thus, this complicated mode of consideration, which the House uses to consider most major bills, begins in the House with a decision to resolve into Committee of the Whole to consider a particular bill  General debate and the amending process take place in Committee of the Whole, but ultimately it is the House that formally amends and then passes or rejects the bill  Clause 1(m) of Rule X authorizes the Rules Committee to report resolutions affecting the order of business  Such a resolution—called a "rule" or "special rule"—usually proposes to make a bill in order for floor consideration so that it can be debated, amended, and passed or defeated by a simple majority vote  In effect, each special rule recommends to the House that it take from the Union or House Calendar a measure that is not otherwise privileged business and bring it to the floor out of its order on that calendar  Typically, such a resolution begins by providing that, at any time after its adoption, the Speaker may declare the House resolved into Committee of the Whole for the consideration of that bill  Because the special rule is itself privileged, under clause 5(a) of Rule XIII, the House can debate and vote on it promptly  If the House accepts the Rules Committee's recommendation, it proceeds to consider the bill itself  One fundamental purpose of most special rules, therefore, is to make another bill or resolution privileged so that it may interrupt the regular order of business  Their other fundamental purpose is to set special procedural ground rules for considering that measure; these ground rules may either supplement or supplant the standing rules of the House  For example, the special rule typically sets the length of time for general debate in Committee of the Whole and specifies which Members are to control that time  In addition, the special rule normally includes provisions that expedite final House action on the bill after the amending process in Committee of the Whole has been completed  Special rules may also waive points of order that Members could otherwise make against consideration of the bill, against one of its provisions, or against an amendment to be offered to it  The most controversial provisions of special rules affect the amendments that Members can offer to the bill that the resolution makes in order  As noted above, an "open rule" permits Representatives to propose any amendment that meets the normal requirements of House rules and precedents—for example, the requirement that each amendment must be germane  A "modified open rule" permits amendments to be offered that otherwise comply with House rules but imposes a time limit on the consideration of amendments or requires them to be preprinted in the Congressional Record   At the other extreme, a "closed rule" prohibits all amendments except perhaps for committee amendments and pro forma amendments ("to strike the last word") offered only for purposes of debate  A "structured" rule, which is the most common type of rule, permits only certain specific amendments to be considered on the floor  These provisions are very important because they can prevent Representatives from offering amendments as alternatives to provisions of the bill, thereby limiting the policy choices that the House can make  Open rules have been rare in recent Congresses  However, like other committees, the Rules Committee only makes recommendations to the House  As noted above, Members debate each of its procedural resolutions in the House under the hour rule and then vote to adopt or reject it  If the House votes against ordering the previous question on a special rule, a Member could offer an amendment to it, proposing to change the conditions under which the bill itself is to be considered  Because the adoption of a special rule is often viewed as a "party loyalty" vote, however, such a development is exceedingly rare  All the same, it is important to remember that while the Rules Committee is instrumental in helping the majority party leadership formulate its order of business and in setting appropriate ground rules for considering each bill, the House retains ultimate control over what it does, when, and how  Legislation is sometimes brought before the House of Representatives for consideration by the unanimous consent of its Members  Long-standing policies announced by the Speaker regulate unanimous consent requests for this purpose  Among other things, the Speaker will recognize a Member to propound a unanimous consent request to call up an unreported bill or resolution only if that request has been cleared in advance with both party floor leaders and with the bipartisan leadership of the committee of jurisdiction  Before any bill can become law, both the House and the Senate must pass it, and the two houses must agree on each and every one of its provisions  This basic constitutional requirement means that the House must have procedures to respond when the House and Senate pass different versions of the same bill  For example, the House may pass a Senate bill with House amendments, or the Senate may pass a House bill with Senate amendments and then send its amendments to the House  In either case, the two houses must resolve their differences over these amendments before the legislative process is completed  There are essentially two ways to approach this stage of the process: (1) by dealing with the amendments individually through a process of exchanging amendments between the chambers, with the bill being sent back and forth between the House and Senate, or (2) by dealing with the amendments collectively through a conference committee of Representatives and Senators who negotiate a series of compromises and concessions that are compiled in a conference report that the two houses can vote to accept  Because the process of resolving differences between the houses can be quite complicated, only some of its basic elements are summarized here  The House normally considers Senate amendments to a House bill by unanimous consent or by suspension of the rules; the House may accept the amendments (concur in them) or amend them (concur in them with House amendments)  Alternatively, the committee with jurisdiction over the bill may authorize its chair to move that the House disagree to the Senate's amendments and send them to a conference committee  When the House amends and passes a Senate bill, it may request a conference with the Senate immediately, or it may simply send its amendments to the Senate in the hope that the Senate will accept them  If the Senate refuses to do so, it may request a conference with the House instead  On the other hand, if the House and Senate can reach agreement by proposing amendments to each other's positions, the bill can be sent to the President for his signature or veto without the need to create a conference committee  This method of resolving differences is sometimes colloquially called "ping-pong," because each chamber acts in turn, shuttling the legislation back and forth as each proposes amendments to the position of the other  If the House and Senate agree to send their versions of the bill to a conference committee, the Speaker appoints the House conferees  These conferees are usually drawn from the standing committee (or committees) with jurisdiction over the bill, although the Speaker may appoint some other Representatives as well  When the House and Senate conferees meet, they are to deal only with provisions of the bill on which the two houses disagree  They should not insert new provisions or change provisions that both houses have already approved  Furthermore, as the conferees resolve each provision or amendment in disagreement, they accept the House position, the Senate position, or a compromise between them  Like almost all other House rules, the rules limiting the authority of conferees are enforced only if Members make points of order at the appropriate time  The House may also adopt a special rule, reported by the Rules Committee, waiving points of order against a conference report  To complete their work successfully, a majority of the House conferees and a majority of the Senate conferees must sign a report that recommends all the agreements they have reached  The conferees also sign a "joint explanatory statement" that describes the original House and Senate positions and the conferees' recommendations and is the functional equivalent of a legislative committee report  After Representatives have had three days to examine a conference report, it is privileged for floor consideration; it may be called up at any time that the House is not already considering something else  The report may be debated in the House under the hour rule, so the vote almost always occurs after no more than one hour of debate  No amendments to the report are in order  In practice, however, the House almost always considers conference reports under the terms of a special rule from the Rules Committee that waives all points of order against the report and its consideration  The conference report is a proposed package settlement of a number of disagreements, so the House and Senate may accept it or reject it, but they may not change it  If the two houses agree to the report by simple majority vote, all their differences have been resolved and the bill is then "enrolled," or reprinted, for formal presentation to the President  In rare instances, conferees cannot reach agreement on one or more of the amendments in conference, or they may reach an agreement that they cannot include in their conference report because their proposal exceeds the scope of the differences between the House and Senate positions (and thus violates the rules governing the content of conference reports)  In either case, the conferees may report back to the two houses with an amendment (or amendments) in disagreement  After acting on the conference report and dealing collectively with all the other amendments that were sent to conference, the House acts on each of the amendments in disagreement by considering motions such as a motion to accept the Senate's amendment or a motion to amend it with a new House amendment  The Senate takes similar action until the disagreements on these amendments are resolved or until the two houses agree to create a new conference committee only to address the remaining amendments that are still in disagreement  The bill cannot become law until the two houses resolve all the differences between their positions  Whenever Representatives vote on the floor, there is almost always first a "voice vote," in which the Members in favor of the bill, amendment, or motion vote "Aye" in unison, followed by those voting "No " Before the Speaker (or the chair of the Committee of the Whole) announces the result, any Representative can demand a "division vote," in which the Members in favor stand up to be counted, again followed by those opposed  But before the result of either a voice vote or a division vote is announced, a Member may try to require another vote in which everyone's position is recorded publicly  This recorded vote is taken by using the House's electronic voting system  In Committee of the Whole, an electronic vote is ordered when 25 Members request it  In the House, such a vote occurs when demanded by at least one-fifth of the Members present  Alternatively, any Member can demand an electronically recorded vote in the House if a quorum of the membership is not present on the floor when the voice or division vote takes place  The Constitution requires that a quorum must be present on the floor when the House is conducting business  In the House, a quorum is a majority of the Representatives; in Committee of the Whole, it is only 100 Members  However, the House has traditionally assumed that a quorum is always present unless a Member makes a point of order that it is not  The rules restrict when Members can make such points of order, and they occur most often when the House or the Committee of the Whole is voting  In the House, for example, a Representative can object to a voice or division vote on the grounds that a quorum is not present and make that point of order  If a quorum is not present, the Speaker automatically orders an electronically recorded vote during which Members record their presence on the floor by casting their votes  The issue is decided and a quorum is established at the same time  A voice or division vote is valid even if less than a quorum participates in the vote so long as no one makes a point of order that a quorum is not present  For this reason, Members can continue to meet in their committees or fulfill their other responsibilities off the floor when the House is doing business that does not involve publicly recorded votes  On most days, the House will meet two hours prior to scheduled legislative business for Morning Hour Debate, a period in which Members can make speeches of up to five minutes on subjects of their choosing  Later, the House will meet for legislative session  After the opening prayer on each day by the House chaplain (or perhaps by a guest chaplain), the Speaker announces approval of the Journal of the previous day's proceedings  A Member may require a recorded vote on agreeing to the Speaker's approval of the Journal  Following the Pledge of Allegiance, some Members may then ask unanimous consent to address the House for one minute each on whatever subjects they wish, including subjects unrelated to the scheduled legislative business of the day  The ability to set the House's floor schedule is one of the primary powers and responsibilities of the majority party leaders, and in doing so they often consult with minority party leaders  Generally speaking, to the extent possible, majority party leaders and the committee chairmen arrange the legislative schedule for each week in advance  During the last floor session of the week, the majority leader normally announces the expected schedule for the coming week in a traditional "wrap-up" colloquy with a minority party leader  Changes in the schedule may be announced as they are made  On a Monday, Tuesday, or Wednesday, the House will commonly consider multiple measures under the "suspension of the rules" procedure  Typically, recorded votes on such measures, if requested, are clustered together and taken at the end of the day  On other days of the week, the House will usually consider a major bill pursuant to a special rule reported by the House Committee on Rules  Such a special rule would be debated in the House under the hour rule, at the end of which the majority manager of the special rule would "move the previous question," which, when adopted, brings the resolution to a vote  Once adopted, the House would ordinarily consider a measure in Committee of the Whole pursuant to the terms for general debate and amendment established by the special rule  Following consideration in the Committee of the Whole, the House would take the final votes on the measure after voting on the amendments recommended by the committee and on a minority motion to recommit, which would likely be made with amendatory instructions  As each item of business is completed, the Speaker anticipates which Member should be seeking recognition to call up the next bill or resolution  If another Representative requests to be recognized instead, t he Speaker may ask, "For what purpose does the gentleman seek recognition?" The Speaker may decline to recognize that Member if the Speaker wants the House to consider another privileged measure, motion, or report  At the end of legislative business on most days, some Members address the House for as much as an hour each on subjects of their choice  These "special order" speeches are arranged in advance and organized by the party leadership  In this way, Representatives can comment at length on current national and international issues and discuss bills that have not yet reached the House floor  The House often adjourns by early evening, although it may remain in session later when the need arises or when the end of the annual session or some other deadline approaches  The House rules for each Congress are published in a volume often called the House manual but officially entitled Constitution, Jefferson's Manual and Rules of the House of Representatives   A new edition of this collection is published each Congress  The precedents of the House established through 1935 have been compiled in the 11-volume set of Hinds' and Cannon's Precedents of the House of Representatives   More recent precedents are published as Deschler's or Deschler-Brown -Johnson Precedents of the U S  House of Representatives ; 18 volumes of this set now are available  Volume 1 of a fourth series of House precedents, Precedents of the United States House of Representatives , was initiated in 2017, and additional volumes are expected in the future  The House's procedures are summarized in House Practice: A Guide to the Rules, Precedents and Procedures of the House , by Charles W  Johnson, John V  Sullivan, and Thomas J  Wickham Jr , Parliamentarians of the House  The most recent version of House Practice was published in 2017  The Parliamentarian and his assistants welcome inquiries about House procedures and offer expert assistance compatible with their other responsibilities  CRS Report 98-995, The Amending Process in the House of Representatives , by Christopher M  Davis  CRS Report RL32200, Debate, Motions, and Other Actions in the Committee of the Whole , by Bill Heniff Jr  and Elizabeth Rybicki  CRS Report 97-552, The Discharge Rule in the House: Principal Features and Uses , by Richard S  Beth  CRS Report RL30787, Parliamentary Reference Sources: House of Representatives , by Richard S  Beth and Megan S  Lynch  CRS Report 98-696, Resolving Legislative Differences in Congress: Conference Committees and Amendments Between the Houses , by Elizabeth Rybicki  CRS Report 97-780, The Speaker of the House: House Officer, Party Leader, and Representative , by Valerie Heitshusen  CRS Report 98-314, Suspension of the Rules in the House: Principal Features , by Elizabeth Rybicki  CRS Report 98-870, Quorum Requirements in the House: Committee and Chamber , by Christopher M  Davis 
Report 2:  The estimate accounts for all possible costs associated with a program, is structured in sufficient detail to ensure that costs are neither omitted nor double counted, and documents all cost-influencing assumptions  Well-documented  Supporting documentation explains the process, sources, and methods used to create the estimate; contains the underlying data used to develop the estimate; and is adequately reviewed and approved by management  Accurate  The estimate is not overly conservative or optimistic, is based on an assessment of the costs most likely to be incurred, and is regularly updated so that it always reflects the program’s current status  Credible  Discusses any limitations of the analysis because of uncertainty or sensitivity surrounding data or assumptions, the estimate’s results are cross-checked, and an independent cost estimate is conducted by a group outside the acquiring organization to determine whether other estimating methods produce similar results  In May 2017, DHS approved GMM’s lifecycle cost estimate of about $251 million for fiscal years 2015 through 2030  We found this initial estimate to be reliable because it fully or substantially addressed all the characteristics associated with a reliable cost estimate  For example, the estimate comprehensively included government and contractor costs, all elements of the program’s work breakdown structure, and all phases of the system lifecycle; and was aligned with the program’s technical documentation at the time the estimate was developed  GMM also fully documented the key assumptions, data sources, estimating methodology, and calculations for the estimate  Further, the program conducted a risk assessment and sensitivity analysis, and DHS conducted an independent assessment of the cost estimate to validate the accuracy and credibility of the cost estimate  However, key assumptions that FEMA made about the program changed soon after DHS approved the cost estimate in May 2017  Thus, the initial cost estimate no longer reflects the current approach for the program  For example, key assumptions about the program that changed include: Change in the technical approach: The initial cost estimate assumed that GMM would implement a software-as-a-service model, meaning that FEMA would rely on a service provider to deliver software applications and the underlying infrastructure to run them  However, in December 2017, the program instead decided to implement an infrastructure-as-a-service model, meaning that FEMA would develop and deploy its own software application and rely on a service provider to deliver and manage the computing infrastructure (e g , servers, software, storage, and network equipment)  According to program officials, this decision was made after learning from the Agile prototypes that the infrastructure-as-a-service model would allow GMM to develop the system in a more flexible environment  Increase in the number of system development personnel: A key factor with Agile development is the number of development teams (each consisting of experts in software development, testing, and cybersecurity) that are operating concurrently and producing separate portions of software functionality  Program officials initially assumed that they would need three to four concurrent Agile development teams, but subsequently realized that they would instead need to expend more resources to achieve GMM’s original completion date  Specifically, program officials now expect they will need to at least double, and potentially triple, the number of concurrent development teams to meet GMM’s original target dates  Significant delays and complexities with data migration: In 2016 and 2017, GMM experienced various technical challenges in its effort to transfer legacy system data to a data staging platform  This data transfer effort needed to be done to standardize the data before eventually migrating the data to GMM  These challenges resulted in significant delays and cost increases  Program officials reported that, by February 2018—at least 9 months later than planned—all legacy data had been transferred to a data staging platform so that FEMA officials could begin analyzing and standardizing the data prior to migrating it into GMM  FEMA officials reported that they anticipated the cost estimate to increase, and for this increase to be high enough to breach the $251 million threshold set in GMM’s May 2017 acquisition program baseline  Thus, consistent with DHS’s acquisition guidance, the program informed the DHS acquisition review board of this anticipated breach  The board declared that the program was in a cost breach status, as of September 12, 2018  As of October 2018, program officials stated that they were in the process of revising the cost estimate to reflect the changes in the program and to incorporate actual costs  In addition, the officials stated that the program was applying a new cost estimating methodology tailored for Agile programs that DHS’s Cost Analysis Division had been developing  In December 2018, program officials stated that they had completed the revised cost estimate but it was still undergoing departmental approval  Establishing an updated cost estimate should help FEMA better understand the expected costs to deliver GMM under the program’s current approach and time frames  The success of an IT program depends, in part, on having an integrated and reliable master schedule that defines when the program’s set of work activities and milestone events are to occur, how long they will take, and how they are related to one another  Among other things, a reliable schedule provides a roadmap for systematic execution of an IT program and the means by which to gauge progress, identify and address potential problems, and promote accountability  GAO’s Schedule Assessment Guide defines leading practices related to the following four characteristics that are vital to having a reliable integrated master schedule  Comprehensive  A comprehensive schedule reflects all activities for both the government and its contractors that are necessary to accomplish a program’s objectives, as defined in the program’s work breakdown structure  The schedule also includes the labor, materials, and overhead needed to do the work and depicts when those resources are needed and when they will be available  It realistically reflects how long each activity will take and allows for discrete progress measurement  Well-constructed  A schedule is well-constructed if all of its activities are logically sequenced with the most straightforward logic possible  Unusual or complicated logic techniques are used judiciously and justified in the schedule documentation  The schedule’s critical path represents a true model of the activities that drive the program’s earliest completion date and total float accurately depicts schedule flexibility  Credible  A schedule that is credible is horizontally traceable—that is, it reflects the order of events necessary to achieve aggregated products or outcomes  It is also vertically traceable—that is, activities in varying levels of the schedule map to one another and key dates presented to management in periodic briefings are consistent with the schedule  Data about risks are used to predict a level of confidence in meeting the program’s completion date  The level of necessary schedule contingency and high-priority risks are identified by conducting a robust schedule risk analysis  Controlled  A schedule is controlled if it is updated regularly by trained schedulers using actual progress and logic to realistically forecast dates for program activities  It is compared to a designated baseline schedule to measure, monitor, and report the program’s progress  The baseline schedule is accompanied by a baseline document that explains the overall approach to the program, defines ground rules and assumptions, and describes the unique features of the schedule  The baseline schedule and current schedule are subject to a configuration management control process  GMM’s schedule was unreliable because it minimally addressed three characteristics—comprehensive, credible, and controlled—and did not address the fourth characteristic of a reliable estimate—well-constructed  One of the most significant issues was that the program’s fast approaching, final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date  Table 4 summarizes our assessment of GMM’s schedule  In discussing the reasons for the shortfalls in these practices, program officials stated that they had been uncertain about the level of rigor that should be applied to the GMM schedule, given their use of Agile development  However, leading practices state that program schedules should meet all the scheduling practices, regardless of whether a program is using Agile development  As discussed earlier in this report, GMM has already experienced significant schedule delays  For example, the legacy data migration effort, the AFG pilot, and the Agile development contract have been delayed  Program officials also stated that the delay in awarding and starting the Agile contract has delayed other important activities, such as establishing time frames for transitioning legacy systems  A more robust schedule could have helped FEMA predict the impact of delays on remaining activities and identify which activities appeared most critical so that the program could ensure that any risks in delaying those activities were properly mitigated  In response to our review and findings, program officials recognized the need to continually enhance their schedule practices to improve the management and communication of program activities  As a result, in August 2018, the officials stated that they planned to add a master scheduler to the team to improve the program’s schedule practices and ensure that all of the areas of concern we identified are adequately addressed  In October 2018, the officials reported that they had recently added two master schedulers to GMM  According to the statement of objectives, the Agile contractor is expected to develop an integrated master schedule soon after it begins performance  However, program officials stated that GMM is schedule-driven—due to the Executive Steering Group’s expectation that the solution will be delivered by September 2020  The officials added that, if GMM encounters challenges in meeting this time frame, the program plans to seek additional resources to allow it to meet the 2020 target  GMM’s schedule-driven approach has already led to an increase in estimated costs and resources  For example, as previously mentioned, the program has determined that, to meet its original target dates, GMM needs to at least double, and possibly triple, the number of concurrent Agile development teams  In addition, we have previously reported that schedule pressure on federal IT programs can lead to omissions and skipping of key activities, especially system testing  In August 2018, program officials acknowledged that September 2020 may not be feasible and that the overall completion time frames established in the acquisition program baseline may eventually need to be rebaselined  Without a robust schedule to forecast whether FEMA’s aggressive delivery goal for GMM is realistic to achieve, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to fully deliver the system  NIST’s risk management framework establishes standards and guidelines for agencies to follow in developing cybersecurity programs  Agencies are expected to use this framework to achieve more secure information and information systems through the implementation of appropriate risk mitigation strategies and by performing activities that ensure that necessary security controls are integrated into agencies’ processes  The framework addresses broad cybersecurity and risk management activities, which include the following: Categorize the system: Programs are to categorize systems by identifying the types of information used, selecting a potential impact level (e g , low, moderate, or high), and assigning a category based on the highest level of impact to the system’s confidentiality, integrity, and availability, if the system was compromised  Programs are also to document a description of the information system and its boundaries and should register the system with appropriate program management offices  System categorization is documented in a system security plan  Select and implement security controls: Programs are to determine protective measures, or security controls, to be implemented based on the system categorization results  These security controls are documented in a system security plan  For example, control areas include access controls, incident response, security assessment and authorization, identification and authentication, and configuration management  Once controls are identified, programs are to determine planned implementation actions for each of the designated controls  These implementation actions are also specified in the system security plan  Assess security controls: Programs are to develop, review, and approve a security assessment plan  The purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  Programs are to also perform a security control assessment by evaluating the security controls in accordance with the procedures defined in the security assessment plan, in order to determine the extent to which the controls were implemented correctly  The output of this process is intended to produce a security assessment report to document the issues, findings, and recommendations  Programs are to conduct initial remediation actions on security controls and reassess those security controls, as appropriate  Obtain an authorization to operate the system: Programs are to obtain security authorization approval in order to operate a system  Resolving weaknesses and vulnerabilities identified during testing is an important step leading up to achieving an authorization to operate  Programs are to establish corrective action plans to address any deficiencies in cybersecurity policies, procedures, and practices  DHS guidance also states that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  Monitor security controls on an ongoing basis: Programs are to monitor their security controls on an ongoing basis after deployment, including determining the security impact of proposed or actual changes to the information system and assessing the security controls in accordance with a monitoring strategy that determines the frequency of monitoring the controls  For the GMM program’s engineering and test environment, which went live in February 2018, FEMA fully addressed three of the five key cybersecurity practices in NIST’s risk management framework and partially addressed two of the practices  Specifically, FEMA categorized GMM’s environment based on security risk, implemented select security controls, and monitored security controls on an ongoing basis  However, the agency partially addressed the areas of assessing security controls and obtaining an authorization to operate the system  Table 5 provides a summary of the extent to which FEMA addressed NIST’s key cybersecurity practices for GMM’s engineering and test environment  Consistent with NIST’s framework, GMM categorized the security risk of its engineering and test environment and identified it as a moderate- impact environment  A moderate-impact environment is one where the loss of confidentiality, integrity, or availability could be expected to have a serious or adverse effect on organizational operations, organizational assets, or individuals  GMM completed the following steps leading to this categorization: The program documented in its System Security Plan the various types of data and information that the environment will collect, process, and store, such as conducting technology research, building or enhancing technology, and maintaining IT networks  The program established three information types and assigned security levels of low, moderate, or high impact in the areas of confidentiality, availability, and integrity  A low-impact security level was assigned to two information types: (1) conducting technology research and (2) building or enhancing technology; and a moderate- impact security level was assigned to the third information type: maintaining IT networks  The engineering and test environment was categorized as an overall moderate-impact system, based on the highest security impact level assignment  GMM documented a description of the environment, including a diagram depicting the system’s boundaries, which illustrates, among other things, databases and firewalls  GMM properly registered its engineering and test environment with FEMA’s Chief Information Officer, Chief Financial Officer, and acting Chief Information Security Officer  By conducting the security categorization process, GMM has taken steps that should ensure that the appropriate security controls are selected for the program’s engineering and test environment  Consistent with NIST’s framework and the system categorization results, GMM appropriately determined which security controls to implement and planned actions for implementing those controls in its System Security Plan for the engineering and test environment  For example, the program utilized NIST guidance to select standard controls for a system categorized with a moderate-impact security level  These control areas include, for example, access controls, risk assessment, incident response, identification and authentication, and configuration management  Further, the program documented its planned actions to implement each control in its System Security Plan  For example, GMM documented that the program plans to implement its Incident Response Testing control by participating in an agency-wide exercise and unannounced vulnerability scans  As another example, GMM documented that the program plans to implement its Contingency Plan Testing control by testing the contingency plan annually, reviewing the test results, and preparing after action reports  By selecting and planning for the implementation of security controls, GMM has taken steps to mitigate its security risks and protect the confidentiality, integrity, and availability of the information system  Consistent with NIST’s framework, in January 2018, GMM program officials developed a security assessment plan for the engineering and test environment  According to GMM program officials, this plan was reviewed by the security assessment team  However, the security assessment plan lacked essential details  Specifically, while the plan included the general process for evaluating the environment’s security controls, the planned assessment procedures for all 964 security controls were not sufficiently defined  Specifically, GMM program officials copied example assessment procedures from NIST guidance and inserted them into its security assessment documentation for all of its 964 controls, without making further adjustments to explain the steps that should be taken specific to GMM  Table 6 shows an example of a security assessment procedure copied from the NIST guidance that should have been further adjusted for GMM  In addition, the actual assessment procedures that the GMM assessors used to evaluate the security controls were not documented  Instead, the program only documented whether each control passed or failed each test  GMM program officials stated that the planned assessment procedures are based on an agency template that was exported from a DHS compliance tool, and that FEMA security officials have been instructed by the DHS OCIO not to tailor or make any adjustments to the template language  However, the assessment procedures outlined in NIST’s guidance are to serve as a starting point for organizations preparing their program specific assessments  According to NIST, organizations are expected to select and tailor their assessment procedures for each security control from NIST’s list of suggested assessment options (e g , review, analyze, or inspect policies, procedures, and related documentation options)  DHS OCIO officials stated that, consistent with NIST’s guidance, they expect that components will ensure they are in compliance with the minimum standards and will also add details and additional rigor, as appropriate, to tailor the planned security assessment procedures to fit their unique missions or needs  In November 2018, in response to our audit, DHS OCIO officials stated that they were meeting with FEMA OCIO officials to understand why they did not document the planned and actual assessment procedures performed by the assessors for GMM  Until FEMA ensures that detailed planned evaluation methods and actual evaluation procedures specific to GMM are defined, the program risks assessing security controls incorrectly, having controls that do not work as intended, and producing undesirable outcomes with respect to meeting the security requirements  In addition, the security assessment plan was not approved by FEMA’s OCIO before proceeding with the security assessment  Program officials stated that approval was not required for the security assessment plan prior to the development of the security assessment report  However, NIST guidance states that the purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  By not getting the security assessment plan approved by FEMA’s OCIO before security assessment reviews were conducted, GMM risks inconsistencies with the plan and security objectives of the organization  Finally, consistent with NIST guidance, GMM performed a security assessment in December 2017 of the engineering and test environment’s controls, which identified 36 vulnerabilities (23 critical- and high-impact vulnerabilities and 13 medium- and low-impact vulnerabilities)  The program also documented these vulnerabilities and associated findings and recommendations in a security assessment report  GMM conducted initial remediation actions (i e , remediation of vulnerabilities that should be corrected immediately) for 12 of the critical- and high-impact vulnerabilities and a reassessment of those security controls confirmed that they were resolved by January 2018  Remediation of the remaining 11 critical- and high-impact vulnerabilities and 13 medium- and low- impact vulnerabilities were to be addressed by corrective action plans as part of the authorization to operate process, which is discussed in the next section  The authorization to operate GMM’s engineering and test environment was granted on February 5, 2018  Among other things, this decision was based on the important stipulation that the remaining 11 critical- and high- impact vulnerabilities associated with multifactor authentication would be addressed within 45 days, or by March 22, 2018  However, the program did not meet this deadline and, instead, approximately 2 months after this deadline passed, obtained a waiver to remediate these vulnerabilities by May 9, 2019  These vulnerabilities are related to a multifactor authentication capability  Program officials stated that they worked with FEMA OCIO officials to attempt to address these vulnerabilities by the initial deadline, but they were unsuccessful in finding a viable solution  Therefore, GMM program officials developed a waiver at the recommendation of the OCIO to provide additional time to develop a viable solution  However, a multifactor authentication capability is essential to ensuring that users are who they say they are, prior to granting users access to the GMM engineering and test environment, in order to reduce the risk of harmful actors accessing the system  In addition, as of September 2018, the program had not established corrective action plans for the 13 medium- and low-impact vulnerabilities  Program officials stated that they do not typically address low-impact vulnerabilities; however, this is in conflict with DHS guidance that specifies that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  In response to our audit, in October 2018, GMM program officials developed these remaining corrective action plans  The plans indicated that these vulnerabilities were to be fully addressed by January 2019 and April 2019  While the program eventually took corrective actions in response to our audit by developing the missing plans, the GMM program initially failed to follow DHS’s guidance on preparing corrective actions plans for all security vulnerabilities  Until GMM consistently follows DHS’s guidance, it will be difficult for FEMA to determine the extent to which GMM’s security weaknesses identified during its security control assessments are remediated  Additionally, as we have reported at other agencies, vulnerabilities can be indicators of more significant underlying issues and, thus, without appropriate management attention or prompt remediation, GMM is at risk of unnecessarily exposing the program to potential exploits  Moreover, GMM was required to assess all untested controls by March 7, 2018, or no later than 30 days after the approval of the authorization to operate; however, it did not meet this deadline  Specifically, we found that, by October 2018, FEMA had not fully tested 190 security controls in the GMM engineering and test environment  These controls were related to areas such as security incident handling and allocation of resources required to protect an information system  In response to our findings, in October 2018, GMM program officials reported that they had since fully tested 27 controls and partially tested the remaining 163 controls  Program officials stated that testing of the 163 controls is a shared responsibility between GMM and other parties (e g , the cloud service provider)  They added that GMM had completed its portion of the testing but was in the process of verifying the completion of testing by other parties  Program officials stated that the untested controls were not addressed sooner, in part, because of errors resulting from configuration changes in the program’s compliance tool during a system upgrade, which have now been resolved  Until GMM ensures that all security controls have been tested, it remains at an increased risk of exposing programs to potential exploits  Consistent with the NIST framework, GMM established methods for assessing and monitoring security controls to be conducted after an authorization to operate has been approved  GMM has tailored its cybersecurity policies and practices for monitoring its controls to take into account the frequent and iterative pace with which system functionality is continuously being introduced into the GMM environment  Specifically, the GMM program established a process for assessing security impact changes to the system and conducting reauthorizations to operate within the rapid Agile delivery environment  As part of this process, GMM embedded cybersecurity experts on each Agile development team so that they are involved early and can impact security considerations from the beginning of requirements development through testing and deployment of system functionality  In addition, the process involves important steps for ensuring that the system moves from development to completion, while producing a secure and reliable system  For example, it includes procedures for creating, reviewing, and testing new system functionality  As the new system functionality is integrated with existing system functionality, it is to undergo automated testing and security scans in order to ensure that the integrity of the security of the system has not been compromised  Further, an automated process is to deploy the code if it passes all security scans, code tests, and code quality checks  GMM’s process for conducting a reauthorization to operate within the rapid delivery Agile development environment is to follow FEMA guidance that states that all high-level changes made to a FEMA IT system must receive approval from both a change advisory board and the FEMA Chief Information Officer  The board and FEMA Chief Information Officer are to focus their review and approval on scheduled releases and epics (i e , collections of user stories)  Additionally, the Information System Security Officer is to review each planned user story and, if it is determined that the proposed changes may impact the integrity of the authorization, the Information System Security Officer is to work with the development team to begin the process of updating the system authorization  Finally, GMM uses automated tools to track the frequency in which security controls are assessed and to ensure that required scanning data are received by FEMA for reporting purposes  Program officials stated that, in the absence of department-level and agency-level guidance, they have coordinated with DHS and FEMA OCIO officials to ensure that these officials are in agreement with GMM’s approach to continuous monitoring  By having monitoring control policies and procedures in place, FEMA management is positioned to more effectively prioritize and plan its risk response to current threats and vulnerabilities for the GMM program  Given FEMA’s highly complex grants management environment, with its many stakeholders, IT systems, and internal and external users, implementing leading practices for business process reengineering and IT requirements management is critical for success  FEMA has taken many positive steps, including ensuring executive leadership support for business process reengineering, documenting the agency’s grants management processes and performance improvement goals, defining initial IT requirements for the program, incorporating input from end user stakeholders into the development and implementation process, and taking recent actions to improve its delivery of planned IT requirements  Nevertheless, until the GMM program finalizes plans and time frames for implementing its organizational change management actions, plans and communicates system transition activities, and maintains clear traceability of IT requirements, FEMA will be limited in its ability to provide streamlined grants management processes and effectively deliver a modernized IT system to meet the needs of its large range of users  While GMM’s initial cost estimate was reliable, key assumptions about the program since the initial estimate had changed and, therefore, it no longer reflected the current approach for the program  The forthcoming updated cost schedule is expected to better reflect the current approach  However, the program’s unreliable schedule to fully deliver GMM by September 2020 is aggressive and unrealistic  The delays the program has experienced to date further compound GMM’s schedule issues  Without a robust schedule that has been informed by a realistic assessment of GMM’s development activities, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to achieve their goals  Further, FEMA’s implementation of cybersecurity practices for GMM in the areas of system categorization, selection and implementation, and monitoring will help the program  However, GMM lacked essential details for evaluating security controls, did not approve the security assessment plan before proceeding with the security assessment, did not follow DHS’s guidance to develop corrective action plans for all security vulnerabilities, and did not fully test all security controls  As a result, the GMM engineering and test environment remains at an increased risk of exploitations  We are making eight recommendations to FEMA: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions  (Recommendation 1) The FEMA Administrator should ensure that the GMM program management office plans and communicates its detailed transition activities to its affected customers before they transition to GMM and undergo significant changes to their processes  (Recommendation 2) The FEMA Administrator should ensure that the GMM program management office implements its planned changes to its processes for documenting requirements for future increments and ensures it maintains traceability among key IT requirements documents  (Recommendation 3) The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report  (Recommendation 4) The FEMA Administrator should ensure that the FEMA OCIO defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls  (Recommendation 5) The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted  (Recommendation 6) The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities  (Recommendation 7) The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system  (Recommendation 8) DHS provided written comments on a draft of this report, which are reprinted in appendix IV  In its comments, the department concurred with all eight of our recommendations and provided estimated completion dates for implementing each of them  For example, with regard to recommendation 4, the department stated that FEMA plans to update the GMM program schedule to address the leading practices for a reliable schedule by April 30, 2019  In addition, for recommendation 7, the department stated that FEMA plans to ensure that corrective action plans are prepared by July 31, 2019, to address all identified security vulnerabilities for GMM  If implemented effectively, the actions that FEMA plans to take in response to the recommendations should address the weaknesses we identified  We also received technical comments from DHS and FEMA officials, which we incorporated, as appropriate  We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-4456 or harriscc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix V  Our objectives were to (1) determine the extent to which the Federal Emergency Management Agency (FEMA) is implementing leading practices for reengineering its grants management business processes and incorporating business needs into Grants Management Modernization (GMM) information technology (IT) requirements; (2) assess the reliability of the program’s estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices for GMM  To address the first objective, we reviewed GAO’s Business Process Reengineering Assessment Guide and Software Engineering Institute’s Capability Maturity Model for Integration for Development to identify practices associated with business process reengineering and IT requirements management  We then selected six areas that, in our professional judgment, represented foundational practices that were of particular importance to the successful implementation of an IT modernization effort that is using Agile development processes  We also selected the practices that were most relevant based on where GMM was in the system development lifecycle and we discussed the practice areas with FEMA officials  The practices are: Ensuring executive leadership support for process reengineering Assessing the current and target business environment and business Establishing plans for implementing new business processes Establishing clear, prioritized, and traceable IT requirements Tracking progress in delivering IT requirements Incorporating input from end user stakeholders We also reviewed selected chapters of GAO’s draft Agile Assessment Guide (Version 6A), which is intended to establish a consistent framework based on best practices that can be used across the federal government for developing, implementing, managing, and evaluating agencies’ IT investments that rely on Agile methods  To develop this guide, GAO worked closely with Agile experts in the public and private sector; some chapters of the guide are considered more mature because they have been reviewed by the expert panel  We reviewed these chapters to ensure that our expectations for how FEMA should apply the six practices for business process reengineering and IT requirements management are appropriate for an Agile program and are consistent with the draft guidance that is under development  Additionally, since Agile development programs may use different terminology to describe their software development processes, the Agile terms used in this report (e g , increment, sprint, epic, etc ) are specific to the GMM program  We obtained and analyzed FEMA grants management modernization documentation, such as current and target grants management business processes, acquisition program baseline, operational requirements document, concept of operations, requirements analyses workbooks, Grants Management Executive Steering Group artifacts, stakeholder outreach artifacts, Agile increment- and sprint-level planning and development artifacts, and the requirements backlog  We assessed the program documentation against the selected practices to determine the extent to which the agency had implemented them  We then assessed each practice area as: fully implemented—FEMA provided complete evidence that showed it fully implemented the practice area; partially implemented—FEMA provided evidence that showed it partially implemented the practice area; not implemented—FEMA did not provide evidence that showed it implemented any of the practice area  Additionally, we observed Agile increment and sprint development activities at GMM facilities in Washington, D C  We also observed a demonstration of how the program manages its lower level requirements (i e , user stories and epics) and maintains traceability of the requirements using an automated tool at GMM facilities in Washington, D C  We also interviewed FEMA officials, including the GMM Program Executive, GMM Program Manager, GMM Business Transformation Team Lead, and Product Owner regarding their efforts to streamline grants management business processes, collect and incorporate stakeholder input, and manage GMM’s requirements  In addition, we interviewed FEMA officials from four out of 16 grant program offices and two out of 10 regional offices to obtain contextual information and illustrative examples of FEMA’s efforts to reengineer grants management business processes and collect business requirements for GMM  Specifically, We selected the four grant program offices based on a range of grant programs managed, legacy systems used, and the amount of grant funding awarded  We also sought to select a cross section of different characteristics, such as selecting larger grant program offices, as well as smaller offices  In addition, we ensured that our selection included the Assistance to Firefighters Grants (AFG) program office because officials in this office represent the first GMM users and, therefore, are more actively involved with the program’s Agile development practices  Based on these factors, we selected: Public Assistance Division, Individual Assistance Division, AFG, and National Fire Academy  Additionally, the four selected grant program offices are responsible for 16 of the total 45 grant programs and are users of five of the nine primary legacy IT systems  The four selected grant program offices also represent about 68 percent of the total grant funding awarded by FEMA from fiscal years 2005 through 2016  We selected two regional offices based on (1) the largest amount of total FEMA grant funding for fiscal years 2005 through 2016—Region 6 located in Denton, Texas; and (2) the highest percentage of AFG funding compared to the office’s total grant funding awarded from fiscal years 2005 through 2016—Region 5 located in Chicago, Illinois  To assess the reliability of data from the program’s automated IT requirements management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM requirements  We determined that the data used were sufficiently reliable for the purpose of evaluating GMM’s practices for managing IT requirements  For our second objective, to assess the reliability of GMM’s estimated costs and schedule, we reviewed documentation on GMM’s May 2017 lifecycle cost estimate and on the program’s schedule, dated May 2018  To assess the reliability of the May 2017 lifecycle cost estimate, we evaluated documentation supporting the estimate, such as the cost estimating model, the report on GMM’s Cost Estimating Baseline Document and Life Cycle Cost Estimate, and briefings provided to the Department of Homeland Security (DHS) and FEMA management regarding the cost estimate  We assessed the cost estimating methodologies, assumptions, and results against leading practices for developing a comprehensive, accurate, well-documented, and credible cost estimate, identified in GAO’s Cost Estimating and Assessment Guide  We also interviewed program officials responsible for developing and reviewing the cost estimate to understand their methodology, data, and approach for developing the estimate  We found that the cost data were sufficiently reliable  To assess the reliability of the May 2018 GMM program schedule, we evaluated documentation supporting the schedule, such as the integrated master schedule, acquisition program baseline, and Agile artifacts  We assessed the schedule documentation against leading practices for developing a comprehensive, well-constructed, credible, and controlled schedule, identified in GAO’s Schedule Assessment Guide  We also interviewed GMM program officials responsible for developing and managing the program schedule to understand their practices for creating and maintaining the schedule  We noted in our report the instances where the quality of the schedule data impacted the reliability of the program’s schedule  For both the cost estimate and program schedule, we assessed each leading practice as: fully addressed—FEMA provided complete evidence that showed it implemented the entire practice area; substantially addressed—FEMA provided evidence that showed it implemented more than half of the practice area; partially addressed—FEMA provided evidence that showed it implemented about half of the practice area; minimally addressed—FEMA provided evidence that showed it implemented less than half of the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  Finally, we provided FEMA with draft versions of our detailed analyses of the GMM cost estimate and schedule  This was done to verify that the information on which we based our findings was complete, accurate, and up-to-date  Regarding our third objective, to determine the extent to which FEMA is addressing key cybersecurity practices for GMM, we reviewed documentation regarding DHS and FEMA cybersecurity policies and guidance, and FEMA’s authorization to operate for the program’s engineering and test environment  We evaluated the documentation against all six cybersecurity practices identified in the National Institute of Standards and Technology’s (NIST) Risk Management Framework  While NIST’s Risk Management Framework identifies six total practices, for reporting purposes, we combined two interrelated practices—selection of security controls and implementation of security controls—into a single practice  The resulting five practices were: categorizing the system based on security risk, selecting and implementing security controls, assessing security controls, obtaining an authorization to operate the system, and monitoring security controls on an ongoing basis  We obtained and analyzed key artifacts supporting the program’s efforts to address these risk management practices, including the program’s System Security Plan, the Security Assessment Plan and Report, Authorization to Operate documentation, and the program’s continuous monitoring documentation  We also interviewed officials from the GMM program office and FEMA’s Office of the Chief Information Officer, such as the GMM Security Engineering Lead, GMM Information System Security Officer, and FEMA’s Acting Chief Information Security Officer, regarding their efforts to assess, document, and review security controls for GMM  We assessed the evidence against the five practices to determine the extent to which the agency had addressed them  We then assessed each practice area as: fully addressed—FEMA provided complete evidence that showed it fully implemented the practice area; partially addressed—FEMA provided evidence that showed it partially implemented the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  To assess the reliability of data from the program’s automated security controls management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM security controls for the engineering and test environment  We found that some of the security controls data we examined were sufficiently reliable for the purpose of evaluating FEMA’s cybersecurity practices for GMM, and we noted in our report the instances where the accuracy of the data impacted the program’s ability to address key cybersecurity practices  We conducted this performance audit from December 2017 to April 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The Federal Emergency Management Agency (FEMA) awards many different types of grants to state, local, and tribal governments and nongovernmental entities  These grants are to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks  Agile software development is a type of incremental development that calls for the rapid delivery of software in small, short increments  The use of an incremental approach is consistent with the Office of Management and Budget’s guidance as specified in its information technology (IT) Reform Plan, as well as the legislation commonly referred to as the Federal Information Technology Acquisition Reform Act  Many organizations, especially in the federal government, are accustomed to using a waterfall software development model, which typically consists of long, sequential phases, and differs significantly from the Agile development approach  Agile practices integrate planning, design, development, and testing into an iterative lifecycle to deliver software early and often  Figure 7 provides a depiction of software development using the Agile approach, as compared to a waterfall approach  The frequent iterations of Agile development are intended to effectively measure progress, reduce technical and programmatic risk, and respond to feedback from stakeholders in changes to IT requirements more quickly than traditional methods  Despite these intended benefits, organizations adopting Agile must overcome challenges in making significant changes to how they are accustomed to developing software  The significant differences between Agile and waterfall development impact how IT programs are planned, implemented, and monitored in terms of cost, schedule, and scope  For example, in waterfall development, significant effort is devoted upfront to document detailed plans and all IT requirements for the entire scope of work at the beginning of the program, and cost and schedule can be varied to complete that work  However, for Agile programs the precise details are unknown upfront, so initial planning of cost, scope, and timing would be conducted at a high level, and then supplemented with more specific plans for each iteration  While cost and schedule are set for each iteration, requirements for each iteration (or increment) can be variable as they are learned over time and revised to reflect experiences from completed iterations and to accommodate changing priorities of the end users  The differences in these two software development approaches are shown in figure 8  Looking at figure 8, the benefit provided from using traditional program management practices such as establishing a cost estimate or a robust schedule, is not obvious  However, unlike a theoretical environment, many government programs may not have the autonomy to manage completely flexible scope, as they must deliver certain minimal specifications with the cost and schedule provided  In those cases, it is vital for the team to understand and differentiate the IT requirements that are “must haves” from the “nice to haves” early in the planning effort  This would help facilitate delivery of the “must-haves” requirements first, thereby providing users with the greatest benefits as soon as possible  In addition to the contact named above, the following staff made key contributions to this report: Shannin G  O’Neill (Assistant Director), Jeanne Sung (Analyst in Charge), Andrew Beggs, Rebecca Eyler, Kendrick Johnson, Thomas J  Johnson, Jason Lee, Jennifer Leotta, and Melissa Melvin 

ground_truth: Historically, Egypt has been an important country for U.S. national security interests based on its geography, demography, and diplomatic posture. Egypt controls the Suez Canal, which is one of the world's most well-known maritime chokepoints, linking the Mediterranean and Red Seas. Egypt, with its population of more than 100 million people, is by far the most populous Arabic-speaking country. Although it may not play the same type of leading political or military role in the Arab world as it has in the past, Egypt may retain some "soft power" by virtue of its history, media, and culture. Cairo plays host both to the 22-member Arab League and Al Azhar University, which claims to be the oldest continuously operating university in the world and has symbolic importance as a leading source of Islamic scholarship. Additionally, Egypt's 1979 peace treaty with Israel remains one of the most significant diplomatic achievements for the promotion of Arab-Israeli peace. While people-to-people relations remain cold, the Israeli and Egyptian governments have increased their cooperation against Islamist militants and instability in the Sinai Peninsula and Gaza Strip. Personnel moves and possible amendments to the Egyptian constitution highlight apparent efforts by President Sisi to consolidate power with the help of political allies, including colleagues from Egypt's security establishment. President Sisi has come under repeated international criticism for an ongoing government crackdown against various forms of political dissent and freedom of expression. The Egyptian government has defended its human rights record, asserting that the country is under pressure from terrorist groups seeking to destabilize Arab nation-states. The Trump Administration has tried to normalize ties with the Sisi government that were generally perceived as strained under President Obama. In January 2019, U.S. Secretary of State Michael Pompeo delivered a major policy speech at the American University in Cairo, where he stated, "And as we seek an even stronger partnership with Egypt, we encourage President Sisi to unleash the creative energy of Egypt's people, unfetter the economy, and promote a free and open exchange of ideas." The United States has provided significant military and economic assistance to Egypt since the late 1970s. Successive U.S. Administrations have justified aid to Egypt as an investment in regional stability, built primarily on long-running cooperation with the Egyptian military and on sustaining the 1979 Egyptian-Israeli peace treaty. All U.S. foreign aid to Egypt (or any recipient) is appropriated and authorized by Congress. Since 1946, the United States has provided Egypt with over $83 billion in bilateral foreign aid (calculated in historical dollars—not adjusted for inflation). Annual appropriations legislation includes several conditions governing the release of these funds. All U.S. military aid to Egypt finances the procurement of weapons systems and services from U.S. defense contractors. For FY2019, Congress has appropriated $1.4 billion in total bilateral assistance for Egypt, the same amount it provided in FY2018. For FY2020, the President is requesting a total of $1.382 billion in bilateral assistance for Egypt. Nearly all of the U.S. funds for Egypt come from the FMF account (military aid). In November 2018, the U.S. Defense Department notified Congress of a major $1 billion sale of defense equipment to Egypt, consisting of 10 AH-64E Apache Attack Helicopters, among other things. Beyond the United States, President Sisi has broadened Egypt's international base of support to include several key partners, including the Arab Gulf states, Israel, Russia, and France. In the last five years, as French-Egyptian ties have improved, Egypt has purchased major air and naval defense systems from French defense companies.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: Since 1952, when a cabal of Egyptian Army officers, known as the Free Officers Movement, ousted the British-backed king, Egypt's military has produced four presidents; Gamal Abdel Nasser (1954-1970), Anwar Sadat (1970-1981), Hosni Mubarak (1981-2011), and Abdel Fattah el Sisi (2013-present)  In general, these four men have ruled Egypt with strong backing from the country's security establishment  The only significant and abiding opposition has come from the Egyptian Muslim Brotherhood, an organization that has opposed single party military-backed rule and advocated for a state governed by a vaguely articulated combination of civil and Shariah (Islamic) law  Egypt's sole departure from this general formula took place between 2011 and 2013, after popular demonstrations sparked by the "Arab Spring," which had started in neighboring Tunisia, compelled the military to force the resignation of former President Hosni Mubarak in February 2011  During this period, Egypt experienced tremendous political tumult, culminating in the one-year presidency of the Muslim Brotherhood's Muhammad Morsi  When Morsi took office on June 30, 2012, after winning Egypt's first truly competitive presidential election, his ascension to the presidency was supposed to mark the end of a rocky 16-month transition period  Proposed time lines for elections, the constitutional drafting process, and the military's relinquishing of power to a civilian government had been constantly changed, contested, and sometimes even overruled by the courts  Instead of consolidating democratic or civilian rule, Morsi's rule exposed the deep divisions in Egyptian politics, pitting a broad cross-section of Egypt's public and private sectors, the Coptic Church, and the military against the Brotherhood and its Islamist supporters  The atmosphere of mutual distrust, political gridlock, and public dissatisfaction that permeated Morsi's presidency provided Egypt's military, led by then-Defense Minister Sisi, with an opportunity to reassert political control  On July 3, 2013, following several days of mass demonstrations against Morsi's rule, the military unilaterally dissolved Morsi's government, suspended the constitution that had been passed during his rule, and installed an interim president  The Muslim Brotherhood and its supporters declared the military's actions a coup d'etat and protested in the streets  Weeks later, Egypt's military and national police launched a violent crackdown against the Muslim Brotherhood, resulting in police and army soldiers firing live ammunition against demonstrators encamped in several public squares and the killing of at least 1,150 demonstrators  The Egyptian military justified these actions by decrying the encampments as a threat to national security  As Egyptian President Abdel Fattah al Sisi consolidates his power amid a continuing macroeconomic recovery, Egypt is poised to play an increasingly active role in the region, albeit from a more independent position vis-a-vis the United States than in the past  Although Egyptian relations with the Trump Administration are solid, and Egypt has relied on the International Monetary Fund (IMF) program to guide its economic recovery, Egypt seems committed to broadening its international base of support  The United States plays a key role in that international base, but Egypt also has other significant partners, including the Arab Gulf states, Israel, Russia, and France  The Egyptian government blames American criticism of its human rights record for preventing closer U S -Egyptian ties  From the U S  perspective, some Members of Congress, U S  media outlets, and advocacy groups document how Egyptian authorities have widened the scope of a crackdown against dissent, which initially was aimed at the Muslim Brotherhood but has evolved to encompass a broader range of political speech  Egypt's parliament is currently considering whether to adopt a package of draft constitutional amendments that would extend presidential term limits and executive branch control over the judiciary  If Egypt's 2019 constitutional amendments are approved, President Sisi will attain unprecedented power in the political system over the military and the judiciary and, if reelected, will have the potential to remain in office until 2034  He has inserted his older brother and oldest son into key security and intelligence positions while stymying all opposition to his rule and criticism of his government  This consolidation of power and crackdown against dissent has taken place during a period of steady economic growth, which has not benefitted wide swaths of the population  The state has enacted a series of austerity measures to reduce debt in compliance with IMF-mandated reforms  In the year ahead, economists anticipate gross domestic product (GDP) growth of 5 3%, driven by an expansion in tourism and natural gas production  Nevertheless, Egyptians continue to endure double-digit inflation stemming in part from the 2016 flotation of the currency, tax increases, and reductions in food and fuel subsidies  While it is difficult to ascertain how dissatisfied the public is with rising prices, President Sisi has responded to criticisms of his economic policies, stating: "The path of real reform is difficult and cruel and causes a lot of suffering     But there is no doubt that the suffering resulting from the lack of reform is much worse " The IMF has praised the Egyptian government's record of reform implementation, while also highlighting the need for private sector growth "that will absorb the rapidly growing labor force and ensure that the benefits are perceived more widely " After several years of observers seeing Egypt as more inwardly focused, several recent developments suggest an increasingly active foreign policy  In January 2019, Egypt hosted an international forum on Mediterranean gas which included European and Arab countries together with Israel  A month later, President Sisi was elected head of the African Union for a year-long term  In February 2019, Egypt hosted the first-ever European Union- Arab summit in Sharm el Sheikh, where officials discussed terrorism, migration, and the need for greater European-Arab cooperation to counter a perceived growing Chinese and Russian interest in the Middle East  Personnel moves and other developments in Egypt highlight apparent efforts by President Sisi to consolidate power with the help of political allies, including colleagues from Egypt's security establishment  In June 2018, Sisi reshuffled his cabinet, making key changes to the defense and interior ministries, among other appointments  Sisi appointed Mohamed Ahmed Zaki, former head of the Republican Guard, as defense minister and Mahmoud Tawfik, former head of the National Security Service, as interior minister  According to one account, Sisi may have been rewarding Zaki for his role in arresting former Egyptian President Mohamed Morsi in 2013  In July 2018, parliament passed Law 161 of 2018, providing judicial immunity to senior military commanders for military acts committed during the two-and-a-half-year period beginning with the military coup of July 2013  The new law grants immunity to senior commanders while potentially keeping high-ranking officers on reserve duty for life, making them ineligible to run for president  In order for a senior commander to be prosecuted under this new law, a case would have to be first authorized by the Supreme Council of the Armed Forces (SCAF), which President Sisi appoints  According to one analysis, the law deters senior officers from challenging President Sisi (for example, some challenges occurred during the run-up to the 2018 presidential election), thereby acting "as a guarantor of President Sisi's authoritarian rule, setting the stage for him to remain president for life " Per the 2014 Egyptian constitution (article 140), President Sisi, who was reelected in April 2018, may only serve two four-year terms in office (current term ends in 2022)  However, his supporters have proposed a set of amendments to the constitution which, if approved by parliament and public referendum, have the potential to make President Sisi eligible for an additional two six-year terms when his current term ends in 2022  Other proposed changes to the constitution include granting the president the authority to appoint all chief justices of Egyptian judicial bodies, and the public prosecutor; requiring that at least one-quarter of the seats in the parliament be allocated to women and reducing the number of the seats in the House of Representatives from 596 to 450; and establishing an upper house of parliament (Senate) consisting of 250 members, two-thirds of whom would be elected and one-third of whom would be appointed by the president  President Sisi has come under repeated international criticism for an ongoing government crackdown against various forms of political dissent and freedom of expression  Certain practices of Sisi's government, the parliament, and the security apparatus have been contentious  According to the U S  State Department's report on human rights conditions in Egypt in 2017: The most significant human rights issues included arbitrary or unlawful killings by the government or its agents; major terrorist attacks; disappearances; torture; harsh or potentially life-threatening prison conditions; arbitrary arrest and detention; including the use of military courts to try civilians; political prisoners and detainees; unlawful interference in privacy; limits on freedom of expression, including criminal "defamation of religion" laws; restrictions on the press, internet, and academic freedom; and restrictions on freedoms of assembly and association, including government control over registration and financing of NGOs [nongovernmental organizations]  LGBTI persons faced arrests, imprisonment, and degrading treatment  The government did not effectively respond to violence against women, and there were reports of child labor  Select international human rights, democracy, and development monitoring organizations provide the following rankings for Egypt globally: Other human rights issues of potential interest to Congress may include the 2013 convictions of American, European, and Egyptian civil society representatives; the controversial 2017 NGO law; the detention of American citizens in Egypt; and the treatment of Coptic Christians, discussed in the following sections  In 2013, an Egyptian court convicted and sentenced 43 individuals from the United States, Egypt, and Europe, including the Egypt country directors of the National Democratic Institute (NDI) and the International Republican Institute (IRI), for spending money from organizations that were operating in Egypt without a license and for receiving foreign funds (known as Case 173 or the "foreign funding case")  Some lawmakers had protested that those individuals were wrongfully convicted and had requested that the Egyptian government and judiciary resolve the matter  In 2018, a retrial began and, on December 20, 2018, the individuals were acquitted of all charges  In January 2019, U S  Secretary of State Michael R  Pompeo traveled to Cairo, where he remarked: "I was happy to see our citizens, wrongly convicted of improperly operating NGOs here, finally be acquitted  And we strongly support President Sisi's initiative to amend Egyptian law so that this does not happen again  More work certainly needs to be done to maximize the potential of the Egyptian nation and its people  I'm glad that America will be a partner in those efforts " However, Case 173 remains active, as the judiciary has imposed asset freezes and travel bans on several Egyptian civil society activists  In May 2017, President Sisi signed Law 70 of 2017 on Associations and Other Foundations Working in the Field of Civil Work  The parliament had passed this bill six months earlier, and both the passage and signing drew widespread international condemnation  The new law (which replaced a 2002 NGO law) requires NGOs to receive prior approval from internal security before accepting foreign funding  It also restricts the scope of permitted NGO activities and increases penalties for violations, including possible imprisonment for up to five years  However, the government did not issue implementing regulations for the new NGO law  At Egypt's November 2018 World Youth Forum in Sharm el Sheikh, President Sisi announced plans to amend Law 70  According to Sisi, "I want to reassure those who are listening to me inside Egypt and outside of Egypt, that in Egypt, we are keen that the law becomes balanced and achieves what is required of it to regulate the work of these groups in a good way  This is not just political talk " Since then, Egypt's Ministry of Social Solidarity has held multiple rounds of talks with local NGOs aimed at determining which articles of the law need to be amended  A draft proposal is expected to be ready in the spring of 2019, when it will be sent to parliament for consideration  The detention of American citizens in Egypt has continued to strain U S -Egyptian relations  Some Members of Congress are concerned about the case of 53-year-old New York resident Mustafa Kassem, who was detained by authorities in 2013 and sentenced to 15 years in prison in a mass trial in September 2018  These lawmakers insist that Kassem, who has been on a limited hunger strike, was wrongfully arrested and convicted, and they have sought Trump Administration support in securing his release from the government of Egypt  In January 2018, Vice President Pence raised Kassem's case directly with President Sisi in a meeting in Cairo, saying "I told him we'd like to see those American citizens restored to their families and restored to our country " Since taking office, President Sisi has publicly called for greater Muslim-Christian coexistence and national unity  In January 2019, he inaugurated Egypt's Coptic Cathedral of Nativity in the new administrative capital east of Cairo saying, "This is an important moment in our history     We are one and we will remain one " Despite these public calls for improved interfaith relations in Egypt, the minority Coptic Christian community continues to claim that they face professional and social discrimination, along with occasional sectarian attacks by terrorists and vigilantes  Coptic Christians have also voiced concern about state regulation of church construction  They have long demanded that the government reform long-standing laws (with two dating back to 1856 and 1934, respectively) on building codes for Christian places of worship  Article 235 of Egypt's 2014 constitution mandates that parliament reform these building code regulations  In 2016, parliament approved a church construction law (Law 80 of 2016) that expedited the government approval process for the construction and restoration of Coptic churches, among other structures  Although Coptic Pope Tawadros II welcomed the law, others claim that it continues to be discriminatory  According to Human Rights Watch , "the new law allows governors to deny church-building permits with no stated way to appeal, requires that churches be built 'commensurate with' the number of Christians in the area, and contains security provisions that risk subjecting decisions on whether to allow church construction to the whims of violent mobs " For 2019, the IMF projects 5 3% GDP growth for the Egyptian economy, noting that the outlook remains "favorable, supported by strong policy implementation " In 2016, the IMF and Egypt reached a three-year, $12 billion loan agreement, $10 billion of which has been disbursed as of March 2019  Key sources of foreign exchange (tourism and remittances) are up and unemployment is at its lowest level since 2011  In line with IMF recommendations, the government has taken several steps to reform the economy, including depreciating the currency, reducing fuel subsidies, enacting a value-added tax (VAT), and providing cash payments to the poor in lieu of subsidizing household goods (though many food subsidies continue)  Egypt's energy sector also is contributing to the economy's rebound  Egypt is the largest oil producer in Africa outside of the Organization of the Petroleum Exporting Countries (OPEC) and the third-largest natural gas producer on the continent following Algeria and Nigeria  In December 2017, an Egyptian and Italian partnership began commercial output from the Zohr natural gas field (est  30 trillion cubic feet of gas), the largest ever natural gas field discovered in the Mediterranean Sea (see Figure 3 )  The Egyptian government also has repaid debts owed to foreign energy companies, allowing for new investments from BP and BG Group  Egypt is attempting to position itself as a regional gas hub, whereby its own gas fields meet domestic demand while imported gas from Israel and Cyprus can be liquefied in Egypt and reexported  Israeli and Egyptian companies have bought significant shares of an unused undersea pipeline connecting Israel to the northern Sinai Peninsula (see Figure 4 )  The pipeline will be used to transport natural gas from Israel to Egypt for possible reexport, as part of an earlier 10-year, $15 billion gas deal between the U S  Company Noble Energy, its Israeli partner Delek, and the Egyptian company Dolphinus Holdings  In January 2019, Egypt convened the first ever Eastern Mediterranean Gas Forum (EMGF), a regional consortium consisting of Egypt, Israel, Jordan, the Palestinian Authority, Cyprus, Greece, and Italy, intended to consolidate regional energy policies and reduce costs  Despite Egypt's positive economic outlook, significant challenges remain  Inflation remains over 11%, making the cost of goods high for many Egyptians  In addition, while the fiscal deficit may be decreasing, Egypt's overall public and foreign debt have grown significantly in recent years and remain high, leading the government to allocate resources (nearly 38% of Egypt's budget) toward debt-service payments and away from spending on health and education  Economists forecast that total public debt will reach 84 8% of GDP and external debt 32% of GDP ($101 7 billion) in 2019  Some observers assert that Egypt's recent economic reforms, while successful in the short term, have not addressed deeper structural impediments to growth  For example, Egypt's industrial sector is heavily dependent upon imports and, as the economy expands, the demand for foreign currency increases  According to Bloomberg , "this means, the more the economy grows, the greater the pressure on dollar reserves  It doesn't help that these were built up almost entirely through foreign borrowing, pushing Egypt's foreign debt from $55 billion in 2016 to $92 billion in late 2018  It won't be long before the country's finances are once again in crisis " Many experts argue that to sustain growth over the long term, Egypt requires dramatic expansion of the nonhydrocarbon private sector  For decades, Egypt's military has played a key role in the nation's economy as a food producer and low-cost domestic manufacturer of consumable products; however, due to political sensitivities, the extent of its economic power is rarely quantified  Egypt's military is largely economically self-sufficient  It produces what it consumes (food and clothes) and then sells surplus goods for additional revenue  Egyptian military companies have been the main beneficiaries of the massive infrastructure contracts Sisi has commissioned  Moreover, military-owned manufacturing companies have expanded into new markets, producing goods (appliances, solar panels, some electronics, and some medical equipment) that are cheaper than either foreign imports or domestically produced goods made by the private sector  President Sisi, who led the 2013 military intervention and was elected president in mid-2014, came to power promising not only to defeat violent Salafi-Jihadi terrorist groups militarily, but also to counter their foundational ideology, which President Sisi and his supporters often attribute to the Muslim Brotherhood  President Sisi has outlawed the Muslim Brotherhood while launching a more general crackdown against a broad spectrum of opponents, both secular and Islamist  While Egypt is no longer beset by the kind of large-scale civil unrest and public protest it faced during the immediate post-Mubarak era, it continues to face terrorist and insurgent violence, both in the Sinai Peninsula and in the rest of Egypt  Terrorists based in the Sinai Peninsula (the Sinai) have been waging an insurgency against the Egyptian government since 2011  While the terrorist landscape in Egypt is evolving and encompasses several groups, the Islamic State's Sinai Province affiliate (IS-SP) is known as the most lethal  Since its affiliation with the Islamic State in 2014, IS-SP has attacked the Egyptian military continually, targeted Coptic Christian individuals and places of worship, and occasionally fired rockets into Israel  In October 2015, IS-SP targeted Russian tourists departing the Sinai by planting a bomb aboard Metrojet Flight 9268, which exploded midair, killing all 224 passengers and crew aboard  Two years later, on November 24, 2017, IS-SP gunmen launched an attack against the Al Rawdah mosque in the town of Bir al Abed in northern Sinai  That attack killed at least 305 people, making it the deadliest terrorist attack in Egypt's modern history  Combating terrorism in the Sinai is particularly challenging due to an array of factors, including the following: Geograph y : The peninsula's interior is mountainous and sparsely populated, providing militants with ample freedom of movement  Demograph y and Culture : The Sinai's northern population is a mix of Palestinians and Bedouin Arab tribes whose relationship to the state is filled with distrust  Sinai Bedouin have faced discrimination and exclusion from full citizenship and access to the economy  In the absence of development, a black market economy based primarily on smuggling has thrived, further contributing to the popular portrayal of Bedouin as outlaws  State authorities charge that the Sinai Bedouin seek autonomy from the central government, while residents insist on obtaining basic rights, such as property rights, full citizenship, and access to government services such as education and health care  Econom ics : Bedouins claim that Egypt has underinvested in northern Sinai, channeling development toward southern tourist destinations that cater to foreign visitors  Northern Sinai consists of mostly flat desert terrain inhospitable to large-scale agriculture without significant investment in irrigation  For decades, the Egyptian state has claimed to follow successive Sinai development plans  However, Egyptian governance and development of the Sinai has been hampered by corruption  Diploma cy : The 1979 Israeli-Egyptian peace treaty limits the number of soldiers that Egypt can deploy in the Sinai, subject to the parties' ability to negotiate changes as circumstances necessitate  Egypt and Israel mutually agree upon any short-term increase of Egypt's military presence in the Sinai  Since Israel returned control over the Sinai to Egypt in 1982, the area has been partially demilitarized, and the Sinai has served as an effective buffer zone between the two countries  The Multinational Force and Observers, or MFO, are deployed in the Sinai to monitor the terms of the Israeli-Egyptian peace treaty (see Figure 5 )  Egypt and Israel reportedly continue to cooperate in countering terrorism in the Sinai  In a televised interview, President Sisi responded to a question on whether Egyptian-Israeli military cooperation was the closest it has ever been, saying "That is correct  The [Egyptian] Air Force sometimes needs to cross to the Israeli side  And that's why we have a wide range of coordination with the Israelis " One news account suggests that Israel, with Egypt's approval, has used its own drones, helicopters, and aircraft to carry out more than 100 covert airstrikes inside Egypt against militant targets  In order to counter IS-SP in northern Sinai, the Egyptian armed forces and police have declared a state of emergency, imposed curfews and travel restrictions, and erected police checkpoints along main roads  Authorities also have limited domestic and foreign media access to the northern Sinai, declaring it an active combat zone and unsafe for journalists  According to Jane's Defence Weekly , Egypt may be upgrading an old air base in the Sinai (Bir Gifgafa), where it could deploy Apache attack helicopters and unmanned aerial vehicles for use in counterterrorism operations  While an increased Egyptian military presence in the Sinai may be necessary to stabilize the area, many observers have argued that military means alone are insufficient  These critics say that force should be accompanied by policies to reduce the appeal of antigovernment militancy by addressing local political and economic grievances  According to one account: Sinai residents are prohibited from joining any senior post in the state  They cannot work in the army, police, judiciary, or in diplomacy  Meanwhile, no development projects have been undertaken in North Sinai the past 40 years  The villages of Rafah and Sheikh Zuwayed have no schools or hospitals and no modern system to receive potable water  They depend on rainwater and wells, as if it were the Middle Ages  Egyptian counterterrorism efforts in the Sinai appear to have reduced the frequency of terrorist attacks somewhat  In February 2018, the military launched an offensive campaign, dubbed "Operation Sinai 2018 " During the campaign, the military deployed tens of thousands of troops to the peninsula and was able to eliminate several senior IS-SP leaders  One report suggests that unlike previous military operations against militants in the Sinai, this time the Egyptian military armed progovernment tribesmen to assist conventional forces in combating IS-SP  According to one analysis, the military's recent campaign has "to some degree, restricted the militants' movements, destroyed a number of hideouts, and most importantly eliminated several trained and influential elements " However, as in previous major operations, once the military reduces its presence in northern Sinai, terrorist groups may reconstitute themselves  In March 2019, CENTCOM Commander General Joseph L  Votel testified before Congress, stating that the "Egyptian Armed Forces have more effectively fought ISIS in the Sinai and are now taking active measures to address the underlying issues that give life to—to these violent extremist groups and are helping to contain the threat " Outside of the Sinai, either in the western desert near the Libya border or other areas (Cairo, Nile Delta, Upper Egypt), small nationalist insurgent groups, such as Liwa al Thawra (The Revolution Brigade) and Harakat Sawaed Misr (Arms of Egypt Movement, referred to by its Arabic acronym HASM), have carried out high-level assassinations of military/police officials and bombings of infrastructure  According to one expert, these insurgent groups are comprised mainly of former Muslim Brotherhood activists who have splintered off from the main organization to wage an insurgency against the government  On January 31, 2018, the U S  State Department designated Liwa al Thawra and HASM as Specially Designated Global Terrorists (SDGTs) under Section 1(b) of Executive Order (E O ) 13224  The State Department noted that some of the leaders of both groups "were previously associated with the Egyptian Muslim Brotherhood " Terrorist attacks against key sectors of the economy continue  In December 2018, a bus carrying a group of Vietnamese tourists to the pyramids in Giza hit a roadside bomb killing 4 people and injuring 11 others  No group claimed responsibility for the attack  In February 2019, a terrorist detonated a suicide bomb he was carrying while being pursued by police, killing himself and two officers near Cairo's popular Khan el Khalili market and famous Al Azhar Mosque  Egypt and Israel have continued to find specific areas in which they can cooperate  In 2018, Israeli and Egyptian companies entered into a decade-long agreement by reaching a $15 billion natural gas deal, according to which Israeli off-shore natural gas will be exported to Egypt for liquefaction before being exported elsewhere (see " The Economy " above)  While people-to-people relations remain cold, Israel and Egypt continue to cooperate against Hamas in the Gaza Strip  In mid-November 2018, Egyptian mediation between Israel and Hamas helped calm tensions after an Israeli raid inside Gaza escalated tensions  Egypt reportedly continues to broker indirect Israel-Hamas talks aimed at establishing a long-term cease-fire  Egypt is opposed to Islamist groups wielding political power across the Middle East, and opposes Turkish and Qatari support for Hamas  On the Egyptian-Gaza border, Egypt has tried to thwart arms tunnel smuggling into Gaza and has accused Palestinian militants in Gaza of aiding terrorist groups in the Sinai  In order to weaken Hamas's rule in Gaza, Egypt has sought to restore a Palestinian Authority (PA) presence in Gaza by reconciling it with the PA  Though Egypt has helped broker several agreements aimed at ending the West Bank-Gaza split, Hamas still effectively controls Gaza  Egypt controls the Rafah border crossing into Gaza, the only non-Israeli-controlled entryway into the Strip, which it periodically closes for security reasons  Control over the Rafah border crossing provides Egypt with some leverage over Hamas, though Egyptian authorities use it carefully in order not to spark a humanitarian crisis on their border  Egypt's relations with most Gulf Arab monarchies are strong  Saudi Arabia, the United Arab Emirates (UAE), and Kuwait have provided billions of dollars in financial assistance to Egypt's military-backed government since 2013  Saudi Arabia also hosts nearly 3 million Egyptian expatriates who work in the kingdom, providing a valuable source of remittances for Egyptians back home  From 2013 onward, Emirati companies have made significant investments in the Egyptian economy  Egypt transferred sovereignty to Saudi Arabia over two islands at the entrance to the Gulf of Aqaba—Tiran and Sanafir—that had been under Egyptian control since 1950, in a move that sparked rare public criticism of President Sisi  In June 2017, Egypt joined other Gulf Arab monarchies in boycotting Qatar  In Yemen, Egypt is officially part of the Saudi-led coalition against Houthi forces, though its contribution to the war effort has been minimal  The Egyptian government supports Field Marshal Khalifa Haftar and the Libyan National Army (LNA) movement, which controls most of eastern Libya  Haftar's politics closely align with President Sisi's, as both figures hail from the military and broadly oppose Islamist political forces  From a security standpoint, Egypt seeks the restoration of order on its western border, which has experienced occasional terrorist attacks and arms smuggling  From an economic standpoint, thousands of Egyptian guest workers were employed in Libya's energy sector prior to unrest in Libya in 2011, and Egypt seeks their return to Libya and a resumption of the vital remittances those workers provided the Egyptian economy  Diplomatically, Egypt has tried to leverage its close ties to Haftar and the LNA in order to play the role of mediator between the LNA and Fayez al Sarraj, the Chairman of the Presidential Council of Libya and Prime Minister of the U N -backed Government of National Accord  Egypt's policy toward Libya also is closely aligned with other foreign backers of the LNA, including France and the United Arab Emirates (UAE)  Reportedly, the three countries are working in concert to strengthen the position of Haftar in order to facilitate the eventual reunification of the Libyan army  A 2019 LNA offensive into southern Libya has placed additional pressure on the Government of National Accord and may complicate U S -backed efforts by the United Nations to facilitate a national dialogue, constitutional referendum, and elections in 2019  To Egypt's south, the government is embroiled in regional disputes with Nile Basin countries, such as Ethiopia, which is nearing completion of the $4 2 billion Grand Ethiopian Renaissance Dam, a major hydroelectric project  Egypt argues that the dam, once filled, will limit the flow of the Nile River below Egypt's agreed share  However, many analysts expect that Egypt will address the dispute by increasing water-use efficiency and investing in desalination, rather than using its military to bomb the dam  Reduced Nile flow into Egypt may exacerbate existing water shortages and cause short-term political problems for the Egyptian government, which faces extensive domestic water needs  In February 2019, President Sisi assumed the one-year chairmanship of the African Union, during which he is expected to promote closer relations with fellow African states  Egypt and Russia, close allies in early years of the Cold War, have again strengthened bilateral ties under President Sisi, who has promised to restore Egyptian stability and international prestige  His relationship with Russian President Vladimir Putin has rekindled, in the words of one observer, "a romanticized memory of relations with Russia during the Nasser era " President Sisi first turned to Russia during the Obama Administration, when U S -Egyptian ties were strained, and Egypt seemed intent on signaling its displeasure with U S  policy  Since 2014, Egypt and Russia have improved ties in a number of ways, including through arms deals  Reportedly, Egypt is upgrading its aging fleet of legacy Soviet MiG-21 aircraft to a fourth generation MiG-29M variant with additional deliveries to Egypt in 2018 (first delivered in April 2017)  Egypt also has purchased 46 standard Ka-52 Russian attack helicopters for its air force  Egypt reportedly also has purchased the naval version of the Ka-52 for use on Egypt's two French-procured Mistral-class helicopter dock vessels (see below), and the S-300VM surface-to-air missile defense system from Russia  In August 2018, Egyptian Defense Minister Mohamed Zaki visited Russia, where he attended a Russian arms exhibition  Additionally, Egypt and Russia reportedly have expanded their cooperation on nuclear energy  In 2015, Egypt reached a deal with Russian state energy firm Rosatom to construct a 4,800-megawatt nuclear power plant in the Egyptian Mediterranean coastal town of Daba'a, 80 miles northwest of Cairo  Russia is lending Egypt $25 billion over 35 years to finance the construction and operation of the nuclear power plant (this will cover 85% of the project's total costs)  The contract also commits Russia to supply the plant's nuclear fuel for 60 years and transfer and store depleted nuclear fuel from the reactors  As Egyptian and Russian foreign policies have become more closely aligned in conflict zones such as eastern Libya, bilateral military cooperation has expanded  One report suggests that Russian Special Forces based out of an airbase in Egypt's western desert (Sidi Barrani) may be aiding General Haftar  In November 2017, Egypt and Russia signed a draft agreement governing the use of each other's air space  While Egyptian-Russian ties have grown warmer in recent years, they are not without complications  In the aftermath of an October 2015 terrorist attack against a Russian passenger jet departing from Sharm El Sheikh, visits to Egypt by Russian tourists, previously the country's largest source of tourists, dropped significantly  Russian commercial aircraft have resumed direct flights to Cairo but not to Sharm El Sheikh  Egypt and Russia also engaged in a trade dispute in 2016 over Russian wheat imports  Egypt is the largest global importer of wheat, and the largest export market for Russian wheat  Aside from Russia, France stands out as a non-U S  country with which President Sisi has sought to build a diplomatic and military procurement relationship  In the last five years, as French-Egyptian ties have improved, Egypt has purchased major air and naval defense systems from French defense contractors, including the following: Four Gowind Corvettes (produced by Naval Group)—This deal was signed in July 2014  As part of the French-Egyptian arrangement, some of the Corvette construction has taken place at the Alexandria Shipyard in Egypt  One FREMM multi-mission Frigate (produced by Naval Group)—Named the Tahya Misr (Long Live Egypt), this vessel was delivered to Egypt in 2015  This ship has participated in an annual joint French-Egyptian naval exercise, known as Cleopatra  In February 2015, Egypt purchased 24 Rafale multirole fighters (produced by Dassault Aviation)  Under the initial agreement, Egypt and France may enter into a new procurement agreement for 12 additional Rafale fighters  According to the manufacturer, the Rafale has flown in combat in Afghanistan, Libya, Mali, Iraq, and Syria and is used by Egypt, Qatar, and India  In 2018, French officials said that the United States would not permit France to export the SCALP air-launched land-attack cruise missile used on the Rafale to Egypt under the International Trade in Arms Regulation (ITAR) agreement  The United States may have been concerned over the transfer of sensitive technology to Egypt  Two Mistral-class Helicopter Carriers (produced by Naval Group)—In the fall of 2015, France announced that it would sell Egypt two Mistral-class Landing Helicopter Dock (LHD) vessels (each carrier can carry 16 helicopters, 4 landing craft, and 13 tanks) for $1 billion  The LHDs (ENS Anwar El Sadat and ENS Gamal Abdel Nasser ) were delivered in 2016  In 2017, Egypt announced that it would purchase Russian 46 Ka-52 Alligator helicopters, which can operate on the LHDs  In January 2019, French President Emmanuel Macron paid a three-day visit to Egypt, where he raised human rights issues in public and with Egyptian authorities and civil society representatives  According to Macron, "I can't see how you can pretend to ensure long-term stability in this country, which was at the heart of the Arab Spring and showed its taste for freedom, and think you can continue to harden beyond what's acceptable or justified for security reasons " President Trump has praised the Egyptian government's counterterrorism efforts while his Administration has worked to restore high-level diplomatic engagement, joint military exercises, and arms sales  Many commentators initially expected President Trump to bring the United States and Egypt closer together, and that largely has been the case  The Administration has withheld some foreign assistance for policy reasons on at least one occasion, however, and the United States has not had an ambassador in Cairo since June 30, 2017  As evidence of improved bilateral ties, the U S  Defense Department notified Congress in November 2018 of a major $1 billion sale of defense equipment to Egypt, consisting of 10 AH-64E Apache Attack Helicopters, among other things  The Egyptian Air Force already possesses 45 less advanced versions of the Apache that were acquired between 2000 and 2014  In January 2019, U S  Secretary of State Michael Pompeo delivered a major policy speech at the American University in Cairo, where he stated: "And as we seek an even stronger partnership with Egypt, we encourage President Sisi to unleash the creative energy of Egypt's people, unfetter the economy, and promote a free and open exchange of ideas  The progress made to date can continue " U S  officials have not yet publicly criticized efforts by supporters of President Sisi to advance amendments to the constitution (see above) to extend the possibility of Sisi's continued presidency  Human rights advocates have called for Western governments to withhold assistance to Egypt if the amendments are approved  According to Human Rights Watch , "Al-Sisi's government is encouraged by the continued silence of its allies, and if the US, UK, and France want to avoid the destabilizing consequences of entrenching authoritarian rule in Egypt, they should act now " On February 22, 2019, a bipartisan group of national security experts called on U S  officials to "express strong concern about the amendments to the Egyptian constitution now moving through a rapid approval process " Egypt's poor record on human rights and democratization has sparked regular criticism from U S  officials and some Members of Congress  Since FY2012, Members have passed appropriations legislation that withholds the obligation of FMF to Egypt until the Secretary of State certifies that Egypt is taking various steps toward supporting democracy and human rights  With the exception of FY2014, lawmakers have included a national security waiver to allow the Administration to waive these congressionally mandated certification requirements under certain conditions  Over the last year, the Administration has obligated several tranches of FMF to Egypt, including the following: In September 2018, the Administration obligated $1 billion in FY2018 FMF  Per Section 7041(a)(3)(A) of P L  115-141 , the Consolidated Appropriations Act, FY2018, $300 million in FMF remains withheld from obligation until the Secretary of State certifies that Egypt is taking various steps toward supporting democracy and human rights  In previous acts, the amount withheld had been $195 million  FY2018 FMF for Egypt remains available to be expended until September 30, 2019  In August 2018, the Administration waived the certification requirement in Section 7041(a)(3)(B) of P L  115-31 , the Consolidated Appropriations Act, FY2017, allowing for the obligation of $195 million in FY2017 FMF, which occurred in September 2018  However, according to one report, Senator Patrick Leahy has placed a hold on $105 million in FY2017 FMF and is seeking more information on the plight of detained Egyptian-American Moustafa Kassem  In January 2018, the Administration notified Congress of its intent to obligate $1 039 billion in FY2017 FMF out of a total of $1 3 billion appropriated for FY2017  It chose not to obligate $65 7 million in FY2017 FMF  The remaining $195 million had been withheld until a national security waiver was issued in August 2018 (see above)  For FY2019, the President requested a total of $1 381 billion in foreign assistance for Egypt, the same amount requested for the previous year  Nearly all of the requested funds for Egypt are for the FMF account  For FY2020, the request is nearly identical from previous years, as the President is seeking a total of $1 382 billion in bilateral assistance for Egypt  The FY2019 Omnibus ( P L  116-6 ) provides the following for Egypt: a total of $1 419 billion in bilateral U S  foreign assistance for Egypt, of which $1 3 billion is in FMF, $112 5 million in ESF, $3 million in NADR, $2 million in INCLE, and $1 8 million in IMET; and a reauthorization of ESF to support future loan guarantees to Egypt; P L  116-6 sets the following conditions for Egypt: As in previous years, it requires that funds may only be made available when the Secretary of State certifies that the government of Egypt is sustaining the strategic relationship with the United States and meeting its obligations under the 1979 Egypt-Israel Peace Treaty  As in previous years, the act withholds ESF that "the Secretary determines to be equivalent to that expended by the United States Government for bail, and by nongovernmental organizations for legal and court fees, associated with democracy-related trials in Egypt until the Secretary certifies and reports to the Committees on Appropriations that the Government of Egypt has dismissed the convictions issued by the Cairo Criminal Court on June 4, 2013, in Public Prosecution Case No  1110 for the Year 2012 and has not subjected the defendants to further prosecution or if convicted they have been granted full pardons  " This last condition (bolded) was added in 2019 to account for the acquittal of the 43 foreign defendants in Case 173 (see above)  As in previous years, the FY2019 Omnibus also includes a limitation on ESF, stating that no FY2018 ESF or prior-year ESF "may be made available for a contribution, voluntary or otherwise, to the Civil Associations and Foundations Support Fund, or any similar fund, established pursuant to Law 70 on Associations and Other Foundations Working in the Field of Civil Work [informally known as the NGO law] " As in previous years, the act also includes a provision that withholds $300 million of FMF funds until the Secretary of State certifies that the Government of Egypt is taking effective steps to advance, among other things, democracy and human rights in Egypt  The Secretary of State may waive this certification requirement, though any waiver must be accompanied by, among other things, an assessment of the Government of Egypt's compliance with United Nations Security Council Resolution 2270 and other such resolutions regarding North Korea  There has been some concern in the Administration and Congress over Egypt's alleged weapons procurement from North Korea in recent years  P L  115-245 , the Department of Defense (DOD) and Labor, Health and Human Services, and Education Appropriations Act, 2019 and Continuing Appropriations Act, 2019, specifies that the Secretary of Defense may provide Egypt with funds from the Counter-ISIS Train and Equip Fund (CTEF) to enhance its border security  To date, Egypt has not received security assistance from DOD-managed accounts  Between 1946 and 2016, the United States provided Egypt with $78 3 billion in bilateral foreign aid (calculated in historical dollars—not adjusted for inflation)  The 1979 Peace Treaty between Israel and Egypt ushered in the current era of U S  financial support for peace between Israel and its Arab neighbors  In two separate memoranda accompanying the treaty, the United States outlined commitments to Israel and Egypt, respectively  In its letter to Israel, the Carter Administration pledged to "endeavor to take into account and will endeavor to be responsive to military and economic assistance requirements of Israel " In his letter to Egypt, former U S  Secretary of Defense Harold Brown wrote the following: In the context of the peace treaty between Egypt and Israel, the United States is prepared to enter into an expanded security relationship with Egypt with regard to the sales of military equipment and services and the financing of, at least a portion of those sales, subject to such Congressional review and approvals as may be required  All U S  foreign aid to Egypt (or any foreign recipient) is appropriated and authorized by Congress   The 1979 Egypt-Israel Peace Treaty is a bilateral peace agreement between Egypt and Israel, and the United States is not a legal party to the treaty  The treaty itself does not include any U S  aid obligations, and any assistance commitments to Israel and Egypt that could be potentially construed in conjunction with the treaty were through ancillary documents or other communications and were—by their terms—subject to congressional approval (see above)  However, as the peace broker between Israel and Egypt, the United States has traditionally provided foreign aid to both countries to ensure a regional balance of power and sustain security cooperation with both countries  In some cases, an Administration may sign a bilateral "Memorandum of Understanding" (MOU) with a foreign country pledging a specific amount of foreign aid to be provided over a selected time period subject to the approval of Congress  In the Middle East, the United States has signed foreign assistance MOUs with Israel and Jordan  Currently, there is no U S -Egyptian MOU specifying a specific amount of total U S  aid pledged to Egypt over a certain time period  Congress typically specifies a precise allocation of most foreign assistance for Egypt in the foreign operations appropriations bill  Egypt receives the bulk of foreign aid funds from three primary accounts: Foreign Military Financing (FMF), Economic Support Funds (ESF), and International Military Education and Training (IMET)  The United States offers IMET training to Egyptian officers in order to facilitate U S -Egyptian military cooperation over the long term  Since the 1979 Israeli-Egyptian Peace Treaty, the United States has provided Egypt with large amounts of military assistance  U S  policymakers have routinely justified this aid to Egypt as an investment in regional stability, built primarily on long-running military cooperation and sustaining the treaty—principles that are supposed to be mutually reinforcing  Egypt has used U S  military aid through the FMF to (among other things) purchase major U S  defense systems, such as the F-16 fighter aircraft, the M1A1 Abrams battle tank, and the AH-64 Apache attack helicopter  For decades, FMF grants have supported Egypt's purchases of large-scale conventional military equipment from U S  suppliers  However, as mentioned above, the Obama Administration announced that future FMF grants may only be used to purchase equipment specifically for "counterterrorism, border security, Sinai security, and maritime security" (and for sustainment of weapons systems already in Egypt's arsenal)  It is not yet clear how the Trump Administration will determine which U S -supplied military equipment would help the Egyptian military counter terrorism and secure its land and maritime borders  Overall, some defense experts continue to view the Egyptian military as inadequately prepared, both doctrinally and tactically, to face the threat posed by terrorist/insurgent groups such as Sinai Province  According to a former U S  National Security Council official, "they [the Egyptian military] understand they have got a problem in Sinai, but they have been unprepared to invest in the capabilities to deal with it " To reorient the military toward unconventional warfare, the Egyptian military needs, according to one assessment, "heavy investment into rapid reaction forces equipped with sophisticated infantry weapons, optics and communication gear     backed by enhanced intelligence, surveillance and reconnaissance platforms  In order to transport them, Egypt would also need numerous modern aviation assets " In addition to substantial amounts of annual U S  military assistance, Egypt has benefited from certain aid provisions that have been available to only a few other countries  For example Early Disbursal and Interest - Bearing Account : Between FY2001 and FY2011, Congress granted Egypt early disbursement of FMF funds (within 30 days of the enactment of appropriations legislation) to an interest-bearing account at the Federal Reserve Bank of New York  Interest accrued from the rapid disbursement of aid has allowed Egypt to receive additional funding for the purchase of U S -origin equipment  In FY2012, Congress began to condition the obligation of FMF, requiring the Administration to certify certain conditions had been met before releasing FMF funds, thereby eliminating their automatic early disbursal  However, Congress has permitted Egypt to continue to earn interest on FMF funds already deposited in the Federal Reserve Bank of New York  The Excess Defense Articles (EDA) program provides one means by which the United States can advance foreign policy objectives—assisting friendly and allied nations through provision of equipment in excess of the requirements of its own defense forces  The Defense Security Cooperation Agency (DSCA) manages the EDA program, which enables the United States to reduce its inventory of outdated equipment by providing friendly countries with necessary supplies at either reduced rates or no charge  As a designated "major non-NATO ally," Egypt is eligible to receive EDA under Section 516 of the Foreign Assistance Act and Section 23(a) of the Arms Export Control Act  Over the past two decades, U S  economic aid to Egypt has been reduced by over 90%, from $833 million in FY1998 to a request of $75 million for FY2019  Beginning in the mid to late 1990s, as Egypt moved from an impoverished country to a lower-middle-income economy, the United States and Egypt began to rethink the assistance relationship, emphasizing "trade not aid " Congress began to scale back economic aid both to Egypt and Israel due to a 10-year agreement reached between the United States and Israel in the late 1990s known as the "Glide Path Agreement," which gradually reduced U S  economic aid to Egypt to $400 million by 2008  U S  economic aid to Egypt stood at $200 million per year by the end of the George W  Bush Administration, whose relations with then-President Hosni Mubarak suffered over the latter's reaction to the Administration's democracy agenda in the Arab world  During the final years of the Obama Administration, distrust of U S  democracy promotion assistance led the Egyptian government to obstruct many U S -funded economic assistance programs  According to the Government Accountability Office (GAO), the Department of State and the U S  Agency for International Development (USAID) reported hundreds of millions of dollars ($460 million as of 2015) in unobligated prior year ESF funding  As these unobligated balances grew, it created pressure on the Obama Administration to reobligate ESF funds for other purposes  In 2016, the Obama Administration notified Congress that it was reprogramming $108 million of ESF that had been appropriated for Egypt in FY2015 but remained unobligated for other purposes  The Administration claimed that its actions were due to "continued government of Egypt process delays that have impeded the effective implementation of several programs " In 2017, the Trump Administration also reprogrammed FY2016 ESF for Egypt  U S  economic aid to Egypt is divided into two components: (1) USAID-managed programs (public health, education, economic development, democracy and governance); and (2) the U S -Egyptian Enterprise Fund  Both are funded primarily through the Economic Support Fund (ESF) appropriations account  


Report 2:  The estimate accounts for all possible costs associated with a program, is structured in sufficient detail to ensure that costs are neither omitted nor double counted, and documents all cost-influencing assumptions  Well-documented  Supporting documentation explains the process, sources, and methods used to create the estimate; contains the underlying data used to develop the estimate; and is adequately reviewed and approved by management  Accurate  The estimate is not overly conservative or optimistic, is based on an assessment of the costs most likely to be incurred, and is regularly updated so that it always reflects the program’s current status  Credible  Discusses any limitations of the analysis because of uncertainty or sensitivity surrounding data or assumptions, the estimate’s results are cross-checked, and an independent cost estimate is conducted by a group outside the acquiring organization to determine whether other estimating methods produce similar results  In May 2017, DHS approved GMM’s lifecycle cost estimate of about $251 million for fiscal years 2015 through 2030  We found this initial estimate to be reliable because it fully or substantially addressed all the characteristics associated with a reliable cost estimate  For example, the estimate comprehensively included government and contractor costs, all elements of the program’s work breakdown structure, and all phases of the system lifecycle; and was aligned with the program’s technical documentation at the time the estimate was developed  GMM also fully documented the key assumptions, data sources, estimating methodology, and calculations for the estimate  Further, the program conducted a risk assessment and sensitivity analysis, and DHS conducted an independent assessment of the cost estimate to validate the accuracy and credibility of the cost estimate  However, key assumptions that FEMA made about the program changed soon after DHS approved the cost estimate in May 2017  Thus, the initial cost estimate no longer reflects the current approach for the program  For example, key assumptions about the program that changed include: Change in the technical approach: The initial cost estimate assumed that GMM would implement a software-as-a-service model, meaning that FEMA would rely on a service provider to deliver software applications and the underlying infrastructure to run them  However, in December 2017, the program instead decided to implement an infrastructure-as-a-service model, meaning that FEMA would develop and deploy its own software application and rely on a service provider to deliver and manage the computing infrastructure (e g , servers, software, storage, and network equipment)  According to program officials, this decision was made after learning from the Agile prototypes that the infrastructure-as-a-service model would allow GMM to develop the system in a more flexible environment  Increase in the number of system development personnel: A key factor with Agile development is the number of development teams (each consisting of experts in software development, testing, and cybersecurity) that are operating concurrently and producing separate portions of software functionality  Program officials initially assumed that they would need three to four concurrent Agile development teams, but subsequently realized that they would instead need to expend more resources to achieve GMM’s original completion date  Specifically, program officials now expect they will need to at least double, and potentially triple, the number of concurrent development teams to meet GMM’s original target dates  Significant delays and complexities with data migration: In 2016 and 2017, GMM experienced various technical challenges in its effort to transfer legacy system data to a data staging platform  This data transfer effort needed to be done to standardize the data before eventually migrating the data to GMM  These challenges resulted in significant delays and cost increases  Program officials reported that, by February 2018—at least 9 months later than planned—all legacy data had been transferred to a data staging platform so that FEMA officials could begin analyzing and standardizing the data prior to migrating it into GMM  FEMA officials reported that they anticipated the cost estimate to increase, and for this increase to be high enough to breach the $251 million threshold set in GMM’s May 2017 acquisition program baseline  Thus, consistent with DHS’s acquisition guidance, the program informed the DHS acquisition review board of this anticipated breach  The board declared that the program was in a cost breach status, as of September 12, 2018  As of October 2018, program officials stated that they were in the process of revising the cost estimate to reflect the changes in the program and to incorporate actual costs  In addition, the officials stated that the program was applying a new cost estimating methodology tailored for Agile programs that DHS’s Cost Analysis Division had been developing  In December 2018, program officials stated that they had completed the revised cost estimate but it was still undergoing departmental approval  Establishing an updated cost estimate should help FEMA better understand the expected costs to deliver GMM under the program’s current approach and time frames  The success of an IT program depends, in part, on having an integrated and reliable master schedule that defines when the program’s set of work activities and milestone events are to occur, how long they will take, and how they are related to one another  Among other things, a reliable schedule provides a roadmap for systematic execution of an IT program and the means by which to gauge progress, identify and address potential problems, and promote accountability  GAO’s Schedule Assessment Guide defines leading practices related to the following four characteristics that are vital to having a reliable integrated master schedule  Comprehensive  A comprehensive schedule reflects all activities for both the government and its contractors that are necessary to accomplish a program’s objectives, as defined in the program’s work breakdown structure  The schedule also includes the labor, materials, and overhead needed to do the work and depicts when those resources are needed and when they will be available  It realistically reflects how long each activity will take and allows for discrete progress measurement  Well-constructed  A schedule is well-constructed if all of its activities are logically sequenced with the most straightforward logic possible  Unusual or complicated logic techniques are used judiciously and justified in the schedule documentation  The schedule’s critical path represents a true model of the activities that drive the program’s earliest completion date and total float accurately depicts schedule flexibility  Credible  A schedule that is credible is horizontally traceable—that is, it reflects the order of events necessary to achieve aggregated products or outcomes  It is also vertically traceable—that is, activities in varying levels of the schedule map to one another and key dates presented to management in periodic briefings are consistent with the schedule  Data about risks are used to predict a level of confidence in meeting the program’s completion date  The level of necessary schedule contingency and high-priority risks are identified by conducting a robust schedule risk analysis  Controlled  A schedule is controlled if it is updated regularly by trained schedulers using actual progress and logic to realistically forecast dates for program activities  It is compared to a designated baseline schedule to measure, monitor, and report the program’s progress  The baseline schedule is accompanied by a baseline document that explains the overall approach to the program, defines ground rules and assumptions, and describes the unique features of the schedule  The baseline schedule and current schedule are subject to a configuration management control process  GMM’s schedule was unreliable because it minimally addressed three characteristics—comprehensive, credible, and controlled—and did not address the fourth characteristic of a reliable estimate—well-constructed  One of the most significant issues was that the program’s fast approaching, final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date  Table 4 summarizes our assessment of GMM’s schedule  In discussing the reasons for the shortfalls in these practices, program officials stated that they had been uncertain about the level of rigor that should be applied to the GMM schedule, given their use of Agile development  However, leading practices state that program schedules should meet all the scheduling practices, regardless of whether a program is using Agile development  As discussed earlier in this report, GMM has already experienced significant schedule delays  For example, the legacy data migration effort, the AFG pilot, and the Agile development contract have been delayed  Program officials also stated that the delay in awarding and starting the Agile contract has delayed other important activities, such as establishing time frames for transitioning legacy systems  A more robust schedule could have helped FEMA predict the impact of delays on remaining activities and identify which activities appeared most critical so that the program could ensure that any risks in delaying those activities were properly mitigated  In response to our review and findings, program officials recognized the need to continually enhance their schedule practices to improve the management and communication of program activities  As a result, in August 2018, the officials stated that they planned to add a master scheduler to the team to improve the program’s schedule practices and ensure that all of the areas of concern we identified are adequately addressed  In October 2018, the officials reported that they had recently added two master schedulers to GMM  According to the statement of objectives, the Agile contractor is expected to develop an integrated master schedule soon after it begins performance  However, program officials stated that GMM is schedule-driven—due to the Executive Steering Group’s expectation that the solution will be delivered by September 2020  The officials added that, if GMM encounters challenges in meeting this time frame, the program plans to seek additional resources to allow it to meet the 2020 target  GMM’s schedule-driven approach has already led to an increase in estimated costs and resources  For example, as previously mentioned, the program has determined that, to meet its original target dates, GMM needs to at least double, and possibly triple, the number of concurrent Agile development teams  In addition, we have previously reported that schedule pressure on federal IT programs can lead to omissions and skipping of key activities, especially system testing  In August 2018, program officials acknowledged that September 2020 may not be feasible and that the overall completion time frames established in the acquisition program baseline may eventually need to be rebaselined  Without a robust schedule to forecast whether FEMA’s aggressive delivery goal for GMM is realistic to achieve, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to fully deliver the system  NIST’s risk management framework establishes standards and guidelines for agencies to follow in developing cybersecurity programs  Agencies are expected to use this framework to achieve more secure information and information systems through the implementation of appropriate risk mitigation strategies and by performing activities that ensure that necessary security controls are integrated into agencies’ processes  The framework addresses broad cybersecurity and risk management activities, which include the following: Categorize the system: Programs are to categorize systems by identifying the types of information used, selecting a potential impact level (e g , low, moderate, or high), and assigning a category based on the highest level of impact to the system’s confidentiality, integrity, and availability, if the system was compromised  Programs are also to document a description of the information system and its boundaries and should register the system with appropriate program management offices  System categorization is documented in a system security plan  Select and implement security controls: Programs are to determine protective measures, or security controls, to be implemented based on the system categorization results  These security controls are documented in a system security plan  For example, control areas include access controls, incident response, security assessment and authorization, identification and authentication, and configuration management  Once controls are identified, programs are to determine planned implementation actions for each of the designated controls  These implementation actions are also specified in the system security plan  Assess security controls: Programs are to develop, review, and approve a security assessment plan  The purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  Programs are to also perform a security control assessment by evaluating the security controls in accordance with the procedures defined in the security assessment plan, in order to determine the extent to which the controls were implemented correctly  The output of this process is intended to produce a security assessment report to document the issues, findings, and recommendations  Programs are to conduct initial remediation actions on security controls and reassess those security controls, as appropriate  Obtain an authorization to operate the system: Programs are to obtain security authorization approval in order to operate a system  Resolving weaknesses and vulnerabilities identified during testing is an important step leading up to achieving an authorization to operate  Programs are to establish corrective action plans to address any deficiencies in cybersecurity policies, procedures, and practices  DHS guidance also states that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  Monitor security controls on an ongoing basis: Programs are to monitor their security controls on an ongoing basis after deployment, including determining the security impact of proposed or actual changes to the information system and assessing the security controls in accordance with a monitoring strategy that determines the frequency of monitoring the controls  For the GMM program’s engineering and test environment, which went live in February 2018, FEMA fully addressed three of the five key cybersecurity practices in NIST’s risk management framework and partially addressed two of the practices  Specifically, FEMA categorized GMM’s environment based on security risk, implemented select security controls, and monitored security controls on an ongoing basis  However, the agency partially addressed the areas of assessing security controls and obtaining an authorization to operate the system  Table 5 provides a summary of the extent to which FEMA addressed NIST’s key cybersecurity practices for GMM’s engineering and test environment  Consistent with NIST’s framework, GMM categorized the security risk of its engineering and test environment and identified it as a moderate- impact environment  A moderate-impact environment is one where the loss of confidentiality, integrity, or availability could be expected to have a serious or adverse effect on organizational operations, organizational assets, or individuals  GMM completed the following steps leading to this categorization: The program documented in its System Security Plan the various types of data and information that the environment will collect, process, and store, such as conducting technology research, building or enhancing technology, and maintaining IT networks  The program established three information types and assigned security levels of low, moderate, or high impact in the areas of confidentiality, availability, and integrity  A low-impact security level was assigned to two information types: (1) conducting technology research and (2) building or enhancing technology; and a moderate- impact security level was assigned to the third information type: maintaining IT networks  The engineering and test environment was categorized as an overall moderate-impact system, based on the highest security impact level assignment  GMM documented a description of the environment, including a diagram depicting the system’s boundaries, which illustrates, among other things, databases and firewalls  GMM properly registered its engineering and test environment with FEMA’s Chief Information Officer, Chief Financial Officer, and acting Chief Information Security Officer  By conducting the security categorization process, GMM has taken steps that should ensure that the appropriate security controls are selected for the program’s engineering and test environment  Consistent with NIST’s framework and the system categorization results, GMM appropriately determined which security controls to implement and planned actions for implementing those controls in its System Security Plan for the engineering and test environment  For example, the program utilized NIST guidance to select standard controls for a system categorized with a moderate-impact security level  These control areas include, for example, access controls, risk assessment, incident response, identification and authentication, and configuration management  Further, the program documented its planned actions to implement each control in its System Security Plan  For example, GMM documented that the program plans to implement its Incident Response Testing control by participating in an agency-wide exercise and unannounced vulnerability scans  As another example, GMM documented that the program plans to implement its Contingency Plan Testing control by testing the contingency plan annually, reviewing the test results, and preparing after action reports  By selecting and planning for the implementation of security controls, GMM has taken steps to mitigate its security risks and protect the confidentiality, integrity, and availability of the information system  Consistent with NIST’s framework, in January 2018, GMM program officials developed a security assessment plan for the engineering and test environment  According to GMM program officials, this plan was reviewed by the security assessment team  However, the security assessment plan lacked essential details  Specifically, while the plan included the general process for evaluating the environment’s security controls, the planned assessment procedures for all 964 security controls were not sufficiently defined  Specifically, GMM program officials copied example assessment procedures from NIST guidance and inserted them into its security assessment documentation for all of its 964 controls, without making further adjustments to explain the steps that should be taken specific to GMM  Table 6 shows an example of a security assessment procedure copied from the NIST guidance that should have been further adjusted for GMM  In addition, the actual assessment procedures that the GMM assessors used to evaluate the security controls were not documented  Instead, the program only documented whether each control passed or failed each test  GMM program officials stated that the planned assessment procedures are based on an agency template that was exported from a DHS compliance tool, and that FEMA security officials have been instructed by the DHS OCIO not to tailor or make any adjustments to the template language  However, the assessment procedures outlined in NIST’s guidance are to serve as a starting point for organizations preparing their program specific assessments  According to NIST, organizations are expected to select and tailor their assessment procedures for each security control from NIST’s list of suggested assessment options (e g , review, analyze, or inspect policies, procedures, and related documentation options)  DHS OCIO officials stated that, consistent with NIST’s guidance, they expect that components will ensure they are in compliance with the minimum standards and will also add details and additional rigor, as appropriate, to tailor the planned security assessment procedures to fit their unique missions or needs  In November 2018, in response to our audit, DHS OCIO officials stated that they were meeting with FEMA OCIO officials to understand why they did not document the planned and actual assessment procedures performed by the assessors for GMM  Until FEMA ensures that detailed planned evaluation methods and actual evaluation procedures specific to GMM are defined, the program risks assessing security controls incorrectly, having controls that do not work as intended, and producing undesirable outcomes with respect to meeting the security requirements  In addition, the security assessment plan was not approved by FEMA’s OCIO before proceeding with the security assessment  Program officials stated that approval was not required for the security assessment plan prior to the development of the security assessment report  However, NIST guidance states that the purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  By not getting the security assessment plan approved by FEMA’s OCIO before security assessment reviews were conducted, GMM risks inconsistencies with the plan and security objectives of the organization  Finally, consistent with NIST guidance, GMM performed a security assessment in December 2017 of the engineering and test environment’s controls, which identified 36 vulnerabilities (23 critical- and high-impact vulnerabilities and 13 medium- and low-impact vulnerabilities)  The program also documented these vulnerabilities and associated findings and recommendations in a security assessment report  GMM conducted initial remediation actions (i e , remediation of vulnerabilities that should be corrected immediately) for 12 of the critical- and high-impact vulnerabilities and a reassessment of those security controls confirmed that they were resolved by January 2018  Remediation of the remaining 11 critical- and high-impact vulnerabilities and 13 medium- and low- impact vulnerabilities were to be addressed by corrective action plans as part of the authorization to operate process, which is discussed in the next section  The authorization to operate GMM’s engineering and test environment was granted on February 5, 2018  Among other things, this decision was based on the important stipulation that the remaining 11 critical- and high- impact vulnerabilities associated with multifactor authentication would be addressed within 45 days, or by March 22, 2018  However, the program did not meet this deadline and, instead, approximately 2 months after this deadline passed, obtained a waiver to remediate these vulnerabilities by May 9, 2019  These vulnerabilities are related to a multifactor authentication capability  Program officials stated that they worked with FEMA OCIO officials to attempt to address these vulnerabilities by the initial deadline, but they were unsuccessful in finding a viable solution  Therefore, GMM program officials developed a waiver at the recommendation of the OCIO to provide additional time to develop a viable solution  However, a multifactor authentication capability is essential to ensuring that users are who they say they are, prior to granting users access to the GMM engineering and test environment, in order to reduce the risk of harmful actors accessing the system  In addition, as of September 2018, the program had not established corrective action plans for the 13 medium- and low-impact vulnerabilities  Program officials stated that they do not typically address low-impact vulnerabilities; however, this is in conflict with DHS guidance that specifies that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  In response to our audit, in October 2018, GMM program officials developed these remaining corrective action plans  The plans indicated that these vulnerabilities were to be fully addressed by January 2019 and April 2019  While the program eventually took corrective actions in response to our audit by developing the missing plans, the GMM program initially failed to follow DHS’s guidance on preparing corrective actions plans for all security vulnerabilities  Until GMM consistently follows DHS’s guidance, it will be difficult for FEMA to determine the extent to which GMM’s security weaknesses identified during its security control assessments are remediated  Additionally, as we have reported at other agencies, vulnerabilities can be indicators of more significant underlying issues and, thus, without appropriate management attention or prompt remediation, GMM is at risk of unnecessarily exposing the program to potential exploits  Moreover, GMM was required to assess all untested controls by March 7, 2018, or no later than 30 days after the approval of the authorization to operate; however, it did not meet this deadline  Specifically, we found that, by October 2018, FEMA had not fully tested 190 security controls in the GMM engineering and test environment  These controls were related to areas such as security incident handling and allocation of resources required to protect an information system  In response to our findings, in October 2018, GMM program officials reported that they had since fully tested 27 controls and partially tested the remaining 163 controls  Program officials stated that testing of the 163 controls is a shared responsibility between GMM and other parties (e g , the cloud service provider)  They added that GMM had completed its portion of the testing but was in the process of verifying the completion of testing by other parties  Program officials stated that the untested controls were not addressed sooner, in part, because of errors resulting from configuration changes in the program’s compliance tool during a system upgrade, which have now been resolved  Until GMM ensures that all security controls have been tested, it remains at an increased risk of exposing programs to potential exploits  Consistent with the NIST framework, GMM established methods for assessing and monitoring security controls to be conducted after an authorization to operate has been approved  GMM has tailored its cybersecurity policies and practices for monitoring its controls to take into account the frequent and iterative pace with which system functionality is continuously being introduced into the GMM environment  Specifically, the GMM program established a process for assessing security impact changes to the system and conducting reauthorizations to operate within the rapid Agile delivery environment  As part of this process, GMM embedded cybersecurity experts on each Agile development team so that they are involved early and can impact security considerations from the beginning of requirements development through testing and deployment of system functionality  In addition, the process involves important steps for ensuring that the system moves from development to completion, while producing a secure and reliable system  For example, it includes procedures for creating, reviewing, and testing new system functionality  As the new system functionality is integrated with existing system functionality, it is to undergo automated testing and security scans in order to ensure that the integrity of the security of the system has not been compromised  Further, an automated process is to deploy the code if it passes all security scans, code tests, and code quality checks  GMM’s process for conducting a reauthorization to operate within the rapid delivery Agile development environment is to follow FEMA guidance that states that all high-level changes made to a FEMA IT system must receive approval from both a change advisory board and the FEMA Chief Information Officer  The board and FEMA Chief Information Officer are to focus their review and approval on scheduled releases and epics (i e , collections of user stories)  Additionally, the Information System Security Officer is to review each planned user story and, if it is determined that the proposed changes may impact the integrity of the authorization, the Information System Security Officer is to work with the development team to begin the process of updating the system authorization  Finally, GMM uses automated tools to track the frequency in which security controls are assessed and to ensure that required scanning data are received by FEMA for reporting purposes  Program officials stated that, in the absence of department-level and agency-level guidance, they have coordinated with DHS and FEMA OCIO officials to ensure that these officials are in agreement with GMM’s approach to continuous monitoring  By having monitoring control policies and procedures in place, FEMA management is positioned to more effectively prioritize and plan its risk response to current threats and vulnerabilities for the GMM program  Given FEMA’s highly complex grants management environment, with its many stakeholders, IT systems, and internal and external users, implementing leading practices for business process reengineering and IT requirements management is critical for success  FEMA has taken many positive steps, including ensuring executive leadership support for business process reengineering, documenting the agency’s grants management processes and performance improvement goals, defining initial IT requirements for the program, incorporating input from end user stakeholders into the development and implementation process, and taking recent actions to improve its delivery of planned IT requirements  Nevertheless, until the GMM program finalizes plans and time frames for implementing its organizational change management actions, plans and communicates system transition activities, and maintains clear traceability of IT requirements, FEMA will be limited in its ability to provide streamlined grants management processes and effectively deliver a modernized IT system to meet the needs of its large range of users  While GMM’s initial cost estimate was reliable, key assumptions about the program since the initial estimate had changed and, therefore, it no longer reflected the current approach for the program  The forthcoming updated cost schedule is expected to better reflect the current approach  However, the program’s unreliable schedule to fully deliver GMM by September 2020 is aggressive and unrealistic  The delays the program has experienced to date further compound GMM’s schedule issues  Without a robust schedule that has been informed by a realistic assessment of GMM’s development activities, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to achieve their goals  Further, FEMA’s implementation of cybersecurity practices for GMM in the areas of system categorization, selection and implementation, and monitoring will help the program  However, GMM lacked essential details for evaluating security controls, did not approve the security assessment plan before proceeding with the security assessment, did not follow DHS’s guidance to develop corrective action plans for all security vulnerabilities, and did not fully test all security controls  As a result, the GMM engineering and test environment remains at an increased risk of exploitations  We are making eight recommendations to FEMA: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions  (Recommendation 1) The FEMA Administrator should ensure that the GMM program management office plans and communicates its detailed transition activities to its affected customers before they transition to GMM and undergo significant changes to their processes  (Recommendation 2) The FEMA Administrator should ensure that the GMM program management office implements its planned changes to its processes for documenting requirements for future increments and ensures it maintains traceability among key IT requirements documents  (Recommendation 3) The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report  (Recommendation 4) The FEMA Administrator should ensure that the FEMA OCIO defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls  (Recommendation 5) The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted  (Recommendation 6) The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities  (Recommendation 7) The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system  (Recommendation 8) DHS provided written comments on a draft of this report, which are reprinted in appendix IV  In its comments, the department concurred with all eight of our recommendations and provided estimated completion dates for implementing each of them  For example, with regard to recommendation 4, the department stated that FEMA plans to update the GMM program schedule to address the leading practices for a reliable schedule by April 30, 2019  In addition, for recommendation 7, the department stated that FEMA plans to ensure that corrective action plans are prepared by July 31, 2019, to address all identified security vulnerabilities for GMM  If implemented effectively, the actions that FEMA plans to take in response to the recommendations should address the weaknesses we identified  We also received technical comments from DHS and FEMA officials, which we incorporated, as appropriate  We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-4456 or harriscc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix V  Our objectives were to (1) determine the extent to which the Federal Emergency Management Agency (FEMA) is implementing leading practices for reengineering its grants management business processes and incorporating business needs into Grants Management Modernization (GMM) information technology (IT) requirements; (2) assess the reliability of the program’s estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices for GMM  To address the first objective, we reviewed GAO’s Business Process Reengineering Assessment Guide and Software Engineering Institute’s Capability Maturity Model for Integration for Development to identify practices associated with business process reengineering and IT requirements management  We then selected six areas that, in our professional judgment, represented foundational practices that were of particular importance to the successful implementation of an IT modernization effort that is using Agile development processes  We also selected the practices that were most relevant based on where GMM was in the system development lifecycle and we discussed the practice areas with FEMA officials  The practices are: Ensuring executive leadership support for process reengineering Assessing the current and target business environment and business Establishing plans for implementing new business processes Establishing clear, prioritized, and traceable IT requirements Tracking progress in delivering IT requirements Incorporating input from end user stakeholders We also reviewed selected chapters of GAO’s draft Agile Assessment Guide (Version 6A), which is intended to establish a consistent framework based on best practices that can be used across the federal government for developing, implementing, managing, and evaluating agencies’ IT investments that rely on Agile methods  To develop this guide, GAO worked closely with Agile experts in the public and private sector; some chapters of the guide are considered more mature because they have been reviewed by the expert panel  We reviewed these chapters to ensure that our expectations for how FEMA should apply the six practices for business process reengineering and IT requirements management are appropriate for an Agile program and are consistent with the draft guidance that is under development  Additionally, since Agile development programs may use different terminology to describe their software development processes, the Agile terms used in this report (e g , increment, sprint, epic, etc ) are specific to the GMM program  We obtained and analyzed FEMA grants management modernization documentation, such as current and target grants management business processes, acquisition program baseline, operational requirements document, concept of operations, requirements analyses workbooks, Grants Management Executive Steering Group artifacts, stakeholder outreach artifacts, Agile increment- and sprint-level planning and development artifacts, and the requirements backlog  We assessed the program documentation against the selected practices to determine the extent to which the agency had implemented them  We then assessed each practice area as: fully implemented—FEMA provided complete evidence that showed it fully implemented the practice area; partially implemented—FEMA provided evidence that showed it partially implemented the practice area; not implemented—FEMA did not provide evidence that showed it implemented any of the practice area  Additionally, we observed Agile increment and sprint development activities at GMM facilities in Washington, D C  We also observed a demonstration of how the program manages its lower level requirements (i e , user stories and epics) and maintains traceability of the requirements using an automated tool at GMM facilities in Washington, D C  We also interviewed FEMA officials, including the GMM Program Executive, GMM Program Manager, GMM Business Transformation Team Lead, and Product Owner regarding their efforts to streamline grants management business processes, collect and incorporate stakeholder input, and manage GMM’s requirements  In addition, we interviewed FEMA officials from four out of 16 grant program offices and two out of 10 regional offices to obtain contextual information and illustrative examples of FEMA’s efforts to reengineer grants management business processes and collect business requirements for GMM  Specifically, We selected the four grant program offices based on a range of grant programs managed, legacy systems used, and the amount of grant funding awarded  We also sought to select a cross section of different characteristics, such as selecting larger grant program offices, as well as smaller offices  In addition, we ensured that our selection included the Assistance to Firefighters Grants (AFG) program office because officials in this office represent the first GMM users and, therefore, are more actively involved with the program’s Agile development practices  Based on these factors, we selected: Public Assistance Division, Individual Assistance Division, AFG, and National Fire Academy  Additionally, the four selected grant program offices are responsible for 16 of the total 45 grant programs and are users of five of the nine primary legacy IT systems  The four selected grant program offices also represent about 68 percent of the total grant funding awarded by FEMA from fiscal years 2005 through 2016  We selected two regional offices based on (1) the largest amount of total FEMA grant funding for fiscal years 2005 through 2016—Region 6 located in Denton, Texas; and (2) the highest percentage of AFG funding compared to the office’s total grant funding awarded from fiscal years 2005 through 2016—Region 5 located in Chicago, Illinois  To assess the reliability of data from the program’s automated IT requirements management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM requirements  We determined that the data used were sufficiently reliable for the purpose of evaluating GMM’s practices for managing IT requirements  For our second objective, to assess the reliability of GMM’s estimated costs and schedule, we reviewed documentation on GMM’s May 2017 lifecycle cost estimate and on the program’s schedule, dated May 2018  To assess the reliability of the May 2017 lifecycle cost estimate, we evaluated documentation supporting the estimate, such as the cost estimating model, the report on GMM’s Cost Estimating Baseline Document and Life Cycle Cost Estimate, and briefings provided to the Department of Homeland Security (DHS) and FEMA management regarding the cost estimate  We assessed the cost estimating methodologies, assumptions, and results against leading practices for developing a comprehensive, accurate, well-documented, and credible cost estimate, identified in GAO’s Cost Estimating and Assessment Guide  We also interviewed program officials responsible for developing and reviewing the cost estimate to understand their methodology, data, and approach for developing the estimate  We found that the cost data were sufficiently reliable  To assess the reliability of the May 2018 GMM program schedule, we evaluated documentation supporting the schedule, such as the integrated master schedule, acquisition program baseline, and Agile artifacts  We assessed the schedule documentation against leading practices for developing a comprehensive, well-constructed, credible, and controlled schedule, identified in GAO’s Schedule Assessment Guide  We also interviewed GMM program officials responsible for developing and managing the program schedule to understand their practices for creating and maintaining the schedule  We noted in our report the instances where the quality of the schedule data impacted the reliability of the program’s schedule  For both the cost estimate and program schedule, we assessed each leading practice as: fully addressed—FEMA provided complete evidence that showed it implemented the entire practice area; substantially addressed—FEMA provided evidence that showed it implemented more than half of the practice area; partially addressed—FEMA provided evidence that showed it implemented about half of the practice area; minimally addressed—FEMA provided evidence that showed it implemented less than half of the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  Finally, we provided FEMA with draft versions of our detailed analyses of the GMM cost estimate and schedule  This was done to verify that the information on which we based our findings was complete, accurate, and up-to-date  Regarding our third objective, to determine the extent to which FEMA is addressing key cybersecurity practices for GMM, we reviewed documentation regarding DHS and FEMA cybersecurity policies and guidance, and FEMA’s authorization to operate for the program’s engineering and test environment  We evaluated the documentation against all six cybersecurity practices identified in the National Institute of Standards and Technology’s (NIST) Risk Management Framework  While NIST’s Risk Management Framework identifies six total practices, for reporting purposes, we combined two interrelated practices—selection of security controls and implementation of security controls—into a single practice  The resulting five practices were: categorizing the system based on security risk, selecting and implementing security controls, assessing security controls, obtaining an authorization to operate the system, and monitoring security controls on an ongoing basis  We obtained and analyzed key artifacts supporting the program’s efforts to address these risk management practices, including the program’s System Security Plan, the Security Assessment Plan and Report, Authorization to Operate documentation, and the program’s continuous monitoring documentation  We also interviewed officials from the GMM program office and FEMA’s Office of the Chief Information Officer, such as the GMM Security Engineering Lead, GMM Information System Security Officer, and FEMA’s Acting Chief Information Security Officer, regarding their efforts to assess, document, and review security controls for GMM  We assessed the evidence against the five practices to determine the extent to which the agency had addressed them  We then assessed each practice area as: fully addressed—FEMA provided complete evidence that showed it fully implemented the practice area; partially addressed—FEMA provided evidence that showed it partially implemented the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  To assess the reliability of data from the program’s automated security controls management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM security controls for the engineering and test environment  We found that some of the security controls data we examined were sufficiently reliable for the purpose of evaluating FEMA’s cybersecurity practices for GMM, and we noted in our report the instances where the accuracy of the data impacted the program’s ability to address key cybersecurity practices  We conducted this performance audit from December 2017 to April 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The Federal Emergency Management Agency (FEMA) awards many different types of grants to state, local, and tribal governments and nongovernmental entities  These grants are to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks  Agile software development is a type of incremental development that calls for the rapid delivery of software in small, short increments  The use of an incremental approach is consistent with the Office of Management and Budget’s guidance as specified in its information technology (IT) Reform Plan, as well as the legislation commonly referred to as the Federal Information Technology Acquisition Reform Act  Many organizations, especially in the federal government, are accustomed to using a waterfall software development model, which typically consists of long, sequential phases, and differs significantly from the Agile development approach  Agile practices integrate planning, design, development, and testing into an iterative lifecycle to deliver software early and often  Figure 7 provides a depiction of software development using the Agile approach, as compared to a waterfall approach  The frequent iterations of Agile development are intended to effectively measure progress, reduce technical and programmatic risk, and respond to feedback from stakeholders in changes to IT requirements more quickly than traditional methods  Despite these intended benefits, organizations adopting Agile must overcome challenges in making significant changes to how they are accustomed to developing software  The significant differences between Agile and waterfall development impact how IT programs are planned, implemented, and monitored in terms of cost, schedule, and scope  For example, in waterfall development, significant effort is devoted upfront to document detailed plans and all IT requirements for the entire scope of work at the beginning of the program, and cost and schedule can be varied to complete that work  However, for Agile programs the precise details are unknown upfront, so initial planning of cost, scope, and timing would be conducted at a high level, and then supplemented with more specific plans for each iteration  While cost and schedule are set for each iteration, requirements for each iteration (or increment) can be variable as they are learned over time and revised to reflect experiences from completed iterations and to accommodate changing priorities of the end users  The differences in these two software development approaches are shown in figure 8  Looking at figure 8, the benefit provided from using traditional program management practices such as establishing a cost estimate or a robust schedule, is not obvious  However, unlike a theoretical environment, many government programs may not have the autonomy to manage completely flexible scope, as they must deliver certain minimal specifications with the cost and schedule provided  In those cases, it is vital for the team to understand and differentiate the IT requirements that are “must haves” from the “nice to haves” early in the planning effort  This would help facilitate delivery of the “must-haves” requirements first, thereby providing users with the greatest benefits as soon as possible  In addition to the contact named above, the following staff made key contributions to this report: Shannin G  O’Neill (Assistant Director), Jeanne Sung (Analyst in Charge), Andrew Beggs, Rebecca Eyler, Kendrick Johnson, Thomas J  Johnson, Jason Lee, Jennifer Leotta, and Melissa Melvin 

ground_truth: The daily order of business on the floor of the House of Representatives is governed by standing rules that make certain matters and actions privileged for consideration. On a day-to-day basis, however, the House can also decide to grant individual bills privileged access to the floor, using one of several parliamentary mechanisms. The standing rules of the House include several different parliamentary mechanisms that the body may use to act on bills and resolutions. Which of these will be employed in a given instance usually depends on the extent to which Members want to debate and amend the legislation. In general, all of the procedures of the House permit a majority of Members to work their will without excessive delay. The House considers most legislation by motions to suspend the rules, with limited debate and no floor amendments, with the support of at least two-thirds of the Members voting. Occasionally, the House will choose to consider a measure on the floor by the unanimous consent of Members. The Rules Committee is instrumental in recommending procedures for considering major bills and may propose restrictions on the floor amendments that Members can offer or bar them altogether. Many major bills are first considered in Committee of the Whole before being passed by a simple majority vote of the House. The Committee of the Whole is governed by more flexible procedures than the basic rules of the House, under which a majority can vote to pass a bill after only one hour of debate and with no floor amendments. Although a quorum is supposed to be present on the floor when the House is conducting business, the House assumes a quorum is present unless a quorum call or electronically recorded vote demonstrates that it is not. However, the standing rules preclude quorum calls at most times other than when the House is voting. Questions are first decided by voice vote, although any Member may then demand a division vote. Before the final result of a voice or division vote is announced, Members can secure an electronically recorded vote instead if enough Members desire it or if a quorum is not present in the House. The constitutional requirements for making law mean that each chamber must pass the same measure with the identical text before transmitting it to the President for his consideration. When the second chamber of Congress amends a measure sent to it by the first chamber, the two chambers must resolve legislative differences to meet this requirement. This can be accomplished by shuttling the bill back and forth between the House and Senate, with each chamber proposing amendments to the position of the other, or by establishing a conference committee to try to negotiate a compromise version of the legislation.