prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.



Report 2: FEMA’s mission is to help people before, during, and after disasters  It provides assistance to those affected by emergencies and disasters by supplying immediate needs (e g , ice, water, food, and temporary housing) and providing financial assistance grants for damage to personal or public property  FEMA also provides non-disaster assistance grants to improve the nation’s preparedness, readiness, and resilience to all hazards  FEMA accomplishes a large part of its mission through awarding grants to state, local, and tribal governments and nongovernmental entities to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks  As previously mentioned, for fiscal years 2005 through 2014, the agency obligated about $104 5 billion in disaster relief grants  In addition, as of April 2018, the four major disasters in 2017—hurricanes Harvey, Irma, and Maria; and the California wildfires—had resulted in over $22 billion in FEMA grants  The current FEMA grants management environment is highly complex with many stakeholders, IT systems, and users  Specifically, this environment is comprised of 45 active disaster and non-disaster grant programs, which are grouped into 12 distinct grant categories  For example, one program in the Preparedness: Fire category is the Assistance to Firefighters Grants (AFG) program, which provides grants to fire departments, nonaffiliated emergency medical service organizations, and state fire training academies to support firefighting and emergency response needs  As another example, the Housing Assistance grant program is in the Recovery Assistance for Individuals category and provides financial assistance to individuals and households in geographical areas that have been declared an emergency or major disaster by the President  Table 1 lists FEMA’s non-disaster and disaster-based grant categories  According to FEMA, the processes for managing these different types of grants vary because the grant programs were developed independently by at least 18 separate authorizing laws that were enacted over a 62-year period (from 1947 through 2009)  The various laws call for different administrative and reporting requirements  For example, the Robert T  Stafford Disaster Relief and Emergency Assistance Act, as amended, established the statutory authority for 11 of the grant programs, such as the administration of Public Assistance and Individual Assistance grant programs after a presidentially declared disaster  The act also requires the FEMA Administrator to submit an annual report to the President and Congress covering FEMA’s expenditures, contributions, work, and accomplishments, pursuant to the act  As another example, the National Dam Safety Program Act established one of the grant programs aimed at providing financial assistance to improve dam safety  Key stakeholders in modernizing the IT grants management environment include the internal FEMA officials that review, approve, and monitor the grants awarded, such as grant specialists, program analysts, and supervisors  FEMA has estimated that it will need to support about 5,000 simultaneous internal users of its grants management systems  Other users include the grant recipients that apply for, receive, and submit reports on their grant awards; these are considered the external system users  These grant recipients can include individuals, states, local governments, Indian tribes, institutions of higher education, and nonprofit organizations  FEMA has estimated that there are hundreds of thousands of external users of its grants systems  The administration of the many different grant programs is distributed across four divisions within FEMA’s organizational structure  Figure 1 provides an overview of FEMA’s organizational structure and the divisions that are responsible for administering grants  Within three of the four divisions—Resilience, United States Fire Administration, and Office of Response and Recovery—16 different grant program offices are collectively responsible for administering the 45 grant programs  The fourth division consists of 10 regional offices that help administer grants within their designated geographical regions  For example, the Office of Response and Recovery division oversees three different offices that administer 13 grant programs that are largely related to providing assistance in response to presidentially declared disasters  Figure 2 shows the number of grant programs administered by each of the four divisions’ grant program and regional offices  In addition, appendix II lists the names of the 45 grant programs  FEMA’s OCIO is responsible for developing, enhancing, and maintaining the agency’s IT systems, and for increasing efficiencies and cooperation across the entire organization  However, we and the DHS Office of Inspector General (OIG) have previously reported that the grant programs and regional offices develop information systems independent of the OCIO and that this has contributed to the agency’s disparate IT environment  We and the DHS OIG have reported that this disparate IT environment was due, in part, to FEMA’s decentralized IT budget and acquisition practices  For example, from fiscal years 2010 through 2015, the OCIO’s budget represented about one-third of the agency’s IT budget, with the grant program offices accounting for the remaining two-thirds of that budget  In February 2018, the OIG found that FEMA had shown limited progress in improving its IT management and that many of the issues reported in prior audits remained unchanged  As such, the OIG initiated a more comprehensive audit of the agency’s IT management that is ongoing  FEMA has identified 10 primary legacy IT systems that support its grants management activities  According to the agency, most of these systems were developed to support specific grant programs or grant categories  Table 2 summarizes the 10 primary legacy systems  According to FEMA officials, the 10 primary grant systems are all in operation (several have been for decades) and are not interoperable  As a result, individual grant programs and regional offices have independently developed work arounds intended to address existing capability gaps with the primary systems  FEMA officials stated that while these work arounds have helped the agency partially address capability gaps with its primary systems, they are often nonstandardized processes, and introduce the potential for information security risks and errors  This environment has contributed to labor-intensive manual processes and an increased burden for grant recipients  The disparate systems have also led to poor information sharing and reporting capabilities, as well as difficulty reconciling financial data  The DHS OIG and we have previously highlighted challenges with FEMA’s past attempts to modernize its grant management systems  For example, In December 2006, the DHS OIG reported that EMMIE, an effort to modernize its grants management systems and provide a single grants processing solution, was being developed without a clear understanding and definition of the future solution  The report also identified the need to ensure crosscutting participation from headquarters, regions, and states in developing and maintaining a complete, documented set of FEMA business and system requirements  In April 2016, we found weaknesses in FEMA’s development of the EMMIE system  For example, we noted that the system was implemented without sufficient documentation of system requirements, an acquisition strategy, up-to-date cost estimate and schedule, total amount spent to develop the system, or a systems integration plan  In response to our findings and related recommendations, FEMA took action to address these issues  For example, the agency implemented a requirements management process that, among other things, provided guidance to programs on analyzing requirements to ensure that they are complete and verifiable  We reported in November 2017 that EMMIE lacked the ability to collect information on all pre-award activities and, as a result, agency officials said that they and applicants used ad hoc reports and personal tracking documents to manage and monitor the progress of grant applications  FEMA officials added that applicants often struggled to access the system and that the system was not user friendly  Due to EMMIE’s shortfalls, the agency had to develop another system in 2017 to supplement EMMIE with additional grant tracking and case management capabilities  FEMA initiated GMM in 2015, in part, due to EMMIE’s failed attempt to modernize the agency’s grants management environment  The program is intended to modernize and streamline the agency’s grants management environment  To help streamline the agency’s grants management processes, the program established a standard framework intended to represent a common grants management lifecycle  The framework consists of five sequential phases—pre-award, award, post-award, closeout, and post- closeout—along with a sixth phase dedicated to continuous grant program management activities, such as analyzing data and producing reports on grant awards and managing IT systems  FEMA also established 43 distinct business functions associated with these six lifecycle phases  Figure 3 provides the general activities that may occur in each of the grant lifecycle phases, but specific activities would depend on the type of grant being administered (i e , disaster versus non-disaster)  GMM is expected to be implemented within the complex IT environment that currently exists at FEMA  For example, the program is intended to replace the 10 legacy grants management systems, and potentially many additional subsystems, with a single IT system  Each of the 10 legacy systems was developed with its own database(s) and with no standardization of the grants management data and, according to FEMA officials, this legacy data has grown significantly over time  Accordingly, FEMA will need to migrate, analyze, and standardize the grants management data before transitioning it to GMM  The agency awarded a contract in June 2016 to support the data migration efforts for GMM  The agency also implemented a data staging environment in October 2017 to migrate the legacy data and identify opportunities to improve the quality of the data  Further, the GMM system is expected to interface with a total of 38 other systems  These include 19 systems external to DHS (e g , those provided by commercial entities or other federal government agencies) and 19 systems internal to DHS or FEMA  Some of the internal FEMA systems are undergoing their own modernization efforts and will need to be coordinated with GMM, such as the agency’s financial management systems, national flood insurance systems, and enterprise data warehouses  For example, FEMA’s Financial Systems Modernization Program was originally expected to deliver a new financial system in time to interface with GMM  However, the financial modernization has been delayed until after GMM is to be fully implemented; thus, GMM will instead need to interface with the legacy financial system  As a result, GMM is in the process of removing one of its key performance parameters in the acquisition program baseline related to financial systems interoperability and timeliness of data exchanged  In May 2017, DHS approved the acquisition program baseline for GMM  The baseline estimated the total lifecycle costs to be about $251 million, initial operational capability to be achieved by September 2019, and full operational capability to be achieved by September 2020  FEMA intends to develop and deploy its own software applications for GMM using a combination of commercial-off-the-shelf software, open source software, and custom developed code  The agency plans to rely on an Agile software development approach  According to FEMA planning documentation, the agency plans to fully deliver GMM by September 2020 over eight Agile development increments  Agile development is a type of incremental development, which calls for the rapid delivery of software in small, short increments  Many organizations, especially in the federal government, are accustomed to using a waterfall software development model  This type of model typically consists of long, sequential phases, and differs significantly from the Agile development approach  We have previously reported that DHS has sought to establish Agile software development as the preferred method for acquiring and delivering IT capabilities  However, the department has not yet completed critical actions necessary to update its guidance, policies, and practices for Agile programs, in areas such as, developing lifecycle cost estimates, managing IT requirements, testing and evaluation, oversight at key decision points, and ensuring cybersecurity  (See appendix III for more details on the Agile software development approach ) FEMA’s acquisition approach includes using contract support to assist with the development and deployment efforts  The agency selected a public cloud environment to host the computing infrastructure  In addition, from March through July 2017, the agency used a short-term contract aimed at developing prototypes of GMM functionality for grant tracking and monitoring, case management of disaster survivors, grant reporting, and grant closeout  The agency planned to award a second development contract by December 2017 to complete the GMM system (beyond the prototypes) and to begin this work in September 2018  However, due to delays in awarding the second contract to develop the complete GMM system, in January 2018, the program extended the scope and time frames of the initial short-term prototype contract for an additional year to develop the first increment of the GMM system— referred to as the AFG pilot  On August 31, 2018, FEMA awarded the second development contract, which is intended to deliver the remaining functionality beyond the AFG pilot (i e , increments 2 through 8)  FEMA officials subsequently issued a 90-day planning task order for the Agile development contractor to define the work that needs to be done to deliver GMM and the level of effort needed to accomplish that work  However, the planning task order was paused after a bid protest was filed with GAO in September 2018  According to FEMA officials, they resumed work on the planning task order after the bid protest was withdrawn by the protester on November 20, 2018, and then the work was paused again during the partial government shutdown from December 22, 2018, through January 25, 2019  FEMA began working on the AFG pilot—GMM’s first increment—in January 2018  This increment was intended to pilot GMM’s use of Agile development methods to replace core functionality for the AFG system (i e , one of the 10 legacy systems) This system supports three preparedness/fire-related grant programs—Assistance to Firefighters Grants Program, Fire Prevention and Safety Grant Program, and Staffing for Adequate Fire and Emergency Response Grant Program  According to FEMA officials, the AFG system was selected as the first system to be replaced because it is costly to maintain and the DHS OIG had identified cybersecurity concerns with the system  Among the 43 GMM business functions discussed earlier in this report, FEMA officials specified 19 functions to be delivered in the AFG pilot  Figure 4 shows the planned time frames for delivering the AFG pilot in increment 1 (which consisted of four 3-month Agile development sub- increments), as of August 2018  As of August 2018, the program was working on sub-increment 1C of the pilot  In September 2018, GMM deployed its first set of functionality to a total of 19 AFG users—which included seven of 169 total internal AFG users, and 12 of more than 153,000 external AFG users  The functionality supported four of the 19 business functions that are related to the closeout of grants (i e , the process by which all applicable administrative actions and all required work to award a grant have been completed)  This functionality included tasks such as evaluation of final financial reports submitted by grant recipients and final reconciliation of finances (e g , final disbursement to recipients and return of unobligated federal funds)  According to FEMA officials, closeout functionality was selected first for deployment because it was the most costly component of the legacy AFG system to maintain, as it is an entirely manual and labor-intensive process  The remaining AFG functionality and remaining AFG users are to be deployed by the end of the AFG pilot  The GMM program is executed by a program management office, which is overseen by a program manager and program executive  This office is responsible for directing the day-to-day operations and ensuring completion of GMM program goals and objectives  The program office resides within the Office of Response and Recovery, which is headed by an Associate Administrator who reports to the FEMA Administrator  In addition, the GMM program executive (who is also the Regional Administrator for FEMA Region IX) reports directly to the FEMA Administrator  GMM is designated as a level 2 major acquisition, which means that it is subject to oversight by the DHS acquisition review board  The board is chaired by the DHS Undersecretary for Management and is made up of executive-level members, such as the DHS Chief Information Officer  The acquisition review board serves as the departmental executive board that decides whether to approve GMM through key acquisition milestones and reviews the program’s progress and its compliance with approved documentation every 6 months  The board approved the acquisition program baseline for GMM in May 2017 (i e , estimated costs to be about $251 million and full operational capability to be achieved by September 2020)  In addition, the program is reviewed on a monthly basis by FEMA’s Grants Management Executive Steering Group  This group is chaired by the Deputy Administrator of FEMA  Further, DHS’s Financial Systems Modernization Executive Steering Committee, chaired by the DHS Chief Financial Officer, meets monthly and is to provide guidance, oversight, and support to GMM  For government organizations, including FEMA, cybersecurity is a key element in maintaining the public trust  Inadequately protected systems may be vulnerable to insider threats  Such systems are also vulnerable to the risk of intrusion by individuals or groups with malicious intent who could unlawfully access the systems to obtain sensitive information, disrupt operations, or launch attacks against other computer systems and networks  Moreover, cyber-based threats to federal information systems are evolving and growing  Accordingly, we designated cybersecurity as a government-wide high risk area 22 years ago, in 1997, and it has since remained on our high-risk list  Federal law and guidance specify requirements for protecting federal information and information systems  The Federal Information Security Modernization Act (FISMA) of 2014 requires executive branch agencies to develop, document, and implement an agency-wide cybersecurity program to provide security for the information and information systems that support operations and assets of the agency  The act also tasks NIST with developing, for systems other than those for national security, standards and guidelines to be used by all agencies to establish minimum cybersecurity requirements for information and information systems based on their level of cybersecurity risk  Accordingly, NIST developed a risk management framework of standards and guidelines for agencies to follow in developing cybersecurity programs  The framework addresses broad cybersecurity and risk management activities, including categorizing the system’s impact level; selecting, implementing, and assessing security controls; authorizing the system to operate (based on progress in remediating control weaknesses and an assessment of residual risk); and monitoring the efficacy of controls on an ongoing basis  Figure 5 provides an overview of this framework  Prior DHS OIG assessments, such as the annual evaluation of DHS’s cybersecurity program, have identified issues with FEMA’s cybersecurity practices  For example, in 2016, the OIG reported that FEMA was operating 111 systems without an authorization to operate  In addition, the agency had not created any corrective action plans for 11 of the systems that were classified as “Secret” or “Top Secret,” thus limiting its ability to ensure that all identified cybersecurity weaknesses were mitigated in a timely manner  The OIG further reported that, for several years, FEMA was consistently below DHS’s 90 percent target for remediating corrective action plans, with scores ranging from 73 to 84 percent  Further, the OIG reported that FEMA had a significant number of open corrective action plans (18,654) and that most of these plans did not contain sufficient information to address identified weaknesses  In 2017, the OIG reported that FEMA had made progress in addressing security weaknesses  For example, it reported that the agency had reduced the number of systems it was operating without an authorization to operate from 111 to 15 systems  According to GAO’s Business Process Reengineering Assessment Guide and the Software Engineering Institute’s Capability Maturity Model Integration® for Development, successful business process reengineering can enable agencies to replace their inefficient and outmoded processes with streamlined processes that can more effectively serve the needs of the public and significantly reduce costs and improve performance  Many times, new IT systems are implemented to support these improved business processes  Thus, effective management of IT requirements is critical for ensuring the successful design, development, and delivery of such new systems  These leading practices state that effective business process reengineering and IT requirements management involve, among other things, (1) ensuring strong executive leadership support for process reengineering; (2) assessing the current and target business environment and business performance goals; (3) establishing plans for implementing new business processes; (4) establishing clear, prioritized, and traceable IT requirements; (5) tracking progress in delivering IT requirements; and (6) incorporating input from end user stakeholders  Among these six selected leading practices for reengineering business processes and managing IT requirements, FEMA fully implemented four and partially implemented two of them for its GMM program  For example, the agency ensured strong senior leadership commitment to changing the way it manages its grants, took steps to assess and document its business environment and performance goals, defined initial IT requirements for GMM, took recent actions to better track progress in delivering planned IT requirements, and incorporated input from end user stakeholders  In addition, FEMA had begun planning for business process reengineering; however, it had not finalized plans for transitioning users to the new business processes  Further, while GMM took steps to establish clearly defined and prioritized IT requirements, key requirements were not always traceable  Table 3 summarizes the extent to which FEMA implemented the selected leading practices  According to GAO’s Business Process Reengineering Assessment Guide, the most critical factor for engaging in a reengineering effort is having strong executive leadership support to establish credibility regarding the seriousness of the effort and to maintain the momentum as the agency faces potentially extensive changes to its organizational structure and values  Without such leadership, even the best process design may fail to be accepted and implemented  Agencies should also ensure that there is ongoing executive support (e g , executive steering committee meetings headed by the agency leader) to oversee the reengineering effort from start to finish  FEMA senior leadership consistently demonstrated its commitment and support for streamlining the agency’s grants management business processes and provided ongoing executive support  For example, one of the Administrator’s top priorities highlighted in FEMA’s 2014 through 2022 strategic plans was to strengthen grants management through innovative systems and business processes to rapidly and effectively deliver the agency’s mission  In accordance with this strategic priority, FEMA initiated GMM with the intent to streamline and modernize grants management across the agency  In addition, FEMA established the Grants Management Executive Steering Group in September 2015  This group is responsible for transforming the agency’s grants management capabilities through its evaluation, prioritization, and oversight of grants management modernization programs, such as GMM  The group’s membership consists of FEMA senior leaders from across the agency’s program and business support areas, such as FEMA regions, Individual Assistance, Public Assistance, Preparedness, Office of the Chief Financial Officer, Office of Chief Counsel, OCIO, and the Office of Policy and Program Analysis  In this group’s ongoing commitment to reengineering grants management processes, it meets monthly to review GMM’s updates, risks, and action items, as well as the program’s budget, schedule, and acquisition activities  For example, the group reviewed the status of key acquisition activities and program milestones, such as the follow-on award for the pilot contractor and the program’s initial operational capability date  The group also reviewed GMM’s program risks, such as data migration challenges (discussed later in this report) and delays in the Agile development contract award  With this continuous executive involvement, FEMA is better positioned to maintain momentum for reengineering the new grants management business processes that the GMM system is intended to support  GAO’s Business Process Reengineering Assessment Guide states that agencies undergoing business process reengineering should develop a common understanding of the current environment by documenting existing core business processes to show how the processes work and how they are interconnected  The agencies should then develop a deeper understanding of the target environment by modeling the workflow of each target business process in enough detail to provide a common understanding of exactly what will be changed and who will be affected by a future solution  Agencies should also assess the performance of their current major business processes to identify problem areas that need to be changed or eliminated and to set realistically achievable, customer- oriented, and measurable business performance improvement goals  FEMA has taken steps to document the current and target grants management business processes  Specifically, The agency took steps to develop a common understanding of its grants management processes by documenting each of the 12 grant categories  For example, in 2016 and 2017, the agency conducted several nationwide user outreach sessions with representatives from FEMA headquarters, the 10 regional offices, and state and local grant recipients to discuss the grant categories and the current grants management business environment  In addition, FEMA’s Office of Chief Counsel developed a Grants Management Manual in January 2018 that outlined the authorizing laws, regulations, and agency policies for all of its grant programs  According to the Grants Management Executive Steering Group, the manual is intended to promote standardized grants management procedures across the agency  Additionally, the group expects grant program and regional offices to assess the manual against their own practices, make updates as needed, and ensure that their staff are properly informed and trained  FEMA also documented target grants management business process workflows for 18 of the 19 business functions that were notionally planned to be developed and deployed in the AFG pilot by December 2018  However, the program experienced delays in developing the AFG pilot (discussed later in this report) and, thus, deferred defining the remaining business function until the program gets closer to developing that function, which is now planned for August 2019  In addition, FEMA established measurable business performance goals for GMM that are aimed at addressing problem areas and improving grants management processes  Specifically, the agency established 14 business performance goals and associated thresholds in an October 2017 acquisition program baseline addendum, as well as 126 performance metrics for all 43 of the target grants management business functions in its March 2017 test and evaluation master plan  According to FEMA, the 14 business performance goals are intended to represent essential outcomes that will indicate whether GMM has successfully met critical, business-focused mission needs  GMM performance goals include areas such as improvements in the satisfaction level of users with GMM compared to the legacy systems and improvements in the timeliness of grant award processing  For example, one of GMM’s goals is to get at least 40 percent of users surveyed to agree or strongly agree that their grants management business processes are easier to accomplish with GMM, compared to the legacy systems  Program officials stated that they plan to work with the Agile development contractor to refine their performance goals and target thresholds, develop a plan for collecting the data and calculating the metrics, and establish a performance baseline with the legacy systems  Program officials also stated that they plan to complete these steps by September 2019—GMM’s initial operational capability date—which is when they are required to begin reporting these metrics to the DHS acquisition review board  According to GAO’s Business Process Reengineering Assessment Guide, agencies undergoing business process reengineering should (1) establish an overall plan to guide the effort (commonly referred to as an organizational change management plan) and (2) provide a common understanding for stakeholders of what to expect and how to plan for process changes  Agencies should develop the plan at the beginning of the reengineering effort and provide specific details on upcoming process changes, such as critical milestones and deliverables for an orderly transition, roles and responsibilities for change management activities, reengineering goals, skills and resource needs, key barriers to change, communication expectations, training, and any staff redeployments or reductions-in-force  The agency should develop and begin implementing its change management plan ahead of introducing new processes to ensure sufficient support among stakeholders for the reengineered processes  While FEMA has begun planning its business process reengineering activities, it has not finalized its plans or established time frames for their completion  Specifically, as of September 2018, program officials were in the process of drafting an organizational change management plan that is intended to establish an approach for preparing grants management stakeholders for upcoming changes  According to FEMA, this document is intended to help avoid uncertainty and confusion among stakeholders as changes are made to the agency’s grant programs, and ensure successful adoption of new business processes, strategies, and technologies  As discussed previously in this report, the transition to GMM will involve changes to FEMA’s disparate grants management processes that are managed by many different stakeholders across the agency  Program officials acknowledged that change management is the biggest challenge they face in implementing GMM and said they had begun taking several actions intended to support the agency’s change management activities  For example, program officials reported in October 2018 that they had recently created an executive-level working group intended to address FEMA’s policy challenges related to the standardization of grants management processes  Additionally, program officials reported that they planned to: (1) hire additional support staff focused on coordinating grants change management activities; and (2) pursue regional office outreach to encourage broad support among GMM’s decentralized stakeholders, such as state, local, and tribal territories  However, despite these actions, the officials were unable to provide time frames for completing the organizational change management plan or the additional actions  Until the plan and actions are complete, the program lacks assurance that it will have sufficient support among stakeholders for the reengineered processes  In addition, GMM did not establish plans and time frames for the activities that needed to take place prior to, during, and after the transition from the legacy AFG to GMM  Instead, program officials stated that they had worked collaboratively with the legacy AFG program and planned these details informally by discussing them in various communications, such as emails and meetings  However, this informal planning approach is not a repeatable process, which is essential to this program as FEMA plans to transition many sets of functionality to many different users during the lifecycle of this program  Program officials acknowledged that for future transitions they will need more repeatable transition planning and stated that they intend to establish such plans, but did not provide a time frame for when such changes would be made  Until FEMA develops a repeatable process, with established time frames for communicating the transition details to its customers prior to each transition, the agency risks that the transition from the legacy systems to GMM will not occur as intended  It also increases its risk that stakeholders will not support the implementation of reengineered grants management processes  Leading practices for software development efforts state that IT requirements are to be clearly defined and prioritized  This includes, among other things, maintaining bidirectional traceability as the requirements evolve, to ensure there are no inconsistencies among program plans and requirements  In addition, programs using Agile software development are to maintain a product vision, or roadmap, to guide the planning of major program milestones and provide a high-level view of planned requirements  Programs should also maintain a prioritized list (referred to as a backlog) of narrowly defined requirements (referred to as lower-level requirements) that are to be delivered  Programs should maintain this backlog with the product owner to ensure the program is always working on the highest priority requirements that will deliver the most value to the users  The GMM program established clearly defined and prioritized requirements and maintained bidirectional traceability among the various levels of requirements: Grant lifecycle phases: In its Concept of Operations document, the program established six grants management lifecycle phases that represent the highest level of GMM’s requirements, through which it derives lower-level requirements  Business functions: The Concept of Operations document also identifies the next level of GMM requirements—the 43 business functions that describe how FEMA officials, grant recipients, and other stakeholders are to manage grants  According to program officials, the 43 business functions are to be refined, prioritized, and delivered to GMM customers iteratively  Further, for the AFG pilot, the GMM program office prioritized 19 business functions with the product owner and planned the development of these functions in a roadmap  Epics: GMM’s business functions are decomposed into epics, which represent smaller portions of functionality that can be developed over multiple increments  According to program officials, GMM intends to develop, refine, and prioritize the epics iteratively  As of August 2018, the program had developed 67 epics in the program backlog  An example of one of the epics for the AFG pilot is to prepare and submit grant closeout materials  User stories: The epics are decomposed into user stories, which convey the customers’ requirements at the smallest and most discrete unit of work that must be done within a single sprint to create working software  GMM develops, refines, and prioritizes the user stories iteratively  As of August 2018, the program had developed 1,118 user stories in the backlog  An example of a user story is “As an external user, I can log in with a username and password ” Figure 6 provides an example of how GMM’s different levels of requirements are decomposed  Nevertheless, while we found requirements to be traceable at the sprint- level (i e , epics and user stories), traceability of requirements at the increment-level (i e , business functions) were inconsistent among different requirements planning documents  Specifically, the capabilities and constraints document shows that five business functions are planned to be developed within sub-increment 1A, whereas the other key planning document—the roadmap for the AFG pilot—showed one of those five functions as being planned for the sub-increment 1B  In addition, the capabilities and constraints document shows that nine business functions are planned to be developed within sub-increment 1B, but the roadmap showed one of those nine functions as being planned for the sub- increment 1C  Program officials stated that they decided to defer these functions to later sub-increments due to unexpected technical difficulties encountered when developing functionality and reprioritizing functions with the product owners  While the officials updated the roadmap to reflect the deferred functionality, they did not update the capabilities and constraints document to maintain traceability between these two important requirements planning documents  Program officials stated that they learned during the AFG pilot that the use of a capabilities and constraints document for increment-level scope planning was not ideal and that they intended to change the process for how they documented planned requirements for future increments  However, program officials did not provide a time frame for when this change would be made  Until the program makes this change and then ensures it maintains traceability of increment-level requirements between requirements planning documents, it will continue to risk confusion among stakeholders about what is to be delivered  In addition, until recently, GMM’s planning documents were missing up- to-date information regarding when most of the legacy systems will be transitioned to GMM  Specifically, while the program’s planning documents (including the GMM roadmap) provided key milestones for the entire lifecycle of the program and high-level capabilities to be delivered in the AFG pilot, these documents lacked up-to-date time frames for when FEMA planned to transition the nine remaining legacy systems  For example, in May 2017, GMM drafted notional time frames for transitioning the legacy systems, including plans for AFG to be the seventh system replaced by GMM  However, in December 2017, the program decided to reprioritize the legacy systems so that AFG would be replaced first—yet this major change was not reflected in the program’s roadmap  Moreover, while AFG program officials were informed of the decision to transition the AFG program first, in June 2018 officials from other grant programs told us that they had not been informed on when their systems were to be replaced  As a result, these programs were uncertain about when they should start planning for their respective transitions  In August 2018, GMM program officials acknowledged that they were delayed in deciding the sequencing order for the legacy system transitions  Program officials stated that the delay was due to their need to factor the Agile development contractor’s perspective into these decisions; yet, at that time, the contract award had been delayed by approximately 8 months  Subsequently, in October 2018, program officials identified tentative time frames for transitioning the remaining legacy systems  Program officials stated that they determined the tentative time frames for transitioning the legacy systems based on key factors, such as mission need, cost, security vulnerabilities, and technical obsolescence, and that they had shared these new time frames with grant program officials  The officials also stated that, once the Agile contractor begins contract performance, they expect to be able to validate the contractor’s capacity and finalize these time frames by obtaining approval from the Grants Management Executive Steering Group  By taking steps to update and communicate these important time frames, FEMA should be better positioned to ensure that each of the grant programs are prepared for transitioning to GMM  According to leading practices, Agile programs should track their progress in delivering planned IT requirements within a sprint (i e , short iterations that produce working software)  Given that sprints are very short cycles of development (e g , 2 weeks), the efficiency of completing planned work within a sprint relies on a disciplined approach that includes using a fixed pace, referred to as the sprint cadence, that provides a consistent and predictable development routine  A disciplined approach also includes identifying by the start of a sprint which user stories will be developed, developing those stories to completion (e g , fully tested and demonstrated to, and accepted by, the product owner), and tracking completion progress of those stories  Progress should be communicated to relevant stakeholders and used by the development teams to better understand their capacity to develop stories, continuously improve on their processes, and forecast how long it will take to deliver all remaining capabilities  The GMM program did not effectively track progress in delivering IT requirements during the first nine sprints, which occurred from January to June 2018  These gaps in tracking the progress of requirements, in part, had an impact on the program’s progress in delivering the 19 AFG business functions that were originally planned by December 2018 and are now deferred to August 2019  However, beginning in July 2018, in response to our ongoing review, the program took steps to improve in these areas  Specifically, GMM did not communicate the status of its Agile development progress to program stakeholders, such as the grant programs, the regional offices, and the development teams, during most of the first nine sprints  Program officials acknowledged that they should use metrics to track development progress and, in July 2018, they began reporting metrics to program stakeholders  For example, they began collecting and providing data on the number of stories planned and delivered, estimated capacity for development teams, and the number of days spent working on the sprint, as part of the program’s weekly status reports to program stakeholders, such as product owners  Rather than using a fixed, predictable sprint cadence, GMM allowed a variable development cadence, meaning that sprint durations varied from 1 to 4 weeks throughout the first nine sprints  Program officials noted that they had experimented with the use of a variable cadence to allow more time to complete complex technical work  Program officials stated that they realized that varying the sprints was not effective and, in July 2018 for sprint 10, they reverted back to a fixed, 2 week cadence  GMM added a significant amount of scope during its first nine sprints, after the development work had already begun  For example, the program committed to 28 user stories at the beginning of sprint eight, and then nearly doubled the work by adding 25 additional stories in the middle of the sprint  Program officials cited multiple reasons for adding more stories, including that an insufficient number of stories had been defined in the backlog when the sprint began, the realization that planned stories were too large and needed to be decomposed into smaller stories, and the realization that other work would be needed in addition to what was originally planned  Program officials recognized that, by the start of a sprint, the requirements should be sufficiently defined, such that they are ready for development without requiring major changes during the sprint  The program made recent improvements in sprints 11 and 12, which had only five stories added after the start of a sprint  By taking these steps to establish consistency among sprints, the program has better positioned itself to more effectively monitor and manage the remaining IT development work  In addition, this improvement in consistency should help the program avoid future deferments of functionality  Leading practices state that programs should regularly collaborate with, and collect input from, relevant stakeholders; monitor the status of stakeholder involvement; incorporate stakeholder input; and measure how well stakeholders’ needs are being met  For Agile programs, it is especially important to track user satisfaction to determine how well the program has met stakeholders’ needs  Consistent stakeholder participation ensures that the program meets its stakeholders’ needs  FEMA implemented its responsibilities in this area through several means, such as stakeholder outreach activities; development of a strategic communications plan; and continuous monitoring, solicitation, and recording of stakeholder involvement and feedback  For example, the agency conducted nationwide outreach sessions from January 2016 through August 2017 and began conducting additional outreach sessions in April 2018  These outreach sessions involved hundreds of representatives from FEMA headquarters, the 10 regional offices, and state and local grant recipients to collect information on the current grants management environment and opportunities for streamlining grants management processes  FEMA also held oversight and stakeholder outreach activities and actively solicited and recorded feedback from its stakeholders on a regular basis  For example, GMM regularly verified with users that the new functionality met their IT requirements, as part of the Agile development cycle  Additionally, we observed several GMM biweekly requirements validation sessions where the program’s stakeholders were involved and provided feedback as part of the requirements development and refinement process  In addition, FEMA identified GMM stakeholders and tracked its engagement with these stakeholders using a stakeholder register  The agency also defined processes for how the GMM program is to collaborate with its stakeholders in a stakeholder communication plan and Agile development team agreement  Also, while several officials from the selected grant program and regional offices that we interviewed indicated that the program could improve in communicating its plans for GMM and incorporating stakeholder input, most of the representatives from these offices stated that GMM is doing well at interacting with its stakeholders  Finally, in October 2018, program officials reported that they had recently begun measuring user satisfaction by conducting surveys and interviews with users that have utilized the new functionality within GMM  The program’s outreach activities, collection of stakeholder input, and measurement of user satisfaction demonstrate that the program is taking the appropriate steps to incorporate stakeholder input  Reliable cost estimates are critical for successfully delivering IT programs  Such estimates provide the basis for informed decision making, realistic budget formulation, meaningful progress measurement, and accountability for results  GAO’s Cost Estimating and Assessment Guide defines leading practices related to the following four characteristics of a high-quality, reliable estimate  Comprehensive
Report 2:  The number of projects identified in agency Plans ranged from as few as 3 projects (the minimum required in the Plans) to nearly 400 projects  The estimated space reductions per project across agencies ranged from about 1,400 to over 94,000 square feet  For example, the Department of Veterans Affairs has a relatively large office and warehouse portfolio of over 28-million square feet  As part of its fiscal year 2017 Plan, the agency reported 320 planned or ongoing projects with an average space reduction of about 1,800 square feet per project  Conversely, the Office of Personnel Management has a relatively small office space portfolio of about 1-million square feet; its fiscal year 2017 Plan identified 4 ongoing or potential projects with an average space reduction of about 6,000 square feet  In fiscal year 2016—the first and only year RTF data were available at the time of our review—the majority (71 percent or 17 of the 24 agencies) reported they achieved reductions in their office and warehouse space even though the agencies had varying success in achieving the individual targets they set for themselves  For example, as shown in figure 2, of the 17 agencies that reduced space, 9 exceeded their targets (i e , reduced more space than planned); 7 reduced space but missed their target (by anywhere between 2 8 and 96 7 percent); and 1 agency expected to increase in square footage, but reduced space  Whether an agency met its target is not the only indicator of an agency’s success in reducing space  For example, although some agencies missed their targets, they reduced their office and warehouse space by a larger percentage than some agencies that exceeded their targets  Also, the fact that some agencies missed their targets can in part be attributed to setting more aggressive targets than other agencies  Agencies’ fiscal year 2016 targets ranged from a 0 8 percent increase to an 8 4 percent decrease in office and warehouse space  Of the 9 agencies that exceeded their reduction targets, 4 more than tripled their target  As mentioned, agency targets are set by the agency and are a reflection of their unique situation including mission needs and priorities and therefore cannot be generalized across agencies  For example, Energy exceeded its fiscal year 2016 reduction target and reduced 292,140 square feet of space (0 8 percent of its total square footage)  However, the Environmental Protection Agency missed its target, which was the second most aggressive target across all the agencies at 7 2 percent of its total square footage; but the agency reduced 174,003 square feet (3 24 percent of its total square footage)  Of the three agencies with the most aggressive target reductions—those that ranged between 6 7 and 8 4 percent of their total square footage—only one met its target  Figure 3 shows the extent to which each of the CFO Act agencies met its fiscal year 2016 targets  See appendix II for more detailed information on each agencies’ square footage of space, reduction targets and fiscal year 2016 reductions  Officials from our case study agencies cited a number of factors that influenced whether or not they met their fiscal year 2016 targets, and may also affect their target achievement in subsequent years  Of our five case study agencies, three exceeded their fiscal year 2016 reduction target and two missed their target  Timing and funding: Officials from two case study agencies cited timing as a factor, noting that there is fluidity to the project’s planning, implementation, and disposal process that may not always be within an agency’s control  As a result, space reductions anticipated in one fiscal year may not be realized until a subsequent fiscal year; conversely, some space reduction opportunities may present themselves unexpectedly  For example, according to officials at HUD, which missed its fiscal year 2016 reduction target, some projects take longer than anticipated to start or complete  HUD officials said that their fiscal year 2016 target may have been too ambitious and planned projects were delayed because they were unable to secure sufficient funding  As such, the officials said the agency must carefully select which projects to move forward with in a given fiscal year, but expected to move forward with their delayed, planned projects in the next fiscal year  Energy on the other hand, exceeded its fiscal year 2016 reduction target  Energy officials said that they tend to be conservative in listing potential RTF projects in their Plans  They noted that it takes a long time to dispose of a building and the timing was dependent on the building’s level of contamination, location, size, agency budget, and other factors  As a result, even though the agency may have planned to dispose of a building in a given fiscal year, there were numerous reasons why the project may get delayed  Further, RTF is a long-term effort and should not be judged based on agencies’ progress in their first year  According to an OMB official, it is understood that there may be circumstances in a given year that may hinder agencies from reaching their RTF targets, such as budget constraints or the timing of leases; however, the expectation is that agencies will continue to work toward accomplishing their target in the next year  Accordingly, under RTF, agencies set annual space reduction targets for a 5-year period  Officials from our case study agencies emphasized that the 5-year targets are not static, but rather are subject to annual updates  The RTF policy also acknowledged that changes to mission requirements and the availability of budgetary resources may require modifications to an agency’s targets, particularly in each of the subsequent years  Lastly, given that the RTF policy is still relatively recent, an OMB official noted that agencies are still in the process of learning how to set appropriate targets  Previous space reductions: Officials from three of our case study agencies noted that prior space reductions made during the Freeze the Footprint policy limited their ability to reduce space more aggressively  Though the thrust of Freeze the Footprint was to maintain the fiscal year 2012 size of an agency’s portfolio, agencies started to look more strategically for opportunities to dispose of excess space in their portfolios  The majority of agencies (18 of 24) have been decreasing the square footage of their domestic office and warehouse space since the Freeze the Footprint policy was implemented in 2013  OMB reported that under Freeze the Footprint, agencies achieved a 24 7-million square foot reduction between fiscal years 2012 and 2015  Officials from the IRS, which accounts for 70 percent of Treasury’s real property inventory, noted it has released 2 7-million square feet (approximately 10 percent) in the past 5 years, bringing its total square footage down to 25 3 million  According to officials from three of our case study agencies, a certain amount of space is required to effectively fulfill their missions  As such, the closer agencies get to attaining their optimum footprint, their ability to achieve further space reductions may be limited  In November 2016, GSA put into effect a new standard operating procedure to, among other things, standardize and streamline the process of receiving, reviewing, and documenting agencies’ space release actions  As previously mentioned, GSA’s occupancy agreements for space it leases on behalf of its customer agencies generally allow the agencies to release space back to GSA with as little as 4 months’ notice, if certain conditions are met  This can enable agencies to reduce their space and related rent costs relatively quickly without penalty  As a result of this new process, GSA established a centralized e-mail for agencies to submit their space release requests  The e-mail is maintained at GSA headquarters before it is forwarded to the respective GSA region  GSA also developed a centralized space release tracking spreadsheet to help ensure that all GSA regions were (1) notifying the customer agency of GSA’s determination on whether the space release request was within GSA’s policy, and (2) processing the space release and ceasing rent billings in a timely manner  According to GSA headquarters officials, this new process was implemented to rectify past concerns that space release requests were not centrally tracked, GSA regions may not have been making consistent determinations, and some requests either were missed or were not processed within the appropriate time frames  GSA officials noted that GSA similarly manages all vacant space in federally owned property under its custody and control and in commercial space it leases, and the agency seeks to utilize the space as quickly as possible  GSA has 11 regional offices throughout the country that generally conduct the day-to-day real property management activities for its customer agencies  These responsibilities include acquiring, managing, and disposing of real property, as well as executing, renewing, and terminating leases on behalf of its customer agencies in exchange for a monthly fee for GSA’s services  GSA headquarters officials told us that GSA regional offices track all the occupancy agreements and proactively work with customer agencies to help manage their space needs well before the agreements expire to understand ongoing space requirements  For example, according to GSA headquarters officials, this process includes working with agencies at a strategic level and helping them think about how they can accomplish their space needs and meet their targets 4 to 5 years in advance  GSA headquarters and regional officials noted that the advance planning helps the GSA regional officials integrate agencies’ potential space needs into the work they are already doing in the region as GSA manages the regional inventory as a whole, including managing the amount of vacant space  GSA regional officials told us that they work closely with the agencies in their space consolidation and reduction efforts to minimize the likelihood that GSA would be caught off guard by a release of space  This work enables GSA to develop options for either filling vacant space based on the known needs in the region or developing an alternative plan to effectively utilize the unneeded space  One of GSA’s strategic objectives is to improve the federal utilization of space in order to lower the government’s operational costs  To assess progress, GSA has an agency-wide vacant space performance goal of 3 2 percent for its federally-owned and leased inventory (with a 5 percent goal for federally owned and 1 5 percent goal for leased space)  Based on GSA data, the agency has steadily lowered its percentage of vacant space under its custody and control from 3 8 percent in fiscal year 2013 to 3 percent in fiscal year 2016, exceeding its performance goal of 3 2 percent for the first time in 4 years  The vacant space performance goal’s data help GSA evaluate its real property assets and plan for and make investment decisions while meeting its customer’s needs  According to GSA officials, the lower vacant space percentage is a reflection of the agency’s continued focus on working with its customer agencies to: (1) move into federally owned space, when possible; (2) decrease the size of commercially leased space to reduce agency rental costs and overall government reliance on leased space; and (3) dispose of unneeded federally owned assets  However, GSA officials noted that a certain level of vacant space is necessary to meet the space needs of new customers and customers with changing space requirements  According to GSA officials, GSA also tracks and reports annual cost avoidance data for all office and warehouse space reductions  These data include space covered under RTF in federally owned buildings under GSA’s custody and control and commercial space that GSA leases  Cost avoidance is defined as the results of an action taken in the immediate timeframe that will decrease future costs  The government-wide cost avoidance for fiscal year 2016 was $104 million based upon a net 10 7 million square foot reduction to all office and warehouse space  Of the government-wide figure, according to GSA, the total cost avoidance associated with office and warehouse space reductions in federally- owned space under GSA’s custody and control and commercial space GSA leased in fiscal year 2016 was over $75 8 million and 3 1 million square feet  In its cost avoidance calculation, GSA accounts for space returned to it by customer agencies only if there is a net square footage reduction in GSA’s total square footage across all the space that it manages  Similarly, the space returned to GSA does not reduce the federal government’s overall office and warehouse square footage unless GSA disposes of it  However, space that is returned to GSA is reflected as a square footage reduction for the customer agency and contributes toward that agency’s RTF target reduction  According to GSA regional officials, agencies’ requests to return space prior to the end of their occupancy agreements appear to have increased since the implementation of the RTF policy  Thus far, GSA has processes to manage agencies’ space release requests and keep its vacant space to a minimum  However, it is too early to determine how the recent increase in space release requests, in combination with agencies’ continued focus on occupying a smaller footprint and reducing their square footage, will affect: (1) the size of GSA’s inventory of vacant space in the long term, (2) GSA’s regional office workload to manage the requests, and (3) the cost savings for the federal government  We provided a draft of this report to GSA, OMB, Commerce, Energy, HUD, Interior, and Treasury for review and comment  We received technical comments from Energy, which we incorporated, where appropriate  GSA, OMB, Commerce, HUD, Interior, and Treasury did not have comments on our draft report  We are sending copies of this report to the appropriate congressional committees; the Administrator of GSA; the Director of the OMB; the Secretaries of the Departments of Commerce, Energy, HUD, the Interior, and the Treasury; and other interested parties  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions concerning this report, please contact me at (202) 512-2834 or rectanusl@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix III  Our objectives were to determine: (1) the approaches and any challenges the 24 Chief Financial Officers (CFO) Act agencies identified to achieving their Reduce the Footprint (RTF) reduction targets for all their domestic office and warehouse space; (2) the extent to which these agencies reduced space and met their fiscal year 2016 RTF targets; and (3) how the General Services Administration (GSA) manages vacated space that it had leased to these agencies  To obtain background information for all three objectives, we reviewed relevant literature, including laws governing federal real-property management and agencies’ efforts to reduce their real property portfolios and Office of Management and Budget’s (OMB) and GSA’s memorandums and guidance governing the RTF policy  We also reviewed prior GAO and GSA inspector general reports describing agencies’ real-property management and efforts to more efficiently manage their real property portfolios  To determine the approaches used and any challenges faced by the CFO Act agencies in achieving their RTF reduction targets for all their domestic office and warehouse space, we conducted a content analysis of the agencies’ 5-year Real Property Efficiency Plans (Plans) for fiscal years 2016 and 2017  These Plans were obtained directly from each of the agencies  Each Plan describes an agency’s overall strategic and tactical approach in managing its real property, provides a rationale for and justifies its optimum portfolio, and directs the identification and execution of real property disposals, efficiency improvements, general usage, and cost-savings measures  The content analysis of the Plans helped us to understand the approaches agencies used to reduce space, how space- reduction targets were set, and any challenges they experienced in reducing their space  To identify agencies’ approaches to achieving their RTF targets, we reviewed all agencies’ Plans to determine the most frequently mentioned approaches agencies reported using or planned to use to reduce their real-property footprints  As part of their plans, each agency is required to include a section detailing approaches it plans to use to reduce space  While these sections were the primary focus of the analysis, we analyzed the Plans as a whole for any additional mention of agencies’ approaches to reduce space  Based on the frequently identified approaches, codes were developed  An analyst reviewed all the agencies’ Plans and coded the approaches and another analyst reviewed the coding  If there was a disagreement, the two analysts reviewed and discussed until they reached an agreement  As a result of the analysis, five approaches were identified that agencies most frequently reported using or were planning to use to achieve their RTF targets  These five approaches are described in more detail in the report: (1) consolidation; (2) co-location; (3) disposition of unneeded space; (4) better utilization of existing space; and (5) teleworking and hoteling  For the purposes of our report, telework and hoteling were combined because these approaches are often used in combination  For example, agencies can use telework strategically to reduce space needs and increase efficiency by making hoteling (i e , desk sharing) possible  To identify any challenges agencies faced in achieving their RTF targets, we similarly conducted a content analysis of agencies’ fiscal year 2016 and 2017 Plans  As part of their Plans, each agency included a section describing challenges it faced to reducing space  While these sections were the primary focus of the analysis, we analyzed the Plans as a whole for any additional mention of agencies’ challenges  Based on the frequently identified challenges, codes were developed  An analyst went through all the agencies’ Plans to code the challenges and another analyst reviewed the coding  If there was a disagreement, the two analysts reviewed and discussed until they reached an agreement  As a result of the analysis, we identified the four challenges that agencies most frequently described in their Plans: (1) space reduction costs; (2) mission delivery; (3) employee organization concerns; and (4) workload growth  In our report, we relied specifically on agencies’ fiscal year 2016 and 2017 Plans to provide examples and context for our description of the approaches agencies use and challenges they experience in achieving their RTF targets  However, after these Plans were submitted, agencies reported that the specific details as described in their Plans may in some instances, have changed due to a variety of factors  For our case study agencies, to the extent possible, we have provided updated information from agency officials as of December 2017  We selected five agencies as case studies to inform our first two objectives  We selected the agencies using a variety of considerations such as the diversity in the size of the agency’s domestic office and warehouse portfolio, the extent to which the agency met its fiscal year 2016 RTF targets, the types of real property authorities the agency has, as well as suggestions from GSA and OMB related to agencies’ experiences  Based on these factors, we selected the: (1) Department of Commerce (Commerce); (2) Department of Energy (Energy); (3) Department of Housing and Urban Development (HUD); (4) Department of the Interior (Interior); and (5) Department of the Treasury (Treasury)  While our case-study agencies and their experiences reducing their space are not generalizable to all CFO Act agencies, they provide a range of examples of how agencies are implementing the RTF policy  We interviewed officials at the selected agencies as well as GSA and OMB, and reviewed relevant agency real-property management and RTF guidance, to obtain more detailed information about agencies’ RTF approaches, challenges, specific RTF projects, RTF project funding and prioritization, and experiences in meeting their RTF targets  In addition, we visited three office buildings of our case study agencies in Washington, D C , with ongoing or recently completed RTF projects that illustrated approaches the agencies used to reduce space and met with officials to discuss the projects in more detail  The spaces we visited were the headquarters buildings for Commerce, HUD, and Interior  We selected the buildings based on recommendations from officials at our case study agencies  To determine to what extent agencies reduced their space and met their fiscal year 2016 RTF targets, we analyzed the 24 CFO Act agencies’ data as submitted to GSA on their RTF targets and reported reductions for fiscal year 2016  The office and warehouse square footage reductions are calculated annually using GSA occupancy agreement data and agencies’ self-reported data in GSA’s Federal Real Property Profile  For example, for fiscal year 2016, the space reduction calculations based on these data sources at the end of the fiscal year was compared to the square footage reported in fiscal year 2015  At the time of our review, this was the first and only year of RTF data available as the policy was implemented in March 2015  We conducted a data reliability assessment of the RTF data GSA provided by interviewing GSA officials and reviewing documentation, and concluded the data were reliable for our purposes  We also interviewed officials at GSA and OMB and reviewed relevant documentation to learn more about each agency’s role and the requirements of the RTF policy  We interviewed officials from our selected case-study agencies to obtain supporting documentation and to improve our understanding of how agencies set their RTF targets, agencies’ progress toward those targets, and the approaches used and challenges faced in meeting those targets  We also asked the agency officials for examples of successful practices used to reduce their office and warehouse space  To determine how GSA manages vacated federally owned and commercially leased space that it leases to agencies, we reviewed federal requirements and GSA policies and vacancy data  We conducted a data reliability assessment of GSA’s vacancy and cost avoidance data by interviewing GSA officials and reviewing documentation, and concluded the data were reliable for our purposes  We also interviewed GSA headquarters and regional officials and obtained documentation on how GSA manages space returned by agencies  We conducted this performance audit from April 2017 to March 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  FY 2016- FY 2020 target reduction (118,127) Social Security Administration Missed target and increased in space Department of Health and Human Services (170,147) (520,987) (15,466) (47,946) (56,062) In addition to the individual named above, Maria Edelstein (Assistant Director); Lacey Coppage; Edgar Garcia; Delwen Jones; Catherine Kim (Analyst-in-Charge); Michael Mgebroff; Malika Rice; Kelly Rubin; and David Wise made key contributions to this report 

ground_truth: Each year, the DHS invests billions of dollars in a diverse portfolio of major acquisition programs to help execute its many critical missions. DHS's acquisition activities are on GAO's High Risk List, in part, because of management and funding issues. The Explanatory Statement accompanying the DHS Appropriations Act, 2015 included a provision for GAO to review DHS's major acquisitions. This report, GAO's fourth annual review, assesses the extent to which: (1) DHS's major acquisition programs are on track to meet their schedule and cost goals, and (2) DHS has taken actions to enhance its policies and processes to better reflect key practices for effectively managing a portfolio of investments. GAO reviewed 28 acquisition programs, including DHS's largest programs that were in the process of obtaining new capabilities as of April 2017, and programs GAO or DHS identified as at risk of poor outcomes. GAO assessed cost and schedule progress against baselines, assessed DHS's policies and processes against GAO's key portfolio management practices, and met with relevant DHS officials. During 2017, 10 of the Department of Homeland Security (DHS) programs GAO assessed that had approved schedule and cost goals were on track to meet those goals. GAO reviewed 28 programs in total, 4 of which were new programs that GAO did not assess because they did not establish cost and schedule goals before the end of calendar year 2017 as planned. The table shows the status of the 24 programs GAO assessed. Reasons for schedule delays or cost increases included technical challenges, changes in requirements, and external factors. Recent enhancements to DHS's acquisition management, resource allocation, and requirements policies largely reflect key portfolio management practices (see table). However, DHS is in the early stages of implementing these policies. GAO identified two areas where DHS could strengthen its portfolio management policies and implementation efforts: DHS's policies do not reflect the key practice to reassess a program that breaches—or exceeds—its cost, schedule, or performance goals in the context of the portfolio to ensure it is still relevant or affordable. Acquisition management officials said that, in practice, they do so based on a certification of funds memorandum—a tool GAO has found to be effective for DHS leadership to assess program affordability—submitted by the component when one of its programs re-baselines in response to a breach. Documenting this practice in policy would help ensure DHS makes strategic investment decisions within its limited budget. DHS is not leveraging information gathered from reviews once programs complete implementation to manage its portfolio of active acquisition programs. DHS's acquisition policy requires programs to conduct post-implementation reviews after initial capabilities are deployed, which is in line with GAO's key practices. Acquisition management officials said they do not consider the results of these reviews in managing DHS's portfolio because the reviews are typically conducted after oversight for a program shifts to the components. Leveraging these results across DHS could enable DHS to address potential issues that may contribute to poor outcomes, such as schedule slips and cost growth, for other programs in its acquisition portfolio. GAO recommends DHS update its acquisition policy to require certification of fund memorandums when programs re-baseline as a result of a breach and assess programs' post-implementation reviews to improve performance across the acquisition portfolio. DHS concurred with GAO's recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: To help manage its multi-billion dollar acquisition investments, DHS has established policies and processes for acquisition management, requirements development, test and evaluation, and resource allocation  The department uses these policies and processes to deliver systems that are intended to close critical capability gaps, helping enable DHS to execute its missions and achieve its goals  DHS policies and processes for managing its major acquisition programs are primarily set forth in its Acquisition Management Directive 102-01 and Acquisition Management Instruction 102-01-001  DHS issued the initial version of this directive in November 2008 in an effort to establish an acquisition management system that effectively provides required capability to operators in support of the department’s missions  DHS’s Under Secretary for Management is currently designated as the department’s Chief Acquisition Officer and, as such, is responsible for managing the implementation of the department’s acquisition policies  DHS’s Under Secretary for Management serves as the acquisition decision authority for the department’s largest acquisition programs, those with LCCEs of $1 billion or greater  Component Acquisition Executives—the most senior acquisition management officials within each of DHS’s components—may be delegated acquisition decision authority for programs with cost estimates between $300 million and less than $1 billion  Table 1 identifies how DHS has categorized the 28 major acquisition programs we review in this report, and table 7 in appendix III specifically identifies the programs within each level  DHS acquisition management policy establishes that a major acquisition program’s decision authority shall review the program at a series of predetermined acquisition decision events to assess whether the major program is ready to proceed through the acquisition life-cycle phases  Depending on the program, these events can occur within months of each other, or be spread over several years  Figure 1 depicts the acquisition life cycle established in DHS acquisition management policy  An important aspect of an acquisition decision event is the decision authority’s review and approval of key acquisition documents  See table 2 for a description of the type of key acquisition documents requiring department-level approval before a program moves to the next acquisition phase  DHS acquisition management policy establishes that the APB is the agreement between program, component, and department-level officials establishing how systems will perform, when they will be delivered, and what they will cost  Specifically, the APB establishes a program’s schedule, costs, and key performance parameters  DHS defines key performance parameters as a program’s most important and non- negotiable requirements that a system must meet to fulfill its fundamental purpose  For example, a key performance parameter for an aircraft may be airspeed and a key performance parameter for a surveillance system may be detection range  The APB schedule, costs, and key performance parameters are defined in terms of an objective and minimum threshold value  According to DHS policy, if a program fails to meet any schedule, cost, or performance threshold approved in the APB, it is considered to be in breach  Programs in breach are required to notify their acquisition decision authority and develop a remediation plan that outlines a time frame for the program to return to its APB parameters, re-baseline—that is, establish new schedule, cost, or performance goals—or have a DHS-led program review that results in recommendations for a revised baseline  In addition to the acquisition decision authority, other bodies and senior officials support DHS’s acquisition management function: The Acquisition Review Board reviews major acquisition programs for proper management, oversight, accountability, and alignment with the department’s strategic functions at acquisition decision events and other meetings as needed  The board is chaired by the acquisition decision authority or a designee and consists of individuals who manage DHS’s mission objectives, resources, and contracts  The Office of Program Accountability and Risk Management (PARM) is responsible for DHS’s overall acquisition governance process, supports the Acquisition Review Board, and reports directly to the Under Secretary for Management  PARM develops and updates program management policies and practices, reviews major programs, provides guidance for workforce planning activities, provides support to program managers, and collects program performance data  Components, such as U S  Customs and Border Protection, the Transportation Security Administration, and the U S  Coast Guard sponsor specific acquisition programs  The head of each component is responsible for oversight of major acquisition programs once the programs complete delivery of all planned capabilities to end users  Component Acquisition Executives within the components are responsible for overseeing the execution of their respective portfolios  Program management offices, also within the components, are responsible for planning and executing DHS’s individual programs  They are expected to do so within the cost, schedule, and performance parameters established in their APBs  If they cannot do so, programs are considered to be in breach and must take specific steps, as noted above  Figure 2 depicts the relationship between acquisition managers at the department, component, and program level  DHS established a Joint Requirements Council (JRC) to develop and lead a component-driven joint requirements process for the department  The JRC has issued policies outlining a process for analyzing and validating capability gaps, needs, and requirements  The JRC consists of a chair and 14 members who are senior executives or officers that represent key DHS headquarters offices and seven of the department’s operational components  The JRC chair rotates annually among the seven operational components  JRC members represent the views of their components or office leadership, endorse and prioritize validated capability needs and operational requirements (user-defined performance parameters outlining what a system must do), and make recommendations that are supported by analytical rigor  Figure 3 depicts the current headquarters and component members of the JRC  The JRC provides input to two senior-level entities: The Acquisition Review Board—as a member, the JRC chair advises the board on capability gaps, needs, and requirements at key milestones in the acquisition life cycle  The Deputy’s Management Action Group, which the Secretary established in April 2014, is a decision-making body that is chaired by the Deputy Secretary  Its membership consists of the DHS Chief of Staff, DHS Under Secretaries, senior operational component deputies and select support component deputies, and the Chief Financial Officer  The group provides recommendations to the Deputy Secretary for consideration in the annual resource allocation process that reflects DHS’s investment priorities  The group reviews JRC- validated capability needs and recommendations, provides direction and guidance to the JRC, and endorses or directs related follow-on JRC activities  The JRC is responsible for validating proposed capability needs and requirements for all major acquisitions, as well as for programs that are joint or of interest to the Deputy’s Management Action Group, regardless of level  See table 3 for a description of the key requirements documents requiring JRC validation  In general, the DHS requirements development process moves from broad mission needs and capability gaps to operational requirements  See figure 4  In May 2009, DHS established policies that describe processes for testing the capabilities delivered by the department’s major acquisition programs  The primary purpose of test and evaluation is to provide timely, accurate information to managers, decision makers, and other stakeholders to reduce programmatic, financial, schedule, and performance risks  We provide an overview of each of the 28 programs’ test activities in the individual program assessments presented in appendix I  DHS testing policy assigns specific responsibilities to particular individuals and entities throughout the department: Program managers have overall responsibility for planning and executing their programs’ testing strategies, including scheduling and funding test activities and delivering systems for testing  They are also responsible for controlling developmental testing, which is used to assist in the development and maturation of products, manufacturing, or support processes  Developmental testing includes engineering- type tests used to verify that design risks are minimized, substantiate achievement of contract technical performance, and certify readiness for operational testing  Operational test agents are responsible for planning, conducting, and reporting on operational test and evaluation, which is intended to identify whether a system can meet its key performance parameters and provide an evaluation of the operational effectiveness, suitability, and cybersecurity of a system in a realistic environment  Operational effectiveness refers to the overall ability of a system to provide a desired capability when used by representative personnel  Operational suitability refers to the degree to which a system can be placed into field use and sustained satisfactorily  The operational test agents may be organic to the component, another government agency, or a contractor, but must be independent of the developer in order to present credible, objective, and unbiased conclusions  The Director, Office of Test and Evaluation is responsible for approving major acquisition programs’ operational test agent and test and evaluation master plans, among other things  A program’s test and evaluation master plan must describe the developmental and operational testing needed to determine technical performance and operational effectiveness, suitability, and cybersecurity  As appropriate, the Director is also responsible for observing operational tests, reviewing operational test agents’ reports, and assessing the reports  Prior to a program’s acquisition decision event 3, the Director provides the program’s acquisition decision authority a letter of assessment that includes an appraisal of the program’s operational test, a concurrence or non-concurrence with the operational test agent’s evaluation, and any further independent analysis  As an acquisition program proceeds through its life cycle, the testing emphasis moves gradually from developmental testing to operational testing  See figure 5  DHS has established a planning, programming, budgeting, and execution process to allocate resources to acquisition programs and other entities throughout the department  DHS uses this process to produce the department’s annual budget request and multi-year funding plans presented in the FYHSP, a database that contains, among other things, 5-year funding plans for DHS’s major acquisition programs  According to DHS guidance, the 5-year plans should allow the department to achieve its goals more efficiently than an incremental approach based on 1-year plans  DHS guidance also states that the FYHSP articulates how the department will achieve its strategic goals within fiscal constraints  At the outset of the annual resource allocation process, the department’s Offices of Policy and Chief Financial Officer provide planning and fiscal guidance, respectively, to the department’s components  In accordance with this guidance, the components should submit 5-year funding plans to the Chief Financial Officer  These plans are subsequently reviewed by DHS’s senior leaders, including the DHS Secretary and Deputy Secretary  DHS’s senior leaders are expected to modify the plans in accordance with their priorities and assessments, and they document their decisions in formal resource allocation decision memorandums  DHS submits the revised funding plans to the Office of Management and Budget, which uses them to inform the President’s annual budget request—a document sent to Congress requesting new budget authority for federal programs, among other things  In some cases, the funding appropriated to certain accounts in a given fiscal year can be carried over to subsequent fiscal years  Figure 6 depicts DHS’s annual resource allocation process  Federal law requires DHS to submit an annual FYHSP report to Congress at or about the same time as the President’s budget request  This report presents the 5-year funding plans in the FYHSP database at that time  Two offices within DHS’s Office of the Chief Financial Officer support the annual resource allocation process: The Office of Program Analysis and Evaluation (PA&E) is responsible for establishing policies for the annual resource allocation process and overseeing the development of the FYHSP  In this role, PA&E develops the Chief Financial Officer’s planning and fiscal guidance, reviews the components’ 5-year funding plans, advises DHS’s senior leaders on resource allocation issues, maintains the FYHSP database, and submits the annual FYHSP report to Congress  The Cost Analysis Division is responsible for reviewing, analyzing, and evaluating acquisition programs’ LCCEs to ensure the cost of DHS programs are presented accurately and completely, in support of resource requests  This division also supports affordability assessments of the department’s budget, in coordination with PA&E, and develops independent cost estimates for major acquisition programs upon request by DHS’s Under Secretary for Management or Chief Financial Officer  Of the 24 programs we assessed with approved schedule and cost goals, 10 were on track to meet those goals during 2017  The other 14 programs were not on track because they changed or breached their schedule goals, cost goals, or both  We found that most programs updated their cost estimates in response to requirements DHS established in January 2016 that are intended to provide decision makers with more timely information  These actions are in accordance with GAO’s best practice to regularly update cost estimates and we plan to use these updated estimates to measure programs’ cost changes going forward  Based on our April 2014 recommendation, DHS revised the format of its fiscal year 2018–2022 FYHSP report to Congress to include acquisition affordability tables for select major acquisition programs  However, the report shows—and our analysis of programs’ current cost estimates confirms— that some programs face acquisition funding gaps in fiscal year 2018  We also reviewed 4 programs that were early in the acquisition process and planned to establish department-approved schedule and cost goals in calendar year 2017  However, these programs were delayed in getting department approval for their initial APBs for various reasons and, therefore, we excluded them from our assessment of whether programs were on track to meet their schedule and cost goals during 2017  DHS leadership subsequently approved initial APBs for 2 particularly complex and costly programs—a border wall system along the southwest U S  border and the Coast Guard’s Heavy Polar Icebreaker—in January 2018  We plan to assess these programs in next year’s review, but provide more details on all 4 additional programs we reviewed in the individual assessments in appendix I  Table 4 summarizes our findings and we present more detailed information after the table  From January 2017 to January 2018, 10 of the 24 programs we assessed with department-approved APBs were on track to meet their schedule and cost goals  This is fewer than our last annual review in which we found that 17 of the 26 programs we assessed were on track during 2016  Three of the 10 programs on track during 2017 were on track against initial schedule and cost goals; that is, the schedule and cost estimates in the baseline DHS leadership initially approved after the department’s acquisition management policy went into effect in November 2008  The other 7 programs had re-baselined prior to January 2017 and were on track against revised schedules and cost estimates that reflected past schedule slips, cost growth, or both  However, some of the programs on track in 2017 identified risks that may lead to schedule slips or cost growth in the future  For example, officials from the Technology Infrastructure Modernization program told us that staffing challenges may impede their ability to execute the program in accordance with its current APB  We also identified 2 programs that are in the process of re-baselining or plan to re-baseline in the near future to account for significant program changes or to add capabilities  For example, the Next Generation Networks Priority Services program plans to update its APB to establish schedule, cost, and performance goals for the next increment, which is intended to address landline capabilities for providing government officials emergency telecommunication services  During 2017, 14 of the 24 programs we assessed with department- approved APBs were not on track  Twelve of these programs had at least one major acquisition milestone that slipped, including 6 of these programs that also changed or breached their cost goals  Two additional programs changed or breached only their cost goals  As of January 2018, 6 of the 12 programs that experienced a schedule slip were in breach and had not yet revised their goals  Therefore, the magnitude of the schedule slips is unknown  For the remaining 6 programs, the change in schedule during 2017 ranged from a delay of 6 months to 66 months  Figure 7 identifies the programs that experienced schedule slips and the extent to which their major milestones slipped in 2017, as well as—for additional context—in prior years  While there are various reasons for schedule delays, the result is that end users may not get needed capabilities when they originally anticipated  Examples of the reasons why these key milestones slipped in 2017 include the following: New requirements: For example, the Passenger Screening Program re-baselined in May 2017 for the fifth time since its initial APB was approved in January 2012  This latest re-baseline was to remediate a 17-month breach caused by delays in incorporating new cybersecurity requirements in one of the program’s transportation security equipment technologies, known as the Credential Authentication Technology  The program now plans to achieve full operational capability for this system by December 2023—more than 9 years later than it initially planned  In another example, the Tactical Communications Modernization program re-baselined in November 2017—4 months after the program notified DHS leadership that it would not achieve full operational capability as planned  The reason for this re-baseline was to resolve issues related to federal information security requirements  The program now plans to achieve this milestone by March 2019, which is more than a year later than its initial APB threshold  Technical challenges: For example, the Continuous Diagnostics and Mitigation program re-baselined in June 2017 to account for significant coverage gaps identified during the deployment of phase 1 sensors and to establish cost, schedule, and performance goals for phase 3 tools  The program’s full operational capability date slipped almost 4 years after this milestone was redefined as the point in time at which phase 1–3 tools are available to all participating civilian agencies  Additionally, the Automated Commercial Environment program declared a schedule breach in April 2017—its second in less than a year—after encountering difficulties developing its remaining functionality  These difficulties have caused further delays to the program’s final acquisition milestone decision  External factors: Officials from the Logistics Supply Chain Management System program notified DHS leadership in September 2017 that the program would not complete all required activities to achieve acquisition decision event 3 and subsequent events, including full operational capability  The primary reason for the delay was because program staff were deployed to support response and recovery efforts during the 2017 hurricane season  Additionally, the Medium Lift Helicopter program experienced delays in getting key acquisition documents approved in time to achieve its acquisition decision event 3  These delays were attributed, in part, to DHS leadership directing Customs and Border Protection to develop a comprehensive border plan that included the helicopter’s capabilities  We elaborate on the reasons for all 12 programs’ schedule slips in the individual assessments in appendix I  Of the 14 programs not on track during 2017, 8 revised or breached their established cost goals  Four of these 8 programs revised their cost goals when they re-baselined to address new requirements and technical challenges, among other things  When the Passenger Screening Program re-baselined in May 2017, the program’s APB threshold for its life-cycle costs increased $418 million (8 percent) over its previous APB  However, the revised threshold is $1 billion below the threshold established in the program’s initial APB, which was approved in January 2012  From 2012 to 2015, the program’s scope was reduced in response to funding constraints  However, emerging threats drove the program to increase capability requirements, which has subsequently increased costs  When the Continuous Diagnostics and Mitigation program re- baselined in June 2017, the APB threshold for life-cycle costs decreased by $15 million (1 percent)  However, the program shifted some acquisition costs to operations and maintenance (O&M) to be consistent with DHS’s new common appropriations structure  This, in addition to other changes, increased the APB threshold for O&M by $631 million (3,712 percent)  When the National Security Cutter program re-baselined in November 2017 to account for a ninth ship—as directed by Congress—the APB cost thresholds for acquisition and O&M increased by $453 million (8 percent) and $123 million (1 percent), respectively  When the Immigration and Customs Enforcement’s TECS Modernization program re-baselined in November 2017 in preparation for acquisition decision event 3, the APB cost thresholds increased overall  Specifically, the acquisition cost threshold decreased by $14 million (6 percent) when the program included actual costs through fiscal year 2016, among other things, and the O&M cost threshold increased by $147 million (92 percent) when the program extended the estimate by 4 years and included support costs for an additional 11 years  The other 4 programs breached their established cost goals during 2017  The Medium Lift Helicopter and Electronic Baggage Screening programs breached certain APB cost thresholds when they shifted costs between categories, such as O&M to acquisitions or vice versa, to be consistent with DHS’s new common appropriations structure  The Tactical Communications Modernization program experienced a cost breach primarily because of increases in costs for contractor labor and support for facilities and infrastructure  The program’s APB cost threshold for O&M increased by $110 million (23 percent) when it re-baselined in November 2017  The Automated Commercial Environment program experienced a cost breach because it had to extend its contracts to address the development difficulties discussed above  The magnitude of the program’s cost goal changes is not yet known because the program does not plan to revise its APB until August 2018  We elaborate on the reasons for all 8 programs’ cost goal changes or breaches in the individual program assessments in appendix I  In January 2016, based on several of our past recommendations, DHS required major acquisition programs to begin submitting to headquarters (1) detailed data on program affordability, such as updates to the program’s LCCE and funding source information, to help inform the department’s annual resource allocation process, and (2) an annual LCCE update  These requirements are intended to provide more timely information that may improve DHS’s efforts to address acquisition program affordability issues, as well as internal and external oversight of programs’ progress against its cost goals  These actions are in accordance with GAO’s cost estimating best practices, which state that cost estimates should be updated with actual costs so that they are always relevant and current  As a result, we have used these sources to provide the programs’ current estimate in the individual assessments in appendix I, as appropriate, and plan to use these data sources to measure programs’ cost changes going forward  According to officials from the Cost Analysis Division, a program’s annual LCCE update should inform the affordability submission to support the annual resource allocation process and can be completed at any point during the fiscal year leading up to this process  We examined documentation to ascertain whether the programs we reviewed complied with the two requirements  For the 24 programs we assessed with department-approved APBs, we found the following: All 24 programs submitted the detailed data on program affordability to headquarters by June 2017 to inform the fiscal year 2019 resource allocation cycle  Most programs’ submissions accounted for changes since the program’s last LCCE was approved by DHS’s Chief Financial Officer, except three  For example, the Long Range Surveillance Aircraft program’s submission reflected no updates from its November 2011 LCCE because the program was in the process of re-baselining to account for significant changes  The program began re-baselining nearly 3 years ago and has been delayed for various reasons, including challenges with the vendor hired to complete a revision of the program’s LCCE  Eighteen of the 24 programs submitted annual LCCE updates  Three programs—Automated Commercial Environment, H-65, and Transformation—did not submit an annual LCCE update because they were in breach  The other 3 programs—all within the Coast Guard—did not submit an annual LCCE because, according to Coast Guard officials, they have limited internal cost estimating capability and rely on outside sources for this service, which led to delays in completing the annual LCCEs for these programs  Coast Guard officials said they are reviewing options to resolve these delays and improve the Coast Guard’s cost estimating capability  Cost Analysis Division officials anticipate the Coast Guard will increase compliance with the annual LCCE requirement in fiscal year 2018  They also plan to update the annual LCCE template to include additional information, such as comparisons of the updated estimates to the program’s APB cost goals and projected funding  In addition, DHS revised the format of its FYHSP report to Congress, improving insight into major programs’ acquisition funding, but decreasing insight into O&M funding  In April 2014, we found that DHS could better communicate its funding needs for acquisition programs to Congress and recommended that DHS enhance the content for future FYHSP reports by presenting programs’ annual cost estimates and any anticipated funding gaps, among other things  DHS concurred with the recommendation and, for the first time, included acquisition affordability tables that presented programs’ annual acquisition cost estimates compared to projected acquisition funding for select major acquisition programs in its FYHSP report for fiscal years 2018–2022  However, DHS no longer reported O&M funding for individual programs  DHS reported in the FYHSP that it focused on acquisition information because O&M funding estimates are generally stable year-to-year and components manage O&M in various ways, such as by individual program or across a portfolio of programs  By removing O&M funding information in the FYHSP for all programs, DHS presents an incomplete picture of programs’ full funding needs and affordability  In April 2018, we assessed the extent to which DHS had accounted for O&M costs and funding in greater detail and recommended that DHS reverse the exclusion of O&M funding at the acquisition program level in its FYHSP report to Congress for all components  DHS officials stated that they plan to re-introduce O&M funding for major acquisition programs in the FYHSP report for fiscal years 2019–2023 based on multiple internal discussions about the best way to present a more comprehensive view of programs’ total costs and feedback from key stakeholders, such as the Office of Management and Budget  Based on the information presented in the FYHSP report for fiscal years 2018–2022, DHS’s acquisition portfolio is not affordable over the next 5 years  For example, the report contained acquisition affordability tables for 18 of the 24 programs we assessed that have approved APBs  Of these 18 programs, 9 were projected to have an acquisition affordability gap in fiscal year 2018  However, some of these projections are outdated since the FYHSP report—which was issued in September 2017—relied on cost information as of April 2016  Therefore, we updated these tables using the programs’ current acquisition cost estimate presented in the individual assessments in appendix I  Based on our assessment of programs’ current cost estimates, we also found that a total of 9 programs are projected to have an acquisition affordability gap in fiscal year 2018  However, 3 of these 9 programs were different programs than those identified based on the FYHSP report  Of the 9 programs we identified with a projected acquisition affordability gap in fiscal year 2018, we found the following: Five programs identified other funding, such as funding from previous fiscal years that remained available for obligation—known as carryover funding—which would address their projected acquisition funding gap  For example, in the FYHSP report, DHS projected allocating approximately $16 million in funding for the Technology Infrastructure Modernization program in fiscal year 2018 to cover an estimated $16 million in acquisition costs  However, in its November 2017 annual LCCE update, this program’s acquisition cost increased to almost $30 million, resulting in a projected acquisition affordability gap of almost 45 percent  The program plans to realign $57 million in O&M carryover funding to cover this and any future acquisition shortfalls  Four programs did not identify other funding that would address their projected acquisition funding gap, which increases the likelihood that they will cost more and take longer to deliver capabilities to end users than expected  For example, in the FYHSP report, DHS projected allocating $109 million in funding for the Non-Intrusive Inspection Systems program in fiscal year 2018 to cover an estimated $103 million in acquisition costs  However, in its April 2017 annual LCCE update, this program’s acquisition costs increased to nearly $186 million, resulting in a projected acquisition affordability gap of 41 percent  The program identified only $2 5 million in fiscal year 2017 acquisition carryover funding  Further, 5 of the 24 programs we assessed were not included in the fiscal years 2018–2022 FYHSP report because they were no longer expected to receive acquisition funding  Officials from 3 of these 5 programs projected funding gaps that could cause future program execution challenges, such as schedule slips or cost growth  For example, the National Bio and Agro-Defense Facility anticipates a projected funding shortfall of approximately $90 million over the next 5 years, which officials said could delay a number of activities to make the facility operational  We elaborate on programs’ affordability over the next 5 years in the individual program assessments in appendix I  We assessed DHS’s policies outlining the department’s processes for acquisition management, resource allocation, and requirements and found that, when considered collectively, they generally reflect key portfolio management practices  In March 2007, we examined the practices that private sector entities use to achieve a balanced mix of new projects and found that successful commercial companies use a disciplined and integrated approach to prioritize needs and allocate resources when making investments  This approach, known as portfolio management, requires companies to view each of their investments as contributing to a collective whole, rather than as independent and unrelated  With this perspective, companies can effectively (1) identify and prioritize opportunities, and (2) allocate available resources to support the highest priority—or most promising—opportunities  Based on this and other work, we identified four key practice areas for portfolio management in September 2012  We previously assessed DHS’s acquisition management and resource allocation policies against our key portfolio management practices in September 2012 and April 2014, respectively  We found that the policies in place at the time of our reviews did not fully reflect all of the key portfolio management practices and recommended that DHS revise its policies to do so  DHS concurred with our recommendations and subsequently took actions to mature and solidify the department’s portfolio management processes and policies  In April 2014, the Secretary of Homeland Security issued a memorandum titled Strengthening Departmental Unity of Effort, which aimed to strengthen DHS’s structures and processes to improve departmental cohesiveness and operational effectiveness, among other things  The memorandum identified several initial focus areas intended to build organizational capacity, one of which centered on improving and integrating the department’s processes for acquisition oversight, resource allocation, and joint requirements analysis  To improve these processes, the memorandum directed senior DHS leaders to update the existing acquisition management and resource allocation processes, as well as lead an expedited review to provide alternatives for developing and facilitating a component-driven joint requirements process, which ultimately led to the re-establishment of the JRC  In response to our recommendations and the Unity of Effort memorandum, DHS issued new policies outlining the acquisition management, resource allocation, and requirements processes in 2016  We assessed these policies and found that, when considered collectively, they generally reflect the key portfolio management practices, as shown in table 5  Because DHS’s new policies were issued in 2016, we did not specifically assess DHS’s implementation of them  However, we did review documentation resulting from the acquisition management, resource allocation, and requirements processes since January 2016 to get a sense of how the department began implementation  Examples of how DHS’s policies reflect the key portfolio management practices and their implementation status are outlined below  Clearly define and empower leadership: the policies identify the roles and responsibilities for decision makers in the acquisition management, resource allocation, and requirements processes, as well as establish cross-functional teams to support those decision makers  For example, to fulfill the role of acquisition decision authority, the Under Secretary for Management is supported by the Acquisition Review Board, which consists of key DHS senior leaders responsible for managing the department’s finances, contracts, and testing, among other things  We reviewed the memorandums issued since January 2016 that document Acquisition Review Board decisions and found that, through this group, DHS has taken steps to manage across programs through its acquisition management process  For example, after reviewing the status of several individual Customs and Border Protection programs in 2016, the Acquisition Review Board identified the need for a comprehensive border plan that depicts the component’s current land, maritime, and air domain awareness capabilities  In October 2016, the Deputy Under Secretary for Management—who was serving as acquisition decision authority at the time—directed Customs and Border Protection to develop such a plan  The plan is to consist of separate analyses for each of the three domains—starting with land— that reflect end users’ capability requirements for systems, such as Integrated Fixed Towers, Multi-Role Enforcement Aircraft, and Medium Lift Helicopter, that address relevant domain threats  As of February 2018, Customs and Border Protection had not yet completed the analysis for land domain awareness capabilities  Establish standard assessment criteria and demonstrate comprehensive knowledge of the portfolio: the policies establish standard criteria for assessing major acquisition programs through the acquisition management, resource allocation, and requirements processes  For example, the updated resource allocation handbook established that PA&E conduct annual assessments of all major investments using standard criteria in five main categories— contribution to DHS’s mission, program health, risk, resources, and governance—to assess the portfolio of investments and present alternatives for leadership decision  PA&E officials told us they used these criteria when assessing components’ resource allocation requests during development of the President’s fiscal year 2018 budget to develop funding options for the Deputy’s Management Action Group, which is responsible for making resource allocation recommendations for the Secretary’s approval  PA&E presented its funding options by DHS mission, which, according to officials associated with the Deputy’s Management Action Group, allowed the group to make cross-component allocation decisions that directly aligned with the department’s strategic goals  We could not verify these officials’ assertions based on the documentation we were provided, but will continue to monitor PA&E’s assessment of major acquisition programs against the standard criteria as the department’s implementation of its resource allocation policies matures  In addition, PARM formally established its Acquisition Program Health Assessments in October 2016 after more than a year of development and pilot efforts  These assessments are intended to monitor major acquisition programs quarterly (both on an individual program level and in aggregate) by rating programs against standard criteria in several categories—such as program management, financial management, and human capital—that DHS deemed important for successful program execution  We reviewed the quarterly reports issued from January 2016 to April 2017 and found that they primarily focused on individual programs  The portfolio-level information contained in these reports was limited to program results grouped in various categories, such as by component, by acquisition life-cycle phase, and by investment type (e g , information technology)  PARM officials said they plan to use the health assessments as a portfolio management tool in the future and are working to determine how to best to analyze and present portfolio-level data  We will continue to track PARM’s implementation of the health assessment process moving forward through GAO’s High Risk work to determine DHS’s progress in demonstrating that major acquisition programs are on track to achieve their established goals  Prioritize investments by integrating the requirements, acquisition, and budget processes: the policies identify areas where DHS’s requirements, acquisition management, and resource allocation processes are integrated and establish processes for prioritizing investments  For example, the updated resource allocation policies require reviews of DHS’s major acquisition portfolio during this annual process  When the portfolio faces a funding gap, programs are to be returned to their respective components for scope or funding adjustments, or prioritized by department leadership to identify an affordable set of programs  For the fiscal year 2018 resource allocation cycle, PA&E officials provided an example where DHS leadership directed components to identify funding from alternative sources to fund specific purposes related to DHS’s mission to prevent terrorism and enhance security  However, as previously discussed, the resulting FYHSP report for fiscal years 2018–2022 showed that DHS’s portfolio of major acquisition programs is not affordable over the next 5 years  In addition, the requirements policies established the Joint Assessment of Requirements, an annual process to prioritize emerging and existing requirements to inform the department’s resource allocation decisions  As we found in October 2016, the JRC plans to implement the Joint Assessment of Requirements through a 3-year phased approach that is expected to be fully implemented in time to inform DHS’s fiscal year 2021 budget request  In fiscal year 2016, the JRC completed the first phase, which included (1) developing initial criteria to evaluate emerging requirements, and (2) evaluating and prioritizing a sample of those requirements against the initial criteria  Based on these results, JRC officials told us in September 2017 that they are working to develop assessment metrics for the criteria as part of the next phase  We will continue to track the JRC’s progress through GAO’s High Risk work to determine DHS’s progress to effectively operate the JRC  Continually make go/no go decisions to rebalance the portfolio: the requirements policies outlining the Joint Assessment of Requirements process also reflected the key practices to conduct reviews (1) annually to make requirement scoping adjustments as priorities change and (2) when new investments are identified  However, as previously discussed, the JRC is still in the process of implementing this process  We consider this overall key practice area to be partially met because DHS’s policies do not reflect the key practice (3) to reassess programs that breach established thresholds within the context of the portfolio to determine if the program remains relevant and affordable  PARM officials told us that—in practice—DHS reassesses programs in the context of their component’s overall acquisition portfolio based on a certification of funds memorandum submitted to DHS’s Chief Financial Officer when programs re-baseline as a result of a cost, schedule, or performance breach  The memorandum is intended to enable the Acquisition Review Board to discuss affordability by certifying a program’s funding levels and identifying trade-offs necessary to address any projected funding gaps  We previously found that the certification of funds memorandum was an effective tool for DHS leadership to assess program affordability  However, DHS’s acquisition management policy requires components to submit this memorandum prior to most acquisition decision events, but not when a program re-baselines as a result of a cost, schedule, or performance breach  During our review of programs’ progress against schedule and cost goals in 2017, we found one instance where a component did not follow the practice to submit this memorandum when one of its programs re-baselined as a result of a breach  Specifically, Customs and Border Protection did not submit a certification of funds memorandum when the Tactical Communications Modernization program re-baselined in November 2017 as a result of a schedule and cost breach  Nevertheless, DHS leadership approved the program’s revised APB and removed it from breach status, even though DHS’s Chief Financial Officer identified that the program’s revised LCCE was not affordable  PARM officials stated that this instance was an oversight because, at the time, the department was still determining when certification of funds memorandums should be submitted  According to the federal standards for internal control, documentation of internal control practices is necessary so that they can be implemented effectively  By amending its acquisition management policy to require a certification when a program re-baselines as a result of a cost, schedule, or performance breach, DHS can ensure that leadership receives the necessary information to reassess that program’s affordability in the context of a larger portfolio  PARM officials stated that, moving forward, components will be required to submit a certification of funds memorandum for each program when a new APB is submitted for DHS leadership approval  In contrast, the acquisition management policy does reflect the key practice (4) to use information gathered from post-implementation reviews to fine tune investment processes and the portfolio to achieve strategic outcomes  For example, DHS’s acquisition management policy requires programs to conduct post-implementation reviews 6 to 18 months after initial operational capability to identify and document any deployment or implementation and coordination issues, how they were resolved, and how they could be prevented in the future  These reviews are intended to help identify capability gaps that may inform future acquisitions, among other things  However, PARM officials said that they do not consider the results of the post-implementation reviews when managing the department’s current acquisition portfolio because these reviews are typically conducted after program oversight shifts from PARM to the component  While post-implementation reviews are conducted later in the acquisition life cycle, the insights they provide could be leveraged by other programs in the acquisition portfolio, not just the program under review  For example, the Integrated Fixed Towers program completed a post-implementation review in June 2016 after its initial deployment of capabilities to the Arizona border  The review found that changes in illegal traffic patterns as a result of the program’s deployment may be predicted, and other technologies may be able to compensate for changes in these patterns  This information could help other programs under development plan for similar outcomes or enable DHS to change deployment plans for existing programs to address changes in threats  PARM has an opportunity to use the results from programs’ post- implementation reviews since it is responsible for overseeing the department’s acquisition portfolio by monitoring each investment’s cost, schedule, and performance against established baselines  Federal standards for internal control state that management should obtain data on a timely basis so that they can be used for effective monitoring and that separate evaluations may provide feedback on the effectiveness of ongoing monitoring  By leveraging the results from post-implementation reviews in its monitoring efforts, PARM may be better able to ensure that programs in the current acquisition portfolio achieve their baselines  PARM officials stated they have generally focused on leveraging information gathered from canceled acquisition programs, such as where and why plans went wrong  However, they agreed that they could better leverage post- implementation review information gathered from programs that complete planned capability deployments  DHS’s mission to safeguard the American people and homeland requires a broad portfolio of acquisitions  However, the performance of DHS’s major acquisition portfolio during 2017 did not improve compared to our last review because we found that more programs will require more time and may require more money to complete than initially planned  DHS is collecting more timely cost estimate information on its acquisition programs to make more informed investment decisions  Yet DHS continues to face challenges in funding its acquisition portfolio, which highlights the need for disciplined policies that reflect best practices to ensure that the department does not pursue more programs than it can afford  DHS leadership has taken positive steps in recent years by strengthening its policies for acquisition management and resource allocation, and establishing policies related to requirements  Collectively, these policies reflect an integrated approach to managing investments  However, opportunities remain to further strengthen the acquisition management policy by documenting DHS’s current practice to reassess programs that breach their established cost, schedule, or performance thresholds to ensure they are still worth pursuing within the context of the portfolio  Additionally, leveraging information learned once programs complete deployment across the acquisition portfolio could help ensure that programs stay on track against their baselines in the first place  This is particularly relevant because DHS is initiating a number of complex and costly acquisition programs, such as development of a wall system along the southwest border and the Coast Guard’s Heavy Polar Icebreaker, which could benefit from this type of information  We are making the following two recommendations to DHS: The Under Secretary for Management should update DHS’s acquisition management policy to require components to submit a certification of funds memorandum when a major acquisition program re-baselines in response to a breach  (Recommendation 1) The Under Secretary for Management should require PARM to assess the results of major acquisition programs’ post-implementation reviews and identify opportunities to improve performance across the acquisition portfolio  (Recommendation 2) We provided a draft of this report to DHS for review and comment  In its comments, reproduced in appendix IV, DHS concurred with both of our recommendations and identified actions it planned to take to address them  DHS also provided technical comments, which we incorporated as appropriate  We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security  In addition, the report is available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix V  This appendix presents individual assessments for each of the 28 programs we reviewed  Each assessment presents information current as of January 2018  They include standard elements, such as an image, a program description, and summaries of the program’s progress in meeting cost and schedule goals, performance and testing activities, and program management-related issues, such as staffing  Each assessment also includes the following figures: Fiscal Years 2018–2022 Affordability  This figure compares the funding plan presented in the Future Years Homeland Security Program report to Congress for fiscal years 2018–2022 to the program’s current cost estimate  We use this funding plan because the data are approved by the Department of Homeland Security (DHS) and Office of Management and Budget, and was submitted to Congress to inform the fiscal year 2018 budget process  The figure only presents acquisition funding because DHS did not report operations and maintenance (O&M) funding for individual programs in its funding plan to Congress  In addition, the data do not account for other potential funding sources, such as carryover  Acquisition Program Baseline (APB) vs  Current Estimate  This figure compares the program’s cost thresholds from the initial APB approved after DHS’s acquisition management policy went into effect in November 2008 and the program’s current DHS-approved APB to the program’s expected costs as of January 2018  The source for the current estimate is the most recent cost data we collected (i e , a department-approved life-cycle cost estimate, updated life-cycle cost estimates submitted during the resource allocation process to inform the fiscal year 2019 budget request, or a fiscal year 2017 annual life- cycle cost estimate update)  Schedule Changes  This figure consists of two timelines that identify key milestones for the program  The first timeline is based on the initial APB DHS leadership approved after the department’s current acquisition management policy went into effect  The second timeline identifies when the program expected to reach its major milestones as of January 2018 and includes milestones introduced after the program’s initial APB  Dates shown are based on the program’s APB threshold dates or updates provided by the program office  Test Status  This table identifies key recent and upcoming test events  It also includes DHS’s Director, Office of Test and Evaluation’s assessment of programs’ test results, if an assessment was conducted  Staffing Profile  This figure identifies the total number of staff a program needs (measured in full time equivalents) including how many are considered critical and how many staff the program actually has  Lastly, each program assessment summarizes comments provided by the program office and identifies whether the program provided technical comments  AUTOMATED COMMERCIAL ENVIRONMENT (ACE) CUSTOMS AND BORDER PROTECTION (CBP) The ACE program is developing software that will electronically collect and process information submitted by the international trade community  ACE is intended to provide private and public sector stakeholders access to information, enhance the government’s ability to determine whether cargo should be admitted into the United States, and increase the efficiency of operations at U S  ports by eliminating manual and duplicative trade processes, and enabling faster decision making  Final deployment and operational testing of ACE functionality delayed  Program plans to identify an approach to address collections functionality in March 2018  We last reported on this program in March 2018 and April 2017 (GAO-18-271, GAO-17-346SP)  CBP declared a cost and schedule breach in April 2017—5 months after re-baselining the program in response to a prior breach—because of difficulties developing the collections aspect of ACE’s remaining functionality, which collects and processes duties owed on imported goods  CBP reported that its officials were not versed in the complexities of collections in the legacy system and underestimated the level of effort required to integrate collections capabilities into ACE  As a result, the program delayed final deployment of ACE functionality several times and missed the deadlines for completing the remaining milestones in its current acquisition program baseline (APB), including achieving acquisition decision event (ADE) 3 and full operational capability (FOC) by the revised dates of June 2017 and September 2017, respectively  Additional coding and testing to complete ACE development also required contract extensions that exceeded the current APB cost thresholds  The program subsequently decoupled collections from ACE’s remaining functionality to permit deployment of the other post-release capabilities—such as liquidations and reconciliation—using a phased approach between September 2017 and February 2018  In November 2017, CBP officials estimated that efforts to decouple collections from post-release functionality would be an additional $32 million in acquisition costs  CBP officials plan to cover these costs with $18 million in fiscal year 2017 carryover funding and by reprogramming $14 million from ACE disaster recovery funding  CBP is in the process of determining a path forward for collections, which is due to Department of Homeland Security (DHS) leadership by the end of March 2018  CBP then plans to update the program’s acquisition documentation, including APB and life- cycle cost estimate, by August 2018  Until then, the time frame for completing ACE’s remaining milestones and true cost of the program, including the cost to complete collections development is unknown  The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs  CBP officials anticipate receiving approximately $535 million in O&M funding over this 5-year period  Customs and Border Protection (CBP) AUTOMATED COMMERCIAL ENVIRONMENT (ACE) When DHS leadership re-baselined ACE’s cost, schedule, and performance parameters in 2013, the program adopted an agile software development methodology to accelerate software creation and increase flexibility in the development process  As of October 2017, the ACE program office oversees 11 agile teams that conduct development and O&M activities  CBP officials said they extended the program’s agile development contracts in 2017 to permit further development of the collections function  In identifying a path forward for collections, CBP officials stated there are three main options: 1  leave collections in the legacy system, 2  continue to pursue development and deployment in ACE, or 3  move collections to a different program altogether  The program previously experienced a schedule breach in June 2016 because it delayed events to address external stakeholders’ concerns about transitioning to ACE  According to CBP officials, CBP has signed a memorandum of understanding with each of the 22 partner agencies responsible for clearing or licensing cargo that provides access to ACE  As of February 2018, 21 of the partner agencies had transitioned to ACE and the program was piloting a solution for the remaining partner  In September 2017, CBP reported that ACE continued to lack a director of testing and evaluation  CBP officials said they do not plan to fill this vacancy despite plans to conduct further testing because existing staff have successfully covered the workload and a large portion of testing has already been completed  CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  CUSTOMS AND BORDER PROTECTION (CBP) The Biometric Entry-Exit Program is developing capabilities to enhance traveler identification upon departure from the U S  at air, land, and sea ports of entries by collecting biometric data, such as fingerprints and facial recognition  The program plans to match this data to biometric data obtained from travelers upon their arrival into the U S  to identify foreign nationals that stay in the U S  beyond their authorized periods of admission and verify the identities of travelers leaving the U S  CBP completed four biometric pilot programs and selected a solution for development  DHS has explored biometric exit capabilities since 2009, but was directed to expedite implementation in March 2017  GAO last reported on this program in February 2017 (GAO- 17-170)  In June 2017, the Department of Homeland Security’s (DHS) Under Secretary for Management (USM) granted the Biometric Entry-Exit Program acquisition decision event (ADE) 1 approval after CBP completed several pilot initiatives to study the feasibility of proposed biometric exit solutions at air and land ports of entry  The USM also authorized the program to continue testing a pilot exit solution at Hartsfield-Jackson Atlanta International Airport and conduct technology demonstrations as needed, but directed the program to achieve ADE 2A prior to deploying a solution to the 20 U S  airports with the most international flights  CBP officials initially planned to achieve ADE 2A approval in September 2017—the point at which the program would establish cost, schedule, and performance goals in a DHS-approved acquisition program baseline (APB)—and pursue separate ADE 2B decisions to initiate development of a biometric solution for each type of port of entry, starting with air  As of December 2017, the program had yet to conduct its ADE 2A because CBP officials have had to resolve several issues identified by the Joint Requirements Council that has delayed approval of the program’s operational requirements document (ORD)  In January 2018, CBP officials said the program plans to conduct ADE 2A in February or March 2018 and is aiming for ADE 2B for the biometric air solution in December 2018  In December 2015, Congress established an account to be used for the development and implementation of the biometric entry-exit system starting in 2017  Specifically, Congress provided that half the amount collected from fee increases for certain visa applications from fiscal years 2016 through 2025—up to $1 billion—would be available to DHS until expended  In February 2017, DHS leadership approved the program to use about $73 million of this funding in fiscal year 2017 for information technology investments and programmatic and operational support, among other things  In September 2017, DHS’s Chief Financial Officer approved the program’s life-cycle cost estimate (LCCE), which CBP expects to refine as the program progresses to meet the fee-funding limit  According to CBP officials, the current funding structure poses challenges because the fees will fluctuate based on immigration rates  Customs and Border Protection (CBP) of a traveler to different sources—one technology compared the photo to the traveler’s passport upon entrance to the U S ; the other technology compared the photo to a gallery of photos based on the outbound flight manifest during an airline’s boarding process  According to CBP officials, the facial recognition technology that matched photos during an airline’s boarding process was the most viable approach and served as the foundation for its development of the ADE 2A acquisition documents  Officials stated a similar approach may be feasible for land border crossings, but will require further planning  In January 2018, CBP officials stated they were developing a test and evaluation master plan—which will outline the developmental and operational test approach—for the biometric exit air solution  DHS’s Director, Office of Test and Evaluation will need to review and approve this plan prior to the program’s ADE 2B  Since 1996, several federal statutes have required development of an entry and exit system for foreign nationals  DHS has been exploring biometric exit capabilities since 2009 and an Executive Order issued in March 2017 directed DHS to expedite the implementation of the biometric entry-exit system  The Biometric Entry-Exit Program plans to develop a capability to match a traveler’s biometric data against data contained in existing DHS biometric data repositories— primarily the National Protection and Program Directorate’s IDENT system  DHS is in the process of replacing and modernizing IDENT through the Homeland Advanced Recognition Technology (HART) program because IDENT is at risk of failure  However, HART has experienced delays, which could affect the Biometric Entry-Exit Program’s development progress  For the air biometric solution, CBP plans to pursue a public/private partnership in which airlines and airports invest in the equipment to collect biometric data  According to CBP officials, this approach could reduce program costs and improve the passenger boarding process  In August 2017, CBP officials told GAO that several airlines have expressed interest in partnering with the program, including one that expanded CBP’s pilot of facial recognition matching for outbound flights to additional gates at the Hartsfield-Jackson Atlanta International Airport  CBP officials reported a staffing gap of 14 full time equivalent staff which the program plans to fill once partnerships with airlines are established  CBP officials stated that authorized funds are collected from visa fee increases that expire in fiscal year 2025  Beyond 2025, officials stated that additional funding will need to be appropriated or the fee increases extended to continue the program  They added that fee collections are currently below forecasted levels and may come under the current $1 billion limit  CBP officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  CUSTOMS AND BORDER PROTECTION (CBP) The border wall system is intended to prevent the illegal entry of people, drugs, and other contraband by enhancing and adding to the 654 miles of existing barriers along the U S  southwest border  CBP plans to create a border enforcement zone between a primary barrier—such as a fence—and a secondary barrier  To establish the enforcement zone, the wall system may also include detection technology, surveillance cameras, lighting, and roads for maintenance and patrolling  CBP has evaluated prototypes for new barrier designs, but risks with planned detection technologies exist  CBP is leveraging staff and the contracting strategy from prior border fencing programs  GAO last reported on the existing Southwest border barriers in February 2017 (GAO-17-331)  In April 2017, Department of Homeland Security (DHS) leadership granted CBP permission to procure barrier prototypes to inform new design standards and approved the construction of the first segment of the wall system  CBP subsequently awarded 8 task orders with a total value of over $3 million for the development of prototypes and selected San Diego as the first segment  CBP plans to replace an existing 14 miles of primary and secondary barriers in San Diego  DHS plans to use fiscal year 2017 funding for the replacement of the primary barrier, which it plans to rebuild to existing design standards  DHS has requested funding for replacement of the secondary barrier beginning in fiscal year 2018 that it plans to rebuild to new design standards once established  DHS leadership plans to approve acquisition documentation—including an acquisition program baseline (APB) and a life-cycle cost estimate (LCCE)—for each segment to determine affordability prior to authorizing construction  However, CBP officials said they do not plan to develop an APB for the San Diego segment because DHS already approved construction  In January 2018, DHS leadership approved an APB establishing cost, schedule, and performance goals for a second segment in the Rio Grande Valley (RGV), which will extend an existing barrier by 60 miles  To inform leadership’s decision, DHS headquarters conducted an independent cost estimate, which CBP adopted as the program’s LCCE  The LCCE includes costs for both the San Diego and RGV segments  However, DHS officials stated that the amounts in the LCCE are not releasable until CBP evaluates the prototypes, determines, and designs a final solution for the San Diego secondary barrier, and updates the LCCE—which is not expected to be complete until June 2018  The costs presented here are only for the RGV segment  CBP reported that construction of the RGV segment would be sufficiently funded if it receives $1 3 billion of acquisition funding in fiscal year 2018  However, CBP identified a shortfall in operations and maintenance (O&M) funding from fiscal years 2019 to 2022 that it plans to cover with existing funding from the Tactical Infrastructure program, which will be responsible for maintenance of the wall system as segments are complete  If funded, the program expects to achieve full operational capability for the RGV segment in March 2023  Customs and Border Protection (CBP) The Border Wall System Program was initiated in response to an Executive Order issued in January 2017 stating that the executive branch is to secure the southern border through the immediate construction of a physical wall on the southern border of the U S  To expedite the acquisition planning process, CBP officials said they leveraged expertise from staff that worked on previous border fencing programs and were familiar with implementation challenges, such as land access  CBP intends to prioritize segments based on threat levels, land ownership, and geography, among other things  From fiscal years 2007 to 2015, CBP spent approximately $2 3 billion to construct pedestrian and vehicle fencing along the southwest border  CBP’s Tactical Infrastructure program is responsible for sustaining this fencing and other infrastructure—such as gates, roads, and bridges— over its lifetime  CBP plans to continue coordinating with the U S  Army Corps of Engineers (USACE) for engineering support and for awarding and oversight of construction contracts  CBP anticipates that all contract awards issued by USACE in support of the RGV segment will be firm fixed price  If appropriations are received, the program plans to award construction contracts for the first portion of RGV in May 2018 and for the secondary barrier in San Diego in August 2018  In February 2018, CBP officials stated that staffing the program office is a challenge because funding has not yet been received  CBP officials said that existing work for the program is being handled by current CBP staff  CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  INTEGRATED FIXED TOWERS (IFT) CUSTOMS AND BORDER PROTECTION (CBP) The IFT program helps the Border Patrol detect, track, identify, and classify illegal entries in remote areas  IFT consists of fixed surveillance tower systems equipped with ground surveillance radar, daylight and infrared cameras, and communications systems linking the towers to command and control centers  CBP plans to deliver or upgrade approximately 53 IFT systems across six areas of responsibility (AoR) in Arizona: Nogales, Douglas, Sonoita, Ajo, Tucson, and Casa Grande  System acceptance test completed in Douglas AoR and requirements were met  Program is adequately staffed, but simultaneous deployments in the future may have a negative impact  GAO last reported on this program in November and April 2017 (GAO-18-119, GAO-17-346SP)  In December 2017, CBP declared a schedule breach of the IFT program’s current acquisition program baseline (APB) because the program did not receive the funding needed to complete planned deployments on time to achieve its full operational capability (FOC) date of September 2020  The program’s FOC date previously slipped 5 years because of delays in the initial contract award process and funding shortfalls  CBP completed IFT deployments to the Douglas AoR in June 2017 and anticipates completing deployments to the Sonoita AoR in December 2017, as scheduled  However, in September 2017, CBP officials stated that they requested—but did not receive—additional funding from the Department of Homeland Security (DHS) to address new IFT requirements, including camera upgrades and replacement of existing tower systems deployed under a legacy program  In January 2015, Border Patrol requested the program prioritize replacement of the legacy systems in the Tucson and Ajo AoRs because the technology was obsolete and more expensive to maintain than the IFT technology planned for deployment in other AoRs  Without additional funding, CBP officials stated that they would be unable to exercise the contract options for the remaining AoRs on time  In June 2017, the program updated its life-cycle cost estimate (LCCE), which is slightly less than its current APB cost thresholds  This LCCE update includes estimated costs for the new requirements  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs  CBP identified $8 million in acquisition carryover funding for fiscal year 2018 and officials anticipate receiving $126 million in O&M funding to cover $100 million in O&M costs over the next 5 years  The program plans to submit a revised APB to DHS leadership by June 2018  However, the FOC date may be further delayed because of land access issues  CBP officials told GAO that they have not yet reached an agreement with the Tohono O’odham Nation—a sovereign Native American Nation—to access tribal lands, which these officials said is necessary for the construction of IFTs in the Ajo and Casa Grande AoRs  10/15 Initial operational capability (Nogales) Customs and Border Protection (CBP) INTEGRATED FIXED TOWERS (IFT) When CBP initiated the IFT program, it decided to procure a non-developmental system, and it required that prospective contractors demonstrate their systems prior to CBP awarding the contract  The program awarded the contract to EFW, Inc  in February 2014, but the award was protested  GAO sustained the protest and CBP had to reevaluate the offerors’ proposals before it again decided to award the contract to EFW, Inc  As a result, EFW, Inc  could not initiate work at the deployment sites until fiscal year 2015  According to CBP officials, the number of IFT systems deployed to a single AoR is subject to change based on assessments by the Border Patrol  DHS leadership directed CBP to develop a comprehensive border plan in October 2016 that includes IFT capabilities and—when preparing for the last budget cycle—the program estimated costs for expansion to the southwest border beginning in fiscal year 2019  In September 2017, CBP officials told GAO that they did not have any current staffing gaps  However, CBP officials added that if the program receives full funding and reaches an agreement with the Tohono O’odham Nation to initiate IFT deployments to the Ajo and Casa Grande AoRs, while concurrently deploying capability to the Sonoita and Tucson sectors, they will be short on government and contracted staff  CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  MEDIUM LIFT HELICOPTER (UH-60) CUSTOMS AND BORDER PROTECTION (CBP) UH-60 is a medium-lift helicopter that CBP uses for law enforcement and border security operations, air and mobility support and transport, search and rescue, and other missions  CBP’s UH-60 fleet consists of 20 aircraft acquired from the U S  Army in three different models  CBP previously acquired 4 modern UH-60M aircraft and converted 6 of its older 16 UH-60A aircraft into more capable UH-60L models  CBP is replacing the remaining 10 UH-60A with reconfigured Army HH-60L aircraft  CBP test agent and the Army completed testing of reconfigured HH-60L prototype  CBP has initiated efforts to acquire additional converted HH-60L aircraft from the Army  GAO last reported on this program in April 2017 (GAO-17-346SP)  The program breached the cost and schedule goals in its acquisition program baseline (APB) and, as of December 2017, CBP officials stated they were in the process of developing the breach notification required under the Department of Homeland Security’s (DHS) acquisition policy  In its annual life-cycle cost estimate (LCCE) update, the program shifted some operations and maintenance (O&M) costs to acquisitions to be consistent with DHS’s new appropriation structure  For example, the program shifted costs for recurring upgrades from O&M to acquisition because these upgrades require development and production  As a result, the program’s updated acquisition cost estimate exceeded the APB acquisition cost threshold, which constitutes a cost breach under DHS’s acquisition policy  CBP officials stated that they did not initially declare a cost breach because the program’s total LCCE was within the APB threshold  The program also did not hold its acquisition decision event (ADE) 3 by the APB deadline of September 2017  The ADE 3 is intended to approve the transfer of CBP’s remaining UH-60A aircraft for reconfigured Army HH60-L aircraft based on an evaluation of a reconfigured prototype  According to CBP officials, the program did not complete the required acquisition documentation by the ADE 3 deadline, in part, because DHS leadership directed CBP to develop a comprehensive border plan in October 2016 that includes UH-60 capabilities  It is unclear when the ADE 3 will occur because, as of December 2017, several documents were pending validation by the Joint Requirements Council  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs  In addition, CBP officials previously told GAO that UH-60 O&M is funded through a separate, central funding account for all of CBP’s air and marine assets  CBP officials stated that the projected acquisition funding gap in fiscal years 2019 and 2020 is primarily for replacing obsolete parts that were previously considered O&M  According to these officials, the Army conducts an annual obsolescence study that will help CBP identify and prioritize replacements across the UH-60 fleet based on available funding levels  Customs and Border Protection (CBP) MEDIUM LIFT HELICOPTER (UH-60) CBP previously acquired UH-60 as a part of its Strategic Air and Marine Program (StAMP)  In July 2016, DHS leadership designated UH-60 as a separate and distinct major acquisition program  CBP initially planned to convert all 16 of its UH-60A aircraft into UH-60L models, but changed its strategy once it learned the Army planned to divest several HH-60L aircraft that could more easily be converted into UH-60L aircraft for CBP missions  CBP officials anticipated the new strategy could reduce the program’s costs by an estimated $70 million, accelerate its schedule, and result in newer aircraft since the Army’s HH-60L airframes had fewer operating hours than CBP’s existing UH-60A aircraft  In September 2017, CBP officials told GAO they had initiated efforts to acquire additional HH-60L aircraft by conducting a study of current capability gaps and drafting a mission need statement  As of September 2017, program officials confirmed that they maintain a consolidated program office where the same staff from StAMP continue to support all remaining acquisitions, including the UH-60  However, these officials stated that they plan to realign staff to a dedicated asset over time  Program officials also stated that the program has hired a dedicated cost estimator and would like to hire additional staff to focus on procuring spare parts and common component issues, such as radio replacements, for CBP’s air and marine assets  CBP officials reiterated that the changes in acquisition costs were primarily a result of cost realignment and that the program’s total life-cycle cost is still within the initial APB LCCE goals  CBP officials also stated that—to supplement Army test data—the program’s OTA participated in the flight tests and will provide a formal report on the results  MULTI-ROLE ENFORCEMENT AIRCRAFT (MEA) CUSTOMS AND BORDER PROTECTION (CBP) MEA are fixed-wing, multi-engine aircraft that can be configured to perform multiple missions including maritime, air, and land interdiction, as well as signals detection to support law enforcement  The current MEA configuration is equipped with marine search radar and an electro-optical/infrared sensor to support maritime and land surveillance and airborne tracking missions  MEA will replace CBP’s fleet of aging C-12, PA-42, and BE-20 aircraft  Testing of new configuration planned for May 2018, but requirements not yet defined  Began retrofitting accepted MEA with new mission system in fiscal year 2017  GAO last reported on this program in April 2017 (GAO-17- 346SP)  According to CBP officials, the program is on track to meet the cost and schedule goals in its current acquisition program baseline (APB) for 16 maritime interdiction MEA and is actively pursuing additional aircraft  In April 2016, CBP developed a report that identified capability needs in three mission areas and proposed increasing the program’s total to 38 aircraft by adding 13 air and 6 land interdiction MEA, and 3 signals detection MEA  The Joint Requirements Council endorsed CBP’s findings, but recommended CBP develop a number of requirements documents—including an operational requirements document—to fully validate the findings  As of September 2017, CBP officials told GAO they were in the process of updating these documents to focus on air interdiction capabilities—the next MEA configuration  These officials stated that completing these documents has been delayed, in part, because Department of Homeland Security (DHS) leadership directed CBP to develop a comprehensive border plan in October 2016 that includes MEA capabilities  Despite not yet completing all the updated documents, DHS leadership approved CBP’s request to procure MEA 17 in September 2017 after the congressional conferees agreed to an additional aircraft beyond DHS’s budget request  CBP anticipates delivery of MEA 17 by September 2018, which is within the program’s full operational capability (FOC) date  However, if the program receives approval to acquire additional aircraft, the FOC date will be extended  The program completed an annual life-cycle cost estimate update, which exceeds the program’s current APB cost thresholds, because it reflects costs for all 38 aircraft, among other reasons  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs  In addition, CBP officials previously told GAO that MEA’s O&M is funded through a separate, central funding account for all of CBP’s air and marine assets  In September 2017, CBP officials said that the program was fully funded for 17 aircraft but had some affordability challenges with spare parts, which they are working with CBP and DHS headquarters to address  Customs and Border Protection (CBP) MULTI-ROLE ENFORCEMENT AIRCRAFT (MEA) CBP is replacing the mission system processor on the MEA with a system used by the U S  Navy and U S  Coast Guard that is intended to enhance operator interface and sensor management, as well as replace obsolete equipment  CBP’s OTA tested a prototype of the processor during an operational assessment in July 2015  The OTA found that the MEA had resolved issues found during prior testing, but also made 29 additional recommendations and findings to improve the aircraft and new mission system’s effectiveness  DHS’s Director, Office of Test and Evaluation (DOT&E) concurred with the OTA’s findings  CBP previously acquired MEA as a part of its Strategic Air and Marine Program (StAMP)  In July 2016, DHS leadership designated MEA as a separate and distinct major acquisition program  CBP initially planned to procure 50 MEA and awarded the first production contract in September 2009  However, the aircraft did not perform well during testing  In October 2014, DHS leadership said CBP could not procure or accept transfer of additional MEA without approval  CBP procured 12 aircraft under the initial contract and—with DHS approval—CBP awarded a new indefinite delivery, indefinite quantity contract in September 2016 for 1 base year and four 1-year options to support procurement of additional aircraft  In December 2017, CBP officials said the program had received 12 aircraft and awarded contracts for 5 more  According to program officials, MEA 13-16 will be delivered with the new mission system and CBP began retrofitting previously delivered aircraft in fiscal year 2017  As of September 2017, program officials confirmed that they maintain a consolidated program office where the same staff from StAMP continue to support all remaining acquisitions, including MEA  However, these officials stated that they plan to re-align staff to a dedicated asset over time  Program officials also stated that the program has hired a dedicated cost estimator and would like to hire additional staff to focus on procuring spare parts and common component issues, such as radio replacements, for CBP’s air and marine assets  CBP officials stated that delays in receiving approval of the program’s requirements documents may pose a risk to exercising options for additional MEA on an existing contract, which could stop production and increase contract costs associated with procuring future aircraft  CBP officials added that air and marine requirements officers continue to produce documentation requested by the Joint Requirements Council to provide sufficient context for the mission need and border security  CBP officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  CUSTOMS AND BORDER PROTECTION (CBP) The NII Systems Program supports CBP’s interdiction of weapons of mass destruction, contraband such as narcotics, and illegal aliens being smuggled into the United States, while facilitating the flow of legitimate commerce  CBP officers use large- and small-scale NII systems at air, sea, and land ports of entry; border checkpoints; and international mail facilities to examine the contents of containers, railcars, vehicles, baggage, and mail  CBP initiated efforts for future NII requirements and procurements  66 percent staffing gap contributed to delays in NII deployments  GAO last reported on this program in April 2017 (GAO-17-346SP)  The NII Systems Program is on track to meet its approved schedule and cost goals  The estimates in the program’s annual life-cycle cost estimate (LCCE) update continued to decrease overall compared to its approved acquisition program baseline (APB) cost thresholds  Specifically, compared to the prior year’s estimate, the program’s acquisition costs decreased by $96 million and operations and maintenance (O&M) costs increased by $22 million  However, the LCCE update only estimated costs through fiscal year 2026—9 years short of the program’s final year  The LCCE primarily decreased because of a reduction of 1,977 planned additional and replacement NII systems  CBP officials said fewer large- and small-scale systems are needed because some systems have longer estimated lives than expected, and systems procured have better capability  CBP officials do not anticipate that the reduction in quantities will have an adverse effect on operations because they stated that the new systems can provide dual purpose capabilities (i e , one system can replace multiple separate systems)  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs  CBP officials anticipate receiving approximately $605 million of O&M funding over this 5-year period to cover about $626 million in estimated O&M costs, which includes $100 million to operate and maintain radiation detection equipment acquired by the Domestic Nuclear Detection Office  These officials also identified $37 million in carryover funding to cover the remaining $21 million of O&M estimated costs  However, the program is projected to have a $266 million acquisition funding gap from fiscal years 2018 to 2022 The program has a plan to address funding shortfalls but, according to CBP officials, it has not yet needed to implement the strategies in this plan because of several factors, including cost reductions achieved through combined life-cycle contracts and lower-than-expected actual technology costs in fiscal year 2016  Customs and Border Protection (CBP) trucks as they are driven through the inspection portals—low dose X-ray to inspect the truck cab and high dose X-ray to inspect the cargo trailer  In March 2017, the Joint Requirements Council validated a capability analysis report that assessed current capability gaps in NII operations to assist with identifying potential upgrades to existing systems and developing requirements for future systems  According to program officials, CBP plans to review and update, as necessary, the mission need statement in fiscal year 2018  Additionally, program officials are preparing a consolidated acquisition plan for future procurements  These officials said CBP has not yet determined whether future procurements would be included into the current NII Systems Program of record or constitute a new acquisition program  CBP’s ability to successfully execute the existing NII Systems Program and plan for future efforts may be at risk because of understaffing  As of January 2018, the NII Systems Program continued to face a staffing gap of approximately 66 percent, including critical vacancies such as the acquisition program manager and a logistics program manager  Officials also noted that a lack of adequate personnel to procure, test, and deploy NII systems forces the program to prioritize its acquisitions, which can result in delays of NII deployments and testing efforts  For example, one manufacturer increased its output rate of NII systems, but the program did not have the staff to accept the systems at the increased rate  Officials anticipate the program may remain understaffed until CBP completes a reorganization that started more than a year ago, in which acquisition programs are realigned from a mission-support office to their operational entity  CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  REMOTE VIDEO SURVEILLANCE SYSTEM (RVSS) CUSTOMS AND BORDER PROTECTION (CBP) The RVSS program helps the Border Patrol detect, track, identify and classify illegal entries across U S borders  RVSS consists of daylight and infrared video cameras mounted on fixed towers and buildings with communications systems that link to command and control centers  From 1995 to 2005, CBP deployed approximately 310 RVSS towers along the U S  northern and southern borders, and initiated efforts to upgrade legacy RVSS towers in Arizona in 2011  Program does not plan to conduct additional operational testing on future deployments  Once funded, program plans to award a new contract for deployments in sectors along the southwest border  GAO last reported on this program in November 2017 (GAO-18-119)  In April 2016, Department of Homeland Security (DHS) leadership elevated RVSS from a level 3 program—which focused on upgrading legacy RVSS in Arizona—to a level 1 program after approving CBP’s plan to expand deployments to the Rio Grande Valley (RGV) sector and adding an additional 6 sectors along the southwest border  At this time, DHS leadership approved the program to move forward with deployments to two RGV stations, which can be completed as options under the program’s existing contract  However, the program was required to re-baseline to account for its expanded scope and conduct an acquisition decision event (ADE) to obtain approval for additional deployments  As of January 2018, the program had not yet conducted its ADE or obtained DHS approval for an acquisition program baseline (APB) that established cost, schedule, and performance goals for the expanded program  In September 2017, CBP officials told us that they had drafted the APB and other required documentation, such as a life-cycle cost estimate (LCCE), but were unsure when the ADE would occur because the program had not received funding for the additional deployments  In addition, the ADE may have been delayed because DHS leadership directed CBP to develop a comprehensive border plan in October 2016 that includes RVSS capabilities  In September 2017, DHS leadership approved the RVSS’s revised LCCE which totaled nearly $4 billion for all program costs from fiscal years 2011 through 2042, including expansion along the southwest border and new initiatives such as a pilot for relocatable RVSS towers  DHS conducted an independent cost estimate for the program, which DHS cost estimating officials stated was within 2 percent of the program’s LCCE  RVSS was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because it had not yet been elevated to a level 1 program at the time the plan was developed  CBP officials stated that the program has received acquisition funding to cover the approved RGV deployments  However, CBP officials told GAO that the program may also assume responsibility for maintaining all legacy RVSS, but has not received adequate operations and maintenance funding to do so  Customs and Border Protection (CBP) REMOTE VIDEO SURVEILLANCE SYSTEM (RVSS) In July 2013, CBP awarded a firm fixed-price contract for a commercially available, non-developmental system  This contract covered the program’s initial scope to deploy upgraded RVSS in Arizona and two stations within the RGV sector, which can be completed as options  According to CBP officials, the program will need to award a new contract to cover expansion to the remaining six sectors along the southwest border  In September 2017, CBP officials said that the request for proposals for the new contract had been drafted but it cannot be released until the program receives funding  CBP officials told GAO that RVSS is coordinating with CBP’s Border Wall System Program on some planned deployments within the RGV sector  For example, CBP is considering moving 2 of the planned RVSS towers to be co-located with the planned barrier, which officials stated may provide better surveillance  If the Border Wall System Program does not receive funding, CBP officials said the towers will be placed in the originally planned locations  CBP officials stated that the RVSS program requires additional staff for contracting activities, maintenance activities for legacy RVSS, and for relocatable tower pilot deployments  To mitigate the staffing gap, CBP officials said they prioritize responsibilities of current personnel to meet program execution needs  CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  CUSTOMS AND BORDER PROTECTION (CBP) The TACCOM program is intended to upgrade land mobile radio infrastructure and equipment to support approximately 95,000 users at CBP and other federal agencies  It is replacing obsolete radio systems with modern digital systems across various sectors located in 19 different service areas, linking these service areas to one another through a nationwide network, and building new communications towers to expand coverage in 5 of the 19 service areas  Issues related to security requirements have delayed full operational capability by more than a year  Program is being re-organized under Border Patrol, but still faces staffing challenges  GAO last reported on this program in April 2017 (GAO-17-346SP)  In November 2017, Department of Homeland Security (DHS) leadership re-baselined the TACCOM program, removing it from breach status after the program experienced a schedule slip and cost growth  In July 2017, CBP officials notified DHS leadership that the program would not achieve full operational capability (FOC) as planned due to issues related to federal information security requirements  The program now plans to achieve FOC by March 2019—more than a year later than its initial acquisition program baseline (APB) deadline  According to CBP officials, FOC will include planned upgrades to the San Diego system, which requires transitioning management of the legacy system from the Department of Justice to DHS  In August 2017, CBP officials stated that both agencies were reviewing an agreement with plans to complete the transition in fiscal year 2018  CBP officials stated that the program realized it would exceed its initial APB cost thresholds as it was developing its annual life-cycle cost estimate (LCCE) update and subsequently submitted a revised LCCE for DHS leadership approval  The program’s costs primarily grew because of increases in costs for contractor labor and support for facilities and infrastructure  CBP officials said the program’s initial estimates were immature; however, DHS leadership approved the initial LCCE in December 2015—4 years after the program began sustaining capabilities  DHS’s Chief Financial Officer (CFO) approved the program’s revised LCCE in November 2017, but noted that the program’s estimate exceeded its available funding and requested that the program address the affordability gap before it was re-baselined  CBP officials said that they are conducting an affordability analysis, which they anticipate will be completed by March 2018  Nevertheless, DHS leadership approved the program’s re-baseline in November 2017  CBP officials subsequently identified errors in the approved APB cost threshold tables and provided revised amounts, which are presented here  The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs  CBP officials anticipate receiving approximately $120 million in O&M funding over this 5-year period  Customs and Border Protection (CBP) CBP officials told GAO that in January 2018, the program will move from a mission support office to a joint program office under Border Patrol as a part of CBP’s reorganization that started more than a year ago  The goal of this move is to make CBP land mobile radio capabilities seamless by combining the mission critical voice functions of Air and Marine Operations, the Border Patrol, and the Office of Field Operations—the TACCOM program’s primary customers—under one organizational leader, the Border Patrol Chief  CBP officials anticipate that the current TACCOM program structure will remain in place after this move with the exception of the program’s engineers, which will move to CBP’s Office of Information and Technology but be assigned to support TACCOM full time  In August 2017, CBP officials told GAO they were in the process of hiring staff to fill the program’s vacant positions  They added that the fiscal year 2019 budget contains plans for additional infrastructure enhancements, which will require technical staff to assist in the planning and execution of these efforts and may put additional strain on the program’s limited government technical staff  They noted that the hiring and retention of qualified land mobile radio engineers and information technology technical staff is a challenge because of competition with the private sector, among other factors  In addition to maintenance of the CBP Land Mobile Radio System that provides critical communication needs for CBP agents and officers protecting U S  borders, CBP officials stated the TACCOM program is providing infrastructure, such as building an engineering lab to facilitate design, development, test, and evaluation activities, to support improvements in CBP’s current and future Land Mobile Radio Systems  CBP officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  CUSTOMS AND BORDER PROTECTION (CBP) TECS (not an acronym) is a law-enforcement information system that has been in place since the 1980s and helps CBP officials determine the admissibility of persons entering the United States at border crossings, ports of entry, and prescreening sites located abroad  CBP initiated efforts to modernize TECS to provide users with enhanced capabilities for accessing and managing data  Immigration and Customs Enforcement has a separate TECS Modernization program  System operationally effective and suitable, but cybersecurity testing needed  CBP working to address and prevent major system outages  GAO last reported on this program in April 2017 (GAO-17-346SP)  In July 2017, Department of Homeland Security (DHS) leadership granted the program acquisition decision event (ADE) 3 approval, but required CBP to conduct follow-on operational test and evaluation (OT&E) before declaring full operational capability (FOC)  This is more than a 2-year delay from CBP’s initial FOC date and a 9-month delay from its most recent revised FOC date  DHS approved the fourth version of the program’s acquisition program baseline (APB) in July 2016  In this APB, CBP split FOC into two separate operational capability milestones at its data centers to better reflect the program’s activities  CBP delivered operational capability at the primary data center in Decemberas scheduled—which provides redundant TECS access to minimize downtime during system maintenance or unscheduled outages  However, not all test results were available in time for the program’s ADE 3 decision, which contributed to DHS leadership’s decision to delay declaring FOC  2016, which included transitioning all TECS users to the modernized system  CBP delivered operational capability at the secondary data center in June 2017—The program updated its life-cycle cost estimate (LCCE) for ADE 3, which is within its current APB cost thresholds  However, the LCCE only included costs through fiscal year 2021—7 years short of DHS’s guidance that states program cost estimates should cover at least 10 years from the FOC date  Nevertheless, DHS granted the program ADE 3 approval without an understanding of the program’s full life-cycle costs, as required by its acquisition policy  CBP officials plan to update the LCCE by the end of calendar year 2018 to include costs for future years and other items, such as costs associated with follow-on OT&E and moving the data centers to a cloud environment—a CBP-wide initiative  The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs  CBP officials anticipate receiving approximately $205 million in O&M funding over the next 4 years and have identified carryover for each year  However, CBP officials said there may be a small funding gap starting in fiscal year 2020, but they expect to achieve savings by migrating the data centers to a cloud environment  Customs and Border Protection (CBP) Since the program has completed development, CBP is focused on ensuring that the modernized TECS system works as intended by addressing operational issues as they are identified  For example, on January 2, 2017, a primary TECS Modernization application experienced a major outage that resulted in long airport delays  In August 2017, CBP officials said they continually monitor system health through a 24/7 operations center and have established a group dedicated to addressing the issues related to the January 2, 2017, outage  In September 2017, DHS’s Office of Inspector General (OIG) found that nearly 100 outages, periods of latency, or degraded service were reported for three TECS Modernization applications between June 2016 and March 2017  The OIG also found that CBP’s monthly reports on TECS system availability did not include periods of slowness or service interruptions that were caused by external factors  For example, the January 2, 2017, incident was identified in CBP outage reports, but was not captured in the monthly report because it was caused by a change to an external feed to the TECS system  CBP officials clarified that the monthly reports only account for interruptions that result in a full loss of operations for all TECS system users  The OIG recommended that CBP develop a plan to address factors that contributed to challenges regarding availability of primary traveler screening applications, among other things  CBP concurred with the recommendations  On January 1, 2018, the TECS system experienced another major outage that caused long airport delays; CBP officials said this incident is under review  CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  LOGISTICS SUPPLY CHAIN MANAGEMENT SYSTEM (LSCMS) FEDERAL EMERGENCY MANAGEMENT AGENCY (FEMA) LSCMS is a computer-based tracking system that FEMA officials use to track shipments during disaster-response efforts  It is largely based on commercial-off-the- shelf software  FEMA initially deployed LSCMS in 2005, and initiated efforts to enhance the system in 2009  According to FEMA officials, LSCMS can identify when a shipment leaves a warehouse and the location of a shipment after it reaches a FEMA staging area near a disaster location  FEMA now anticipates reaching full operational capability by June 2019, up to 6 months late  Recent testing shows progress, but additional operational testing delayed to May 2018  GAO last reported on this program in April 2017 (GAO-17-346SP)  In November 2017, Department of Homeland Security (DHS) leadership approved a revised acquisition program baseline (APB) after the LSCMS program experienced a schedule breach  In September 2017, FEMA officials notified DHS leadership that it would not complete all required activities—including follow-on operational test and evaluation (OT&E)—to achieve acquisition decision event (ADE) 3 and full operational capability (FOC) by its initial APB dates of September 2018 and December 2018, respectively  According to FEMA officials, the delay was primarily caused by the need to deploy LSCMS program personnel in support of response and recovery efforts during the 2017 hurricane season  The program now plans to achieve FOC by June 2019—up to 6 months later than initially planned  DHS leadership authorized LSCMS to resume all development and acquisition efforts in March 2016 after a nearly 2-year program pause following program management issues  In October 2017, FEMA officials told GAO that they had completed several development efforts—such as integration with DHS’s asset management system—and were in the process of adding Electronic Data Interchange (EDI) to allow LSCMS to interface with its partners’ information systems  The program’s annual life-cycle cost estimate (LCCE) update continued to be within its APB cost thresholds  However, the program’s APB thresholds are not adjusted to account for risk, which increases the chance that the program could experience a cost breach  As of November 2017, FEMA officials did not anticipate that its schedule delays would lead to a cost breach  Federal Emergency Management Agency (FEMA) LOGISTICS SUPPLY CHAIN MANAGEMENT SYSTEM (LSCMS) The LSCMS program previously experienced significant execution challenges because of poor governance  FEMA initially deployed the enhanced LSCMS in 2013 without DHS leadership approval, a DOT&E letter of assessment, or a DHS-approved APB documenting the program’s costs, schedule, and performance parameters, as required by DHS’s acquisition policy  DHS’s Office of Inspector General also found that neither DHS nor FEMA leadership ensured the program office identified all mission needs before selecting a solution  In response, DHS leadership paused all LSCMS development efforts in April 2014 until the program addressed these issues, among others  FEMA subsequently completed an analysis of alternatives and developed an APB based on this assessment  DHS leadership approved the APB in December 2015 and authorized FEMA to resume all LSCMS development and acquisition efforts in March 2016  In October 2017, FEMA officials told GAO that the LSCMS program had minimal staffing shortages and was working to recruit additional staff  Officials previously attributed the program’s governance and testing challenges, in part, to staffing shortages and we previously found that it only had 7 of the 22 5 full time equivalents it needed in fiscal year 2014  Although the program has obtained more staff since then, FEMA officials noted in October 2017 that during disasters—such as 2017 hurricanes Harvey, Irma, and Maria—LSCMS program personnel are deployed to support response and recovery efforts, which leave program positions vacant for the duration of the deployment  FEMA officials stated that during the response to hurricanes Harvey, Irma and Maria in 2017, LSCMS processed supply chain transactions that exceeded the total number of transactions from the preceding 12 years—which includes the response to Hurricane Katrina  They added that the program provided support for nearly 130 million meals in 2017 compared to a total of approximately 84 million from the 12 previous years  FEMA officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  IMMIGRATION AND CUSTOMS ENFORCEMENT (ICE) Since the 1980s, TECS (not an acronym) has provided case management, intelligence reporting, and information sharing capabilities to support ICE’s mission to investigate and enforce border control, customs, and immigration laws  ICE initiated efforts to modernize TECS in 2009 to replace aging functionality and provide end users with additional functionality to meet mission needs  Customs and Border Protection (CBP) executes a separate TECS Modernization program  Conducted additional testing of a revised key performance parameter and cybersecurity  Program has improved integration with external systems  GAO last reported on this program in April 2017 (GAO-17-346SP)  In November 2017, Department of Homeland Security (DHS) leadership approved a revised life-cycle cost estimate (LCCE) and acquisition program baseline (APB) in preparation for the program’s acquisition decision event (ADE) 3 following deployment of final functionality  According to ICE officials, the program completed deployment of full operational capability (FOC) functionality in August 2017—4 months earlier than initially planned  FOC functionality included enhancements to case management capabilities, such as improved system search capabilities  The functionality was deployed in conjunction with enhancements and fixes for initial operational capability (IOC) functionality  The program achieved IOC in June 2016, which entailed delivering 80 percent of the modernized TECS functionality and successfully transitioning ICE off the legacy system  The overall cost thresholds in the current APB increased compared to the program’s prior APB from July 2016  Specifically, the acquisition cost threshold decreased by $14 million and the operations and maintenance (O&M) cost threshold increased by $147 million  These costs changed for various reasons, such as the following: The acquisition cost threshold decreased when ICE included actual costs through fiscal year 2016 and accounted for funding shortfalls  ICE officials told GAO that the program experienced a funding shortfall in fiscal year 2017 that led it to adjust spending under multiple contracts and shift some costs to fiscal year 2018  The O&M cost threshold increased when ICE extended the estimate from fiscal years 2024 to 2028 and continued contractor and systems engineering support for an additional 11 years  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs  ICE officials anticipate receiving approximately $94 million in O&M funding to cover an estimated $105 million in O&M costs over this 5-year period  ICE officials said that they are pursuing strategies to reduce future O&M costs, such as awarding a competitive contract in March 2018 for O&M activities and any future enhancements  ICE officials continue to work closely with CBP to provide users access to various systems through the modernized TECS system  The program previously worked to resolve technical problems with CBP support services that emerged during final integration testing of the ICE and CBP modernized TECS systems, which contributed to a 3-month delay in achieving IOC  Users reported during initial OT&E that the modernized ICE TECS system was an improvement over the legacy system but they requested better integration with external systems, such as CBP’s Seized Assets and Case Tracking System (SEACATS), which they use to determine the disposition of seized assets for case management and reporting purposes  According to ICE officials, CBP subsequently decided to modernize SEACATS  ICE officials stated that they have coordinated closely with CBP to integrate the two modernized systems and ensure un-interrupted access to SEACATS for TECS users  For example, ICE developed a workaround so that TECS users maintain access to the latest seizure data available from the modernized SEACATS  ICE officials added that they continue to make improvements in interfaces with other external systems as prioritized by end users  In July 2017, ICE reported that the program was fully staffed  ICE officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  CONTINUOUS DIAGNOSTICS AND MITIGATION (CDM) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) The CDM program aims to strengthen the cybersecurity of the federal government’s networks at more than 65 participating civilian agencies by providing tools and dashboards that continually monitor and report on network vulnerabilities  Tools are delivered in four phases: phase 1 and 2 tools report vulnerabilities in hardware and software, and user access controls, respectively; phase 3 tools will report on efforts to prevent attacks; and phase 4 tools will provide encryption to protect network data  Program revised its key performance parameters and test and evaluation master plan as a part of its rebaseline  Program plans to change its acquisition strategy and continues to face workforce challenges  GAO last reported on this program in April 2017 (GAO-17-346SP)  In June 2017, Department of Homeland Security (DHS) leadership re-baselined the CDM program for the third time to approve initiating development of phase 3 and to address challenges encountered during phase 1  Specifically, contractors previously found large gaps—ranging from 19 to 384 percent—in the actual number of devices needing phase 1 tools than what was originally reported by 12 agencies  The operations and maintenance (O&M) cost thresholds increased by $631 million when the program shifted some potential acquisition costs to beThe program’s new acquisition program baseline (APB) modified the program’s cost, schedule, and performance parameters  For example: consistent with DHS’s new appropriation structure, among other things  The O&M cost thresholds previously decreased by $1 2 billion, in part, because DHS leadership determined the program would only fund CDM tools for the first 2 years after deployment  The acquisition costs did not increase despite phase 1 challenges, in part, because coverage for the U S  Postal Service— The program’s full operational capability (FOC) date slipped almost 4 years after which had the largest gap in estimated devices—will no longer be funded by the CDM program  it was redefined from deployment of phase 1-3 tools at 5 agencies to the availability of these tools to all participating agencies  However, the program’s costs will increase and its FOC date may slip further once the program establishes goals for phase 4  NPPD officials said they were unable to complete planning efforts for phase 4 in time to incorporate it into the most recent APB revision and, therefore, plan to re-baseline the CDM program again in 2018  The CDM program identified a potential acquisition affordability gap in fiscal year 2018 based on its revised life-cycle cost estimate, which it addressed by adjusting the phase 3 schedule to shift some acquisition costs out to fiscal year 2020  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs  However, the program anticipates receiving approximately $281 million in O&M funding over the 5-year period  12/16 Phase 1 initial operational capability (IOC) National Protection and Programs Directorate (NPPD) CONTINUOUS DIAGNOSTICS AND MITIGATION (CDM) The CDM program updated its acquisition plan as a part of its re-baselining efforts, which reflects a change in strategy for procuring CDM tools and integration services for participating agencies through the General Services Administration (GSA)  Previously, the CDM program issued task orders for these tools and services through blanket purchase agreements established under vendors’ GSA Federal Supply Schedule contracts  These agreements are set to expire in August 2018  Going forward, the program plans to use an existing GSA government-wide acquisition contract—known as Alliant—to obtain CDM tools and services  According to NPPD officials, the new acquisition strategy is intended to provide greater flexibility in contracting for current capabilities and to support future capabilities  It will also allow participating agencies to order additional CDM-approved products or services from GSA’s schedule for information technology equipment, software, and services; however, as of September 2017, NPPD officials stated they were in the process of determining how this process will work  NPPD officials said that the program continues to face workforce challenges related to managing the program’s change in contracts and planning for phase 4  In February 2018, NPPD officials stated that they had on-boarded 5 staff to help address the program’s reported fiscal year 2017 gap of 16 full time equivalents  They noted that another 5 candidates were in the hiring process and that NPPD continues to work with officials from DHS’s Office of the Chief Security Officer to reduce continued challenges in onboarding new staff due to the lengthy security clearance process  In addition to activities outlined in this assessment, NPPD officials stated that the CDM program continues to manage its budget to ensure program costs match available funding, and is leveraging the collective buying power of federal agencies and strategic sourcing to achieve government cost savings on CDM products  NPPD officials also stated that, as of December 2017, CDM has deployed agency dashboards to 23 agencies and was conducting and testing information exchanges of data between agency dashboards and the federal dashboard  HOMELAND ADVANCED RECOGNITION TECHNOLOGY (HART) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) HART will replace and modernize the Department of Homeland Security’s (DHS) legacy biometric identification system—known as IDENT—which shares information on foreign nationals with U S  government and foreign partners to facilitate legitimate travel, trade, and immigration  NPPD plans to develop HART in four increments: increments 1 and 2 will replace and enhance IDENT functionality; increments 3 and 4 will provide additional biometric services, as well as a web portal and new tools for analysis and reporting  Key performance parameters will be demonstrated as capability is developed  Program has developed mitigation plans to address workforce risks  GAO last reported on this program in April 2017 (GAO-17-346SP)  In June 2017, NPPD declared a schedule breach when it determined the HART program would not be able to meet its initial acquisition program baseline (APB) milestones  DHS leadership approved the program’s APB in April 2016 and authorized the program to initiate development efforts for increments 1 and 2 in October 2016  NPPD officials attribute the schedule slip to multiple delays in awarding the contract for increments 1 and 2 as a result of issues with the request for proposals (RFP)  The program released the RFP in February 2017 and awarded the contract in September 2017—approximately 9 months later than NPPD officials had planned  However, the program experienced additional delays after a bid protest to the contract award was filed with GAO in October 2017  GAO subsequently denied the protest and NPPD officials said the program plans to initiate work with the contractor in March 2018  HART initially planned to achieve initial operational capability (IOC) with the deployment of increment 1 in December 2018, at which point program officials anticipated beginning to transition users from IDENT to HART  However, it is unclear when this will now occur, which is a significant challenge because IDENT is at risk of failure and may be unable to fully support requirements related to new programs— such as Customs and Border Protection’s Biometric Entry-Exit  As a result, delays in HART could contribute to delays in other DHS acquisition programs  The program updated its life-cycle cost estimate (LCCE) in June 2017 to inform the budget process  This LCCE is within its current APB cost thresholds, but does not account for the contractor’s solution  The program plans to update its LCCE and other acquisition documentation, such as its APB, after initiating work with the contractor  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs  However, the program anticipates receiving approximately $1 3 billion in O&M funding to cover $1 5 billion in O&M costs  NPPD officials explained that the current O&M cost estimate includes costs for maintaining IDENT  Future LCCE updates will reflect delivery of services through HART, which NPPD officials anticipate will be more cost effective  National Protection and Programs Directorate (NPPD) HOMELAND ADVANCED RECOGNITION TECHNOLOGY (HART) NPPD officials told GAO they are currently planning for increments 3 and 4 and plan to refine the cost, schedule, and performance goals for these increments in its next APB  NPPD plans to pursue a separate contract for the development and delivery of increments 3 and 4  However, the program will require DHS leadership approval prior to initiating these development efforts  In September 2017, NPPD officials told GAO they had hired two staff and planned to hire additional staff to address the program’s staffing gap of 5 5 full time equivalents  In response to DHS leadership’s direction, the program coordinated with DHS’s Chief Technology Officer to assess the skills and functions of staff necessary to execute the program and to develop the HART staffing plan  In its June 2017 staffing plan, the program identified workforce risks, including the potential for experiencing insufficient technical skillsets and inadequate resources to simultaneously execute development of HART and operate IDENT  To mitigate these risks, the program plans to develop a training plan to address the gap in skills, leverage support within the program by cross- training staff, and issue contracts for additional support as needed, among other things  However, if the program does not have adequate staff to complete these efforts, it may experience further schedule delays  NPPD officials stated that the program’s schedule delays pose a challenge because IDENT remains at risk of failure despite incremental improvements to extend its service life and may be unable to fully support new customer requirements or requirements related to new programs  They added that the program has a risk management process, which it is using to manage a variety of identified risks—including several related to workforce  They noted that these risks have not yet materialized  NPPD officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  NATIONAL CYBERSECURITY PROTECTION SYSTEM (NCPS) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) NCPS is intended to defend the federal civilian government from cyber threats  NCPS develops and delivers capabilities through a series of “blocks ” Blocks 1 0, 2 0, and 2 1 are fully deployed and provide intrusion-detection and analytic capabilities across the government  The NCPS program is currently deploying EINSTEIN 3 Accelerated (EA) to provide intrusion-prevention capabilities and plans to deliver block 2 2 to improve information sharing across agencies  A at 95 percent of agencies and departments  GAO last reported on this program in April 2017 (GAO-17-346SP)  NPPD officials said the program is on track to meet the schedule and cost goals in its current acquisition program baseline (APB), which reflected changes resulting from the adoption of some of the Department of Homeland Security’s (DHS) Homeland Security Information Network (HSIN) capabilities for block 2 2 rather than developing custom solutions  However, challenges in completing test plans delayed testing: Initial operational test and evaluation (OT&E) for EA transition to sustainment— slipped from September 2016 to May 2017  The initial test event for block 2 2—intended to inform the ADE 2C for deploying additional block 2 2 capabilities—slipped from March 2017 to September 2017  As of August 2017, NPPD officials said NCPS had adopted all planned HSIN capabilities but one because of security concerns, which HSIN is addressing by piloting a new tool  The program updated its life-cycle cost estimate (LCCE) in June 2017 to inform the budget process, which is within its current APB cost thresholds  However, the program plans to update the LCCE again to support the EA, and costs through fiscal year 2022  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan no longer contained O&M funding for individual programs  NPPD officials anticipate receiving $1 8 billion in O&M funding over this 5-year period  The program is also projected to have an $83 million surplus in acquisition funding over this 5-year period, which NPPD officials anticipate will be less once the LCCE revision is complete  National Protection and Programs Directorate (NPPD) NATIONAL CYBERSECURITY PROTECTION SYSTEM (NCPS) A intrusion-prevention capabilities have been primarily provided through sole source contracts with internet service providers (ISP) and a contract to provide basic intrusion-prevention services  In December 2015, Congress required DHS to make available for use by federal agencies, certain capabilities, such as those provided by NCPS’s EA at approximately 93 percent of civilian federal agencies and departments and, in January 2018, NPPD officials said NCPS was up to 95 percent  According to NPPD officials, the program first focused on integrating EA for individual agencies and departments, but stated that they continue to work with all agencies and departments to provide EA services and approximately 95 percent of the federal civilian  gov user population is protected by at least one EA and an OA of NCPS block 2 2 information sharing capabilities in 2017  NPPD officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  NEXT GENERATION NETWORKS PRIORITY SERVICES (NGN-PS) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) NGN-PS is intended to address an emerging capability gap in the government’s emergency telecommunications service, which prioritizes select officials’ phone calls when networks are overwhelmed  NPPD executes NGN-PS through commercial telecommunications service providers, which addresses the government’s requirements as they modernize their own networks  NPPD is executing NGN-PS in two phases—(1) voice and (2) data and video  Initial operational capability for voice phase wireless capabilities achieved in August 2017  Acquisition of data and video phase capabilities to begin in September 2021  GAO last reported on this program in April 2017 (GAO-17-346SP)  In November 2017, the Department of Homeland Security’s (DHS) Chief Financial Officer approved a revised life-cycle cost estimate (LCCE) for NGN-PS, which includes costs for the entire program’s voice phase and eliminates operations and maintenance (O&M) costs  The program removed O&M costs because capabilities acquired through NGN-PS are transferred to and funded through NPPD’s Priority Telecommunications Service (PTS) once they become operational  NGN-PS is currently focused on delivering its voice phase, which is divided into three increments: Increment 1 maintains current priority service on long distance calls as commercial service providers update their networks; Increment 2 delivers wireless capabilities; and Increment 3 is intended to address landline capabilities  The program’s previous LCCE and current acquisition program baseline (APB) only include costs associated with increments 1 and 2  NPPD officials told GAO they plan to update the program’s APB in January 2018 to include costs, schedule, and performance goals for increment 3 and expect to receive DHS leadership approval to initiate development by August 2018  NGN-PS remains on track to meet its cost and schedule goals for the first two increments of the voice phase  The program’s full operational capability (FOC) for increment 1 previously slipped from June 2017 to March 2019, which NPPD officials attributed to funding shortfalls  NGN-PS achieved initial operational capability (IOC) for increment 2 wireless capabilities in August 2017 when priority service via cellular towers was demonstrated by the program’s largest service provider  The program projects an acquisition affordability gap of $92 million from fiscal years 2018 to 2022  However, DHS’s current funding plan does not include funding for increment 3, which accounts for the funding shortfall in fiscal years 2021 and 2022  NPPD officials said they anticipate receiving an additional $79 million in acquisition funding over this 2-year period, but will continue to prioritize capabilities if additional funding is not provided  These officials also said the program has achieved cost savings on increments 1 and 2 that will mitigate some of the projected shortfall in fiscal years 2018 and 2019  National Protection and Programs Directorate (NPPD) NEXT GENERATION NETWORKS PRIORITY SERVICES (NGN-PS) NGN-PS was established in response to an Executive Order requiring the federal government to have the ability to communicate at all times during all circumstances to ensure national security and manage emergencies  A Presidential Policy Directive issued in July 2016 superseded previous directives requiring continuous communication services for select government officials  According to NPPD officials, the new directive validates the program’s requirements for the voice phase and was used to develop requirements for the video and data phase  The program expects to begin the acquisition of the phase 2 for video and data in September 2021  In July 2017, NPPD reported that the program needed a systems engineer and was mitigating the vacancy with contracted support staff  The program also identified a need for an additional systems engineer and program support staff starting in fiscal year 2019 to support the start of increment 3  In August 2017, NPPD officials told GAO they continue to face challenges hiring and retaining engineers with adequate experience because of competition with the private sector  The program has historically mitigated staffing gaps by leveraging support from contracted and PTS program staff, as needed  In addition to activities identified in this assessment, NPPD officials stated that the program has received Joint Requirements Council validation of the phase 2 concept of operations and DHS leadership approval of the phase 2 operational requirements document  As of January 2018, the updated APB was in the approval process  NPPD officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  NATIONAL BIO AND AGRO-DEFENSE FACILITY (NBAF) SCIENCE AND TECHNOLOGY DIRECTORATE (S&T) The NBAF program is constructing a state-of-the-art laboratory in Manhattan, Kansas to replace the Plum Island Animal Disease Center  The facility will enable the Department of Homeland Security (DHS) and the Department of Agriculture (USDA) to conduct research, develop vaccines, and provide enhanced diagnostic capabilities to protect against foreign animal, emerging, and zoonotic diseases that threaten the nation’s food supply, agricultural economy, and public health  Commissioning process underway, but performance will not be demonstrated until construction is complete  NBAF adequately staffed, but staffing needs will change as operational stand-up activities begin  GAO last reported on this program in April 2017 (GAO-17-346SP)  The program’s annual life-cycle cost estimate (LCCE) update is within its current acquisition program baseline (APB) cost thresholds and, according to NBAF officials, the program remains on track to meet its schedule goals  In August 2017, NBAF officials said that construction activities thus far—such as pouring concrete for the main laboratory and steel framing—have proceeded as anticipated and will continue through December 2020  NBAF officials told GAO the program has already received full acquisition funding for facility construction efforts through federal appropriations and gift funds from the state of Kansas  As construction continues, the program plans to begin operational stand-up activities for the facility  However, a potential affordability gap may delay the program’s ability to complete these stand-up activities, which are needed to begin conducting laboratory operations  The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs  However, NBAF officials anticipate receiving only $149 million in O&M funding to cover an estimated $239 million in O&M costs over the next 5 years, resulting in a projected shortfall of approximately $90 million  NBAF officials stated the O&M funding gap could delay a number of operational stand-up activities, including plans to award a management operations and research support contract in October 2018, the purchase of laboratory and information technology equipment, and hiring of operations management staff  According to NBAF officials, if operational stand-up activities are delayed, there is a risk the facility will not be fully operational by December 2022, as is currently planned  This may delay the transition from the Plum Island Animal Disease Center, which is nearing the end of its useful life  NBAF officials reported that S&T plans to communicate the program’s future funding needs to DHS leadership through the annual budget process  If the program does not receive the funding it requests, these officials stated that S&T will prioritize the operational stand-up activities that best reduce the risk of schedule delays  Science and Technology Directorate (S&T) NATIONAL BIO AND AGRO-DEFENSE FACILITY (NBAF) NBAF officials reported that they coordinate regularly with key stakeholders  For example, they hold regular coordination meetings with USDA officials to discuss NBAF operations, including operational stand-up activities and future procurement  The NBAF program office has also begun outreach to the federal regulators responsible for awarding the registrations needed for NBAF to conduct laboratory operations to begin planning for this authorization process  The NBAF program office is currently fully staffed  However, NBAF officials reported the program’s staffing needs will change in the coming years, as the program progresses through construction and begins operational stand-up of the facility  For example, over the next 5 years, the program will need to hire an operations director, bio-risk manager, chief information officer, and facility manager, among others, for NBAF operations management  However, the projected O&M funding shortfall during this same period could affect the program’s ability to hire new staff when needed and complete operational stand-up activities on time  NBAF officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  ELECTRONIC BAGGAGE SCREENING PROGRAM (EBSP) TRANSPORTATION SECURITY ADMINISTRATION (TSA) Established in response to the terrorist attacks of September 11, 2001, EBSP tests, procures, and deploys transportation security equipment, such as explosives trace detectors and explosives detection systems, across approximately 440 U S  airports to ensure 100 percent of checked baggage is screened for explosives  EBSP is primarily focused on delivering new systems with enhanced screening capabilities and developing software upgrades for existing systems  Program is incorporating requirements to address cybersecurity risk for existing systems  EBSP plans to pursue a new procurement approach in 2018, and staffing challenges exist  GAO last reported on this program in April 2017 (GAO-17-346SP)  In the program’s annual life-cycle cost estimate update, its operations and maintenance (O&M) costs exceeded the acquisition program baseline (APB) cost threshold, which constitutes a breach under the Department of Homeland Security’s (DHS) acquisition policy  The O&M costs increased when TSA accounted for updated maintenance costs and quantities, and shifted salaries from acquisition to O&M to align with DHS’s new appropriation structure  TSA officials said they did not submit a breach notification because they considered the movement of salaries to be an administrative change  The program plans to update its APB in calendar year 2018 to reflect a new plan for procuring equipment under its current acquisition strategy  TSA officials said this APB will also reflect the cost changes  In May 2016, DHS leadership approved a revised APB for EBSP, which reflects its current acquisition strategy to competitively procure systems on an ongoing basis using qualified product lists  The program’s revised APB cost thresholds decreased compared to its initial APB, which TSA officials attributed to various reasons, including shortening the program’s end date by 3 years and lower than anticipated actual costs, among other things  TSA officials told GAO that one of their primary challenges is funding, and the program is projected to face a $72 million acquisition funding shortfall in fiscal year 2018  TSA identified $70 million in carryover funding to address this gap  To mitigate anticipated funding gaps in future years, TSA officials said they may shift projects from one fiscal year to another or cancel them altogether, which may result in the delay or elimination of screening capabilities  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs  TSA anticipates receiving $980 million in O&M funding over this 5-year period to cover $1 billion in O&M costs  TSA officials anticipate achieving the program’s final APB milestone—initial operational capability (IOC) for systems that detect additional materials and provide an advanced threat detection algorithm—by its revised threshold date  Previously, EBSP planned to award contracts for these systems in September 2015 and September 2018, respectively  Transportation Security Administration (TSA) ELECTRONIC BAGGAGE SCREENING PROGRAM (EBSP) As of December 2017, EBSP had deployed 1,664 explosives detection systems and 2,638 explosives trace detectors nationwide  In 2018, EBSP plans to pursue a new competitive procurement approach to replace and update existing systems that will include: New contract vehicles to better align EBSP procurement activities with the program’s strategic roadmap  Updates to EBSP’s vendor qualification process to allow for vendor collaboration before testing  Transitioning from procuring systems with different sizes and speeds to two types: (1) inline systems that integrate with a baggage handling system and are linked through a network and (2) standalone systems that may be integrated with a baggage handling system, but not linked to a network  The program is in the process of updating its acquisition documentation to reflect this new procurement approach and TSA officials anticipate opening a qualified products list for new systems starting in June 2018  TSA officials said that staffing remains a challenge for the program because of cuts in government and contracted mission support staff and critical vacancies, including a division director  In September 2017, TSA reported that existing personnel across the program have assumed responsibilities of these positions, but workloads are unsustainable at current staffing levels  TSA officials stated that EBSP continues to procure, test, and deploy equipment and capabilities to recapitalize older equipment, improve security screening capability at airports, and enhance the detection capabilities of the fleet  They added that TSA employs extensive testing to verify the suitability and effectiveness of equipment to meet requirements  Moving forward, EBSP intends to establish IOC milestones for new technologies and capabilities, while allowing TSA the flexibility to make risk-based decisions  TSA officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  PASSENGER SCREENING PROGRAM (PSP) TRANSPORTATION SECURITY ADMINISTRATION (TSA) The Department of Homeland Security (DHS) established PSP in response to the terrorist attacks of September 11, 2001  PSP identifies, tests, procures, deploys, and sustains transportation security equipment across approximately 440 U S  airports to help TSA officers identify threats concealed on people and in their carryon items  The program aims to increase threat detection capabilities, improve the efficiency of passenger screening, and balance passenger privacy and security  Started testing on the Credential Authentication Technology in TSA Precheck lanes during 2017  Critical staffing vacancies persist and may delay followon acquisition planning efforts  GAO last reported on this program in April 2017 (GAO-17-346SP)  In May 2017, the DHS Under Secretary for Management (USM) approved the sixth version of the PSP acquisition program baseline (APB) and subsequently removed the program from breach status  In January 2016, TSA declared a schedule breach of a key milestone—acquisition decision event (ADE) 3—for the Credential Authentication Technology (CAT) because of delays in incorporating new cybersecurity requirements  Consistent with previous versions of the program’s APB, the new baseline modified the program’s cost, schedule, and performance parameters  For example, the program established the following: Separate CAT milestone dates for TSA Precheck and standard lanes  TSA officials stated there is no capability difference between screening lanes, but an initial focus on TSA Precheck lanes will assist with demonstrating CAT requirements and resolving past testing issues that contributed to an initial 4-year delay to CAT’s full operational capability (FOC) date  PSP now plans to reach FOC for CAT more than 5 years later than its revised target of June 2018 and more than 9 years later than initially planned  New FOC dates for other technologies, which TSA officials said are expected to be more realistic about delivery dates and account for changes in some FOC quantities  For example, TSA requested and received approval in September 2017 to increase FOC quantities for second generation Advanced Technology (AT-2) TierI systems to meet increasing passenger volume and expected airport growth  In May 2017, the USM also directed the program to revise its life-cycle cost estimate (LCCE) in response to less-than-expected funding levels  The new LCCE also shifted some acquisition costs to operations and maintenance (O&M) to be consistent with DHS’s new appropriation structure  TSA officials believe the new funding profile will be sufficient to sustain legacy PSP equipment, but will significantly limit the program’s ability to enhance existing equipment capabilities and support operational needs  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs  TSA anticipates receiving $906 million in O&M funding over this 5-year period to cover $923 million in O&M costs  05/17 APB version 6 0 approved 03/20 CAT ADE 3 (precheck lanes) 09/21 CAT ADE 3 (standard lanes) 12/21 CAT FOC (precheck lanes) 12/23 CAT FOC (standard lanes) Transportation Security Administration (TSA) PASSENGER SCREENING PROGRAM (PSP) Automated screening lanes operational utility assessment AT-2 tier II follow-on operational test & evaluation (OT&E) TSA employs two acquisition strategies to acquire PSP systems: Qualified Product List (QPL) approach—used for proven technologies when capability requirements are rigid and contractors’ systems are mature  Any contractors’ systems that demonstrate they meet the capability requirements are added to the QPL  TSA has used this approach to acquire the second generation AT-2 systems, Bottled Liquid Scanners, and Explosive Trace Detectors  Low Rate Initial Production (LRIP) approach—used when capability requirements are flexible and contractors’ systems are evolving  Under this approach, PSP uses a series of development contracts to enhance systems’ capabilities over time  PSP is currently using this approach to acquire CAT  TSA planned to initiate new acquisition programs starting in fiscal year 2018 that will replace PSP, but this effort may be at risk because of understaffing  In August 2017, TSA reported that its checkpoint screening division—whose staff is concurrently responsible for PSP and its follow-on programs—continued to have staffing vacancies, including project managers, analysts, and a deputy program manager  TSA is mitigating these gaps with existing staff and, according to TSA officials, the staffing challenges may decrease because the new programs may be delayed in response to funding cuts  TSA officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  TECHNOLOGY INFRASTRUCTURE MODERNIZATION (TIM) TRANSPORTATION SECURITY ADMINISTRATION (TSA) The TIM program was initiated to address shortfalls in TSA’s threat assessment screening and vetting functions by providing a modern and centralized end-to-end credentialing system  The TIM system will manage credential applications and the review process for millions of transportation workers and travelers across three segment populations: maritime, surface, and aviation  It will support large programs, such as TSA Precheck and the Transportation Worker Identification Credential  Operational testing identified limitations with the system; cybersecurity has not been assessed  Staffing gaps in key areas, such as systems engineering and testing, are a significant program risk  GAO last reported on this program in October and April 2017 (GAO-18-46, GAO-17- 346SP)  The TIM program is on track to meet the cost and schedule goals in its current acquisition program baseline (APB)  In September 2016, the Department of Homeland Security’s (DHS) Under Secretary for Management approved the TIM program’s revised APB—which reflected a new technical approach to deploy capabilities using an agile development methodology—and subsequently removed the program from breach status, authorizing TSA to resume new development after a nearly 22-month pause  DHS leadership paused new development in January 2015 after the program breached its initial APB goals for various reasons, including technical challenges, insufficient contractor performance, and the addition of new requirements after DHS leadership had approved the program’s initial acquisition strategy  The program now plans to achieve full operational capability (FOC) in March 2022 and its life-cycle cost estimate (LCCE) increased to account for this 6-year schedule slip and integration with the Transportation Vetting System, among other things  Since the program’s re-baseline, it has been developing and deploying capabilities in 2-month incremental agile releases, such as functionality to transition TSA Precheck program to the TIM system  The program updated its LCCE in November 2017 to inform a program review with DHS leadership, which is within its current APB cost thresholds  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs  TSA officials anticipate receiving approximately $318 million in O&M funding over this 5-year period, which includes nearly $118 million in fees from vetting programs  TSA officials plan to realign $57 million to cover the projected acquisition shortfall, and said any additional surplus funding available in fiscal year 2022 would be used to implement new system requirements identified by the program’s customers  In November 2017, TSA officials identified several program and technical risks that could affect the program’s cost, schedule, and performance  These risks include an increase in new requirements and increased risk of system vulnerabilities and cyberattacks if the program does not identify a provider to perform software updates on open source code  TSA officials are working to mitigate these risks  Transportation Security Administration (TSA) TECHNOLOGY INFRASTRUCTURE MODERNIZATION (TIM) Under the program’s new technical approach, TSA plans to replace the TIM system’s existing commercial-off-the-shelf applications with open source applications—software that can be accessed, used, modified, and shared by anyone—and move to a new virtual environment  The program’s new agile development methodology develops, tests, and deploys capabilities using an iterative, rather than a sequential approach  Consistent with this strategy, TSA awarded task orders in 2016 and 2017 totaling $34 5 million to the program’s existing contractor for agile design and development services, and plans to competitively award a new contract by May 2018  In October 2017, GAO found that TSA had not fully implemented several leading practices to ensure successful agile adoption  GAO also found that TSA and DHS needed to conduct more effective oversight of the TIM program to reduce the risk of repeating past mistakes  DHS concurred with all 14 recommendations made by GAO to improve program execution and oversight, and identified actions DHS and TSA can take to address them  TSA reported that staffing challenges are a significant risk to the program’s success and identified gaps in key areas—such as systems engineering, testing, and agile development  Program officials told GAO these positions cannot be filled because of a hiring freeze within TSA, which the component has imposed to assess their current workforce and restructure, if necessary  Program officials told GAO they requested waivers from the hiring freeze and, as of January 2018, they had received approval to hire 4 additional staff  TSA officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  FAST RESPONSE CUTTER (FRC) UNITED STATES COAST GUARD (USCG) The USCG uses the FRC to conduct search and rescue, migrant and drug interdiction, and other law enforcement missions  The FRC carries one cutter boat on board and is able to conduct operations in moderate sea conditions  The FRC replaces the USCG’s Island Class patrol boat and provides improved fuel capacity, surveillance, and communications interoperability with other Department of Homeland Security (DHS) and Department of Defense assets  FRC found operationally effective and suitable, and all key performance parameters validated  Main diesel engine issues persist, which may require further retrofits  GAO last reported on this program in March and April 2017 (GAO-17-218, GAO-17- 346SP)  According to USCG officials, the FRC program is on track to meet its current cost and schedule goals  The USCG plans to acquire 58 FRCs and, as of September 2017, 25 had been delivered and 19 were on contract  To inform the budget process, the program updated its life-cycle cost estimate in June 2017, which is within its current acquisition program baseline (APB) cost thresholds  Previously, the program’s initial operational capability (IOC) date slipped after a bid protest related to the program’s initial contract award—now known as phase 1—and the need for structural modifications  USCG officials attributed the 5-year slip in the program’s full operational capability (FOC) date to a decrease in annual procurement quantities under the phase 1 contract  Specifically, in fiscal years 2010 and 2011, the quantities decreased from 6 FRCs per year to 4  In May 2014, the USCG determined that it would procure only 32 of the 58 FRCs through this contract and initiated efforts to conduct a full and open competition for the remaining 26 vessels—known as phase 2  In May 2016, the USCG awarded the phase 2 contract for the remaining 26 FRCs, which has a potential value of $1 42 billion  Under the phase 2 contract, the USCG can procure 4 to 6 FRCs per option period  The USCG ordered 6 FRCs at the time of the phase 2 award and, in June 2017, exercised an option for an additional 6 FRCs  The USCG has established that the annual procurement quantity will be dictated by funding levels, and funding shortfalls could cause further schedule delays  The affordability gap from fiscal years 2018 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not contain operations and maintenance (O&M) funding for USCG programs  USCG officials anticipate receiving $1 6 billion in O&M funding over this 5-year period  USCG officials stated that they expect to exercise an option for 4 FRCs in fiscal year 2018 and that the USCG plans to prioritize acquisition funding in fiscal years 2019 and 2020 to procure the final 10 hulls and complete procurement of all 58 FRCs  United States Coast Guard (USCG) FAST RESPONSE CUTTER (FRC) The USCG continues to work with the contractor—Bollinger Shipyards, LLC—to address issues covered by the warranty and acceptance clauses for each ship  For example, 18 engines—9 operational engines and 9 spare engines—have been replaced under the program’s warranty  According to USCG documentation, 65 percent of the current issues with the engines have been resolved through retrofits; however, additional problems with the engines have been identified since our April 2017 review  For example, issues with water pump shafts are currently being examined through a root cause analysis and will be redesigned and are scheduled to undergo retrofits starting in December 2018  We previously found that the FRC’s warranty resulted in improved cost and quality by requiring the shipbuilder to pay for the repair of defects  As of September 2017, USCG officials said the replacements and retrofits completed under the program’s warranty allowed the USCG to avoid an estimated $104 million in potential unplanned costs—of which $63 million is related to the engines  The FRC program does not have any critical staffing vacancies, but the USCG identified insufficient staffing for shore-side support groups as a potential risk that could affect the asset’s operations  These groups provide maintenance to the FRCs while they are in port  In order to mitigate this staffing issue, the USCG is using commercial contracts for maintenance to supplement the capacity of the USCG’s maintenance staff  USCG officials stated that the FRC program is fully funded, executable, and on track to reach FOC by March of 2027  They added that FRCs were recently delivered to locations in Mississippi, Alaska, and Hawaii  USCG officials stated that FRCs are integral to USCG operations, such as providing critical support during the recent hurricane season, and that the program office continues to work with the contractor and stakeholders to quickly and properly address issues with FRCs as they are identified  USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  H-65 CONVERSION/SUSTAINMENT PROGRAM (H-65) UNITED STATES COAST GUARD (USCG) The H-65 aircraft is a short-range helicopter that the USCG uses to fulfill its missions, including search and rescue, ports and waterways security, marine safety, and defense readiness  The H-65 acquisition program increased the fleet’s size by 7 aircraft, added armament capabilities, upgraded navigation systems, and replaced each of the helicopters’ engines  The program is currently focused on upgrades to radar sensors, the automatic flight control system (AFCS), and avionics  Operational assessment of avionics upgrade planned to start in February 2018  Program fully staffed, but schedule slips raise risks with future staffing requirements  GAO last reported on this program in April 2017 (GAO-17-346SP)  As of November 2017, the program remains in breach of its current acquisition program baseline (APB)  In November 2016, the USCG notified Department of Homeland Security (DHS) leadership that it would not complete all activities required—including developmental testing and an operational assessment—to achieve acquisition decision event (ADE) 2C for low-rate initial production of the avionics and AFCS upgrades by its current APB threshold date of March 2017  USCG officials primarily attributed these delays to an underestimation of the technical effort necessary to meet the requirements and have subsequently worked with the contractor to continue development of avionic upgrades  In January 2017, DHS leadership directed the program to update its APB, life-cycle cost estimate (LCCE) and test and evaluation master plan by May 2017  However, the USCG did not meet this deadline, in part, because it decided to add a service life extension program (SLEP) to the H-65 program  The SLEP is expected to extend the current 20,000 flight hour service life of each aircraft by another 10,000 flight hours by replacing obsolete aircraft components  USCG officials stated that this will allow the USCG to delay purchasing new aircraft to prioritize funding for the Offshore Patrol Cutter  USCG officials plan to obtain approval for the SLEP when the program submits its revised APB for DHS approval, which is expected by March 2018  The program is revising its LCCE, but provided an update in June 2017 to inform the budget process  This update exceeds its current APB thresholds because it includes an initial estimate for the SLEP  The USCG estimates that the SLEP will cost $54 million for the entire fleet  USCG officials attributed the increase in operations and maintenance (O&M) costs to the additional extension of the aircraft’s operational life  The program’s O&M costs previously increased due to the USCG’s decision to extend the aircraft’s operational life from 2030 to 2039  The affordability gap from fiscal years 2018 to 2022 may be overstated because— as we found in April 2015—DHS’s funding plan to Congress does not contain O&M funding for USCG programs  USCG officials anticipate receiving $1 6 billion in O&M funding over this 5-year period  United States Coast Guard (USCG) H-65 CONVERSION/SUSTAINMENT PROGRAM (H-65) The USCG awarded new contracts to Rockwell Collins—the original equipment manufacturer of the legacy AFCS and avionics—to address the challenges encountered with development of the new upgrades  Specifically, the program awarded new contracts to support continued development of the AFCS and avionics upgrades in July 2016 and March 2017, respectively  As of September 2017, the combined value of both contracts totaled more than $15 million  The USCG cancelled development of a dedicated surface search radar capability for the H-65 in 2014, but USCG officials said a commercial off-the-shelf weather radar with surface search capability will be installed as part of the avionics upgrade  USCG officials said there is some risk involved with extending the aircrafts’ service life beyond 20,000 flight hours since it has never been done by other agencies that operate the H-65  However, USCG officials stated that the aircraft manufacturer, Airbus, assisted the USCG’s chief aeronautical engineer in identifying specific parts needing replacement and is providing support  In July 2017, the USCG reported that the program was fully staffed, but that the schedule slips have introduced potential risks with future staffing requirements  The program is mitigating these risks by extending some military personnel and ensuring rotating personnel are replaced by new staff with the expertise needed to complete the program’s planned activities, such as testing  USCG officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  UNITED STATES COAST GUARD (USCG) The program is intended to assist the USCG in maintaining the capability to access the Arctic and Antarctic polar regions  The USCG requires its icebreaking fleet to conduct multiple missions, including defense readiness; marine environmental protection; ports, waterway, and coastal security; and search and rescue  The USCG plans to acquire three heavy icebreakers to recapitalize the only existing operational heavy icebreaker, which is nearing the end of its service life  Program initiated model testing of hull and propulsion systems, which will inform design decisions  Program office integrates USCG and Navy personnel, but funding responsibilities may cause challenges  GAO last reported on this program in September 2017 (GAO-17-698R)  In June 2014, Department of Homeland Security (DHS) leadership granted the program acquisition decision event (ADE) 1 approval  The Acting Under Secretary for Management also acknowledged the USCG’s need to accelerate the acquisition process to mitigate gaps in the heavy icebreaking capability because the service life of the USCG’s only heavy polar icebreaker, which had already been extended, could end as early as 2020  In January 2018, DHS leadership approved the program’s initial acquisition program baseline (APB) establishing cost, schedule, and performance goals  The USCG planned to achieve a combined ADE 2A and 2B by December 2017, which would authorize the initiation of development efforts  According to DHS officials, this milestone was delayed to February 2018 to allow for the completion of required acquisition documents to inform the decision, such as the program’s life-cycle cost estimate and APB  The USCG is partnering with the Navy to leverage shipbuilding expertise and engaging early with potential shipbuilders through industry studies to mitigate some risks associated with the program’s accelerated acquisition schedule  However, GAO previously found that the program faces challenges in implementing the accelerated schedule  For example, the first icebreaker—which is preliminarily estimated to cost about $750 million to design and construct—would need to be fully funded in fiscal year 2019 at the same time the USCG is expecting to prioritize funding for the Offshore Patrol Cutter  In fiscal year 2017, the Consolidated Appropriations Act or associated explanatory materials, reflected funding for the program, including $150 million for advance procurement of heavy polar icebreakers and $25 million to the USCG for programmatic costs, respectively  USCG officials stated that the Navy funding could cover most of the design costs but would not cover long lead items or construction costs for any of the ships  They further stated that uncertainties with the amount and source of future appropriations have made planning the icebreaker acquisition challenging  United States Coast Guard (USCG) DHS leadership approved four key performance parameters (KPP) related to the ship’s ability to independently break through ice, the ship’s operating duration, and communications  In May 2017, the USCG began model testing of potential hull designs and propulsion configurations  USCG officials explained that the hulls of icebreakers are unique from other ships because they must balance a hull design optimized for icebreaking, which are generally broad and blunt, against a hull design optimized for seakeeping, which are generally narrow and streamlined  USCG officials noted that the power demands and propulsion system for the ship are dependent on the hull design  USCG officials stated that maneuverability was identified as a challenge during model testing and explained that azimuthing propulsors—propellers that sit below the ship and can rotate 360 degrees—offered better maneuverability than traditional propulsion systems  USCG officials said these propulsors are widely used on commercial ships, but may need modification to meet the USCG’s requirements  USCG officials anticipate results from the model testing to be completed by March 2018 and plan to use these results to inform the final specifications for the ships  The USCG established an integrated heavy polar icebreaker program office with the Navy and in 2017, DHS, the USCG, and Navy entered into several agreements that outline oversight roles, among other things  For example, these agreements state that the program will follow DHS acquisition policies with DHS leadership serving as the acquisition decision authority for program milestones  However, the Navy will review and approve acquisition documents before the program seeks DHS approval  These agreements also state that the program’s contracting actions could be funded by either USCG or Navy appropriations, and the source of the appropriations will award the contract  The program plans to competitively award a contract, which would include options for the detail design and construction for all three ships to a single shipbuilder by June 2019  Program officials stated they plan to award the contract under full and open competition to obtain competitive prices and include the construction of the three ships as options to accommodate the program’s funding uncertainties  In February 2017, the USCG awarded contracts to five shipbuilders—valued at approximately $4 million each—for design studies which will inform program decisions  Program officials stated that under these design studies contracts, the shipbuilders developed several potential ship designs and preliminary costs, with a focus on alternative propulsion options and hull designs  In August 2017, USCG officials told GAO that the program’s staffing gap was not negatively impacting program efforts  USCG officials stated that the program office had completed requirements for ADE 2A and 2B, and is on track to release the request for proposals for the detail design and construction contract by March 2018  These officials added that, during 2017, the program office refined the program’s requirements, completed ice and open water model testing, and partnered with five industry teams to evaluate multiple design solutions  USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  LONG RANGE SURVEILLANCE AIRCRAFT (HC-130H/J) UNITED STATES COAST GUARD (USCG) The USCG uses HC-130H and HC-130J aircraft to conduct search and rescue missions, transport cargo and personnel, support law enforcement, and execute other operations  Both aircraft are quad-engine propeller-driven platforms  The HC-130J is a modernized version of the HC-130H, which has advanced engines, propellers, and equipment that provide enhanced speed, altitude, range, and surveillance capabilities  Performance testing of new mission system processor complete  Transfer of HC-130H aircraft to other agencies ongoing  GAO last reported on this program in April 2017 (GAO-17-346SP)  During 2017, the USCG continued a nearly 3-year effort to re-baseline the program— which includes revisions to the program’s life-cycle cost estimate (LCCE) and acquisition program baseline (APB)—to account for significant changes  Specifically, the USCG decided to pursue an all HC-130J fleet and, in fiscal year 2014, Congress directed the transfer of 7 HC-130H aircraft to the U S  Air Force  The USCG was in the process of upgrading these aircraft, but cancelled further HC-130H upgrades  In September 2017, Department of Homeland Security (DHS) leadership directed the USCG to submit the revised APB by January 2018  According to USCG officials, the re-baseline has been delayed, in part, because Congress also directed the USCG to conduct a multi-phased analysis of its mission needs  In November 2016, the USCG submitted the results of its analysis for fixed- wing aircraft, which confirmed the planned total quantity of 22 HC-130J aircraft and an annual flight-hour goal of 800 hours per aircraft  USCG officials said the results of the analysis will be reflected in the program’s revised LCCE and subsequent APB, but noted that challenges with the vendor hired to complete the LCCE revision have also contributed to delays  The program submitted cost information in June 2017 to inform the budget process, but it reflected no updates from the program’s November 2011 LCCE  USCG officials previously attributed the acquisition cost growth and schedule slip from the program’s initial APB to the increase in HC-130J quantities from 6 to 22  However, when the revised LCCE is complete, estimated costs may decrease since the HC-130J aircraft are less expensive to maintain  As of December 2017, USCG officials stated they had received 11 HC-130J aircraft and had awarded contracts for 3 more—some of which were not requested  USCG officials previously stated that the program needs to acquire 1-2 HC-130J aircraft per year to meet its full operational capability (FOC) date  However, it is unclear how the USCG will meet its FOC date because it only requested funding for 1 aircraft over the next 5 years  The affordability gap from fiscal years 2018 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not contain operations and maintenance (O&M) funding for USCG programs  USCG officials anticipate receiving approximately $1 4 billion in O&M funding over this 5- year period  United States Coast Guard (USCG) LONG RANGE SURVEILLANCE AIRCRAFT (HC-130H/J) In December 2013, Congress directed the transfer of 7 HC-130H aircraft to the U S  Air Force for modifications—which consists of upgrades and installing a fire retardant delivery system—and subsequent transfer to the U S  Forest Service  This direction factored into the USCG’s decision to pursue an all HC-130J fleet  As of December 2017, the Forest Service had not yet received any modified aircraft primarily because of issues with contractors  According to USCG officials, the original contract the Air Force awarded to install the fire retardant delivery system in May 2016 was terminated 7 months later due to an unqualified vendor and a new contract has not yet been awarded  In the meantime, the Forest Service is using 2 of the 7 HC-130Hs  USCG officials said these aircraft are not modified, but outfitted with a less effective firefighting device  As of November 2017, the USCG plans to operate 14 of its HC-130H aircraft until the end of their service lives or until they can be replaced with new HC-130J aircraft  However, as previously discussed, the USCG has not requested funding for the additional HC-130J aircraft to support this plan  In October 2017, USCG officials reported that they were in the process of hiring staff to address the program’s staffing gap  USCG officials provided technical comments on a draft of this assessment, which GAO incorporated, as appropriate  MEDIUM RANGE SURVEILLANCE AIRCRAFT (HC-144A/ C-27J) UNITED STATES COAST GUARD (USCG) The USCG uses HC-144A and C-27J aircraft to conduct all types of missions, including search and rescue and disaster response  All 32 aircraft—18 HC-144A aircraft and 14 C-27J aircraft—are twin-engine propeller driven platforms  The interior of both aircraft are able to be re-configured to accommodate cargo, personnel or medical transports  Developmental testing of new mission system processor is ongoing  Program continues to face challenges related to purchasing spare parts and accessing technical data  GAO last reported on this program in April 2017 and March 2015 (GAO-17-346SP, GAO-15-325)  USCG officials said the program is on track to meet the cost and schedule goals in its current acquisition program baseline (APB), which Department of Homeland Security (DHS) leadership approved in August 2016 to reflect the restructuring of the HC-144A acquisition program  The USCG initially planned to procure a total of 36 HC-144A aircraft, but reduced that number to the 18 it had already procured after Congress directed the transfer of 14 C-27J aircraft from the U S  Air Force to the USCG in fiscal year 2014  The program’s APB divides the program into two phases: phase 1 includes acceptance of the 18 HC-144A aircraft and upgrades to the aircraft’s mission and flight management systems, and phase 2 includes acceptance of and modifications to the C-27J aircraft to meet the USCG’s mission needs  In October 2017, USCG officials told GAO that the program had initiated phase 1 efforts to upgrade the first HC-144A aircraft  The USCG plans to complete upgrades on all HC-144As by the end of fiscal year 2021  For phase 2, the USCG has accepted all 14 C-27Js from the U S  Air Force and plans to complete the modification of all C-27Js by March 2025 to achieve full operational capability (FOC)  To inform the budget process, the program updated its life-cycle cost estimate (LCCE) in June 2017, which is within its current APB cost thresholds  This estimate includes C-27J modification costs, such as installation of a new sensor package and new mission system processor  The program’s LCCE for the 36 HC-144A aircraft previously increased to $28 7 billion in 2012 when the USCG accounted for 5 years of additional costs, among other things  The current LCCE represents a considerable decrease, but also reflects a reduction in the number of aircraft and planned flight hours  The affordability gap from fiscal years 2018 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not contain operations and maintenance (O&M) funding for USCG programs  USCG officials anticipate receiving nearly $1 7 billion in total funding over this 5-year period to cover nearly $1 8 billion in total costs  United States Coast Guard (USCG) MEDIUM RANGE SURVEILLANCE AIRCRAFT (HC-144A/C-27J) The USCG still faces challenges in transitioning the C-27J into the USCG fleet  In March 2015, GAO found that the successful and cost-effective fielding of the C-27J aircraft is contingent on the USCG’s ability to address risk areas including, purchasing spare parts and accessing technical data, among other issues  According to USCG officials, the program continues to face challenges purchasing spare parts and accessing technical data  The program is reliant on the aircraft original equipment manufacturer for about 35 percent of spare C-27J parts  For other parts, USCG officials said that the USCG continues to look for ways to provide the same or similar parts for the aircraft at a faster rate and the USCG plans to award contracts to two additional manufacturers in calendar year 2018  USCG officials stated that retrieving technical data for the C-27J aircraft remains a challenge, but the USCG is working with the Department of Defense to obtain rights to data currently owned by the original equipment manufacturer  Once the USCG receives appropriate rights to C-27J technical data, the USCG officials said they can begin modification of the aircraft  The USCG also plans to purchase the same surface search radar used on the HC-144A or the HC-130J for the C-27J, which will give the USCG some commonality in maintenance, logistics, and training for this aspect of the aircraft  In October 2017, USCG officials told GAO that the program’s staffing is adequate and the gap has not negatively affected the program  USCG officials stated that the program remains on track to meet the cost, schedule, and performance goals outlined in its current APB and that they monitor APB key parameters in accordance with DHS guidance  These officials added that market research continues to increase supply chain sources and to identify products for new mission systems  USCG officials also provided technical comments, which GAO incorporated as appropriate  NATIONAL SECURITY CUTTER (NSC) UNITED STATES COAST GUARD (USCG) The USCG uses the NSC to conduct search and rescue, migrant and drug interdiction, environmental protection, and other missions  The NSC replaces and provides improved capabilities over the USCG’s High Endurance Cutters  The NSC carries helicopters and cutter boats, provides an extended on-scene presence at forward deployed locations, and operates worldwide  Follow-on operational testing began in October 2017, but cybersecurity testing delayed  The USCG is conducting a study to determine root cause of propulsion system issues  GAO last reported on this program in March and April 2017 (GAO-17-218, GAO-17- 346SP)  In November 2017, Department of Homeland Security (DHS) leadership approved a revised acquisition program baseline (APB), which accounted for the addition of a ninth NSC to the program of record  The USCG originally planned to acquire only eight NSCs; however, in the Consolidated Appropriations Act of 2016, Congress directed that not less than $640 million be immediately available and allotted to contract for the production of a ninth NSC  In December 2016, the USCG awarded a contract to produce the ninth NSC and, as of November 2017, six NSCs had been delivered and three were under construction  The USCG anticipates delivery of the ninth NSC in September 2020, which coincides with the program’s prior APB threshold date for full operational capability (FOC)  However, the revised APB extends this date by 1 year to account for any risks in delivering the additional ship  The program’s FOC date previously slipped 4 years, which USCG officials attributed to funding shortfalls, among other things  The ninth NSC contributed to a $453 million and $123 million increase in the program’s APB cost thresholds for acquisition and operations and maintenance (O&M), respectively  However, the program’s revised life-cycle cost estimate (LCCE) is still lower than its initial estimate for eight ships, which USCG officials attribute to more accurate estimates  The revised LCCE also included costs for several design changes the USCG has had to implement on equipment with known issues  As of September 2017, 12 equipment systems required design changes, which totaled an estimated cost of over $260 million  This work includes structural enhancement work on the first two NSCs and the replacement of the gantry crane, which aids in the deployment of cutter boats  The affordability gap from fiscal years 2018 to 2022 may be overstated because— as we found in April 2015—DHS’s funding plan to Congress does not contain O&M funding for USCG programs  USCG officials anticipate receiving approximately $2 1 billion in O&M funding over this 5-year period to cover the NSC’s estimated $1 8 billion in O&M costs, but stated it will refine its annual budget request based on the program’s needs each year  The USCG also identified carryover funding to cover the projected acquisition funding shortfall in fiscal year 2018  United States Coast Guard (USCG) NATIONAL SECURITY CUTTER (NSC) The NSC program does not have any critical staffing vacancies  However, in July 2017, the program reported that the greatest staffing challenge is a potential extension to the program’s end date if the USCG acquires more than 9 NSCs  If this occurs, the program office must reassess future staffing requirements to ensure adequate program oversight continues until the last NSC completes post-delivery activities  In addition, the USCG has made changes to its staffing model for operating the NSCs  The USCG initially planned to implement a crew rotational concept in which crews would rotate while NSCs were underway to achieve a goal of 230 days away from the cutter’s homeport  In February 2018, USCG officials told GAO they abandoned the crew rotational concept because the concept did not provide the USCG with the expected return on investment  Instead, USCG officials said a new plan has been implemented that does not rotate crew and is anticipated to increase the days away from home port from the current capability of 185 days to 200 days  USCG officials stated that NSCs had a record year of narcotics seizures in 2017  In addition to the test activities identified in this assessment, USCG officials stated that the first follow-on OT&E event was completed in December 2017 and the first cybersecurity test event is scheduled for February 2018  They also noted that the shipbuilder continues to show improving cost performance and is completing construction within budget  USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  OFFSHORE PATROL CUTTER (OPC) UNITED STATES COAST GUARD (USCG) The USCG plans to use the OPC to conduct patrols for homeland security, law enforcement, and search and rescue operations  The OPC is being designed for long-distance transit, extended on-scene presence, and operations with deployable aircraft and small boats  It is intended to replace the USCG’s aging Medium Endurance Cutters (MEC) and bridge the operational capabilities provided by the Fast Response Cutters and National Security Cutters (NSC)  Program plans to refine the ship’s design, as needed, based on early operational assessment results  Program’s acquisition strategy incorporated some best practices  GAO last reported on this program in April and June 2017 (GAO-17-346SP, GAO-17-654T)  According to USCG officials, the OPC program is on track to meet its cost and schedule goals  In September 2014, Department of Homeland Security (DHS) leadership approved the program’s current acquisition program baseline (APB), which accounts for schedule slips resulting from delays in awarding the program’s initial contracts and a subsequent bid protest  The USCG expects to start construction of the first OPC in fiscal year 2019 and procure a total of 25 ships  The USCG plans to initially fund one OPC per year and eventually two OPCs per year until all 25 OPCs are delivered  USCG officials have stated that additional OPC delays will decrease the USCG’s operational capacity because the MECs will likely require increased downtime for maintenance and other issues, reducing their availability  In January 2016, DHS leadership directed the USCG to revise the OPC life-cycle cost estimate (LCCE) and submit it for approval within 6 months of awarding the detailed design and construction contract for the ships—which the USCG subsequently awarded in September 2016  In June 2017, the program submitted an updated LCCE to inform the budget process that—while not approved by DHS leadership—accounts for the contract award and the program’s schedule slips  As of December 2017, the program’s revised LCCE still had not been approved  It is unclear whether it will address other issues, such as an increase in the estimated weight of each ship  The OPC’s initial LCCE was based in large part on the estimated weight of each ship  However, in November 2017, USCG officials said the ship is expected to weigh up to 35 percent more than originally estimated  Nevertheless, USCG officials expect to procure all 25 OPCs for the program’s APB objective cost of $10 5 billion because the contractor identified cost efficiencies to compensate for the increased weight  GAO previously raised questions about the OPC’s affordability and its effect on other USCG acquisition programs, such as the Heavy Polar Icebreaker  Specifically, GAO noted that the OPC procurement will consume about two-thirds of the USCG’s planned acquisition budget between fiscal years 2018 and 2032 based on recent funding history  The program’s affordability gap from fiscal years 2020 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not report operations and maintenance (O&M) funding for USCG programs  USCG officials anticipate receiving $103 million in O&M funding over this 5-year period  United States Coast Guard (USCG) OFFSHORE PATROL CUTTER (OPC) The USCG is in the process of completing the design of the OPC before starting construction, which is in-line with GAO shipbuilding best practices  In addition, USCG officials stated that the program is using state-of-the-market technology that has been proven on other ships as opposed to state-of-the-art technology, which lowers the risk of the program  The USCG used a two-phased down-select strategy to select a contractor to deliver the OPC  For phase 1, the USCG conducted a full and open competition and selected three contractors to perform preliminary design work  For phase 2, the USCG selected one of the phase 1 contractors—Eastern Shipbuilding—to develop a detailed design of the OPC and construct no more than the first 11 ships  The contract—worth approximately $110 million—includes separate options for each ship  The options for ships 10 and 11 were unpriced and included in the solicitation as an incentive to convert the contract type from fixed price incentive to firm fixed price  These options will be included in a repricing proposal submitted by the contractor for ships 6-9 after delivery of the first ship  USCG officials have stated the USCG will decide whether to exercise the option for ships 10 and 11 based on the contractor’s re-pricing proposal for ships 6-9  The USCG plans to re-compete the contract for the remaining 14-16 ships  The OPC program continued to increase its required staffing level and the USCG reported that adjustments to staffing will continue as the program matures  The program faces shortages including engineers, a logistics manager, and a technical director, but USCG officials said they are hiring staff to address these gaps  USCG officials stated that the OPC program is fully funded, executable, and on track to award construction for the first OPC in September 2018  These officials said design efforts are on track and the contractor is meeting the milestones to deliver the first OPC in 2021  USCG officials noted that they are continuing to increase staff at the contractor’s facility to prepare for the start of construction for the first OPC  USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  UNITED STATES CITIZENSHIP AND IMMIGRATION SERVICES (USCIS) The Transformation program was established in 2006 to transition USCIS from a fragmented, paper-based filing environment to a consolidated, paperless environment for processing immigration and citizenship applications  The program developed a new system architecture and delivers capability through releases that correspond to new product lines within four lines of business: Citizenship, Immigrant, Non-Immigrant, and Humanitarian  Revision of key performance parameters and test and evaluation master plan in progress  Program is reorganizing to leverage expertise within USCIS and revise its approach  GAO last reported on this program in April 2017 and July 2016 (GAO-17-346SP, GAO-16- 467)  The program remains in breach of its current acquisition program baseline (APB)  In September 2016, the Transformation program experienced a schedule breach when it failed to complete deployment of all the product lines associated with the Citizenship line of business  The deployment was delayed because of challenges processing new product lines on the new system architecture and other technical issues with the case management system  Prior to the breach, the program deployed six product lines, which supported approximately 24 percent of the total workload processed by USCIS in fiscal year 2016  Department of Homeland Security (DHS) leadership previously re- baselined the program in April 2015 after USCIS determined that it could not use any of the architecture delivered under its initial strategy, despite having invested more than $475 million in its development  In December 2016, DHS leadership directed USCIS to stop planning and development for new product lines, develop a breach remediation plan, and update its acquisition documentation  In February 2017, DHS leadership approved the program’s remediation plan and the program has since made progress in implementing this plan  However, DHS leadership elected to continue with the program’s pause in new development following program reviews in March 2017, July 2017, and October 2017  USCIS officials said they are revising the program’s acquisition documents—including its APB and life-cycle cost estimate (LCCE)—and plan to re-baseline by March 2018  The program updated the total costs in its LCCE to inform the budget process, but these costs do not reflect the program’s re-baselining plans  As a result, the status of the program against its cost and schedule goals is unclear  However, the program is more than 3 years past its original full operational capability (FOC) date  The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance funding for individual programs  USCIS uses revenue from premium processing fees to fund the Transformation program and routinely collects more fees than the program’s estimated costs  USCIS officials told GAO that the program office underwent a reorganization in January 2017 to help address the program’s recent challenges  This effort included dismantling the program office and repositioning Transformation under the USCIS Office of Information Technology so the program could leverage expertise in areas such as engineering within USCIS  USCIS officials reported that the program no longer plans to deliver capability by product lines because this strategy focused too narrowly on the automation of forms associated with the lines of business  Going forward, USCIS officials said the program plans to develop capabilities that will address broader objectives, such as reducing the time it takes to process applications and decisions  The program previously made significant changes after it experienced a 5-month delay with its first release, which was deployed in May 2012  DHS attributed this delay to weak contractor performance and pursuing an unnecessarily complex system, among other things  To address these issues, the Office of Management and Budget, DHS, and USCIS determined the program should implement a new acquisition strategy, which allowed for an agile software development methodology and increased competition for development work  This strategy was reflected in the program’s April 2015 re-baseline  USCIS officials told GAO that they plan to address the Transformation program’s staffing gap now that the reorganization is complete  USCIS officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate  To help determine the extent to which the Department of Homeland Security (DHS) has taken actions to enhance its policies and processes to better reflect key portfolio management practices, we assessed the department’s requirements, acquisition management, and resource allocation policies using key practices we established in September 2012  These key practices are based on our past work, in which we examined the practices that private sector entities use to achieve a balanced mix of new projects and found that successful commercial companies use a disciplined and integrated approach to prioritize needs and allocate resources  As a result, these organizations can avoid pursuing more projects than their resources can support and better optimize the return on their investments  This approach, known as portfolio management, requires companies to view each of their investments as contributing to a collective whole, rather than as independent and unrelated  The objectives of this audit were designed to provide congressional committees insight into the Department of Homeland Security’s (DHS) major acquisition programs  We assessed the extent to which (1) DHS’s major acquisition programs are on track to meet their schedule and cost goals and (2) DHS has taken actions to enhance its policies and processes to better reflect key portfolio management practices  To answer these questions, we reviewed 28 of DHS’s 79 major acquisition programs  We reviewed all 16 of DHS’s Level 1 acquisition programs— those with life-cycle cost estimates (LCCE) of $1 billion or more—that had at least one project, increment, or segment in the Obtain phase—the stage in the acquisition life cycle when programs develop, test, and evaluate systems—at the initiation of our audit  Additionally, we reviewed 12 other major acquisition programs—including 8 Level 1 programs that either had not yet entered or were beyond the Obtain phase, and 4 Level 2 programs that have LCCEs between $300 million and less than $1 billion—that we identified were at risk of not meeting their cost estimates, schedules, or capability requirements based on our past work and discussions with DHS officials  Specifically, we met with representatives from DHS’s Office of Program Accountability and Risk Management (PARM)—DHS’s main body for acquisition oversight—as a part of our scoping effort to determine which programs (if any) were facing difficulties in meeting their cost estimates, schedules, or capability requirements  The 28 selected programs were sponsored by eight different components, and they are identified in table 7, along with our rationale for selecting them  To determine the extent to which DHS’s major acquisition programs are on track to meet their schedule and cost goals, we collected key acquisition documentation for each of the 28 programs, such as all LCCEs and acquisition program baselines (APB) approved at the department level since DHS’s current acquisition management policy went into effect in November 2008  DHS policy establishes that all major acquisition programs should have a department-approved APB, which establishes a program’s critical cost, schedule, and performance parameters, before they initiate efforts to obtain new capabilities  Twenty four of the 28 programs had one or more department-approved LCCEs and APBs between November 2008 and December 31, 2017  We used these APBs to establish the initial and current cost and schedule goals for the programs  We then developed a data collection instrument to help validate the information from the APBs and collect similar information from programs without department-approved APBs  Specifically, for each program, we pre-populated a data collection instrument to the extent possible with the schedule and cost information we had collected from the APBs and our 2017 assessment (if applicable) to identify schedule and cost goal changes, if any, since (a) the program’s initial baseline was approved and (b) January 2017—the data cut-off date of the report we issued in April 2017  We shared our data collection instruments with officials from the program offices to confirm or correct our initial analysis and to collect additional information to enhance the timeliness and comprehensiveness of our data sets  We then met with program officials to identify causes and effects associated with any identified schedule and cost goal changes  Subsequently, we drafted preliminary assessments for each of the 28 programs, shared them with program and component officials, and gave these officials an opportunity to submit comments to help us correct any inaccuracies, which we accounted for as appropriate (such as when new information was available)  Additionally, in July 2017, we collected copies of the detailed data on affordability that programs submitted to inform the fiscal year 2019 resource allocation process  We also collected copies of any annual LCCE updates programs submitted in fiscal year 2017  For each of the 24 programs with a department-approved APB, we compared (a) the most recent cost data we collected (i e , a department-approved LCCE, the detailed LCCE information submitted during the resource allocation process, a fiscal year 2017 annual LCCE update, or an update provided by the program office) to (b) DHS’s funding plan presented in the Future Years Homeland Security Program (FYHSP) report to Congress for fiscal years 2018–2022, which presents 5-year funding plans for DHS’s major acquisition programs, to assess the extent to which a program was projected to have an acquisition funding gap in fiscal year 2018  Through this process, we determined that our data elements were sufficiently reliable for the purpose of this engagement  The FYHSP reports information by the department’s new common appropriation structure, which created standard appropriation fund types including (1) procurement, construction, and improvements and (2) operations and support  We refer to these types of funding as (1) acquisition and (2) operations and maintenance throughout this report  which are listed in appendix II—and identified any significant shortfalls  Specifically, we assessed the joint requirements directives and instruction manual; DHS’s Acquisition Management Directive 102-01, Acquisition Management Instruction 102-01-001, and other related guidance; and DHS’s resource allocation directive, instruction, and handbook  First, we assessed each group of policies against the key practices using the following ratings: Met—the documents fully reflected the key practice  Partially met—the documents reflected some, but not all parts of the key practice  Not met—the documents did not reflect the key practice  We shared our preliminary analysis for each group of policies with the DHS officials responsible for implementing them—specifically, the Joint Requirements Council (JRC), PARM, and the Office of Program Analysis and Evaluation (PA&E)—to discuss our findings, identify relevant sections of the documents we had not yet accounted for, and solicit their thoughts on those key practices that were not reflected in the policies  Second, we used the scores for each group of policies to develop a department-wide rating for each key practice  When applicable, we weighted the department-wide rating based on the intent of the key practice  For example, the department-wide rating for the key practice related to resource allocation across the portfolio was based more heavily on the rating for the resource allocation policies, rather than the ratings for the requirements or acquisition management policies  Third, we rolled-up the ratings for all the key practices in a particular area—as identified in appendix II—to establish a department-wide overall rating for each key practice area  We concluded that a key practice area was met if all ratings for the individual key practices in that area were met; partially met if the ratings for the individual key practices in that area were all partially met or a mix of met and not met; or not met if the ratings for the individual key practices in that area were all not met  In addition, we reviewed documentation that resulted from DHS’s requirements, acquisition management, and resource allocation processes since January 2016 to get a sense of how the department has implemented its current policies  For example, we reviewed JRC- validated requirements documents; acquisition decision memorandums; Acquisition Program Health Assessment reports; and documentation related to the development of DHS’s fiscal year 2018 budget request and the fiscal year 2018–2022 FYHSP report, including resource allocation guidance, presentations to DHS leadership, and preliminary decisions  We also interviewed officials from the JRC, PARM, PA&E, and the Deputy’s Management Action Group to identify any current and planned initiatives to improve management of the department’s portfolio of major acquisition programs  We then compared our assessment of DHS’s current policies, practices, and planned initiatives to our previous findings and the Standards for Internal Control in the Federal Government  We conducted this performance audit from March 2017 through May 2018 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  In addition to the contact listed above, Rick Cederholm (Assistant Director), Aryn Ehlow (Analyst-in-Charge), Pete Anderson, Lorraine Ettaro, Helena Johnson, TyAnn Lee, Alexis Olson, Sylvia Schatz, Roxanna Sun, and Lindsay Taylor made key contributions to this report  Other contributors included Mathew Bader, Carissa Bryant, Andrew Burton, Erin Butkowski, Lisa Canini, Jenny Chow, John Crawford, Lindsey Cross, Laurier R  Fish, Betsy Gregory-Hosler, Claire Li, Sarah Martin, Marycella Mierez, Erin O’Brien, Katherine Pfeiffer, John Rastler, Ashley Rawson, Andrew Redd, Jill Schofield, Charlie Shivers III, and Jeanne Sung  DHS Program Costs: Reporting Program-Level Operations and Support Costs to Congress Would Improve Oversight  GAO-18-344  Washington, D C : April 25, 2018  Homeland Security Acquisitions: Identifying All Non-Major Acquisitions Would Advance Ongoing Efforts to Improve Management  GAO-17-396  Washington, D C : April 13, 2017  Homeland Security Acquisitions: Earlier Requirements Definition and Clear Documentation of Key Decisions Could Facilitate Ongoing Progress  GAO-17-346SP  Washington, D C : April 6, 2017  Coast Guard Cutters: Depot Maintenance Is Affecting Operational Availability and Cost Estimates Should Reflect Actual Expenditures  GAO-17-218  Washington, D C : March 2, 2017  Homeland Security Acquisitions: Joint Requirements Council’s Initial Approach Is Generally Sound and It Is Developing a Process to Inform Investment Priorities  GAO-17-171  Washington, D C : October 24, 2016  Homeland Security Acquisitions: DHS Has Strengthened Management, but Execution and Affordability Concerns Endure  GAO-16-338SP  Washington, D C : March 31, 2016  National Security Cutter: Enhanced Oversight Needed to Ensure Problems Discovered during Testing and Operations Are Addressed  GAO-16-148  Washington, D C : January 12, 2016  TSA Acquisitions: Further Actions Needed to Improve Efficiency of Screening Technology Test and Evaluation  GAO-16-117  Washington, D C : December 17, 2015  Homeland Security Acquisitions: Major Program Assessments Reveal Actions Needed to Improve Accountability  GAO-15-171SP  Washington, D C : April 22, 2015  Coast Guard Aircraft: Transfer of Fixed-Wing C-27J Aircraft Is Complex and Further Fleet Purchases Should Coincide with Study Results  GAO-15-325  Washington, D C : March 26, 2015  Homeland Security Acquisitions: DHS Should Better Define Oversight Roles and Improve Program Reporting to Congress  GAO-15-292  Washington, D C : March 12, 2015  Coast Guard Acquisitions: Better Information on Performance and Funding Needed to Address Shortfalls  GAO-14-450  Washington, D C : June 5, 2014  Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio to Address Funding Gaps and Improve Communications with Congress  GAO-14-332  Washington, D C : April 17, 2014  Homeland Security: DHS Requires More Disciplined Investment Management to Help Meet Mission Needs  GAO-12-833  Washington, D C : September 18, 2012  Department of Homeland Security: Assessments of Selected Complex Acquisitions  GAO-10-588SP  Washington, D C : June 30, 2010  Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight  GAO-09-29  Washington, D C : November 18, 2008 


Report 2:  The estimate accounts for all possible costs associated with a program, is structured in sufficient detail to ensure that costs are neither omitted nor double counted, and documents all cost-influencing assumptions  Well-documented  Supporting documentation explains the process, sources, and methods used to create the estimate; contains the underlying data used to develop the estimate; and is adequately reviewed and approved by management  Accurate  The estimate is not overly conservative or optimistic, is based on an assessment of the costs most likely to be incurred, and is regularly updated so that it always reflects the program’s current status  Credible  Discusses any limitations of the analysis because of uncertainty or sensitivity surrounding data or assumptions, the estimate’s results are cross-checked, and an independent cost estimate is conducted by a group outside the acquiring organization to determine whether other estimating methods produce similar results  In May 2017, DHS approved GMM’s lifecycle cost estimate of about $251 million for fiscal years 2015 through 2030  We found this initial estimate to be reliable because it fully or substantially addressed all the characteristics associated with a reliable cost estimate  For example, the estimate comprehensively included government and contractor costs, all elements of the program’s work breakdown structure, and all phases of the system lifecycle; and was aligned with the program’s technical documentation at the time the estimate was developed  GMM also fully documented the key assumptions, data sources, estimating methodology, and calculations for the estimate  Further, the program conducted a risk assessment and sensitivity analysis, and DHS conducted an independent assessment of the cost estimate to validate the accuracy and credibility of the cost estimate  However, key assumptions that FEMA made about the program changed soon after DHS approved the cost estimate in May 2017  Thus, the initial cost estimate no longer reflects the current approach for the program  For example, key assumptions about the program that changed include: Change in the technical approach: The initial cost estimate assumed that GMM would implement a software-as-a-service model, meaning that FEMA would rely on a service provider to deliver software applications and the underlying infrastructure to run them  However, in December 2017, the program instead decided to implement an infrastructure-as-a-service model, meaning that FEMA would develop and deploy its own software application and rely on a service provider to deliver and manage the computing infrastructure (e g , servers, software, storage, and network equipment)  According to program officials, this decision was made after learning from the Agile prototypes that the infrastructure-as-a-service model would allow GMM to develop the system in a more flexible environment  Increase in the number of system development personnel: A key factor with Agile development is the number of development teams (each consisting of experts in software development, testing, and cybersecurity) that are operating concurrently and producing separate portions of software functionality  Program officials initially assumed that they would need three to four concurrent Agile development teams, but subsequently realized that they would instead need to expend more resources to achieve GMM’s original completion date  Specifically, program officials now expect they will need to at least double, and potentially triple, the number of concurrent development teams to meet GMM’s original target dates  Significant delays and complexities with data migration: In 2016 and 2017, GMM experienced various technical challenges in its effort to transfer legacy system data to a data staging platform  This data transfer effort needed to be done to standardize the data before eventually migrating the data to GMM  These challenges resulted in significant delays and cost increases  Program officials reported that, by February 2018—at least 9 months later than planned—all legacy data had been transferred to a data staging platform so that FEMA officials could begin analyzing and standardizing the data prior to migrating it into GMM  FEMA officials reported that they anticipated the cost estimate to increase, and for this increase to be high enough to breach the $251 million threshold set in GMM’s May 2017 acquisition program baseline  Thus, consistent with DHS’s acquisition guidance, the program informed the DHS acquisition review board of this anticipated breach  The board declared that the program was in a cost breach status, as of September 12, 2018  As of October 2018, program officials stated that they were in the process of revising the cost estimate to reflect the changes in the program and to incorporate actual costs  In addition, the officials stated that the program was applying a new cost estimating methodology tailored for Agile programs that DHS’s Cost Analysis Division had been developing  In December 2018, program officials stated that they had completed the revised cost estimate but it was still undergoing departmental approval  Establishing an updated cost estimate should help FEMA better understand the expected costs to deliver GMM under the program’s current approach and time frames  The success of an IT program depends, in part, on having an integrated and reliable master schedule that defines when the program’s set of work activities and milestone events are to occur, how long they will take, and how they are related to one another  Among other things, a reliable schedule provides a roadmap for systematic execution of an IT program and the means by which to gauge progress, identify and address potential problems, and promote accountability  GAO’s Schedule Assessment Guide defines leading practices related to the following four characteristics that are vital to having a reliable integrated master schedule  Comprehensive  A comprehensive schedule reflects all activities for both the government and its contractors that are necessary to accomplish a program’s objectives, as defined in the program’s work breakdown structure  The schedule also includes the labor, materials, and overhead needed to do the work and depicts when those resources are needed and when they will be available  It realistically reflects how long each activity will take and allows for discrete progress measurement  Well-constructed  A schedule is well-constructed if all of its activities are logically sequenced with the most straightforward logic possible  Unusual or complicated logic techniques are used judiciously and justified in the schedule documentation  The schedule’s critical path represents a true model of the activities that drive the program’s earliest completion date and total float accurately depicts schedule flexibility  Credible  A schedule that is credible is horizontally traceable—that is, it reflects the order of events necessary to achieve aggregated products or outcomes  It is also vertically traceable—that is, activities in varying levels of the schedule map to one another and key dates presented to management in periodic briefings are consistent with the schedule  Data about risks are used to predict a level of confidence in meeting the program’s completion date  The level of necessary schedule contingency and high-priority risks are identified by conducting a robust schedule risk analysis  Controlled  A schedule is controlled if it is updated regularly by trained schedulers using actual progress and logic to realistically forecast dates for program activities  It is compared to a designated baseline schedule to measure, monitor, and report the program’s progress  The baseline schedule is accompanied by a baseline document that explains the overall approach to the program, defines ground rules and assumptions, and describes the unique features of the schedule  The baseline schedule and current schedule are subject to a configuration management control process  GMM’s schedule was unreliable because it minimally addressed three characteristics—comprehensive, credible, and controlled—and did not address the fourth characteristic of a reliable estimate—well-constructed  One of the most significant issues was that the program’s fast approaching, final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date  Table 4 summarizes our assessment of GMM’s schedule  In discussing the reasons for the shortfalls in these practices, program officials stated that they had been uncertain about the level of rigor that should be applied to the GMM schedule, given their use of Agile development  However, leading practices state that program schedules should meet all the scheduling practices, regardless of whether a program is using Agile development  As discussed earlier in this report, GMM has already experienced significant schedule delays  For example, the legacy data migration effort, the AFG pilot, and the Agile development contract have been delayed  Program officials also stated that the delay in awarding and starting the Agile contract has delayed other important activities, such as establishing time frames for transitioning legacy systems  A more robust schedule could have helped FEMA predict the impact of delays on remaining activities and identify which activities appeared most critical so that the program could ensure that any risks in delaying those activities were properly mitigated  In response to our review and findings, program officials recognized the need to continually enhance their schedule practices to improve the management and communication of program activities  As a result, in August 2018, the officials stated that they planned to add a master scheduler to the team to improve the program’s schedule practices and ensure that all of the areas of concern we identified are adequately addressed  In October 2018, the officials reported that they had recently added two master schedulers to GMM  According to the statement of objectives, the Agile contractor is expected to develop an integrated master schedule soon after it begins performance  However, program officials stated that GMM is schedule-driven—due to the Executive Steering Group’s expectation that the solution will be delivered by September 2020  The officials added that, if GMM encounters challenges in meeting this time frame, the program plans to seek additional resources to allow it to meet the 2020 target  GMM’s schedule-driven approach has already led to an increase in estimated costs and resources  For example, as previously mentioned, the program has determined that, to meet its original target dates, GMM needs to at least double, and possibly triple, the number of concurrent Agile development teams  In addition, we have previously reported that schedule pressure on federal IT programs can lead to omissions and skipping of key activities, especially system testing  In August 2018, program officials acknowledged that September 2020 may not be feasible and that the overall completion time frames established in the acquisition program baseline may eventually need to be rebaselined  Without a robust schedule to forecast whether FEMA’s aggressive delivery goal for GMM is realistic to achieve, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to fully deliver the system  NIST’s risk management framework establishes standards and guidelines for agencies to follow in developing cybersecurity programs  Agencies are expected to use this framework to achieve more secure information and information systems through the implementation of appropriate risk mitigation strategies and by performing activities that ensure that necessary security controls are integrated into agencies’ processes  The framework addresses broad cybersecurity and risk management activities, which include the following: Categorize the system: Programs are to categorize systems by identifying the types of information used, selecting a potential impact level (e g , low, moderate, or high), and assigning a category based on the highest level of impact to the system’s confidentiality, integrity, and availability, if the system was compromised  Programs are also to document a description of the information system and its boundaries and should register the system with appropriate program management offices  System categorization is documented in a system security plan  Select and implement security controls: Programs are to determine protective measures, or security controls, to be implemented based on the system categorization results  These security controls are documented in a system security plan  For example, control areas include access controls, incident response, security assessment and authorization, identification and authentication, and configuration management  Once controls are identified, programs are to determine planned implementation actions for each of the designated controls  These implementation actions are also specified in the system security plan  Assess security controls: Programs are to develop, review, and approve a security assessment plan  The purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  Programs are to also perform a security control assessment by evaluating the security controls in accordance with the procedures defined in the security assessment plan, in order to determine the extent to which the controls were implemented correctly  The output of this process is intended to produce a security assessment report to document the issues, findings, and recommendations  Programs are to conduct initial remediation actions on security controls and reassess those security controls, as appropriate  Obtain an authorization to operate the system: Programs are to obtain security authorization approval in order to operate a system  Resolving weaknesses and vulnerabilities identified during testing is an important step leading up to achieving an authorization to operate  Programs are to establish corrective action plans to address any deficiencies in cybersecurity policies, procedures, and practices  DHS guidance also states that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  Monitor security controls on an ongoing basis: Programs are to monitor their security controls on an ongoing basis after deployment, including determining the security impact of proposed or actual changes to the information system and assessing the security controls in accordance with a monitoring strategy that determines the frequency of monitoring the controls  For the GMM program’s engineering and test environment, which went live in February 2018, FEMA fully addressed three of the five key cybersecurity practices in NIST’s risk management framework and partially addressed two of the practices  Specifically, FEMA categorized GMM’s environment based on security risk, implemented select security controls, and monitored security controls on an ongoing basis  However, the agency partially addressed the areas of assessing security controls and obtaining an authorization to operate the system  Table 5 provides a summary of the extent to which FEMA addressed NIST’s key cybersecurity practices for GMM’s engineering and test environment  Consistent with NIST’s framework, GMM categorized the security risk of its engineering and test environment and identified it as a moderate- impact environment  A moderate-impact environment is one where the loss of confidentiality, integrity, or availability could be expected to have a serious or adverse effect on organizational operations, organizational assets, or individuals  GMM completed the following steps leading to this categorization: The program documented in its System Security Plan the various types of data and information that the environment will collect, process, and store, such as conducting technology research, building or enhancing technology, and maintaining IT networks  The program established three information types and assigned security levels of low, moderate, or high impact in the areas of confidentiality, availability, and integrity  A low-impact security level was assigned to two information types: (1) conducting technology research and (2) building or enhancing technology; and a moderate- impact security level was assigned to the third information type: maintaining IT networks  The engineering and test environment was categorized as an overall moderate-impact system, based on the highest security impact level assignment  GMM documented a description of the environment, including a diagram depicting the system’s boundaries, which illustrates, among other things, databases and firewalls  GMM properly registered its engineering and test environment with FEMA’s Chief Information Officer, Chief Financial Officer, and acting Chief Information Security Officer  By conducting the security categorization process, GMM has taken steps that should ensure that the appropriate security controls are selected for the program’s engineering and test environment  Consistent with NIST’s framework and the system categorization results, GMM appropriately determined which security controls to implement and planned actions for implementing those controls in its System Security Plan for the engineering and test environment  For example, the program utilized NIST guidance to select standard controls for a system categorized with a moderate-impact security level  These control areas include, for example, access controls, risk assessment, incident response, identification and authentication, and configuration management  Further, the program documented its planned actions to implement each control in its System Security Plan  For example, GMM documented that the program plans to implement its Incident Response Testing control by participating in an agency-wide exercise and unannounced vulnerability scans  As another example, GMM documented that the program plans to implement its Contingency Plan Testing control by testing the contingency plan annually, reviewing the test results, and preparing after action reports  By selecting and planning for the implementation of security controls, GMM has taken steps to mitigate its security risks and protect the confidentiality, integrity, and availability of the information system  Consistent with NIST’s framework, in January 2018, GMM program officials developed a security assessment plan for the engineering and test environment  According to GMM program officials, this plan was reviewed by the security assessment team  However, the security assessment plan lacked essential details  Specifically, while the plan included the general process for evaluating the environment’s security controls, the planned assessment procedures for all 964 security controls were not sufficiently defined  Specifically, GMM program officials copied example assessment procedures from NIST guidance and inserted them into its security assessment documentation for all of its 964 controls, without making further adjustments to explain the steps that should be taken specific to GMM  Table 6 shows an example of a security assessment procedure copied from the NIST guidance that should have been further adjusted for GMM  In addition, the actual assessment procedures that the GMM assessors used to evaluate the security controls were not documented  Instead, the program only documented whether each control passed or failed each test  GMM program officials stated that the planned assessment procedures are based on an agency template that was exported from a DHS compliance tool, and that FEMA security officials have been instructed by the DHS OCIO not to tailor or make any adjustments to the template language  However, the assessment procedures outlined in NIST’s guidance are to serve as a starting point for organizations preparing their program specific assessments  According to NIST, organizations are expected to select and tailor their assessment procedures for each security control from NIST’s list of suggested assessment options (e g , review, analyze, or inspect policies, procedures, and related documentation options)  DHS OCIO officials stated that, consistent with NIST’s guidance, they expect that components will ensure they are in compliance with the minimum standards and will also add details and additional rigor, as appropriate, to tailor the planned security assessment procedures to fit their unique missions or needs  In November 2018, in response to our audit, DHS OCIO officials stated that they were meeting with FEMA OCIO officials to understand why they did not document the planned and actual assessment procedures performed by the assessors for GMM  Until FEMA ensures that detailed planned evaluation methods and actual evaluation procedures specific to GMM are defined, the program risks assessing security controls incorrectly, having controls that do not work as intended, and producing undesirable outcomes with respect to meeting the security requirements  In addition, the security assessment plan was not approved by FEMA’s OCIO before proceeding with the security assessment  Program officials stated that approval was not required for the security assessment plan prior to the development of the security assessment report  However, NIST guidance states that the purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment  By not getting the security assessment plan approved by FEMA’s OCIO before security assessment reviews were conducted, GMM risks inconsistencies with the plan and security objectives of the organization  Finally, consistent with NIST guidance, GMM performed a security assessment in December 2017 of the engineering and test environment’s controls, which identified 36 vulnerabilities (23 critical- and high-impact vulnerabilities and 13 medium- and low-impact vulnerabilities)  The program also documented these vulnerabilities and associated findings and recommendations in a security assessment report  GMM conducted initial remediation actions (i e , remediation of vulnerabilities that should be corrected immediately) for 12 of the critical- and high-impact vulnerabilities and a reassessment of those security controls confirmed that they were resolved by January 2018  Remediation of the remaining 11 critical- and high-impact vulnerabilities and 13 medium- and low- impact vulnerabilities were to be addressed by corrective action plans as part of the authorization to operate process, which is discussed in the next section  The authorization to operate GMM’s engineering and test environment was granted on February 5, 2018  Among other things, this decision was based on the important stipulation that the remaining 11 critical- and high- impact vulnerabilities associated with multifactor authentication would be addressed within 45 days, or by March 22, 2018  However, the program did not meet this deadline and, instead, approximately 2 months after this deadline passed, obtained a waiver to remediate these vulnerabilities by May 9, 2019  These vulnerabilities are related to a multifactor authentication capability  Program officials stated that they worked with FEMA OCIO officials to attempt to address these vulnerabilities by the initial deadline, but they were unsuccessful in finding a viable solution  Therefore, GMM program officials developed a waiver at the recommendation of the OCIO to provide additional time to develop a viable solution  However, a multifactor authentication capability is essential to ensuring that users are who they say they are, prior to granting users access to the GMM engineering and test environment, in order to reduce the risk of harmful actors accessing the system  In addition, as of September 2018, the program had not established corrective action plans for the 13 medium- and low-impact vulnerabilities  Program officials stated that they do not typically address low-impact vulnerabilities; however, this is in conflict with DHS guidance that specifies that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report  In response to our audit, in October 2018, GMM program officials developed these remaining corrective action plans  The plans indicated that these vulnerabilities were to be fully addressed by January 2019 and April 2019  While the program eventually took corrective actions in response to our audit by developing the missing plans, the GMM program initially failed to follow DHS’s guidance on preparing corrective actions plans for all security vulnerabilities  Until GMM consistently follows DHS’s guidance, it will be difficult for FEMA to determine the extent to which GMM’s security weaknesses identified during its security control assessments are remediated  Additionally, as we have reported at other agencies, vulnerabilities can be indicators of more significant underlying issues and, thus, without appropriate management attention or prompt remediation, GMM is at risk of unnecessarily exposing the program to potential exploits  Moreover, GMM was required to assess all untested controls by March 7, 2018, or no later than 30 days after the approval of the authorization to operate; however, it did not meet this deadline  Specifically, we found that, by October 2018, FEMA had not fully tested 190 security controls in the GMM engineering and test environment  These controls were related to areas such as security incident handling and allocation of resources required to protect an information system  In response to our findings, in October 2018, GMM program officials reported that they had since fully tested 27 controls and partially tested the remaining 163 controls  Program officials stated that testing of the 163 controls is a shared responsibility between GMM and other parties (e g , the cloud service provider)  They added that GMM had completed its portion of the testing but was in the process of verifying the completion of testing by other parties  Program officials stated that the untested controls were not addressed sooner, in part, because of errors resulting from configuration changes in the program’s compliance tool during a system upgrade, which have now been resolved  Until GMM ensures that all security controls have been tested, it remains at an increased risk of exposing programs to potential exploits  Consistent with the NIST framework, GMM established methods for assessing and monitoring security controls to be conducted after an authorization to operate has been approved  GMM has tailored its cybersecurity policies and practices for monitoring its controls to take into account the frequent and iterative pace with which system functionality is continuously being introduced into the GMM environment  Specifically, the GMM program established a process for assessing security impact changes to the system and conducting reauthorizations to operate within the rapid Agile delivery environment  As part of this process, GMM embedded cybersecurity experts on each Agile development team so that they are involved early and can impact security considerations from the beginning of requirements development through testing and deployment of system functionality  In addition, the process involves important steps for ensuring that the system moves from development to completion, while producing a secure and reliable system  For example, it includes procedures for creating, reviewing, and testing new system functionality  As the new system functionality is integrated with existing system functionality, it is to undergo automated testing and security scans in order to ensure that the integrity of the security of the system has not been compromised  Further, an automated process is to deploy the code if it passes all security scans, code tests, and code quality checks  GMM’s process for conducting a reauthorization to operate within the rapid delivery Agile development environment is to follow FEMA guidance that states that all high-level changes made to a FEMA IT system must receive approval from both a change advisory board and the FEMA Chief Information Officer  The board and FEMA Chief Information Officer are to focus their review and approval on scheduled releases and epics (i e , collections of user stories)  Additionally, the Information System Security Officer is to review each planned user story and, if it is determined that the proposed changes may impact the integrity of the authorization, the Information System Security Officer is to work with the development team to begin the process of updating the system authorization  Finally, GMM uses automated tools to track the frequency in which security controls are assessed and to ensure that required scanning data are received by FEMA for reporting purposes  Program officials stated that, in the absence of department-level and agency-level guidance, they have coordinated with DHS and FEMA OCIO officials to ensure that these officials are in agreement with GMM’s approach to continuous monitoring  By having monitoring control policies and procedures in place, FEMA management is positioned to more effectively prioritize and plan its risk response to current threats and vulnerabilities for the GMM program  Given FEMA’s highly complex grants management environment, with its many stakeholders, IT systems, and internal and external users, implementing leading practices for business process reengineering and IT requirements management is critical for success  FEMA has taken many positive steps, including ensuring executive leadership support for business process reengineering, documenting the agency’s grants management processes and performance improvement goals, defining initial IT requirements for the program, incorporating input from end user stakeholders into the development and implementation process, and taking recent actions to improve its delivery of planned IT requirements  Nevertheless, until the GMM program finalizes plans and time frames for implementing its organizational change management actions, plans and communicates system transition activities, and maintains clear traceability of IT requirements, FEMA will be limited in its ability to provide streamlined grants management processes and effectively deliver a modernized IT system to meet the needs of its large range of users  While GMM’s initial cost estimate was reliable, key assumptions about the program since the initial estimate had changed and, therefore, it no longer reflected the current approach for the program  The forthcoming updated cost schedule is expected to better reflect the current approach  However, the program’s unreliable schedule to fully deliver GMM by September 2020 is aggressive and unrealistic  The delays the program has experienced to date further compound GMM’s schedule issues  Without a robust schedule that has been informed by a realistic assessment of GMM’s development activities, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to achieve their goals  Further, FEMA’s implementation of cybersecurity practices for GMM in the areas of system categorization, selection and implementation, and monitoring will help the program  However, GMM lacked essential details for evaluating security controls, did not approve the security assessment plan before proceeding with the security assessment, did not follow DHS’s guidance to develop corrective action plans for all security vulnerabilities, and did not fully test all security controls  As a result, the GMM engineering and test environment remains at an increased risk of exploitations  We are making eight recommendations to FEMA: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions  (Recommendation 1) The FEMA Administrator should ensure that the GMM program management office plans and communicates its detailed transition activities to its affected customers before they transition to GMM and undergo significant changes to their processes  (Recommendation 2) The FEMA Administrator should ensure that the GMM program management office implements its planned changes to its processes for documenting requirements for future increments and ensures it maintains traceability among key IT requirements documents  (Recommendation 3) The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report  (Recommendation 4) The FEMA Administrator should ensure that the FEMA OCIO defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls  (Recommendation 5) The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted  (Recommendation 6) The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities  (Recommendation 7) The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system  (Recommendation 8) DHS provided written comments on a draft of this report, which are reprinted in appendix IV  In its comments, the department concurred with all eight of our recommendations and provided estimated completion dates for implementing each of them  For example, with regard to recommendation 4, the department stated that FEMA plans to update the GMM program schedule to address the leading practices for a reliable schedule by April 30, 2019  In addition, for recommendation 7, the department stated that FEMA plans to ensure that corrective action plans are prepared by July 31, 2019, to address all identified security vulnerabilities for GMM  If implemented effectively, the actions that FEMA plans to take in response to the recommendations should address the weaknesses we identified  We also received technical comments from DHS and FEMA officials, which we incorporated, as appropriate  We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or your staff have any questions about this report, please contact me at (202) 512-4456 or harriscc@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  GAO staff who made key contributions to this report are listed in appendix V  Our objectives were to (1) determine the extent to which the Federal Emergency Management Agency (FEMA) is implementing leading practices for reengineering its grants management business processes and incorporating business needs into Grants Management Modernization (GMM) information technology (IT) requirements; (2) assess the reliability of the program’s estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices for GMM  To address the first objective, we reviewed GAO’s Business Process Reengineering Assessment Guide and Software Engineering Institute’s Capability Maturity Model for Integration for Development to identify practices associated with business process reengineering and IT requirements management  We then selected six areas that, in our professional judgment, represented foundational practices that were of particular importance to the successful implementation of an IT modernization effort that is using Agile development processes  We also selected the practices that were most relevant based on where GMM was in the system development lifecycle and we discussed the practice areas with FEMA officials  The practices are: Ensuring executive leadership support for process reengineering Assessing the current and target business environment and business Establishing plans for implementing new business processes Establishing clear, prioritized, and traceable IT requirements Tracking progress in delivering IT requirements Incorporating input from end user stakeholders We also reviewed selected chapters of GAO’s draft Agile Assessment Guide (Version 6A), which is intended to establish a consistent framework based on best practices that can be used across the federal government for developing, implementing, managing, and evaluating agencies’ IT investments that rely on Agile methods  To develop this guide, GAO worked closely with Agile experts in the public and private sector; some chapters of the guide are considered more mature because they have been reviewed by the expert panel  We reviewed these chapters to ensure that our expectations for how FEMA should apply the six practices for business process reengineering and IT requirements management are appropriate for an Agile program and are consistent with the draft guidance that is under development  Additionally, since Agile development programs may use different terminology to describe their software development processes, the Agile terms used in this report (e g , increment, sprint, epic, etc ) are specific to the GMM program  We obtained and analyzed FEMA grants management modernization documentation, such as current and target grants management business processes, acquisition program baseline, operational requirements document, concept of operations, requirements analyses workbooks, Grants Management Executive Steering Group artifacts, stakeholder outreach artifacts, Agile increment- and sprint-level planning and development artifacts, and the requirements backlog  We assessed the program documentation against the selected practices to determine the extent to which the agency had implemented them  We then assessed each practice area as: fully implemented—FEMA provided complete evidence that showed it fully implemented the practice area; partially implemented—FEMA provided evidence that showed it partially implemented the practice area; not implemented—FEMA did not provide evidence that showed it implemented any of the practice area  Additionally, we observed Agile increment and sprint development activities at GMM facilities in Washington, D C  We also observed a demonstration of how the program manages its lower level requirements (i e , user stories and epics) and maintains traceability of the requirements using an automated tool at GMM facilities in Washington, D C  We also interviewed FEMA officials, including the GMM Program Executive, GMM Program Manager, GMM Business Transformation Team Lead, and Product Owner regarding their efforts to streamline grants management business processes, collect and incorporate stakeholder input, and manage GMM’s requirements  In addition, we interviewed FEMA officials from four out of 16 grant program offices and two out of 10 regional offices to obtain contextual information and illustrative examples of FEMA’s efforts to reengineer grants management business processes and collect business requirements for GMM  Specifically, We selected the four grant program offices based on a range of grant programs managed, legacy systems used, and the amount of grant funding awarded  We also sought to select a cross section of different characteristics, such as selecting larger grant program offices, as well as smaller offices  In addition, we ensured that our selection included the Assistance to Firefighters Grants (AFG) program office because officials in this office represent the first GMM users and, therefore, are more actively involved with the program’s Agile development practices  Based on these factors, we selected: Public Assistance Division, Individual Assistance Division, AFG, and National Fire Academy  Additionally, the four selected grant program offices are responsible for 16 of the total 45 grant programs and are users of five of the nine primary legacy IT systems  The four selected grant program offices also represent about 68 percent of the total grant funding awarded by FEMA from fiscal years 2005 through 2016  We selected two regional offices based on (1) the largest amount of total FEMA grant funding for fiscal years 2005 through 2016—Region 6 located in Denton, Texas; and (2) the highest percentage of AFG funding compared to the office’s total grant funding awarded from fiscal years 2005 through 2016—Region 5 located in Chicago, Illinois  To assess the reliability of data from the program’s automated IT requirements management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM requirements  We determined that the data used were sufficiently reliable for the purpose of evaluating GMM’s practices for managing IT requirements  For our second objective, to assess the reliability of GMM’s estimated costs and schedule, we reviewed documentation on GMM’s May 2017 lifecycle cost estimate and on the program’s schedule, dated May 2018  To assess the reliability of the May 2017 lifecycle cost estimate, we evaluated documentation supporting the estimate, such as the cost estimating model, the report on GMM’s Cost Estimating Baseline Document and Life Cycle Cost Estimate, and briefings provided to the Department of Homeland Security (DHS) and FEMA management regarding the cost estimate  We assessed the cost estimating methodologies, assumptions, and results against leading practices for developing a comprehensive, accurate, well-documented, and credible cost estimate, identified in GAO’s Cost Estimating and Assessment Guide  We also interviewed program officials responsible for developing and reviewing the cost estimate to understand their methodology, data, and approach for developing the estimate  We found that the cost data were sufficiently reliable  To assess the reliability of the May 2018 GMM program schedule, we evaluated documentation supporting the schedule, such as the integrated master schedule, acquisition program baseline, and Agile artifacts  We assessed the schedule documentation against leading practices for developing a comprehensive, well-constructed, credible, and controlled schedule, identified in GAO’s Schedule Assessment Guide  We also interviewed GMM program officials responsible for developing and managing the program schedule to understand their practices for creating and maintaining the schedule  We noted in our report the instances where the quality of the schedule data impacted the reliability of the program’s schedule  For both the cost estimate and program schedule, we assessed each leading practice as: fully addressed—FEMA provided complete evidence that showed it implemented the entire practice area; substantially addressed—FEMA provided evidence that showed it implemented more than half of the practice area; partially addressed—FEMA provided evidence that showed it implemented about half of the practice area; minimally addressed—FEMA provided evidence that showed it implemented less than half of the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  Finally, we provided FEMA with draft versions of our detailed analyses of the GMM cost estimate and schedule  This was done to verify that the information on which we based our findings was complete, accurate, and up-to-date  Regarding our third objective, to determine the extent to which FEMA is addressing key cybersecurity practices for GMM, we reviewed documentation regarding DHS and FEMA cybersecurity policies and guidance, and FEMA’s authorization to operate for the program’s engineering and test environment  We evaluated the documentation against all six cybersecurity practices identified in the National Institute of Standards and Technology’s (NIST) Risk Management Framework  While NIST’s Risk Management Framework identifies six total practices, for reporting purposes, we combined two interrelated practices—selection of security controls and implementation of security controls—into a single practice  The resulting five practices were: categorizing the system based on security risk, selecting and implementing security controls, assessing security controls, obtaining an authorization to operate the system, and monitoring security controls on an ongoing basis  We obtained and analyzed key artifacts supporting the program’s efforts to address these risk management practices, including the program’s System Security Plan, the Security Assessment Plan and Report, Authorization to Operate documentation, and the program’s continuous monitoring documentation  We also interviewed officials from the GMM program office and FEMA’s Office of the Chief Information Officer, such as the GMM Security Engineering Lead, GMM Information System Security Officer, and FEMA’s Acting Chief Information Security Officer, regarding their efforts to assess, document, and review security controls for GMM  We assessed the evidence against the five practices to determine the extent to which the agency had addressed them  We then assessed each practice area as: fully addressed—FEMA provided complete evidence that showed it fully implemented the practice area; partially addressed—FEMA provided evidence that showed it partially implemented the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area  To assess the reliability of data from the program’s automated security controls management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data  We also compared the data to other relevant program documentation on GMM security controls for the engineering and test environment  We found that some of the security controls data we examined were sufficiently reliable for the purpose of evaluating FEMA’s cybersecurity practices for GMM, and we noted in our report the instances where the accuracy of the data impacted the program’s ability to address key cybersecurity practices  We conducted this performance audit from December 2017 to April 2019 in accordance with generally accepted government auditing standards  Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives  We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives  The Federal Emergency Management Agency (FEMA) awards many different types of grants to state, local, and tribal governments and nongovernmental entities  These grants are to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks  Agile software development is a type of incremental development that calls for the rapid delivery of software in small, short increments  The use of an incremental approach is consistent with the Office of Management and Budget’s guidance as specified in its information technology (IT) Reform Plan, as well as the legislation commonly referred to as the Federal Information Technology Acquisition Reform Act  Many organizations, especially in the federal government, are accustomed to using a waterfall software development model, which typically consists of long, sequential phases, and differs significantly from the Agile development approach  Agile practices integrate planning, design, development, and testing into an iterative lifecycle to deliver software early and often  Figure 7 provides a depiction of software development using the Agile approach, as compared to a waterfall approach  The frequent iterations of Agile development are intended to effectively measure progress, reduce technical and programmatic risk, and respond to feedback from stakeholders in changes to IT requirements more quickly than traditional methods  Despite these intended benefits, organizations adopting Agile must overcome challenges in making significant changes to how they are accustomed to developing software  The significant differences between Agile and waterfall development impact how IT programs are planned, implemented, and monitored in terms of cost, schedule, and scope  For example, in waterfall development, significant effort is devoted upfront to document detailed plans and all IT requirements for the entire scope of work at the beginning of the program, and cost and schedule can be varied to complete that work  However, for Agile programs the precise details are unknown upfront, so initial planning of cost, scope, and timing would be conducted at a high level, and then supplemented with more specific plans for each iteration  While cost and schedule are set for each iteration, requirements for each iteration (or increment) can be variable as they are learned over time and revised to reflect experiences from completed iterations and to accommodate changing priorities of the end users  The differences in these two software development approaches are shown in figure 8  Looking at figure 8, the benefit provided from using traditional program management practices such as establishing a cost estimate or a robust schedule, is not obvious  However, unlike a theoretical environment, many government programs may not have the autonomy to manage completely flexible scope, as they must deliver certain minimal specifications with the cost and schedule provided  In those cases, it is vital for the team to understand and differentiate the IT requirements that are “must haves” from the “nice to haves” early in the planning effort  This would help facilitate delivery of the “must-haves” requirements first, thereby providing users with the greatest benefits as soon as possible  In addition to the contact named above, the following staff made key contributions to this report: Shannin G  O’Neill (Assistant Director), Jeanne Sung (Analyst in Charge), Andrew Beggs, Rebecca Eyler, Kendrick Johnson, Thomas J  Johnson, Jason Lee, Jennifer Leotta, and Melissa Melvin 

ground_truth: FEMA, a component of DHS, annually awards billions of dollars in grants to help communities prepare for, mitigate the effects of, and recover from major disasters. However, FEMA's complex IT environment supporting grants management consists of many disparate systems. In 2008, the agency attempted to modernize these systems but experienced significant challenges. In 2015, FEMA initiated a new endeavor (the GMM program) aimed at streamlining and modernizing the grants management IT environment. GAO was asked to review the GMM program. GAO's objectives were to (1) determine the extent to which FEMA is implementing leading practices for reengineering its grants management processes and incorporating needs into IT requirements; (2) assess the reliability of the program's estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices. GAO compared program documentation to leading practices for process reengineering and requirements management, cost and schedule estimation, and cybersecurity risk management, as established by the Software Engineering Institute, National Institute of Standards and Technology, and GAO. Of six important leading practices for effective business process reengineering and information technology (IT) requirements management, the Federal Emergency Management Agency (FEMA) fully implemented four and partially implemented two for the Grants Management Modernization (GMM) program (see table). Specifically, FEMA ensured senior leadership commitment, took steps to assess its business environment and performance goals, took recent actions to track progress in delivering IT requirements, and incorporated input from end user stakeholders. However, FEMA has not yet fully established plans for implementing new business processes or established complete traceability of IT requirements. Until FEMA fully implements the remaining two practices, it risks delivering an IT solution that does not fully modernize FEMA's grants management systems. While GMM's initial May 2017 cost estimate of about $251 million was generally consistent with leading practices for a reliable, high-quality estimate, it no longer reflects current assumptions about the program. FEMA officials stated in December 2018 that they had completed a revised cost estimate, but it was undergoing departmental approval. GMM's program schedule was inconsistent with leading practices; of particular concern was that the program's final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date. Developing sound cost and schedule estimates is necessary to ensure that FEMA has a clear understanding of program risks. Of five key cybersecurity practices, FEMA fully addressed three and partially addressed two for GMM. Specifically, it categorized GMM's system based on security risk, selected and implemented security controls, and monitored security controls on an ongoing basis. However, the program had not initially established corrective action plans for 13 medium- and low-risk vulnerabilities. This conflicts with the Department of Homeland Security's (DHS) guidance that specifies that corrective action plans must be developed for every weakness identified. Until FEMA, among other things, ensures that the program consistently follows the department's guidance on preparing corrective action plans for all security vulnerabilities, GMM's system will remain at increased risk of exploits. GAO is making eight recommendations to FEMA to implement leading practices related to reengineering processes, managing requirements, scheduling, and implementing cybersecurity. DHS concurred with all recommendations and provided estimated dates for implementing each of them.