You are given two reports by the government agency.  

Report 1:
FEMA’s mission is to help people before, during, and after disasters. It provides assistance to those affected by emergencies and disasters by supplying immediate needs (e.g., ice, water, food, and temporary housing) and providing financial assistance grants for damage to personal or public property. FEMA also provides non-disaster assistance grants to improve the nation’s preparedness, readiness, and resilience to all hazards. FEMA accomplishes a large part of its mission through awarding grants to state, local, and tribal governments and nongovernmental entities to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks. As previously mentioned, for fiscal years 2005 through 2014, the agency obligated about $104.5 billion in disaster relief grants. In addition, as of April 2018, the four major disasters in 2017—hurricanes Harvey, Irma, and Maria; and the California wildfires—had resulted in over $22 billion in FEMA grants. The current FEMA grants management environment is highly complex with many stakeholders, IT systems, and users. Specifically, this environment is comprised of 45 active disaster and non-disaster grant programs, which are grouped into 12 distinct grant categories. For example, one program in the Preparedness: Fire category is the Assistance to Firefighters Grants (AFG) program, which provides grants to fire departments, nonaffiliated emergency medical service organizations, and state fire training academies to support firefighting and emergency response needs. As another example, the Housing Assistance grant program is in the Recovery Assistance for Individuals category and provides financial assistance to individuals and households in geographical areas that have been declared an emergency or major disaster by the President. Table 1 lists FEMA’s non-disaster and disaster-based grant categories. According to FEMA, the processes for managing these different types of grants vary because the grant programs were developed independently by at least 18 separate authorizing laws that were enacted over a 62-year period (from 1947 through 2009). The various laws call for different administrative and reporting requirements. For example, the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended, established the statutory authority for 11 of the grant programs, such as the administration of Public Assistance and Individual Assistance grant programs after a presidentially declared disaster. The act also requires the FEMA Administrator to submit an annual report to the President and Congress covering FEMA’s expenditures, contributions, work, and accomplishments, pursuant to the act. As another example, the National Dam Safety Program Act established one of the grant programs aimed at providing financial assistance to improve dam safety. Key stakeholders in modernizing the IT grants management environment include the internal FEMA officials that review, approve, and monitor the grants awarded, such as grant specialists, program analysts, and supervisors. FEMA has estimated that it will need to support about 5,000 simultaneous internal users of its grants management systems. Other users include the grant recipients that apply for, receive, and submit reports on their grant awards; these are considered the external system users. These grant recipients can include individuals, states, local governments, Indian tribes, institutions of higher education, and nonprofit organizations. FEMA has estimated that there are hundreds of thousands of external users of its grants systems. The administration of the many different grant programs is distributed across four divisions within FEMA’s organizational structure. Figure 1 provides an overview of FEMA’s organizational structure and the divisions that are responsible for administering grants. Within three of the four divisions—Resilience, United States Fire Administration, and Office of Response and Recovery—16 different grant program offices are collectively responsible for administering the 45 grant programs. The fourth division consists of 10 regional offices that help administer grants within their designated geographical regions. For example, the Office of Response and Recovery division oversees three different offices that administer 13 grant programs that are largely related to providing assistance in response to presidentially declared disasters. Figure 2 shows the number of grant programs administered by each of the four divisions’ grant program and regional offices. In addition, appendix II lists the names of the 45 grant programs. FEMA’s OCIO is responsible for developing, enhancing, and maintaining the agency’s IT systems, and for increasing efficiencies and cooperation across the entire organization. However, we and the DHS Office of Inspector General (OIG) have previously reported that the grant programs and regional offices develop information systems independent of the OCIO and that this has contributed to the agency’s disparate IT environment. We and the DHS OIG have reported that this disparate IT environment was due, in part, to FEMA’s decentralized IT budget and acquisition practices. For example, from fiscal years 2010 through 2015, the OCIO’s budget represented about one-third of the agency’s IT budget, with the grant program offices accounting for the remaining two-thirds of that budget. In February 2018, the OIG found that FEMA had shown limited progress in improving its IT management and that many of the issues reported in prior audits remained unchanged. As such, the OIG initiated a more comprehensive audit of the agency’s IT management that is ongoing. FEMA has identified 10 primary legacy IT systems that support its grants management activities. According to the agency, most of these systems were developed to support specific grant programs or grant categories. Table 2 summarizes the 10 primary legacy systems. According to FEMA officials, the 10 primary grant systems are all in operation (several have been for decades) and are not interoperable. As a result, individual grant programs and regional offices have independently developed work arounds intended to address existing capability gaps with the primary systems. FEMA officials stated that while these work arounds have helped the agency partially address capability gaps with its primary systems, they are often nonstandardized processes, and introduce the potential for information security risks and errors. This environment has contributed to labor-intensive manual processes and an increased burden for grant recipients. The disparate systems have also led to poor information sharing and reporting capabilities, as well as difficulty reconciling financial data. The DHS OIG and we have previously highlighted challenges with FEMA’s past attempts to modernize its grant management systems. For example, In December 2006, the DHS OIG reported that EMMIE, an effort to modernize its grants management systems and provide a single grants processing solution, was being developed without a clear understanding and definition of the future solution. The report also identified the need to ensure crosscutting participation from headquarters, regions, and states in developing and maintaining a complete, documented set of FEMA business and system requirements. In April 2016, we found weaknesses in FEMA’s development of the EMMIE system. For example, we noted that the system was implemented without sufficient documentation of system requirements, an acquisition strategy, up-to-date cost estimate and schedule, total amount spent to develop the system, or a systems integration plan. In response to our findings and related recommendations, FEMA took action to address these issues. For example, the agency implemented a requirements management process that, among other things, provided guidance to programs on analyzing requirements to ensure that they are complete and verifiable. We reported in November 2017 that EMMIE lacked the ability to collect information on all pre-award activities and, as a result, agency officials said that they and applicants used ad hoc reports and personal tracking documents to manage and monitor the progress of grant applications. FEMA officials added that applicants often struggled to access the system and that the system was not user friendly. Due to EMMIE’s shortfalls, the agency had to develop another system in 2017 to supplement EMMIE with additional grant tracking and case management capabilities. FEMA initiated GMM in 2015, in part, due to EMMIE’s failed attempt to modernize the agency’s grants management environment. The program is intended to modernize and streamline the agency’s grants management environment. To help streamline the agency’s grants management processes, the program established a standard framework intended to represent a common grants management lifecycle. The framework consists of five sequential phases—pre-award, award, post-award, closeout, and post- closeout—along with a sixth phase dedicated to continuous grant program management activities, such as analyzing data and producing reports on grant awards and managing IT systems. FEMA also established 43 distinct business functions associated with these six lifecycle phases. Figure 3 provides the general activities that may occur in each of the grant lifecycle phases, but specific activities would depend on the type of grant being administered (i.e., disaster versus non-disaster). GMM is expected to be implemented within the complex IT environment that currently exists at FEMA. For example, the program is intended to replace the 10 legacy grants management systems, and potentially many additional subsystems, with a single IT system. Each of the 10 legacy systems was developed with its own database(s) and with no standardization of the grants management data and, according to FEMA officials, this legacy data has grown significantly over time. Accordingly, FEMA will need to migrate, analyze, and standardize the grants management data before transitioning it to GMM. The agency awarded a contract in June 2016 to support the data migration efforts for GMM. The agency also implemented a data staging environment in October 2017 to migrate the legacy data and identify opportunities to improve the quality of the data. Further, the GMM system is expected to interface with a total of 38 other systems. These include 19 systems external to DHS (e.g., those provided by commercial entities or other federal government agencies) and 19 systems internal to DHS or FEMA. Some of the internal FEMA systems are undergoing their own modernization efforts and will need to be coordinated with GMM, such as the agency’s financial management systems, national flood insurance systems, and enterprise data warehouses. For example, FEMA’s Financial Systems Modernization Program was originally expected to deliver a new financial system in time to interface with GMM. However, the financial modernization has been delayed until after GMM is to be fully implemented; thus, GMM will instead need to interface with the legacy financial system. As a result, GMM is in the process of removing one of its key performance parameters in the acquisition program baseline related to financial systems interoperability and timeliness of data exchanged. In May 2017, DHS approved the acquisition program baseline for GMM. The baseline estimated the total lifecycle costs to be about $251 million, initial operational capability to be achieved by September 2019, and full operational capability to be achieved by September 2020. FEMA intends to develop and deploy its own software applications for GMM using a combination of commercial-off-the-shelf software, open source software, and custom developed code. The agency plans to rely on an Agile software development approach. According to FEMA planning documentation, the agency plans to fully deliver GMM by September 2020 over eight Agile development increments. Agile development is a type of incremental development, which calls for the rapid delivery of software in small, short increments. Many organizations, especially in the federal government, are accustomed to using a waterfall software development model. This type of model typically consists of long, sequential phases, and differs significantly from the Agile development approach. We have previously reported that DHS has sought to establish Agile software development as the preferred method for acquiring and delivering IT capabilities. However, the department has not yet completed critical actions necessary to update its guidance, policies, and practices for Agile programs, in areas such as, developing lifecycle cost estimates, managing IT requirements, testing and evaluation, oversight at key decision points, and ensuring cybersecurity. (See appendix III for more details on the Agile software development approach.) FEMA’s acquisition approach includes using contract support to assist with the development and deployment efforts. The agency selected a public cloud environment to host the computing infrastructure. In addition, from March through July 2017, the agency used a short-term contract aimed at developing prototypes of GMM functionality for grant tracking and monitoring, case management of disaster survivors, grant reporting, and grant closeout. The agency planned to award a second development contract by December 2017 to complete the GMM system (beyond the prototypes) and to begin this work in September 2018. However, due to delays in awarding the second contract to develop the complete GMM system, in January 2018, the program extended the scope and time frames of the initial short-term prototype contract for an additional year to develop the first increment of the GMM system— referred to as the AFG pilot. On August 31, 2018, FEMA awarded the second development contract, which is intended to deliver the remaining functionality beyond the AFG pilot (i.e., increments 2 through 8). FEMA officials subsequently issued a 90-day planning task order for the Agile development contractor to define the work that needs to be done to deliver GMM and the level of effort needed to accomplish that work. However, the planning task order was paused after a bid protest was filed with GAO in September 2018. According to FEMA officials, they resumed work on the planning task order after the bid protest was withdrawn by the protester on November 20, 2018, and then the work was paused again during the partial government shutdown from December 22, 2018, through January 25, 2019. FEMA began working on the AFG pilot—GMM’s first increment—in January 2018. This increment was intended to pilot GMM’s use of Agile development methods to replace core functionality for the AFG system (i.e., one of the 10 legacy systems).This system supports three preparedness/fire-related grant programs—Assistance to Firefighters Grants Program, Fire Prevention and Safety Grant Program, and Staffing for Adequate Fire and Emergency Response Grant Program. According to FEMA officials, the AFG system was selected as the first system to be replaced because it is costly to maintain and the DHS OIG had identified cybersecurity concerns with the system. Among the 43 GMM business functions discussed earlier in this report, FEMA officials specified 19 functions to be delivered in the AFG pilot. Figure 4 shows the planned time frames for delivering the AFG pilot in increment 1 (which consisted of four 3-month Agile development sub- increments), as of August 2018. As of August 2018, the program was working on sub-increment 1C of the pilot. In September 2018, GMM deployed its first set of functionality to a total of 19 AFG users—which included seven of 169 total internal AFG users, and 12 of more than 153,000 external AFG users. The functionality supported four of the 19 business functions that are related to the closeout of grants (i.e., the process by which all applicable administrative actions and all required work to award a grant have been completed). This functionality included tasks such as evaluation of final financial reports submitted by grant recipients and final reconciliation of finances (e.g., final disbursement to recipients and return of unobligated federal funds). According to FEMA officials, closeout functionality was selected first for deployment because it was the most costly component of the legacy AFG system to maintain, as it is an entirely manual and labor-intensive process. The remaining AFG functionality and remaining AFG users are to be deployed by the end of the AFG pilot. The GMM program is executed by a program management office, which is overseen by a program manager and program executive. This office is responsible for directing the day-to-day operations and ensuring completion of GMM program goals and objectives. The program office resides within the Office of Response and Recovery, which is headed by an Associate Administrator who reports to the FEMA Administrator. In addition, the GMM program executive (who is also the Regional Administrator for FEMA Region IX) reports directly to the FEMA Administrator. GMM is designated as a level 2 major acquisition, which means that it is subject to oversight by the DHS acquisition review board. The board is chaired by the DHS Undersecretary for Management and is made up of executive-level members, such as the DHS Chief Information Officer. The acquisition review board serves as the departmental executive board that decides whether to approve GMM through key acquisition milestones and reviews the program’s progress and its compliance with approved documentation every 6 months. The board approved the acquisition program baseline for GMM in May 2017 (i.e., estimated costs to be about $251 million and full operational capability to be achieved by September 2020). In addition, the program is reviewed on a monthly basis by FEMA’s Grants Management Executive Steering Group. This group is chaired by the Deputy Administrator of FEMA. Further, DHS’s Financial Systems Modernization Executive Steering Committee, chaired by the DHS Chief Financial Officer, meets monthly and is to provide guidance, oversight, and support to GMM. For government organizations, including FEMA, cybersecurity is a key element in maintaining the public trust. Inadequately protected systems may be vulnerable to insider threats. Such systems are also vulnerable to the risk of intrusion by individuals or groups with malicious intent who could unlawfully access the systems to obtain sensitive information, disrupt operations, or launch attacks against other computer systems and networks. Moreover, cyber-based threats to federal information systems are evolving and growing. Accordingly, we designated cybersecurity as a government-wide high risk area 22 years ago, in 1997, and it has since remained on our high-risk list. Federal law and guidance specify requirements for protecting federal information and information systems. The Federal Information Security Modernization Act (FISMA) of 2014 requires executive branch agencies to develop, document, and implement an agency-wide cybersecurity program to provide security for the information and information systems that support operations and assets of the agency. The act also tasks NIST with developing, for systems other than those for national security, standards and guidelines to be used by all agencies to establish minimum cybersecurity requirements for information and information systems based on their level of cybersecurity risk. Accordingly, NIST developed a risk management framework of standards and guidelines for agencies to follow in developing cybersecurity programs. The framework addresses broad cybersecurity and risk management activities, including categorizing the system’s impact level; selecting, implementing, and assessing security controls; authorizing the system to operate (based on progress in remediating control weaknesses and an assessment of residual risk); and monitoring the efficacy of controls on an ongoing basis. Figure 5 provides an overview of this framework. Prior DHS OIG assessments, such as the annual evaluation of DHS’s cybersecurity program, have identified issues with FEMA’s cybersecurity practices. For example, in 2016, the OIG reported that FEMA was operating 111 systems without an authorization to operate. In addition, the agency had not created any corrective action plans for 11 of the systems that were classified as “Secret” or “Top Secret,” thus limiting its ability to ensure that all identified cybersecurity weaknesses were mitigated in a timely manner. The OIG further reported that, for several years, FEMA was consistently below DHS’s 90 percent target for remediating corrective action plans, with scores ranging from 73 to 84 percent. Further, the OIG reported that FEMA had a significant number of open corrective action plans (18,654) and that most of these plans did not contain sufficient information to address identified weaknesses. In 2017, the OIG reported that FEMA had made progress in addressing security weaknesses. For example, it reported that the agency had reduced the number of systems it was operating without an authorization to operate from 111 to 15 systems. According to GAO’s Business Process Reengineering Assessment Guide and the Software Engineering Institute’s Capability Maturity Model Integration® for Development, successful business process reengineering can enable agencies to replace their inefficient and outmoded processes with streamlined processes that can more effectively serve the needs of the public and significantly reduce costs and improve performance. Many times, new IT systems are implemented to support these improved business processes. Thus, effective management of IT requirements is critical for ensuring the successful design, development, and delivery of such new systems. These leading practices state that effective business process reengineering and IT requirements management involve, among other things, (1) ensuring strong executive leadership support for process reengineering; (2) assessing the current and target business environment and business performance goals; (3) establishing plans for implementing new business processes; (4) establishing clear, prioritized, and traceable IT requirements; (5) tracking progress in delivering IT requirements; and (6) incorporating input from end user stakeholders. Among these six selected leading practices for reengineering business processes and managing IT requirements, FEMA fully implemented four and partially implemented two of them for its GMM program. For example, the agency ensured strong senior leadership commitment to changing the way it manages its grants, took steps to assess and document its business environment and performance goals, defined initial IT requirements for GMM, took recent actions to better track progress in delivering planned IT requirements, and incorporated input from end user stakeholders. In addition, FEMA had begun planning for business process reengineering; however, it had not finalized plans for transitioning users to the new business processes. Further, while GMM took steps to establish clearly defined and prioritized IT requirements, key requirements were not always traceable. Table 3 summarizes the extent to which FEMA implemented the selected leading practices. According to GAO’s Business Process Reengineering Assessment Guide, the most critical factor for engaging in a reengineering effort is having strong executive leadership support to establish credibility regarding the seriousness of the effort and to maintain the momentum as the agency faces potentially extensive changes to its organizational structure and values. Without such leadership, even the best process design may fail to be accepted and implemented. Agencies should also ensure that there is ongoing executive support (e.g., executive steering committee meetings headed by the agency leader) to oversee the reengineering effort from start to finish. FEMA senior leadership consistently demonstrated its commitment and support for streamlining the agency’s grants management business processes and provided ongoing executive support. For example, one of the Administrator’s top priorities highlighted in FEMA’s 2014 through 2022 strategic plans was to strengthen grants management through innovative systems and business processes to rapidly and effectively deliver the agency’s mission. In accordance with this strategic priority, FEMA initiated GMM with the intent to streamline and modernize grants management across the agency. In addition, FEMA established the Grants Management Executive Steering Group in September 2015. This group is responsible for transforming the agency’s grants management capabilities through its evaluation, prioritization, and oversight of grants management modernization programs, such as GMM. The group’s membership consists of FEMA senior leaders from across the agency’s program and business support areas, such as FEMA regions, Individual Assistance, Public Assistance, Preparedness, Office of the Chief Financial Officer, Office of Chief Counsel, OCIO, and the Office of Policy and Program Analysis. In this group’s ongoing commitment to reengineering grants management processes, it meets monthly to review GMM’s updates, risks, and action items, as well as the program’s budget, schedule, and acquisition activities. For example, the group reviewed the status of key acquisition activities and program milestones, such as the follow-on award for the pilot contractor and the program’s initial operational capability date. The group also reviewed GMM’s program risks, such as data migration challenges (discussed later in this report) and delays in the Agile development contract award. With this continuous executive involvement, FEMA is better positioned to maintain momentum for reengineering the new grants management business processes that the GMM system is intended to support. GAO’s Business Process Reengineering Assessment Guide states that agencies undergoing business process reengineering should develop a common understanding of the current environment by documenting existing core business processes to show how the processes work and how they are interconnected. The agencies should then develop a deeper understanding of the target environment by modeling the workflow of each target business process in enough detail to provide a common understanding of exactly what will be changed and who will be affected by a future solution. Agencies should also assess the performance of their current major business processes to identify problem areas that need to be changed or eliminated and to set realistically achievable, customer- oriented, and measurable business performance improvement goals. FEMA has taken steps to document the current and target grants management business processes. Specifically, The agency took steps to develop a common understanding of its grants management processes by documenting each of the 12 grant categories. For example, in 2016 and 2017, the agency conducted several nationwide user outreach sessions with representatives from FEMA headquarters, the 10 regional offices, and state and local grant recipients to discuss the grant categories and the current grants management business environment. In addition, FEMA’s Office of Chief Counsel developed a Grants Management Manual in January 2018 that outlined the authorizing laws, regulations, and agency policies for all of its grant programs. According to the Grants Management Executive Steering Group, the manual is intended to promote standardized grants management procedures across the agency. Additionally, the group expects grant program and regional offices to assess the manual against their own practices, make updates as needed, and ensure that their staff are properly informed and trained. FEMA also documented target grants management business process workflows for 18 of the 19 business functions that were notionally planned to be developed and deployed in the AFG pilot by December 2018. However, the program experienced delays in developing the AFG pilot (discussed later in this report) and, thus, deferred defining the remaining business function until the program gets closer to developing that function, which is now planned for August 2019. In addition, FEMA established measurable business performance goals for GMM that are aimed at addressing problem areas and improving grants management processes. Specifically, the agency established 14 business performance goals and associated thresholds in an October 2017 acquisition program baseline addendum, as well as 126 performance metrics for all 43 of the target grants management business functions in its March 2017 test and evaluation master plan. According to FEMA, the 14 business performance goals are intended to represent essential outcomes that will indicate whether GMM has successfully met critical, business-focused mission needs. GMM performance goals include areas such as improvements in the satisfaction level of users with GMM compared to the legacy systems and improvements in the timeliness of grant award processing. For example, one of GMM’s goals is to get at least 40 percent of users surveyed to agree or strongly agree that their grants management business processes are easier to accomplish with GMM, compared to the legacy systems. Program officials stated that they plan to work with the Agile development contractor to refine their performance goals and target thresholds, develop a plan for collecting the data and calculating the metrics, and establish a performance baseline with the legacy systems. Program officials also stated that they plan to complete these steps by September 2019—GMM’s initial operational capability date—which is when they are required to begin reporting these metrics to the DHS acquisition review board. According to GAO’s Business Process Reengineering Assessment Guide, agencies undergoing business process reengineering should (1) establish an overall plan to guide the effort (commonly referred to as an organizational change management plan) and (2) provide a common understanding for stakeholders of what to expect and how to plan for process changes. Agencies should develop the plan at the beginning of the reengineering effort and provide specific details on upcoming process changes, such as critical milestones and deliverables for an orderly transition, roles and responsibilities for change management activities, reengineering goals, skills and resource needs, key barriers to change, communication expectations, training, and any staff redeployments or reductions-in-force. The agency should develop and begin implementing its change management plan ahead of introducing new processes to ensure sufficient support among stakeholders for the reengineered processes. While FEMA has begun planning its business process reengineering activities, it has not finalized its plans or established time frames for their completion. Specifically, as of September 2018, program officials were in the process of drafting an organizational change management plan that is intended to establish an approach for preparing grants management stakeholders for upcoming changes. According to FEMA, this document is intended to help avoid uncertainty and confusion among stakeholders as changes are made to the agency’s grant programs, and ensure successful adoption of new business processes, strategies, and technologies. As discussed previously in this report, the transition to GMM will involve changes to FEMA’s disparate grants management processes that are managed by many different stakeholders across the agency. Program officials acknowledged that change management is the biggest challenge they face in implementing GMM and said they had begun taking several actions intended to support the agency’s change management activities. For example, program officials reported in October 2018 that they had recently created an executive-level working group intended to address FEMA’s policy challenges related to the standardization of grants management processes. Additionally, program officials reported that they planned to: (1) hire additional support staff focused on coordinating grants change management activities; and (2) pursue regional office outreach to encourage broad support among GMM’s decentralized stakeholders, such as state, local, and tribal territories. However, despite these actions, the officials were unable to provide time frames for completing the organizational change management plan or the additional actions. Until the plan and actions are complete, the program lacks assurance that it will have sufficient support among stakeholders for the reengineered processes. In addition, GMM did not establish plans and time frames for the activities that needed to take place prior to, during, and after the transition from the legacy AFG to GMM. Instead, program officials stated that they had worked collaboratively with the legacy AFG program and planned these details informally by discussing them in various communications, such as emails and meetings. However, this informal planning approach is not a repeatable process, which is essential to this program as FEMA plans to transition many sets of functionality to many different users during the lifecycle of this program. Program officials acknowledged that for future transitions they will need more repeatable transition planning and stated that they intend to establish such plans, but did not provide a time frame for when such changes would be made. Until FEMA develops a repeatable process, with established time frames for communicating the transition details to its customers prior to each transition, the agency risks that the transition from the legacy systems to GMM will not occur as intended. It also increases its risk that stakeholders will not support the implementation of reengineered grants management processes. Leading practices for software development efforts state that IT requirements are to be clearly defined and prioritized. This includes, among other things, maintaining bidirectional traceability as the requirements evolve, to ensure there are no inconsistencies among program plans and requirements. In addition, programs using Agile software development are to maintain a product vision, or roadmap, to guide the planning of major program milestones and provide a high-level view of planned requirements. Programs should also maintain a prioritized list (referred to as a backlog) of narrowly defined requirements (referred to as lower-level requirements) that are to be delivered. Programs should maintain this backlog with the product owner to ensure the program is always working on the highest priority requirements that will deliver the most value to the users. The GMM program established clearly defined and prioritized requirements and maintained bidirectional traceability among the various levels of requirements: Grant lifecycle phases: In its Concept of Operations document, the program established six grants management lifecycle phases that represent the highest level of GMM’s requirements, through which it derives lower-level requirements. Business functions: The Concept of Operations document also identifies the next level of GMM requirements—the 43 business functions that describe how FEMA officials, grant recipients, and other stakeholders are to manage grants. According to program officials, the 43 business functions are to be refined, prioritized, and delivered to GMM customers iteratively. Further, for the AFG pilot, the GMM program office prioritized 19 business functions with the product owner and planned the development of these functions in a roadmap. Epics: GMM’s business functions are decomposed into epics, which represent smaller portions of functionality that can be developed over multiple increments. According to program officials, GMM intends to develop, refine, and prioritize the epics iteratively. As of August 2018, the program had developed 67 epics in the program backlog. An example of one of the epics for the AFG pilot is to prepare and submit grant closeout materials. User stories: The epics are decomposed into user stories, which convey the customers’ requirements at the smallest and most discrete unit of work that must be done within a single sprint to create working software. GMM develops, refines, and prioritizes the user stories iteratively. As of August 2018, the program had developed 1,118 user stories in the backlog. An example of a user story is “As an external user, I can log in with a username and password.” Figure 6 provides an example of how GMM’s different levels of requirements are decomposed. Nevertheless, while we found requirements to be traceable at the sprint- level (i.e., epics and user stories), traceability of requirements at the increment-level (i.e., business functions) were inconsistent among different requirements planning documents. Specifically, the capabilities and constraints document shows that five business functions are planned to be developed within sub-increment 1A, whereas the other key planning document—the roadmap for the AFG pilot—showed one of those five functions as being planned for the sub-increment 1B. In addition, the capabilities and constraints document shows that nine business functions are planned to be developed within sub-increment 1B, but the roadmap showed one of those nine functions as being planned for the sub- increment 1C. Program officials stated that they decided to defer these functions to later sub-increments due to unexpected technical difficulties encountered when developing functionality and reprioritizing functions with the product owners. While the officials updated the roadmap to reflect the deferred functionality, they did not update the capabilities and constraints document to maintain traceability between these two important requirements planning documents. Program officials stated that they learned during the AFG pilot that the use of a capabilities and constraints document for increment-level scope planning was not ideal and that they intended to change the process for how they documented planned requirements for future increments. However, program officials did not provide a time frame for when this change would be made. Until the program makes this change and then ensures it maintains traceability of increment-level requirements between requirements planning documents, it will continue to risk confusion among stakeholders about what is to be delivered. In addition, until recently, GMM’s planning documents were missing up- to-date information regarding when most of the legacy systems will be transitioned to GMM. Specifically, while the program’s planning documents (including the GMM roadmap) provided key milestones for the entire lifecycle of the program and high-level capabilities to be delivered in the AFG pilot, these documents lacked up-to-date time frames for when FEMA planned to transition the nine remaining legacy systems. For example, in May 2017, GMM drafted notional time frames for transitioning the legacy systems, including plans for AFG to be the seventh system replaced by GMM. However, in December 2017, the program decided to reprioritize the legacy systems so that AFG would be replaced first—yet this major change was not reflected in the program’s roadmap. Moreover, while AFG program officials were informed of the decision to transition the AFG program first, in June 2018 officials from other grant programs told us that they had not been informed on when their systems were to be replaced. As a result, these programs were uncertain about when they should start planning for their respective transitions. In August 2018, GMM program officials acknowledged that they were delayed in deciding the sequencing order for the legacy system transitions. Program officials stated that the delay was due to their need to factor the Agile development contractor’s perspective into these decisions; yet, at that time, the contract award had been delayed by approximately 8 months. Subsequently, in October 2018, program officials identified tentative time frames for transitioning the remaining legacy systems. Program officials stated that they determined the tentative time frames for transitioning the legacy systems based on key factors, such as mission need, cost, security vulnerabilities, and technical obsolescence, and that they had shared these new time frames with grant program officials. The officials also stated that, once the Agile contractor begins contract performance, they expect to be able to validate the contractor’s capacity and finalize these time frames by obtaining approval from the Grants Management Executive Steering Group. By taking steps to update and communicate these important time frames, FEMA should be better positioned to ensure that each of the grant programs are prepared for transitioning to GMM. According to leading practices, Agile programs should track their progress in delivering planned IT requirements within a sprint (i.e., short iterations that produce working software). Given that sprints are very short cycles of development (e.g., 2 weeks), the efficiency of completing planned work within a sprint relies on a disciplined approach that includes using a fixed pace, referred to as the sprint cadence, that provides a consistent and predictable development routine. A disciplined approach also includes identifying by the start of a sprint which user stories will be developed, developing those stories to completion (e.g., fully tested and demonstrated to, and accepted by, the product owner), and tracking completion progress of those stories. Progress should be communicated to relevant stakeholders and used by the development teams to better understand their capacity to develop stories, continuously improve on their processes, and forecast how long it will take to deliver all remaining capabilities. The GMM program did not effectively track progress in delivering IT requirements during the first nine sprints, which occurred from January to June 2018. These gaps in tracking the progress of requirements, in part, had an impact on the program’s progress in delivering the 19 AFG business functions that were originally planned by December 2018 and are now deferred to August 2019. However, beginning in July 2018, in response to our ongoing review, the program took steps to improve in these areas. Specifically, GMM did not communicate the status of its Agile development progress to program stakeholders, such as the grant programs, the regional offices, and the development teams, during most of the first nine sprints. Program officials acknowledged that they should use metrics to track development progress and, in July 2018, they began reporting metrics to program stakeholders. For example, they began collecting and providing data on the number of stories planned and delivered, estimated capacity for development teams, and the number of days spent working on the sprint, as part of the program’s weekly status reports to program stakeholders, such as product owners. Rather than using a fixed, predictable sprint cadence, GMM allowed a variable development cadence, meaning that sprint durations varied from 1 to 4 weeks throughout the first nine sprints. Program officials noted that they had experimented with the use of a variable cadence to allow more time to complete complex technical work. Program officials stated that they realized that varying the sprints was not effective and, in July 2018 for sprint 10, they reverted back to a fixed, 2 week cadence. GMM added a significant amount of scope during its first nine sprints, after the development work had already begun. For example, the program committed to 28 user stories at the beginning of sprint eight, and then nearly doubled the work by adding 25 additional stories in the middle of the sprint. Program officials cited multiple reasons for adding more stories, including that an insufficient number of stories had been defined in the backlog when the sprint began, the realization that planned stories were too large and needed to be decomposed into smaller stories, and the realization that other work would be needed in addition to what was originally planned. Program officials recognized that, by the start of a sprint, the requirements should be sufficiently defined, such that they are ready for development without requiring major changes during the sprint. The program made recent improvements in sprints 11 and 12, which had only five stories added after the start of a sprint. By taking these steps to establish consistency among sprints, the program has better positioned itself to more effectively monitor and manage the remaining IT development work. In addition, this improvement in consistency should help the program avoid future deferments of functionality. Leading practices state that programs should regularly collaborate with, and collect input from, relevant stakeholders; monitor the status of stakeholder involvement; incorporate stakeholder input; and measure how well stakeholders’ needs are being met. For Agile programs, it is especially important to track user satisfaction to determine how well the program has met stakeholders’ needs. Consistent stakeholder participation ensures that the program meets its stakeholders’ needs. FEMA implemented its responsibilities in this area through several means, such as stakeholder outreach activities; development of a strategic communications plan; and continuous monitoring, solicitation, and recording of stakeholder involvement and feedback. For example, the agency conducted nationwide outreach sessions from January 2016 through August 2017 and began conducting additional outreach sessions in April 2018. These outreach sessions involved hundreds of representatives from FEMA headquarters, the 10 regional offices, and state and local grant recipients to collect information on the current grants management environment and opportunities for streamlining grants management processes. FEMA also held oversight and stakeholder outreach activities and actively solicited and recorded feedback from its stakeholders on a regular basis. For example, GMM regularly verified with users that the new functionality met their IT requirements, as part of the Agile development cycle. Additionally, we observed several GMM biweekly requirements validation sessions where the program’s stakeholders were involved and provided feedback as part of the requirements development and refinement process. In addition, FEMA identified GMM stakeholders and tracked its engagement with these stakeholders using a stakeholder register. The agency also defined processes for how the GMM program is to collaborate with its stakeholders in a stakeholder communication plan and Agile development team agreement. Also, while several officials from the selected grant program and regional offices that we interviewed indicated that the program could improve in communicating its plans for GMM and incorporating stakeholder input, most of the representatives from these offices stated that GMM is doing well at interacting with its stakeholders. Finally, in October 2018, program officials reported that they had recently begun measuring user satisfaction by conducting surveys and interviews with users that have utilized the new functionality within GMM. The program’s outreach activities, collection of stakeholder input, and measurement of user satisfaction demonstrate that the program is taking the appropriate steps to incorporate stakeholder input. Reliable cost estimates are critical for successfully delivering IT programs. Such estimates provide the basis for informed decision making, realistic budget formulation, meaningful progress measurement, and accountability for results. GAO’s Cost Estimating and Assessment Guide defines leading practices related to the following four characteristics of a high-quality, reliable estimate. Comprehensive. The estimate accounts for all possible costs associated with a program, is structured in sufficient detail to ensure that costs are neither omitted nor double counted, and documents all cost-influencing assumptions. Well-documented. Supporting documentation explains the process, sources, and methods used to create the estimate; contains the underlying data used to develop the estimate; and is adequately reviewed and approved by management. Accurate. The estimate is not overly conservative or optimistic, is based on an assessment of the costs most likely to be incurred, and is regularly updated so that it always reflects the program’s current status. Credible. Discusses any limitations of the analysis because of uncertainty or sensitivity surrounding data or assumptions, the estimate’s results are cross-checked, and an independent cost estimate is conducted by a group outside the acquiring organization to determine whether other estimating methods produce similar results. In May 2017, DHS approved GMM’s lifecycle cost estimate of about $251 million for fiscal years 2015 through 2030. We found this initial estimate to be reliable because it fully or substantially addressed all the characteristics associated with a reliable cost estimate. For example, the estimate comprehensively included government and contractor costs, all elements of the program’s work breakdown structure, and all phases of the system lifecycle; and was aligned with the program’s technical documentation at the time the estimate was developed. GMM also fully documented the key assumptions, data sources, estimating methodology, and calculations for the estimate. Further, the program conducted a risk assessment and sensitivity analysis, and DHS conducted an independent assessment of the cost estimate to validate the accuracy and credibility of the cost estimate. However, key assumptions that FEMA made about the program changed soon after DHS approved the cost estimate in May 2017. Thus, the initial cost estimate no longer reflects the current approach for the program. For example, key assumptions about the program that changed include: Change in the technical approach: The initial cost estimate assumed that GMM would implement a software-as-a-service model, meaning that FEMA would rely on a service provider to deliver software applications and the underlying infrastructure to run them. However, in December 2017, the program instead decided to implement an infrastructure-as-a-service model, meaning that FEMA would develop and deploy its own software application and rely on a service provider to deliver and manage the computing infrastructure (e.g., servers, software, storage, and network equipment). According to program officials, this decision was made after learning from the Agile prototypes that the infrastructure-as-a-service model would allow GMM to develop the system in a more flexible environment. Increase in the number of system development personnel: A key factor with Agile development is the number of development teams (each consisting of experts in software development, testing, and cybersecurity) that are operating concurrently and producing separate portions of software functionality. Program officials initially assumed that they would need three to four concurrent Agile development teams, but subsequently realized that they would instead need to expend more resources to achieve GMM’s original completion date. Specifically, program officials now expect they will need to at least double, and potentially triple, the number of concurrent development teams to meet GMM’s original target dates. Significant delays and complexities with data migration: In 2016 and 2017, GMM experienced various technical challenges in its effort to transfer legacy system data to a data staging platform. This data transfer effort needed to be done to standardize the data before eventually migrating the data to GMM. These challenges resulted in significant delays and cost increases. Program officials reported that, by February 2018—at least 9 months later than planned—all legacy data had been transferred to a data staging platform so that FEMA officials could begin analyzing and standardizing the data prior to migrating it into GMM. FEMA officials reported that they anticipated the cost estimate to increase, and for this increase to be high enough to breach the $251 million threshold set in GMM’s May 2017 acquisition program baseline. Thus, consistent with DHS’s acquisition guidance, the program informed the DHS acquisition review board of this anticipated breach. The board declared that the program was in a cost breach status, as of September 12, 2018. As of October 2018, program officials stated that they were in the process of revising the cost estimate to reflect the changes in the program and to incorporate actual costs. In addition, the officials stated that the program was applying a new cost estimating methodology tailored for Agile programs that DHS’s Cost Analysis Division had been developing. In December 2018, program officials stated that they had completed the revised cost estimate but it was still undergoing departmental approval. Establishing an updated cost estimate should help FEMA better understand the expected costs to deliver GMM under the program’s current approach and time frames. The success of an IT program depends, in part, on having an integrated and reliable master schedule that defines when the program’s set of work activities and milestone events are to occur, how long they will take, and how they are related to one another. Among other things, a reliable schedule provides a roadmap for systematic execution of an IT program and the means by which to gauge progress, identify and address potential problems, and promote accountability. GAO’s Schedule Assessment Guide defines leading practices related to the following four characteristics that are vital to having a reliable integrated master schedule. Comprehensive. A comprehensive schedule reflects all activities for both the government and its contractors that are necessary to accomplish a program’s objectives, as defined in the program’s work breakdown structure. The schedule also includes the labor, materials, and overhead needed to do the work and depicts when those resources are needed and when they will be available. It realistically reflects how long each activity will take and allows for discrete progress measurement. Well-constructed. A schedule is well-constructed if all of its activities are logically sequenced with the most straightforward logic possible. Unusual or complicated logic techniques are used judiciously and justified in the schedule documentation. The schedule’s critical path represents a true model of the activities that drive the program’s earliest completion date and total float accurately depicts schedule flexibility. Credible. A schedule that is credible is horizontally traceable—that is, it reflects the order of events necessary to achieve aggregated products or outcomes. It is also vertically traceable—that is, activities in varying levels of the schedule map to one another and key dates presented to management in periodic briefings are consistent with the schedule. Data about risks are used to predict a level of confidence in meeting the program’s completion date. The level of necessary schedule contingency and high-priority risks are identified by conducting a robust schedule risk analysis. Controlled. A schedule is controlled if it is updated regularly by trained schedulers using actual progress and logic to realistically forecast dates for program activities. It is compared to a designated baseline schedule to measure, monitor, and report the program’s progress. The baseline schedule is accompanied by a baseline document that explains the overall approach to the program, defines ground rules and assumptions, and describes the unique features of the schedule. The baseline schedule and current schedule are subject to a configuration management control process. GMM’s schedule was unreliable because it minimally addressed three characteristics—comprehensive, credible, and controlled—and did not address the fourth characteristic of a reliable estimate—well-constructed. One of the most significant issues was that the program’s fast approaching, final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date. Table 4 summarizes our assessment of GMM’s schedule. In discussing the reasons for the shortfalls in these practices, program officials stated that they had been uncertain about the level of rigor that should be applied to the GMM schedule, given their use of Agile development. However, leading practices state that program schedules should meet all the scheduling practices, regardless of whether a program is using Agile development. As discussed earlier in this report, GMM has already experienced significant schedule delays. For example, the legacy data migration effort, the AFG pilot, and the Agile development contract have been delayed. Program officials also stated that the delay in awarding and starting the Agile contract has delayed other important activities, such as establishing time frames for transitioning legacy systems. A more robust schedule could have helped FEMA predict the impact of delays on remaining activities and identify which activities appeared most critical so that the program could ensure that any risks in delaying those activities were properly mitigated. In response to our review and findings, program officials recognized the need to continually enhance their schedule practices to improve the management and communication of program activities. As a result, in August 2018, the officials stated that they planned to add a master scheduler to the team to improve the program’s schedule practices and ensure that all of the areas of concern we identified are adequately addressed. In October 2018, the officials reported that they had recently added two master schedulers to GMM. According to the statement of objectives, the Agile contractor is expected to develop an integrated master schedule soon after it begins performance. However, program officials stated that GMM is schedule-driven—due to the Executive Steering Group’s expectation that the solution will be delivered by September 2020. The officials added that, if GMM encounters challenges in meeting this time frame, the program plans to seek additional resources to allow it to meet the 2020 target. GMM’s schedule-driven approach has already led to an increase in estimated costs and resources. For example, as previously mentioned, the program has determined that, to meet its original target dates, GMM needs to at least double, and possibly triple, the number of concurrent Agile development teams. In addition, we have previously reported that schedule pressure on federal IT programs can lead to omissions and skipping of key activities, especially system testing. In August 2018, program officials acknowledged that September 2020 may not be feasible and that the overall completion time frames established in the acquisition program baseline may eventually need to be rebaselined. Without a robust schedule to forecast whether FEMA’s aggressive delivery goal for GMM is realistic to achieve, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to fully deliver the system. NIST’s risk management framework establishes standards and guidelines for agencies to follow in developing cybersecurity programs. Agencies are expected to use this framework to achieve more secure information and information systems through the implementation of appropriate risk mitigation strategies and by performing activities that ensure that necessary security controls are integrated into agencies’ processes. The framework addresses broad cybersecurity and risk management activities, which include the following: Categorize the system: Programs are to categorize systems by identifying the types of information used, selecting a potential impact level (e.g., low, moderate, or high), and assigning a category based on the highest level of impact to the system’s confidentiality, integrity, and availability, if the system was compromised. Programs are also to document a description of the information system and its boundaries and should register the system with appropriate program management offices. System categorization is documented in a system security plan. Select and implement security controls: Programs are to determine protective measures, or security controls, to be implemented based on the system categorization results. These security controls are documented in a system security plan. For example, control areas include access controls, incident response, security assessment and authorization, identification and authentication, and configuration management. Once controls are identified, programs are to determine planned implementation actions for each of the designated controls. These implementation actions are also specified in the system security plan. Assess security controls: Programs are to develop, review, and approve a security assessment plan. The purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment. Programs are to also perform a security control assessment by evaluating the security controls in accordance with the procedures defined in the security assessment plan, in order to determine the extent to which the controls were implemented correctly. The output of this process is intended to produce a security assessment report to document the issues, findings, and recommendations. Programs are to conduct initial remediation actions on security controls and reassess those security controls, as appropriate. Obtain an authorization to operate the system: Programs are to obtain security authorization approval in order to operate a system. Resolving weaknesses and vulnerabilities identified during testing is an important step leading up to achieving an authorization to operate. Programs are to establish corrective action plans to address any deficiencies in cybersecurity policies, procedures, and practices. DHS guidance also states that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report. Monitor security controls on an ongoing basis: Programs are to monitor their security controls on an ongoing basis after deployment, including determining the security impact of proposed or actual changes to the information system and assessing the security controls in accordance with a monitoring strategy that determines the frequency of monitoring the controls. For the GMM program’s engineering and test environment, which went live in February 2018, FEMA fully addressed three of the five key cybersecurity practices in NIST’s risk management framework and partially addressed two of the practices. Specifically, FEMA categorized GMM’s environment based on security risk, implemented select security controls, and monitored security controls on an ongoing basis. However, the agency partially addressed the areas of assessing security controls and obtaining an authorization to operate the system. Table 5 provides a summary of the extent to which FEMA addressed NIST’s key cybersecurity practices for GMM’s engineering and test environment. Consistent with NIST’s framework, GMM categorized the security risk of its engineering and test environment and identified it as a moderate- impact environment. A moderate-impact environment is one where the loss of confidentiality, integrity, or availability could be expected to have a serious or adverse effect on organizational operations, organizational assets, or individuals. GMM completed the following steps leading to this categorization: The program documented in its System Security Plan the various types of data and information that the environment will collect, process, and store, such as conducting technology research, building or enhancing technology, and maintaining IT networks. The program established three information types and assigned security levels of low, moderate, or high impact in the areas of confidentiality, availability, and integrity. A low-impact security level was assigned to two information types: (1) conducting technology research and (2) building or enhancing technology; and a moderate- impact security level was assigned to the third information type: maintaining IT networks. The engineering and test environment was categorized as an overall moderate-impact system, based on the highest security impact level assignment. GMM documented a description of the environment, including a diagram depicting the system’s boundaries, which illustrates, among other things, databases and firewalls. GMM properly registered its engineering and test environment with FEMA’s Chief Information Officer, Chief Financial Officer, and acting Chief Information Security Officer. By conducting the security categorization process, GMM has taken steps that should ensure that the appropriate security controls are selected for the program’s engineering and test environment. Consistent with NIST’s framework and the system categorization results, GMM appropriately determined which security controls to implement and planned actions for implementing those controls in its System Security Plan for the engineering and test environment. For example, the program utilized NIST guidance to select standard controls for a system categorized with a moderate-impact security level. These control areas include, for example, access controls, risk assessment, incident response, identification and authentication, and configuration management. Further, the program documented its planned actions to implement each control in its System Security Plan. For example, GMM documented that the program plans to implement its Incident Response Testing control by participating in an agency-wide exercise and unannounced vulnerability scans. As another example, GMM documented that the program plans to implement its Contingency Plan Testing control by testing the contingency plan annually, reviewing the test results, and preparing after action reports. By selecting and planning for the implementation of security controls, GMM has taken steps to mitigate its security risks and protect the confidentiality, integrity, and availability of the information system. Consistent with NIST’s framework, in January 2018, GMM program officials developed a security assessment plan for the engineering and test environment. According to GMM program officials, this plan was reviewed by the security assessment team. However, the security assessment plan lacked essential details. Specifically, while the plan included the general process for evaluating the environment’s security controls, the planned assessment procedures for all 964 security controls were not sufficiently defined. Specifically, GMM program officials copied example assessment procedures from NIST guidance and inserted them into its security assessment documentation for all of its 964 controls, without making further adjustments to explain the steps that should be taken specific to GMM. Table 6 shows an example of a security assessment procedure copied from the NIST guidance that should have been further adjusted for GMM. In addition, the actual assessment procedures that the GMM assessors used to evaluate the security controls were not documented. Instead, the program only documented whether each control passed or failed each test. GMM program officials stated that the planned assessment procedures are based on an agency template that was exported from a DHS compliance tool, and that FEMA security officials have been instructed by the DHS OCIO not to tailor or make any adjustments to the template language. However, the assessment procedures outlined in NIST’s guidance are to serve as a starting point for organizations preparing their program specific assessments. According to NIST, organizations are expected to select and tailor their assessment procedures for each security control from NIST’s list of suggested assessment options (e.g., review, analyze, or inspect policies, procedures, and related documentation options). DHS OCIO officials stated that, consistent with NIST’s guidance, they expect that components will ensure they are in compliance with the minimum standards and will also add details and additional rigor, as appropriate, to tailor the planned security assessment procedures to fit their unique missions or needs. In November 2018, in response to our audit, DHS OCIO officials stated that they were meeting with FEMA OCIO officials to understand why they did not document the planned and actual assessment procedures performed by the assessors for GMM. Until FEMA ensures that detailed planned evaluation methods and actual evaluation procedures specific to GMM are defined, the program risks assessing security controls incorrectly, having controls that do not work as intended, and producing undesirable outcomes with respect to meeting the security requirements. In addition, the security assessment plan was not approved by FEMA’s OCIO before proceeding with the security assessment. Program officials stated that approval was not required for the security assessment plan prior to the development of the security assessment report. However, NIST guidance states that the purpose of the security assessment plan approval is to establish the appropriate expectations for the security control assessment. By not getting the security assessment plan approved by FEMA’s OCIO before security assessment reviews were conducted, GMM risks inconsistencies with the plan and security objectives of the organization. Finally, consistent with NIST guidance, GMM performed a security assessment in December 2017 of the engineering and test environment’s controls, which identified 36 vulnerabilities (23 critical- and high-impact vulnerabilities and 13 medium- and low-impact vulnerabilities). The program also documented these vulnerabilities and associated findings and recommendations in a security assessment report. GMM conducted initial remediation actions (i.e., remediation of vulnerabilities that should be corrected immediately) for 12 of the critical- and high-impact vulnerabilities and a reassessment of those security controls confirmed that they were resolved by January 2018. Remediation of the remaining 11 critical- and high-impact vulnerabilities and 13 medium- and low- impact vulnerabilities were to be addressed by corrective action plans as part of the authorization to operate process, which is discussed in the next section. The authorization to operate GMM’s engineering and test environment was granted on February 5, 2018. Among other things, this decision was based on the important stipulation that the remaining 11 critical- and high- impact vulnerabilities associated with multifactor authentication would be addressed within 45 days, or by March 22, 2018. However, the program did not meet this deadline and, instead, approximately 2 months after this deadline passed, obtained a waiver to remediate these vulnerabilities by May 9, 2019. These vulnerabilities are related to a multifactor authentication capability. Program officials stated that they worked with FEMA OCIO officials to attempt to address these vulnerabilities by the initial deadline, but they were unsuccessful in finding a viable solution. Therefore, GMM program officials developed a waiver at the recommendation of the OCIO to provide additional time to develop a viable solution. However, a multifactor authentication capability is essential to ensuring that users are who they say they are, prior to granting users access to the GMM engineering and test environment, in order to reduce the risk of harmful actors accessing the system. In addition, as of September 2018, the program had not established corrective action plans for the 13 medium- and low-impact vulnerabilities. Program officials stated that they do not typically address low-impact vulnerabilities; however, this is in conflict with DHS guidance that specifies that corrective action plans must be developed for every weakness identified during a security control assessment and within a security assessment report. In response to our audit, in October 2018, GMM program officials developed these remaining corrective action plans. The plans indicated that these vulnerabilities were to be fully addressed by January 2019 and April 2019. While the program eventually took corrective actions in response to our audit by developing the missing plans, the GMM program initially failed to follow DHS’s guidance on preparing corrective actions plans for all security vulnerabilities. Until GMM consistently follows DHS’s guidance, it will be difficult for FEMA to determine the extent to which GMM’s security weaknesses identified during its security control assessments are remediated. Additionally, as we have reported at other agencies, vulnerabilities can be indicators of more significant underlying issues and, thus, without appropriate management attention or prompt remediation, GMM is at risk of unnecessarily exposing the program to potential exploits. Moreover, GMM was required to assess all untested controls by March 7, 2018, or no later than 30 days after the approval of the authorization to operate; however, it did not meet this deadline. Specifically, we found that, by October 2018, FEMA had not fully tested 190 security controls in the GMM engineering and test environment. These controls were related to areas such as security incident handling and allocation of resources required to protect an information system. In response to our findings, in October 2018, GMM program officials reported that they had since fully tested 27 controls and partially tested the remaining 163 controls. Program officials stated that testing of the 163 controls is a shared responsibility between GMM and other parties (e.g., the cloud service provider). They added that GMM had completed its portion of the testing but was in the process of verifying the completion of testing by other parties. Program officials stated that the untested controls were not addressed sooner, in part, because of errors resulting from configuration changes in the program’s compliance tool during a system upgrade, which have now been resolved. Until GMM ensures that all security controls have been tested, it remains at an increased risk of exposing programs to potential exploits. Consistent with the NIST framework, GMM established methods for assessing and monitoring security controls to be conducted after an authorization to operate has been approved. GMM has tailored its cybersecurity policies and practices for monitoring its controls to take into account the frequent and iterative pace with which system functionality is continuously being introduced into the GMM environment. Specifically, the GMM program established a process for assessing security impact changes to the system and conducting reauthorizations to operate within the rapid Agile delivery environment. As part of this process, GMM embedded cybersecurity experts on each Agile development team so that they are involved early and can impact security considerations from the beginning of requirements development through testing and deployment of system functionality. In addition, the process involves important steps for ensuring that the system moves from development to completion, while producing a secure and reliable system. For example, it includes procedures for creating, reviewing, and testing new system functionality. As the new system functionality is integrated with existing system functionality, it is to undergo automated testing and security scans in order to ensure that the integrity of the security of the system has not been compromised. Further, an automated process is to deploy the code if it passes all security scans, code tests, and code quality checks. GMM’s process for conducting a reauthorization to operate within the rapid delivery Agile development environment is to follow FEMA guidance that states that all high-level changes made to a FEMA IT system must receive approval from both a change advisory board and the FEMA Chief Information Officer. The board and FEMA Chief Information Officer are to focus their review and approval on scheduled releases and epics (i.e., collections of user stories). Additionally, the Information System Security Officer is to review each planned user story and, if it is determined that the proposed changes may impact the integrity of the authorization, the Information System Security Officer is to work with the development team to begin the process of updating the system authorization. Finally, GMM uses automated tools to track the frequency in which security controls are assessed and to ensure that required scanning data are received by FEMA for reporting purposes. Program officials stated that, in the absence of department-level and agency-level guidance, they have coordinated with DHS and FEMA OCIO officials to ensure that these officials are in agreement with GMM’s approach to continuous monitoring. By having monitoring control policies and procedures in place, FEMA management is positioned to more effectively prioritize and plan its risk response to current threats and vulnerabilities for the GMM program. Given FEMA’s highly complex grants management environment, with its many stakeholders, IT systems, and internal and external users, implementing leading practices for business process reengineering and IT requirements management is critical for success. FEMA has taken many positive steps, including ensuring executive leadership support for business process reengineering, documenting the agency’s grants management processes and performance improvement goals, defining initial IT requirements for the program, incorporating input from end user stakeholders into the development and implementation process, and taking recent actions to improve its delivery of planned IT requirements. Nevertheless, until the GMM program finalizes plans and time frames for implementing its organizational change management actions, plans and communicates system transition activities, and maintains clear traceability of IT requirements, FEMA will be limited in its ability to provide streamlined grants management processes and effectively deliver a modernized IT system to meet the needs of its large range of users. While GMM’s initial cost estimate was reliable, key assumptions about the program since the initial estimate had changed and, therefore, it no longer reflected the current approach for the program. The forthcoming updated cost schedule is expected to better reflect the current approach. However, the program’s unreliable schedule to fully deliver GMM by September 2020 is aggressive and unrealistic. The delays the program has experienced to date further compound GMM’s schedule issues. Without a robust schedule that has been informed by a realistic assessment of GMM’s development activities, leadership will be limited in its ability to make informed decisions on what additional increases in cost or reductions in scope might be needed to achieve their goals. Further, FEMA’s implementation of cybersecurity practices for GMM in the areas of system categorization, selection and implementation, and monitoring will help the program. However, GMM lacked essential details for evaluating security controls, did not approve the security assessment plan before proceeding with the security assessment, did not follow DHS’s guidance to develop corrective action plans for all security vulnerabilities, and did not fully test all security controls. As a result, the GMM engineering and test environment remains at an increased risk of exploitations. We are making eight recommendations to FEMA: The FEMA Administrator should ensure that the GMM program management office finalizes the organizational change management plan and time frames for implementing change management actions. (Recommendation 1) The FEMA Administrator should ensure that the GMM program management office plans and communicates its detailed transition activities to its affected customers before they transition to GMM and undergo significant changes to their processes. (Recommendation 2) The FEMA Administrator should ensure that the GMM program management office implements its planned changes to its processes for documenting requirements for future increments and ensures it maintains traceability among key IT requirements documents. (Recommendation 3) The FEMA Administrator should ensure that the GMM program management office updates the program schedule to address the leading practices for a reliable schedule identified in this report. (Recommendation 4) The FEMA Administrator should ensure that the FEMA OCIO defines sufficiently detailed planned evaluation methods and actual evaluation methods for assessing security controls. (Recommendation 5) The FEMA Administrator should ensure that the FEMA OCIO approves a security assessment plan before security assessment reviews are conducted. (Recommendation 6) The FEMA Administrator should ensure that the GMM program management office follows DHS guidance on preparing corrective action plans for all security vulnerabilities. (Recommendation 7) The FEMA Administrator should ensure that the GMM program management office fully tests all of its security controls for the system. (Recommendation 8) DHS provided written comments on a draft of this report, which are reprinted in appendix IV. In its comments, the department concurred with all eight of our recommendations and provided estimated completion dates for implementing each of them. For example, with regard to recommendation 4, the department stated that FEMA plans to update the GMM program schedule to address the leading practices for a reliable schedule by April 30, 2019. In addition, for recommendation 7, the department stated that FEMA plans to ensure that corrective action plans are prepared by July 31, 2019, to address all identified security vulnerabilities for GMM. If implemented effectively, the actions that FEMA plans to take in response to the recommendations should address the weaknesses we identified. We also received technical comments from DHS and FEMA officials, which we incorporated, as appropriate. We are sending copies of this report to the Secretary of Homeland Security and interested congressional committees. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. Our objectives were to (1) determine the extent to which the Federal Emergency Management Agency (FEMA) is implementing leading practices for reengineering its grants management business processes and incorporating business needs into Grants Management Modernization (GMM) information technology (IT) requirements; (2) assess the reliability of the program’s estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices for GMM. To address the first objective, we reviewed GAO’s Business Process Reengineering Assessment Guide and Software Engineering Institute’s Capability Maturity Model for Integration for Development to identify practices associated with business process reengineering and IT requirements management. We then selected six areas that, in our professional judgment, represented foundational practices that were of particular importance to the successful implementation of an IT modernization effort that is using Agile development processes. We also selected the practices that were most relevant based on where GMM was in the system development lifecycle and we discussed the practice areas with FEMA officials. The practices are: Ensuring executive leadership support for process reengineering Assessing the current and target business environment and business Establishing plans for implementing new business processes Establishing clear, prioritized, and traceable IT requirements Tracking progress in delivering IT requirements Incorporating input from end user stakeholders We also reviewed selected chapters of GAO’s draft Agile Assessment Guide (Version 6A), which is intended to establish a consistent framework based on best practices that can be used across the federal government for developing, implementing, managing, and evaluating agencies’ IT investments that rely on Agile methods. To develop this guide, GAO worked closely with Agile experts in the public and private sector; some chapters of the guide are considered more mature because they have been reviewed by the expert panel. We reviewed these chapters to ensure that our expectations for how FEMA should apply the six practices for business process reengineering and IT requirements management are appropriate for an Agile program and are consistent with the draft guidance that is under development. Additionally, since Agile development programs may use different terminology to describe their software development processes, the Agile terms used in this report (e.g., increment, sprint, epic, etc.) are specific to the GMM program. We obtained and analyzed FEMA grants management modernization documentation, such as current and target grants management business processes, acquisition program baseline, operational requirements document, concept of operations, requirements analyses workbooks, Grants Management Executive Steering Group artifacts, stakeholder outreach artifacts, Agile increment- and sprint-level planning and development artifacts, and the requirements backlog. We assessed the program documentation against the selected practices to determine the extent to which the agency had implemented them. We then assessed each practice area as: fully implemented—FEMA provided complete evidence that showed it fully implemented the practice area; partially implemented—FEMA provided evidence that showed it partially implemented the practice area; not implemented—FEMA did not provide evidence that showed it implemented any of the practice area. Additionally, we observed Agile increment and sprint development activities at GMM facilities in Washington, D.C. We also observed a demonstration of how the program manages its lower level requirements (i.e., user stories and epics) and maintains traceability of the requirements using an automated tool at GMM facilities in Washington, D.C. We also interviewed FEMA officials, including the GMM Program Executive, GMM Program Manager, GMM Business Transformation Team Lead, and Product Owner regarding their efforts to streamline grants management business processes, collect and incorporate stakeholder input, and manage GMM’s requirements. In addition, we interviewed FEMA officials from four out of 16 grant program offices and two out of 10 regional offices to obtain contextual information and illustrative examples of FEMA’s efforts to reengineer grants management business processes and collect business requirements for GMM. Specifically, We selected the four grant program offices based on a range of grant programs managed, legacy systems used, and the amount of grant funding awarded. We also sought to select a cross section of different characteristics, such as selecting larger grant program offices, as well as smaller offices. In addition, we ensured that our selection included the Assistance to Firefighters Grants (AFG) program office because officials in this office represent the first GMM users and, therefore, are more actively involved with the program’s Agile development practices. Based on these factors, we selected: Public Assistance Division, Individual Assistance Division, AFG, and National Fire Academy. Additionally, the four selected grant program offices are responsible for 16 of the total 45 grant programs and are users of five of the nine primary legacy IT systems. The four selected grant program offices also represent about 68 percent of the total grant funding awarded by FEMA from fiscal years 2005 through 2016. We selected two regional offices based on (1) the largest amount of total FEMA grant funding for fiscal years 2005 through 2016—Region 6 located in Denton, Texas; and (2) the highest percentage of AFG funding compared to the office’s total grant funding awarded from fiscal years 2005 through 2016—Region 5 located in Chicago, Illinois. To assess the reliability of data from the program’s automated IT requirements management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data. We also compared the data to other relevant program documentation on GMM requirements. We determined that the data used were sufficiently reliable for the purpose of evaluating GMM’s practices for managing IT requirements. For our second objective, to assess the reliability of GMM’s estimated costs and schedule, we reviewed documentation on GMM’s May 2017 lifecycle cost estimate and on the program’s schedule, dated May 2018. To assess the reliability of the May 2017 lifecycle cost estimate, we evaluated documentation supporting the estimate, such as the cost estimating model, the report on GMM’s Cost Estimating Baseline Document and Life Cycle Cost Estimate, and briefings provided to the Department of Homeland Security (DHS) and FEMA management regarding the cost estimate. We assessed the cost estimating methodologies, assumptions, and results against leading practices for developing a comprehensive, accurate, well-documented, and credible cost estimate, identified in GAO’s Cost Estimating and Assessment Guide. We also interviewed program officials responsible for developing and reviewing the cost estimate to understand their methodology, data, and approach for developing the estimate. We found that the cost data were sufficiently reliable. To assess the reliability of the May 2018 GMM program schedule, we evaluated documentation supporting the schedule, such as the integrated master schedule, acquisition program baseline, and Agile artifacts. We assessed the schedule documentation against leading practices for developing a comprehensive, well-constructed, credible, and controlled schedule, identified in GAO’s Schedule Assessment Guide. We also interviewed GMM program officials responsible for developing and managing the program schedule to understand their practices for creating and maintaining the schedule. We noted in our report the instances where the quality of the schedule data impacted the reliability of the program’s schedule. For both the cost estimate and program schedule, we assessed each leading practice as: fully addressed—FEMA provided complete evidence that showed it implemented the entire practice area; substantially addressed—FEMA provided evidence that showed it implemented more than half of the practice area; partially addressed—FEMA provided evidence that showed it implemented about half of the practice area; minimally addressed—FEMA provided evidence that showed it implemented less than half of the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area. Finally, we provided FEMA with draft versions of our detailed analyses of the GMM cost estimate and schedule. This was done to verify that the information on which we based our findings was complete, accurate, and up-to-date. Regarding our third objective, to determine the extent to which FEMA is addressing key cybersecurity practices for GMM, we reviewed documentation regarding DHS and FEMA cybersecurity policies and guidance, and FEMA’s authorization to operate for the program’s engineering and test environment. We evaluated the documentation against all six cybersecurity practices identified in the National Institute of Standards and Technology’s (NIST) Risk Management Framework. While NIST’s Risk Management Framework identifies six total practices, for reporting purposes, we combined two interrelated practices—selection of security controls and implementation of security controls—into a single practice. The resulting five practices were: categorizing the system based on security risk, selecting and implementing security controls, assessing security controls, obtaining an authorization to operate the system, and monitoring security controls on an ongoing basis. We obtained and analyzed key artifacts supporting the program’s efforts to address these risk management practices, including the program’s System Security Plan, the Security Assessment Plan and Report, Authorization to Operate documentation, and the program’s continuous monitoring documentation. We also interviewed officials from the GMM program office and FEMA’s Office of the Chief Information Officer, such as the GMM Security Engineering Lead, GMM Information System Security Officer, and FEMA’s Acting Chief Information Security Officer, regarding their efforts to assess, document, and review security controls for GMM. We assessed the evidence against the five practices to determine the extent to which the agency had addressed them. We then assessed each practice area as: fully addressed—FEMA provided complete evidence that showed it fully implemented the practice area; partially addressed—FEMA provided evidence that showed it partially implemented the practice area; not addressed—FEMA did not provide evidence that showed it implemented any of the practice area. To assess the reliability of data from the program’s automated security controls management tool, we interviewed knowledgeable officials about the quality control procedures used by the program to assure accuracy and completeness of the data. We also compared the data to other relevant program documentation on GMM security controls for the engineering and test environment. We found that some of the security controls data we examined were sufficiently reliable for the purpose of evaluating FEMA’s cybersecurity practices for GMM, and we noted in our report the instances where the accuracy of the data impacted the program’s ability to address key cybersecurity practices. We conducted this performance audit from December 2017 to April 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Federal Emergency Management Agency (FEMA) awards many different types of grants to state, local, and tribal governments and nongovernmental entities. These grants are to help communities prevent, prepare for, protect against, mitigate the effects of, respond to, and recover from disasters and terrorist attacks. Agile software development is a type of incremental development that calls for the rapid delivery of software in small, short increments. The use of an incremental approach is consistent with the Office of Management and Budget’s guidance as specified in its information technology (IT) Reform Plan, as well as the legislation commonly referred to as the Federal Information Technology Acquisition Reform Act. Many organizations, especially in the federal government, are accustomed to using a waterfall software development model, which typically consists of long, sequential phases, and differs significantly from the Agile development approach. Agile practices integrate planning, design, development, and testing into an iterative lifecycle to deliver software early and often. Figure 7 provides a depiction of software development using the Agile approach, as compared to a waterfall approach. The frequent iterations of Agile development are intended to effectively measure progress, reduce technical and programmatic risk, and respond to feedback from stakeholders in changes to IT requirements more quickly than traditional methods. Despite these intended benefits, organizations adopting Agile must overcome challenges in making significant changes to how they are accustomed to developing software. The significant differences between Agile and waterfall development impact how IT programs are planned, implemented, and monitored in terms of cost, schedule, and scope. For example, in waterfall development, significant effort is devoted upfront to document detailed plans and all IT requirements for the entire scope of work at the beginning of the program, and cost and schedule can be varied to complete that work. However, for Agile programs the precise details are unknown upfront, so initial planning of cost, scope, and timing would be conducted at a high level, and then supplemented with more specific plans for each iteration. While cost and schedule are set for each iteration, requirements for each iteration (or increment) can be variable as they are learned over time and revised to reflect experiences from completed iterations and to accommodate changing priorities of the end users. The differences in these two software development approaches are shown in figure 8. Looking at figure 8, the benefit provided from using traditional program management practices such as establishing a cost estimate or a robust schedule, is not obvious. However, unlike a theoretical environment, many government programs may not have the autonomy to manage completely flexible scope, as they must deliver certain minimal specifications with the cost and schedule provided. In those cases, it is vital for the team to understand and differentiate the IT requirements that are “must haves” from the “nice to haves” early in the planning effort. This would help facilitate delivery of the “must-haves” requirements first, thereby providing users with the greatest benefits as soon as possible. In addition to the contact named above, the following staff made key contributions to this report: Shannin G. O’Neill (Assistant Director), Jeanne Sung (Analyst in Charge), Andrew Beggs, Rebecca Eyler, Kendrick Johnson, Thomas J. Johnson, Jason Lee, Jennifer Leotta, and Melissa Melvin.

 

 Report 2:
The Clean Water Act (CWA) authorizes the principal federal program to aid municipal wastewater treatment plant construction and related eligible activities. Congress established this program in the Federal Water Pollution Control Act Amendments of 1972 (P.L. 92-500) (although prior versions of the act had authorized less ambitious grants assistance since 1956). Title II of P.L. 92-500 authorized grants to states for wastewater treatment plant construction under a program administered by the Environmental Protection Agency (EPA). Federal funds were provided through annual appropriations under a state-by-state allocation formula contained in the act itself. States used their allotments to make grants to cities to build or upgrade wastewater treatment plants, supporting the overall objectives of the act: restoring and maintaining the chemical, physical, and biological integrity of the nation's waters. The federal share of project costs, originally 75% under P.L. 92-500, was reduced to 55% in 1981. By the mid-1980s, there was considerable policy debate between Congress and the Administration over the future of the act's construction grants program and, in particular, the appropriate federal role in funding municipal water infrastructure projects. Through FY1984, Congress had appropriated nearly $41 billion under this program, representing the largest nonmilitary public works programs since the Interstate Highway System. The grants program was a target of budget cuts in the Reagan Administration, which sought to redirect budgetary priorities in part to sort out the appropriate roles of federal, state, and local governments in a number of domestic policy areas, including water pollution control. The Administration's rationale included several points: The original intent of the program to address the backlog of sewage treatment needs had been virtually eliminated by the mid-1980s. Most remaining projects (such as small, rural systems) were believed to pose little environmental threat and were not appropriate federal responsibilities. State and local governments, in the Administration's view, were fully capable of running construction programs and have a clear responsibility to construct treatment capacity to meet environmental objectives that were primarily established by states. Thus, the Reagan Administration sought a phaseout of the act's construction grants program by 1990. Many states and localities supported the idea of phasing out the grants program, since many were critical of what they viewed as burdensome rules and regulations that accompanied the federal grant money. However, they sought a longer transition and ample flexibility to set up long-term financing to promote state and local self-sufficiency. Congress's response to this debate was contained in 1987 amendments to the act ( P.L. 100-4 , the Water Quality Act of 1987). It authorized $18 billion over nine years for sewage treatment plant construction, through a combination of the Title II grants program and a new State Water Pollution Control Revolving Funds program—hereinafter the clean water state revolving fund (CWSRF) program. Under the new program, in CWA Title VI, federal grants would be provided as seed money for state-administered loans to build sewage treatment plants and, eventually, other water quality projects. Cities, in turn, would repay loans to the state, enabling a phaseout of federal involvement while the state built up a source of capital for future investments. Under the amendments, the CWSRF program was phased in beginning in FY1989 (in FY1989 and FY1990, appropriations were split equally between Title II and Title VI grants) and entirely replaced the previous Title II program in FY1991. The intention was that states would have flexibility to set priorities and administer funding, while federal aid would end after FY1994. The CWSRF authorizations for appropriations provided in the 1987 amendments expired in FY1994, but pressure to extend federal funding has continued, in part because, although Congress has appropriated $98 billion in CWA Title II and Title VI wastewater infrastructure assistance since 1972, funding needs remain high: According to the most recent formal estimate by EPA and states (prepared in 2016), an additional $271 billion nationwide is needed over the next 20 years for all types of projects eligible for funding under the act. Congress has continued to appropriate funds, and continued to assist states and localities in meeting wastewater infrastructure needs and complying with CWA requirements. In 1996, Congress established a parallel program under the Safe Drinking Water Act (SDWA) to help communities finance projects needed to comply with federal drinking water regulations. Funding support for drinking water occurred for several reasons. First, until the 1980s, the number of drinking water regulations was fairly small, and public water systems often did not need to make large investments in treatment technologies to meet those regulations. Second, good quality drinking water traditionally has been available to many communities at relatively low cost. By comparison, essentially all communities have had to construct or upgrade sewage treatment facilities to meet the requirements of the CWA. Over time, drinking water circumstances changed, as communities grew, and commercial, industrial, agricultural, and residential land-uses became more concentrated, thus resulting in more contaminants reaching drinking water sources. Moreover, as the number of federal drinking water standards has increased, many communities have found that their water may not be as good as once thought and that additional treatment technologies are required to meet the new standards and protect public health. Between 1986 and 1996, for example, the number of regulated drinking water contaminants grew from 23 to 83, and EPA and the states expressed concern that many of the nation's 52,000 small community water systems were likely to lack the financial capacity to meet the rising costs of SDWA compliance. According to the most recent EPA-state survey (issued in 2018), future funding needs for projects to treat and deliver public drinking water supplies in the United States are $473 billion over the next 20 years. Congress responded to these concerns by enacting the 1996 SDWA Amendments ( P.L. 104-182 ), which authorized a drinking water state revolving loan fund (DWSRF) program to help systems finance projects needed to comply with SDWA regulations and to protect public health. This program, fashioned after the CWSRF program, authorizes EPA to make grants to states to capitalize DWSRFs which states then use to make loans to public water systems. Appropriations for the program were authorized at $599 million for FY1994 and $1 billion annually for FY1995 through FY2003. Capitalization grants for DWSRF programs were provided for the first time in FY1997. Although the authorizations for appropriations expired in FY2003, Congress continued to provide funding for the program in annual appropriations, totaling $23 billion through FY2019. America's Water Infrastructure Act of 2018 (AWIA; P.L. 115-270 ), enacted on October 23, 2018, reauthorized appropriations for the DWSRF at $1.17 billion in FY2019, $1.30 billion in FY2020, and $1.95 billion in FY2021. The first section of this report includes a table that summarizes the history of appropriations for both wastewater and drinking water infrastructure programs. The next section discusses several historical developments in water infrastructure funding. The last section contains a detailed chronology of congressional activity regarding wastewater and drinking water infrastructure funding for each fiscal year since the 1987 CWA amendments. Table 1 summarizes funding for the wastewater and drinking infrastructure programs since enactment of the 1987 CWA amendments ( P.L. 100-4 ). Funding for these EPA programs is contained in the appropriations act providing funds for the Department of the Interior, Environment, and Related Agencies. Within the portion of the bill that funds EPA, wastewater treatment assistance was first specified in an account called Construction Grants, which was subsequently renamed State Revolving Funds/Construction Grants, and then renamed Water Infrastructure. Since FY1996, this account has been titled State and Tribal Assistance Grants (STAG). The STAG account now includes all water infrastructure funds and management grants provided to assist states in implementing air quality, water quality, and other media-specific environmental programs. The FY1996 appropriation was the first to include both water infrastructure and other state environmental grants; the latter previously were included in EPA's general program management account. Amounts shown in Table 1 include funds for CWA Title II grants, CWSRF grants, drinking water SRF grants, special project grants (discussed below), and the Water Infrastructure Finance and Innovation Act (WIFIA) program. Congress first provided appropriations to cover the subsidy costs of this program in FY2017, as discussed in the detailed chronology section below. Table 1 does not include funds for consolidated state environmental management grants. These grants include funding for a wide range of environmental programs, which have changed over time. In recent years, the categorical grants have included funding for water, air, and waste programs. The categorical grant programs most closely related to water infrastructure issues include grants for states' nonpoint source management programs (CWA Section 319) and states' pollution control programs (CWA Section 106). Funding levels for the environmental management state grants are discussed below in the appropriations chronology section. As an additional comparison, Figure 1 illustrates the total EPA water infrastructure appropriations (for clean water and drinking water assistance combined) between FY1986 and FY2019 in both nominal dollars (i.e., not adjusted for inflation) and constant (2018) dollars (i.e., adjusted for inflation). This section discusses several historical developments of note regarding appropriations for EPA's water infrastructure programs. The practice of earmarking a portion of the construction grants/SRF account for specific wastewater treatment and other water quality projects began with the FY1989 appropriations. The practice increased to the point of representing a significant portion of appropriated funds (31% of the total water infrastructure appropriation in FY1994, for example, but less in subsequent years: 2.5% in FY2009 and 5% in FY2010). The number of projects receiving these earmarked funds also increased: from 4 in FY1989 to 319 in FY2010. Beginning in FY2000, the larger total number of earmarked projects resulted in more communities receiving such grants, but at the same time receiving smaller amounts of funds. Thus, while a few communities received individual earmarked awards of $1 million or more, the average size of earmarked grants shrank: $18.1 million in FY1995, $4.9 million in FY1999, $1.08 million in FY2006, and $586,000 in FY2010. (Conference reports on the individual appropriations bills, noted in the later discussion in this report, provide some detail on projects funded in this manner.) The effective result of earmarking was to reduce the amount of funds provided to states to capitalize their SRF programs. Between FY1989 and FY2010, approximately 10% of the total water infrastructure appropriations ($7.4 billion) went to earmarked project grants. Interest groups representing state water quality program managers and administrators of infrastructure financing programs criticized the practice of earmarked appropriations. They contended that earmarking undermined the intended purpose of the state funds—promoting water quality improvements nationwide. Many state officials preferred funds to be allocated more equitably, not based on what they viewed largely as political considerations, and they preferred for state environmental and financing officials to retain responsibility to set actual spending priorities. Further, they argued that the special projects funding would diminish the level of seed funding to SRFs, delaying the time when SRFs would be financially self-sufficient. The practice of earmarking was criticized because designated projects were arguably receiving more favorable treatment than other communities' projects: They were generally eligible for 55% federal grants (and were not required to repay 100% of the funded project cost, as is the case with a loan through an SRF), and the practice circumvented the standard process of states determining the priority by which projects will receive funding. It also meant that the projects were generally not reviewed by the CWA authorizing committees. This was especially true after FY1992, when special purpose grant funding was designated for types of projects not authorized in the Clean Water Act or the Safe Drinking Water Act. Members of Congress intervened for a specific community for a number of reasons. In some cases, the communities may have been unsuccessful in seeking state approval to fund the project under an SRF loan or other program. For some, the cost of a project financed through a state loan was deemed unacceptably high, because repaying the loan would result in increased user fees that ratepayers felt would have been unduly burdensome. In the early years of this congressional practice, special purpose grant funding originated in the House version of the EPA appropriations bill, while the Senate, for the most part, resisted earmarking by rejecting or reducing amounts and projects included in House-passed legislation. Therefore, special purpose grant funding on several occasions was an issue during the House-Senate conference on the appropriations bill. Beginning in FY1999, however, both the House and Senate proposed earmarked projects in their respective versions of the EPA appropriations bill, with the final total number of projects and dollar amounts determined by conferees. The Clean Water Act Title II grants program effectively ended when authorizations for it expired after FY1990. One result of earmarking special purpose grants in appropriations bills was to continue grants as a method of funding wastewater treatment construction long after FY1990. This practice led Congress to provide EPA grants for drinking water system projects, which had not previously been available. However, as discussed in the next section, general opposition to congressional earmarking stopped the practice after FY2011. The federal percentage share and local match required on special purpose grants varied depending on the project and the year of funding. For example, in the early projects (FY1989), the 1987 CWA amendments specified the federal cost shares, which ranged from 75% to 85%. In FY1992 and FY1993, the appropriations acts specified that funds were provided "as grants under title II," resulting in a requirement for local communities to provide a 45% share of project costs. After FY1993, the appropriations acts themselves were the authority for the special purpose projects grants. In the FY1995 appropriation bill, which also directed allocation of funds appropriated in FY1994 to several needy cities, Congress addressed the issue of federal and local cost shares in report language accompanying the bill, but not in the appropriation act itself. The conferees are in agreement that the agency should work with the grant recipients on appropriate cost-share arrangements. It is the conferees' expectation that the agency will apply the 45% local cost share requirement under Title II of the Clean Water Act in most cases. In the FY1996 appropriations, both the act and accompanying reports were silent on federal/local cost share and applicability of Title II requirements. Because of that, EPA officials planned to require only a 5% local match for most of the special purpose grants in that bill, which is the standard matching requirement for other EPA noninfrastructure grants. Under the agency's rules, the local match could include in-kind services, as well as funding toward the project. In the FY1997 appropriations, Congress included report language as it had in FY1995 concerning federal and local cost share requirements. The conferees are in agreement that the Agency should work with the grant recipients on appropriate cost-share agreements and to that end the conferees direct the Agency to develop a standard cost-share consistent with fiscal year 1995. The FY1998 and FY1999 appropriations included neither bill nor report language on this point. However, language in the House and Senate Appropriations Committees' reports on the FY1998 and FY1999 bills directed EPA to work with grant recipients on appropriate cost-share arrangements. For FY2000, Congress included explicit report language concerning the local match. The conferees agree that the $331,650,000 provided to communities or other entities for construction of water and wastewater treatment facilities and for groundwater protection infrastructure shall be accompanied by a cost-share requirement whereby 45 percent of a project's cost is to be the responsibility of the community or entity consistent with long-standing guidelines for the Agency. These guidelines also offer flexibility in the application of the cost-share requirement for those few circumstances when meeting the 45 percent requirement is not possible. Similar report language concerning local cost-share requirements accompanied the conference reports on the appropriations bills from FY2001 through FY2005. Beginning with FY2004, Congress specified in the appropriations legislation that the local share of project costs shall be not less than 45%. Similarly, beginning with the FY2003 appropriations legislation, Congress also specified that, except for those limited instances in which an applicant meets the criteria for a waiver of the cost-share requirement, the earmarked grant shall provide no more than 55% of an individual project's cost, regardless of the amount appropriated. The practice of earmarking special project water infrastructure grants continued to change. First, in FY2007, Congress applied a one-year moratorium on earmarks in all appropriations bills. For the next three years, special project grants were allowed in appropriations bills—including EPA's—but again in FY2011, no special project funding was provided for congressional projects. Following the 2010 midterm election and during subsequent months while FY2011 appropriations were under consideration (discussed below), the general issue of congressional earmarks of specific projects had become highly controversial because of the overall growing number of them, concern over the influence of special interests on spending decisions, and lack of congressional oversight. In response, President Obama said he would veto any legislation containing earmarks, the House extended the ban on earmarks under the Republican Conferences rules, and the chairman of the Senate Appropriations Committee announced a moratorium on earmarks for FY2011 and FY2012. Thus, the FY2011 full-year appropriations measure contained no congressionally directed special project funds for water infrastructure projects in the EPA STAG account. However, it did include funds requested by the President: $10 million for Alaska Native Villages and $10 million for U.S.-Mexico border projects. The FY2012 full-year appropriations measure also contained no special project funding in the EPA STAG account. The FY2012 bill did include funds for Alaska Native and Rural Villages ($10 million) and for U.S.-Mexico border projects ($5 million). The moratorium on congressional earmarks has continued. The FY2013 full-year appropriations measure ( P.L. 113-6 ) contained no special project funding in the STAG account. As with other recent bills, however, it did include funds for Alaska Native and Rural Villages ($9.5 million) and for U.S.-Mexico border projects ($4.7 million). Similarly, the moratorium on earmarks continued in FY2014 and FY2015; P.L. 113-76 contained no special project funding in the STAG account for FY2014, but did include funds for Alaska Native and Rural Villages ($10 million) and for U.S.-Mexico border projects ($5 million). The FY2015 funding bill, P.L. 113-235 , was the same as FY2014. The FY2016, FY2017, and FY2018 appropriations acts ( P.L. 114-113 , P.L. 115-31 , and P.L. 115-141 , respectively) included $20 million for Alaska Native and Rural Villages and $10 million for U.S.-Mexico border projects. The FY2019 appropriations act provided $25 million for Alaska Native and Rural Villages and $15 million for U.S.-Mexico border projects. President Trump's FY2020 budget request proposes to eliminate funding for the U.S.-Mexico border program and decrease funding for the Alaska Native and Rural Villages to $3 million. Although the CWSRF and DWSRF have largely functioned as loan programs, both allow the implementing state agency to provide "additional subsidization" under certain conditions. Since its amendments in 1996, the SDWA has authorized states to use up to 30% of their DWSRF capitalization grants to provide additional assistance, such as forgiveness of loan principal or negative interest rate loans, to help disadvantaged communities (as determined by the state). In 2018, AWIA increased that percentage to 35% and conditionally required states to provide at least 6% of their annual grants as additional subsidization. Congress amended the CWA in 2014, adding similar provisions to the CWSRF program. In addition, appropriations acts in recent years have required states to use minimum percentages of their allotted funds to provide additional subsidization. This trend began with the American Recovery and Reinvestment Act of 2009 ( P.L. 111-5 ), which required states to use at least 50% of their funds to "provide additional subsidization to eligible recipients in the form of forgiveness of principal, negative interest loans or grants or any combination of these." Subsequent appropriation acts have included similar conditions, with varying percentages of subsidization. The FY2016, FY2017, FY2018, and FY2019 appropriations acts included an identical condition, requiring 10% of the CWSRF grants and 20% of the DWSRF grants to be used "to provide additional subsidy to eligible recipients in the form of forgiveness of principal, negative interest loans, or grants (or any combination of these)." The 1987 CWA amendments authorized federal grants to assist states in implementing programs to manage water pollution from nonpoint sources such as farm and urban areas, construction, forestry, and mining sites. Because of competing demands for funding, it was difficult for Congress to fund this grant program and other water quality initiatives in the 1987 act. Appropriators did fund Section 319 grants in EPA's general program management account (abatement, control, and compliance) in FY1990, FY1991, and FY1992 but well below authorized levels. In the FY1993 act, appropriators moved funding into the SRF/construction grants account, thereby providing a degree of protection from competing priorities. In FY1996, Congress included all state grants for management of environmental programs in a single consolidated grants appropriation. In doing so, Congress endorsed a Clinton Administration proposal for a more flexible approach to state grants, a key element of EPA's efforts to improve the federal-state partnership in environmental programs. In more recent years, Congress has provided specific funding amounts for certain programs within the categorical grants appropriation. This section summarizes, in chronological order, congressional activity to fund items in the STAG account since the 1987 CWA amendments. The authorization period covered by P.L. 100-4 was FY1986-FY1994. By the time the amendments were enacted, FY1986 was over, as was a portion of FY1987. Thus, appropriations for those two years only indirectly reflected the policy and program changes for later years that were contained in P.L. 100-4 . For FY1986, Congress appropriated a total of $1.8 billion, consisting of $600 million approved in December 1985 (while Congress was beginning to debate reauthorization legislation that eventually was enacted as P.L. 100-4 in January 1987) and $1.2 billion more in July 1986. For FY1987, while debate on CWA reauthorization continued, President Reagan requested $2.0 billion, consistent with his legislative proposal to terminate the grants program by FY1990. In October 1986, Congress appropriated $2.4 billion ( P.L. 99-500 / P.L. 99-591 ). However, only $1.2 billion of that amount was released immediately, pending enactment of a reauthorization bill, which was then in conference. Following enactment of the Water Quality Act of 1987, remaining FY1987 funds were released as part of a supplemental appropriations bill ( P.L. 100-71 ). Conferees on that measure agreed, however, to shift $39 million of the remaining unreleased grant funds to other priority water quality activities authorized in P.L. 100-4 . The final total of construction grant monies was $2.361 billion. For FY1988 the President again requested $2.0 billion. In December 1987, Congress approved legislation providing FY1988 appropriations ( P.L. 100-202 , the omnibus continuing resolution to fund EPA and other federal agencies). In it, Congress appropriated $2.304 billion for construction grants. Final action on the EPA budget and other funding bills had been delayed by budget-cutting talks between Congress and the White House. Reduced construction grants funding was one of many spending cuts required to implement a congressional-White House "summit agreement" on the budget. The final construction grants appropriation was less than funding levels that had been included in separate versions of a bill passed by the House and Senate before the budget summit, $2.4 billion. For FY1989, President Reagan requested $1.5 billion, or 35% below FY1988 appropriations and 37.5% less than the authorized level of $2.4 billion for FY1989. In separate versions of an EPA appropriations bill, the House and Senate voted to provide $1.95 billion and $2.1 billion respectively. The final figure, in P.L. 100-404 , was $1.95 billion, which included $68 million for special projects in four states. Thus, the actual amount provided for grants was $1.882 billion. That total was divided equally between the previous Title II grants program and new Title VI SRF program, as provided in the authorizing language of P.L. 100-4 . The FY1989 legislation was the first to include earmarking of funds for specified projects or grants in EPA's construction grants account, an action that continued in subsequent years, as discussed above. All of the projects funded in the 1989 legislation were ones that had been authorized in provisions of the Water Quality Act of 1987 (WQA, P.L. 100-4 ). The designated projects were in Boston (authorized in Section 513 of the WQA, to fund the Boston Harbor wastewater treatment project), San Diego/Tijuana (Section 510, to fund an international sewage treatment project needed because of the flow of raw sewage from Tijuana, Mexico, across the border), Des Moines, IA (Section 515, for sewage treatment plant construction), and Oakwood Beach/Redhook, NY (Section 512 of the WQA, to relocate natural gas distribution facilities that were near wastewater treatment works in New York City). For FY1990, President Reagan's budget requested $1.2 billion in wastewater treatment assistance, or 50% less than the authorized level and 38.5% less than the FY1989 enacted amount of $1.95 billion. Further, the Reagan budget proposed that the $1.2 billion consist of $800 million in Title VI monies and $400 million in Title II grants, contrary to provisions of the CWA directing that appropriations be equally divided between the two grant programs, as in FY1989. President Bush's revised FY1990 budget, presented in March 1989, made no changes from the Reagan budget in this area. In acting on this request, Congress agreed to provide $2.05 billion, including $46 million for three special projects (Boston, San Diego/Tijuana, and Des Moines), leaving a total of $1.002 billion each for Titles II and VI ( P.L. 101-144 ). Title II funds were reduced by $6.8 million, however, due to funds earmarked for a specific project in South Carolina. Although these amounts were appropriated, all funds in the bill were reduced by 1.55% (or, a $31.8 million reduction from the construction grants account) to provide funds for the federal government's antidrug program. Final FY1990 appropriations were altered again by passage of the FY1990 Budget Reconciliation measure and implementation of the Balanced Budget and Emergency Deficit Control Act (the Gramm-Rudman-Hollings Act), which established procedures to reduce budget deficits annually, resulting in a zero deficit by 1993. For each fiscal year that the deficit was estimated to exceed maximum targets established in law, an automatic spending reduction procedure was triggered to eliminate deficits in excess of the targets through "sequestration," or permanent cancellation of budgetary resources. Thus, to meet budget reduction mandates and, in particular, deficit reduction targets under the Balanced Budget and Emergency Deficit Control Act (the Gramm-Rudman-Hollings Act), additional funding cuts were included in P.L. 101-239 , the Budget Reconciliation Act of 1989, affecting construction grants funding and all other accounts not exempted from Gramm-Rudman procedures. P.L. 101-239 provided that the "sequestration" procedures under the Gramm-Rudman-Hollings Act would be allowed to apply for a portion of FY1990 (for 130 days, or 35.6% of the year), providing an additional automatic spending reduction in EPA and other agencies' programs subject to the act. As a result of these reductions, funding for wastewater treatment aid in FY1990 totaled $1.98 billion, or $30 million more than in FY1989. The total included $53 million for special projects in San Diego, Boston, Des Moines, and Honea Path/Ware Shoals, SC, $960 million for Title II grants, and $967 million for Title VI grants. The combined reductions amounted to 3.4% less than the amount agreed to by conferees on P.L. 101-144 (i.e., $2.05 billion), before subtracting funds for antidrug programs and accounting for effects of the Gramm-Rudman partial-year sequester. For FY1991, President Bush requested $1.6 billion in funding for wastewater treatment assistance. This total included $15.4 million for the San Diego project authorized in Section 510 of the Water Quality Act of 1987, to fund construction of an international sewage treatment project. The remainder, $1.584 billion, would be only for capitalization grants under Title VI of the act, as the 1987 legislation provides for no new Title II grants after FY1990. In acting on EPA's appropriations for FY1991 ( P.L. 101-507 ), Congress agreed to provide $2.1 billion in wastewater treatment assistance. Beginning in FY1991, all appropriated funds are utilized for capitalization grants under Title VI of the act (as provided in the Water Quality Act of 1987); funding for the traditional Title II grants program was no longer available. The enacted level included several earmarkings: $15.7 million for San Diego (Section 510 of the WQA), $20 million for Boston Harbor (Section 513 of the WQA), and $16.5 million for a new Water Quality Cooperative Agreement Program under Section 104(b)(3) of the act. The President's budget had requested $16.5 million to support state permitting, enforcement, and water quality management activities, especially to offset the reductions in aid to states due to elimination of state management setasides from the previous Title II construction grants program. Congress agreed to the level requested, but provided it as a portion of the wastewater treatment appropriation, rather than as part of EPA's general program management appropriation, as in the President's request. As a result of these earmarkings, $2.048 billion was provided for Title VI grants. For FY1992, President Bush requested $1.9 billion in wastewater treatment funds, or $100 million more than authorized under the Water Quality Act of 1987 for Title VI grants in FY1992. However, out of the $1.9 billion total, the President's request sought $1.5 billion for Title VI SRF grants and $400 million as grants under the expired Title II construction grants program for the following coastal cities: Boston, San Diego, New York, Los Angeles, and Seattle. Two of the five designated projects had been authorized in the 1987 CWA amendments; the other three did not have explicit statutory authorization. Also, $16.5 million was requested for Water Quality Cooperative Agreement grants to the states. In acting on the request in November 1991, Congress provided total wastewater funds of $2.4 billion ( P.L. 102-139 ). The total was allocated as follows: $1,948.5 million for SRF capitalization grants, $16.5 million for Section 104(b)(3) grants, $49 million for the special project in San Diego-Tijuana (Section 510 of the Water Quality Act), $46 million to the Rouge River (MI) National Wet Weather Demonstration Project, and $340 million as construction grants under title II of the Clean Water Act for several other special projects—the Back River Wastewater Treatment Plant (Baltimore), Maryland, the Boston Harbor project, New York City, Los Angeles, San Diego (a wastewater reclamation project), and Seattle. This appropriation bill was the first to include special purpose grant funding for several projects not specifically authorized in the Clean Water Act or amendments to that law. For FY1993, President Bush requested $2.484 billion for state revolving funds/construction grants (now called the water infrastructure account). The requested total included $340 million to be targeted for 55% construction grants to six communities: Boston, New York, Los Angeles, San Diego, Seattle, and Baltimore. In addition, the President requested that $130 million be directed toward a Mexican Border Initiative, consisting of $65 million for construction of the international treatment plant at San Diego (to address the Tijuana sewage problem), $15 million for projects at Nogales, AZ, and New River, CA, and $50 million as 50% grants for colonias in Texas. The President also requested $16.5 million for Section 104(b)(3) grants. Along with these special project and grant amounts, the request sought $2.014 billion for SRF assistance. Final action on FY1993 funding occurred on September 25, 1992 ( P.L. 102-389 ). It provided an appropriation of $2.55 billion, but $622.5 million of this amount was reserved for special projects and other grants. The bill provided $50 million in CWA Section 319 grants and $16.5 million in Section 104(b)(3) grants out of the SRF amount. It included $556 million for the following special purpose grants: the international treatment plant at San Diego (Tijuana—Section 510 of the WQA, with bill language capping funding for that project at $239.4 million), plus projects in Boston; New York; Los Angeles; San Diego; Seattle; Rouge River, MI; Baltimore; Ocean County, NJ; Atlanta; and for colonias in Texas, Arizona, and New Mexico. The final SRF grant amount under the bill was $1.928 billion. Early in 1993, President Clinton requested that Congress approve "economic stimulus and investment" spending, in the form of supplemental FY1993 appropriations. Both his original proposal and a subsequent modified proposal included additional SRF grant funds, but neither of the bills enacted by Congress in response to these requests ( P.L. 103-24 , P.L. 103-50 ) provided additional SRF funds. For FY1994, the Clinton Administration requested $2.047 billion for water infrastructure. The funds in this request were $1.198 billion to capitalize State Revolving Funds, $150 million for Mexican border project grants, and $100 million for a single hardship community (Boston). The request also included $599 million to capitalize new state drinking water revolving funds. The final version of the FY1994 legislation ( P.L. 103-124 ) provided $2.477 billion for water infrastructure/state revolving funds. Of this total amount, $599 million was to be reserved for drinking water SRFs, if authorization legislation were enacted; $80 million was for Section 319 grants; $22 million was for Section 104(b)(3) grants; and $58 million was for Tijuana/San Diego—Section 510 of the WQA. This resulted in an appropriation of $1.718 billion for clean water SRFs. In addition, the final bill provided that $500 million be used to support water infrastructure financing in economically distressed/hardship communities. Under the bill, these funds were not available for spending until May 31, 1994, and were set aside until projects were authorized in the CWA for this purpose. Thus, the bill as enacted provided $1.218 billion immediately for clean water SRFs, with the expectation that $500 million more would be available for financing hardship community projects after May 31, 1994. For FY1995, President Clinton requested $2.65 billion for water infrastructure consisting of $1.6 billion for CWA SRFs, $100 million for Section 319 nonpoint source management grants to states, $52.5 million for a grant to San Diego for a wastewater project pursuant to Section 510 of the WQA, $47.5 million for other Mexican border projects, $50 million to the state of Texas for colonias projects, and $100 million for grants under Title II for needy cities (intended for Boston). The request included $700 million for drinking water SRFs, pending enactment of authorizing legislation. The President's budget also requested $21.5 million for Section 104(b)(3) grants/cooperative agreements. Final agreement on FY1995 funding was contained in P.L. 103-327 , enacted in September 1994, which provided a total of $2.962 billion for water infrastructure financing. Of the total, $22.5 million was for grants under Section 104(b), $100 million for Section 319 grants, $70 million for Public Water System Supervision program grants (grants to states under the Safe Drinking Water Act to support state implementation of delegated drinking water programs), $52.5 million for the Section 510 project in San Diego, and $700 million for drinking water SRFs (contingent upon enactment of authorization legislation). The remaining $2.017 billion was for CWA projects. Of this amount, $1.235 billion was for clean water SRF grants to states under Title VI of the CWA. The remaining $781.8 million (39% of this amount, 26% of the total appropriation) was designated for 45 specific, named projects in 22 states. The earmarked amounts ranged in size from $200,000 for Southern Fulton County, PA, to $100 million for the city of Boston. Finally, the conferees included bill language concerning release of the $500 million in FY1994 needy cities money (because the authorizing committees of Congress had not acted on legislation to authorize specific projects, as had been intended in P.L. 103-124 ) as follows: $150 million to Boston, $50 million for colonias in Texas, $10 million for colonias in New Mexico, $70 million for a New York City wastewater reclamation facility, $85 million for the Rouge River project, $50 million for the city of Los Angeles, $50 million for the county of Los Angeles, and $35 million for Seattle, WA. In February 1995, President Clinton submitted the Administration's budget request for FY1996. It requested $2.365 billion for water infrastructure funding consisting of $1.6 billion for clean water state revolving funds, $500 million for drinking water state revolving funds, $150 million to support Mexico border projects under the U.S.-Mexican Border Environmental Initiative and NAFTA, and $100 million for special need/economically distressed communities (not specified in the request, but presumed to be intended for Boston), plus $15 million for water infrastructure needs in Alaska Native Villages. In February 1995, congressional appropriations committees began considering legislation to rescind previously appropriated FY1995 funds, as part of overall efforts by the 104 th Congress to shape the budget and federal spending. These efforts resulted in passage in July 1995 of P.L. 104-19 , which rescinded $16.5 billion in total funds from a number of departments, agencies, and programs. In the water infrastructure area, it rescinded $1,077,200,000 from prior year appropriations including the $3.2 million for a project in New Jersey (it had mistakenly been funded twice in P.L. 103-327 ) and $1,074,000,000 in other water infrastructure appropriations. Although not contained in bill language, it was understood that the larger rescinded amount consisted solely of drinking water SRF funds (leaving $1.235 billion for FY1995 clean water SRF funds, $778.6 million for earmarked wastewater projects—both amounts as originally appropriated—and $225 million in FY1994-FY1995 drinking water SRF funds that had not yet been authorized). It took until April 1996 for Congress and the Administration to reach agreement on FY1996 appropriations for EPA as part of omnibus legislation ( P.L. 104-134 ) that consolidated five appropriations bills not yet enacted due to disagreements over funding levels and policy. Agreement came as the fiscal year was more than one-half over. Before that, however, congressional conferees reached agreement in November 1995 on FY1996 legislation for EPA ( H.R. 2099 , H.Rept. 104-353 ). Conferees agreed to provide $2.323 billion for a new account titled State and Tribal Assistance Grants (STAG), consisting of infrastructure assistance and state environmental management grants for 16 categorical programs that had previously been funded in a separate appropriations account. The total included $1.125 billion for clean water SRF grants, $275 million in new appropriations for drinking water SRF grants, and $265 million for special purpose project grants. Report language provided that the drinking water SRF money also included $225 million from FY1995 appropriations rescinded in P.L. 104-19 . The drinking water SRF money would be available upon enactment of SDWA reauthorization legislation that would authorize a drinking water SRF program; otherwise, it would revert to clean water SRF grants if the SDWA were not reauthorized by June 30, 1996. This made the total potentially available for drinking water SRF grants $500 million. The November 1995 agreement on H.R. 2099 included $658 million for consolidated state environmental grants. In doing so, Congress endorsed an Administration proposal for a more flexible approach to state grants, a key element of EPA's efforts to improve the federal-state partnership in environmental programs. In lieu of traditional grants provided separately to support state air, water, hazardous waste, and other programs, consolidated grants are intended to reduce administrative burdens and improve environmental performance by allowing states and tribes to target funds to meet their specific needs and integrate their environmental programs, as appropriate. Congress's support was described in accompanying report language. The conferees agree that Performance Partnership Grants are an important step to reducing the burden and increasing the flexibility that state and tribal governments need to manage and implement their environmental protection programs. This is an opportunity to use limited resources in the most effective manner, yet at the same time, produce the results-oriented environmental performance necessary to address the most pressing concerns while still achieving a clean environment. Including state environmental grants in the same account with water infrastructure assistance reflected Congress's support for enhancing the ability of states and localities to implement environmental programs flexibly and support for EPA's ability to provide block grants to states and Indian tribes. The H.R. 2099 conference agreement also included legislative riders intended to limit or prohibit EPA from spending money to implement several environmental programs. The Administration opposed the riders. The House and Senate approved this bill in December, but President Clinton vetoed it, because of objections to spending and policy aspects of the legislation. With no full-year funding in place from October 1995 to April 1996, EPA and the programs it administers (along with agencies and departments covered by four other appropriations bills not yet enacted) were subject to a series of short-term continuing resolutions, some lasting only a day, some lasting several weeks. In March 1996, the House and Senate began consideration of an omnibus appropriations bill to fund EPA and other agencies for the remainder of FY1996, finally reaching agreement in April on a bill ( H.R. 3019 ) enacted as P.L. 104-134 . Congress agreed to provide $2.813 billion for a new account titled STAG, consisting of state grants and infrastructure assistance, as in H.R. 2099 , the vetoed measure. The total was divided as follows: $1.3485 billion for clean water SRF grants (including $50 million for impoverished communities), $500 million in new appropriations for drinking water SRF grants, $150 million for Mexico-border project grants and Texas colonias , as requested, $15 million for Alaska Native Villages, as requested, $141.5 million for 17 special purpose project grants, and $658 million for consolidated state environmental grants, which states could use to administer a range of delegated environmental programs. Report language provided that the drinking water SRF money also included $225 million from FY1995 appropriations that remained available after the rescissions in P.L. 104-19 , for a total of $725 million. The drinking water SRF money was contingent upon enactment of legislation authorizing an SRF program under the Safe Drinking Water Act by August 1, 1996; otherwise, it would revert to clean water SRF grants. The final agreement ( P.L. 104-134 ) included several of the legislative riders from previous versions of the legislation, including riders related to drinking water and clean air, but dropped others strongly opposed by the Administration. Funds within the STAG account were redistributed after Congress passed Safe Drinking Water Act amendments in August 1996. Enactment of the amendments ( P.L. 104-182 ) occurred on August 6—after the August 1 deadline in P.L. 104-134 that would have made $725 million available for drinking water SRF grants in FY1996. Thus, the previously appropriated $725 million reverted to clean water SRF grants, making the FY1996 total for those grants $2.0735 billion. While debate over the FY1996 appropriations was continuing, in March 1996, President Clinton submitted the details of a FY1997 budget. For water infrastructure and state and tribal assistance, the request totaled $2.852 billion consisting of $1.35 billion for clean water SRF grants (the request included language that would authorize states the discretion to use this SRF money either for clean water or drinking water projects), $165 million for U.S.-Mexico border projects, Texas colonias , and Alaska Native Village projects, $113 million for needy cities projects, $550 million for drinking water infrastructure SRF funding, contingent upon enactment of authorizing legislation, and $674 million for state performance partnership consolidated management grants, which could address a range of environmental programs. In response to the Administration's request, in June 1996 the House approved legislation ( H.R. 3666 ) providing FY1997 funding for EPA. In the STAG account, the House approved $2.768 billion, $84 million less than requested but on the whole endorsing the budget request. The total provided the following: $1.35 billion for clean water SRF grants, as requested; $165 million, as requested, for U.S.-Mexico Border projects, Texas colonias , and Alaska Native Village projects; $450 million for drinking water SRF funding, contingent upon authorization; $674 million for state performance partnership consolidated management grants; and $129 million for seven special purpose grants. In July, the Senate Appropriations Committee reported its version of H.R. 3666 . The committee approved $2.815 billion for this account, consisting of $1.426 billion for clean water SRF grants; $550 million for drinking water SRF grants, contingent upon authorization; $165 million, as requested, for U.S.-Mexico border projects, Texas colonias , and Alaska Native Village projects; and $674 million for consolidated state grants. The committee rejected the provision of the House-passed bill providing $129 million for special purpose grants, including funds for Boston and New Orleans requested by the Administration, saying in report language that earmarking is provided at the expense of state revolving funds and does not represent an equitable distribution of grant funds ( S.Rept. 104-318 ). During debate on H.R. 3666 in September, the Senate adopted an amendment to reduce the FY1997 appropriation for clean water SRF grants by $725 million in order to fund the new drinking water SRF program. This action was intended to restore funds to the drinking water program which had been lost when Safe Drinking Water Act amendments were not enacted by August 1, 1996. Thus, the Senate-passed bill provided $701 million for clean water SRF grants and $1.275 billion for drinking water SRF grants for FY1997. Other amounts in the account were unchanged. The conference report on H.R. 3666 ( H.Rept. 104-812 ) was approved by the House and Senate on September 24, 1996. President Clinton signed the bill September 26 ( P.L. 104-204 ). It reflected compromise of the House- and Senate-passed bills, providing the following amounts within the STAG account ($2.875 billion total): $625 million for clean water SRF grants, $1.275 billion for drinking water SRF grants, $165 million, as requested, for U.S.-Mexico border projects, Texas colonias , and Alaska Native Village projects, $136 million for 18 specific wastewater, water, and groundwater project grants (the 7 specified in House-passed H.R. 3666 , plus 11 more; the bill provided funds for each of the needy cities projects requested by the Administration, but in lesser amounts), and $674 million for consolidated state grants, which could support implementation of a range of environmental programs. The allocation of clean water and drinking water SRF grants was consistent with the Senate's action to restore funds to the drinking water program after enactment of the Safe Drinking Water Act amendments in early August. Subsequently, Congress passed a FY1997 Omnibus Consolidated Appropriations bill to cover agencies and departments for which full-year funding had not been enacted by October 1, 1996 ( P.L. 104-208 ). It included additional funding for several EPA programs, as well as $35 million (on top of $40 million provided in P.L. 104-204 ) for the Boston Harbor cleanup project. President Clinton presented the Administration's budget request for FY1998 in February 1997. For water infrastructure and state and tribal assistance, the request totaled $2.793 billion, consisting of $1.075 billion for clean water SRF grants, $725 million for drinking water SRF grants, $715 million for consolidated state environmental grants, and $278 million for special project grants. House and Senate committees began activities on FY1998 funding bills somewhat late in 1997, due to prolonged negotiations between Congress and the President over a five-year budget plan to achieve a balanced budget by 2002. After appropriators took up the FY1998 funding bills in June, the House passed EPA's appropriation in H.R. 2158 ( H.Rept. 105-175 ) on July 15. In the STAG account, the House approved $3.019 billion, consisting of $1.25 billion for clean water SRF grants ($600 million more than FY1997 levels and $175 million more than requested by the President), $750 million for drinking water SRF grants ($425 million less than FY1997 levels, but $25 million more than the request), $750 million for state environmental assistance grants, and $269 million for special projects. The latter included funds for the special projects requested by the Administration but at reduced levels ($149 million total for these projects), plus $120 million in special project grants for 21 other communities. The Senate passed a separate version of an FY1998 appropriations bill on July 22, 1997 ( S. 1034 , S.Rept. 105-53 ). It provided $3.047 billion for the STAG account, consisting of $1.35 billion for clean water SRF grants, $725 million for drinking water SRF grants, $725 million for state environmental assistance grants, and $247 million for special project grants. The Senate bill provided the amounts requested by the Administration for U.S.-Mexico border projects, Texas colonias , and Alaska Native Village projects (but no special funds for others requested by the President), plus $82 million for 18 special project grants for other communities identified in report language. Conferees reached agreement on FY1998 funding in early October 1997 ( H.R. 2158 , H.Rept. 105-297 ). The final version passed the House on October 8 and passed the Senate on October 9. President Clinton signed the bill October 27 ( P.L. 105-65 ). As enacted, it provided $3.213 billion for the STAG account, consisting of $1.35 billion for clean water SRF grants, $725 million for drinking water SRF grants, $745 million for consolidated state environmental assistance grants (which could address a range of environmental programs), and $393 million for 42 special purpose project and special community need grants for construction of wastewater, water treatment and drinking water facilities, and groundwater protection infrastructure. It included the following amounts for grants requested by the Administration: $75 million for U.S.-Mexico border projects, $50 million for Texas colonias , $50 million for Boston Harbor wastewater needs, $10 million for New Orleans, $3 million for Bristol County, MA, and $15 million for Alaska Native Village projects. The final bill also provided funds for all of the special purpose projects included in the separate House and Senate versions of the legislation, plus three projects not included in either earlier version. Bill language was included in P.L. 105-65 to allow states to cross-collateralize clean water and drinking water SRF funds, that is, to use the combined assets of amounts appropriated to State Revolving Funds as common security for both SRFs, which conferees said is intended to ensure maximum opportunity for states to leverage these funds. Senate committee report language also said that the conference report on the 1996 Safe Drinking Water Act Amendments had stated that bond pooling and similar arrangements were not precluded under that legislation. The appropriations bill language was intended to ensure that EPA does not take an unduly narrow interpretation of this point which would restrict the states' use of SRF funds. On November 1, 1997, President Clinton used his authority under the Line Item Veto Act ( P.L. 104-130 ) to cancel six items of discretionary budget authority provided in P.L. 105-65 . The President's authority under this act took effect in the 105 th Congress; thus, this was the first EPA appropriations bill affected by it. The cancelled items included funding for one of the special purpose grants in the bill, $500,000 for new water and sewer lines in an industrial park in McConnellsburg, PA. Reasons for the cancellation, according to the President, were that the project had not been requested by the Administration; it would primarily benefit a private entity and is outside the scope of EPA's usual mission; it is a low priority use of environmental funds; and it would provide funding outside the normal process of allocating funds according to state environmental priorities. However, in June 1998, the Supreme Court struck down the Line Item Veto Act as unconstitutional, and in July the Office of Management and Budget announced that funding would be released for 40-plus cancellations made in 1997 under that act (including those cancelled in P.L. 105-65 ) that Congress had not previously overturned. (For additional information, see CRS Report RL33635, Item Veto and Expanded Impoundment Proposals: History and Current Status , by Virginia A. McMurtry.) President Clinton's budget request for FY1999, presented to Congress in February 1998, requested $2.9 billion for the STAG account, representing 37% of the $7.9 billion total requested for EPA programs. The total included $1.075 billion for clean water SRF grants, $775 million for drinking water SRF grants, $115 million for water infrastructure projects along the U.S.-Mexico border projects and in Alaska Native Villages, $78 million for needy cities projects, and $875 million for consolidated state environmental grants (which could address a range of environmental programs). Legislative action on the budget request occurred in mid-1998. Both houses of Congress increased amounts for water infrastructure financing, finding the Administration's request for clean water and drinking water SRF grants, as well as special project funding, not adequate. First, the Senate Appropriations Committee reported its version of an EPA spending bill in June 1998 ( S. 2168 , S.Rept. 105-216 ). This bill, passed by the Senate July 17, provided $3.2 billion for the STAG account, consisting of $1.4 billion for clean water SRF grants, $800 million for drinking water SRF grants, $105 million for U.S.-Mexico and Alaska Native Village projects, $100 million for 39 other special needs infrastructure grants, and $850 million for state performance partnership/categorical grants. As in FY1998, the committee included bill language allowing states to cross-collateralize their clean water and drinking water state revolving funds, making the language explicit for FY1999 and thereafter. Second, the House passed its version of EPA's funding bill ( H.R. 4194 , H.Rept. 105-610 ) on July 29. This bill provided $3.2 billion for the STAG account, consisting of $1.25 billion for clean water SRF grants, $775 million for drinking water SRF grants, $70 million for U.S.-Mexico and Alaska Native Village projects, $253.5 million for 49 other special needs infrastructure grants (including nine projects also funded in the Senate bill), and $885 million for state environmental management grants (a 20% increase above FY1998 amounts for these state grants). Conferees resolved differences between the two versions in October 1998 ( H.R. 4194 , H.Rept. 105-769 ). The conference agreement provided $3.4 billion for the STAG account, consisting of $1.35 billion for clean water SRF grants, $775 million for drinking water SRF grants, $80 million for U.S.-Mexico and Alaska Native and Rural Village projects, $301.8 million for 80 other special needs project grants, and $880 million for state and tribal environmental program grants (which could address a range of environmental programs). The House and Senate approved the agreement on October 7 and 8, respectively, and President Clinton signed the bill into law on October 21 ( P.L. 105-276 ). Additional funding was provided in the Omnibus Consolidated and Supplemental Appropriations Act, FY1999 ( P.L. 105-277 ). This bill, which provided full-year funding for agencies and departments covered by seven separate appropriations measures, directed $20 million more in special needs grants for the Boston Harbor wastewater infrastructure project, on top of $30 million that was included in P.L. 105-276 . For FY2000, beginning on October 1, 1999, the Administration requested $2.638 billion for water infrastructure assistance and state environmental grants. The total, $370 million less than the FY1999 appropriation for this account, consisted of $800 million for clean water SRF grants, $825 million for drinking water SRF grants, $128 million for Mexican border and special project grants, and $885 million for consolidated state environmental grants (which could address a range of environmental programs). The request included one SRF policy issue. The Administration asked the appropriators to grant states the permission to set aside up to 20% of FY2000 clean water SRF monies in the form of grants for local communities to implement nonpoint source pollution and estuary management projects. Under the Clean Water Act, SRFs may only be used to provide loans. Some have argued that some types of water pollution projects which are eligible for SRF funding may not be suitable for loans, as they may not generate revenues which can be used to repay the loan to a state. This new authority, the Administration said, would allow states greater flexibility to address nonpoint pollution problems. Critics of the proposal said that making grants from an SRF would reduce the long-term integrity of a state's fund, since grants would not be repaid. Some Members of Congress and stakeholder groups were particularly critical of the budget request for clean water SRF grants, $550 million (40%) less than the FY1999 level. Critics said the request was insufficient to meet the needs of states and localities for clean water infrastructure. In response, EPA acknowledged that several years prior the Clinton Administration had made a commitment to states that the clean water SRF would revolve at $2 billion annually in the year 2005. Because of loan repayments and other factors, EPA said, the overall fund will be revolve at $2 billion per year in the year 2002, even with the 20% grant setaside included in the FY2000 request. According to EPA, the $550 million decrease from 1999 would have only a limited impact on SRFs and would still allow the agency to meet its long-term capitalization goal of providing an average amount of $2 billion in annual assistance. The House and Senate passed their respective versions of an EPA appropriations bill ( H.R. 2684 ) in September 1999. The conference committee report resolving differences between the two versions ( H.Rept. 106-379 ) was passed by the House on October 14 and the Senate on October 15 and was signed by the President on October 20 ( P.L. 106-74 ). The final bill provided $7.6 billion overall for EPA programs, including $3.47 billion for the STAG account. Within that account, the bill included $1.35 billion for clean water SRF grants, $820 million for drinking water SRF grants, $885 million for categorical state grants (which generally support state and tribal implementation and could address a range of environmental programs), $80 million for U.S.-Mexico border and Alaska Rural and Native Village projects, and $331.6 million for 141 other special needs water and wastewater grants specified in report language. The final bill did not approve the Administration's request to allow states to use up to 20% of clean water SRF monies as grants for nonpoint pollution and estuary management projects. Subsequent to enactment of the EPA funding bill, Congress passed the Consolidated Appropriations Act for FY2000 with funding for five other agencies ( P.L. 106-113 ), which included provisions requiring a government-wide cut of 0.38% in discretionary appropriations. The bill gave the President some flexibility in applying this across-the-board reduction. Details of the reduction were announced at the time of the release of the FY2001 budget. EPA's distribution of the rescission resulted in a total reduction of $16.3 million for 139 of the special needs water and wastewater projects identified in P.L. 106-74 . These projects were reduced 4.9% below enacted levels. The agency did not reduce funds for the two projects that had been included in the President's FY2000 budget request (Bristol County, MA, and New Orleans, LA) or for the United States-Mexico border and the Alaska Rural and Native Villages programs. EPA also reduced funds for the clean water SRF (enacted at $1.35 billion) by 0.3%, for a final funding level of $1.345 billion. The appropriation level was not reduced for the drinking water SRF or consolidated state grants. The President's budget for FY2001 requested a total of $2.9 billion for water infrastructure assistance and state environmental grants. For the second year in a row, President Clinton requested $800 million for the clean water SRF program, a $545 million reduction from the FY2000 level. The request included $825 million for the drinking water SRF program, $100 million for U.S.-Mexico border project grants, $15 million for Alaska Native Villages projects, two needy cities grants totaling $13 million (Bristol County, MA, and New Orleans, LA), plus $1.069 billion for consolidated state environmental grants (which could address a range of environmental programs). The budget included a policy request similar to one in the FY2000 budget, which Congress rejected. The FY2001 budget sought flexibility for states to set aside up to 19% of clean water SRF monies in the form of grants for local communities to implement nonpoint source pollution and estuary management projects. The House approved its version of EPA's funding bill ( H.R. 4635 , H.Rept. 106-674 ) on June 21, 2000. For the STAG account, H.R. 4635 provided $3.2 billion ($273 million more than requested, but $288 million below the FY2000 level). The total in the STAG account consisted of $1.2 billion for clean water SRF grants, $825 million for drinking water SRF grants, $1.068 billion (the budget request) for categorical state grants, and $85 million for U.S.-Mexico border and Alaska Rural and Native Villages projects. Beyond these, however, the House-passed bill included no funds for other special needs grants. The Senate approved its version of the funding bill ( S.Rept. 106-410 ) on October 12, 2000. For the STAG account, the Senate-passed bill provided $3.3 billion, consisting of $1.35 billion for clean water SRF grants, $820 million for drinking water SRF grants, $955 million for categorical state grants, $85 million for U.S.-Mexico border and Alaska Rural and Native Village projects, and $110 million for special needs water and wastewater grants. In October, the House and Senate approved EPA's funding bill for FY2001 ( H.Rept. 106-988 ), providing $1.35 billion for clean water SRF grants (the same level enacted for FY2000) and $825 million for drinking water SRF grants. The enacted bill included $110 million in grants for water infrastructure projects in Alaska Rural and Native Villages and U.S.-Mexico border projects and an additional $336 million for 237 other specified project grants throughout the country. The bill also provided $1,008 million for state categorical program grants ($60 million less in total than requested), which states could use to address a range of environmental programs. Total funding for the STAG account was $3.6 billion. Congress disapproved the Administration's policy request concerning use of clean water SRF monies for nonpoint source project grants. President Clinton signed the bill October 27, 2000 ( P.L. 106-377 ). Subsequently, in December, Congress provided $21 million more for five more special project water infrastructure grants (in addition to the $336 million in P.L. 106-377 ) as a provision of H.R. 4577 , the FY2001 Consolidated Appropriations Act ( P.L. 106-554 ). Also in that legislation, Congress enacted the Wet Weather Water Quality Act, authorizing a two-year, $1.5 billion grants program to reduce wet weather flows from municipal sewer systems. The provision was included in Section 112, Division B, of P.L. 106-554 . In April 2001, the Bush Administration presented its budget request for FY2002. The Administration requested a total of $2.1 billion for clean water infrastructure funds, consisting of $823 million for drinking water SRF grants, $850 million for clean water SRF grants (compared with $1.35 billion appropriated for FY2001), and $450 million for the new program of municipal sewer overflow grants under legislation enacted in December, the Wet Weather Water Quality Act. However, that act provided that sewer overflow grants are only available in years when at least $1.35 billion in clean water SRF grants is appropriated. Subsequently, Administration officials said they would request that Congress modify the provision linking new grant funds to at least $1.35 billion in clean water SRF grants. The Bush budget requested no funds for special earmarked grants, except for $75 million to fund projects along the U.S.-Mexico border and $35 million for projects in Alaska Native Villages (both are the same amounts provided in FY2001). In response, some Members of Congress and outside groups criticized the budget request, saying that it did not provide enough support for water infrastructure programs. The President's budget also requested $1.06 billion for state categorical program grants, which generally support state and tribal administration of a range of environmental programs. The House passed its version of FY2002 funding for EPA on July 30 ( H.R. 2620 , H.Rept. 107-159 ). The House-passed bill provided a total of $2.4 billion for water infrastructure funds, consisting of $1.2 billion for clean water SRF grants, $850 million for drinking water SRF grants, $200 million for special project grants (individual projects were unspecified in the report accompanying H.R. 2620 ), $75 million for U.S.-Mexico border projects, and $30 million for Alaska Rural and Native Villages. The House bill provided no separate funds for the new wet weather overflow grant program, which the Administration had requested. Including $1.08 billion for state categorical program grants, total STAG account funding in the bill was $3.44 billion, about $150 million higher than the President's request. The Senate passed its version of this appropriations bill on August 2 ( S. 1216 , S.Rept. 107-43 ). Like the House, the Senate rejected separate funding for wet weather overflow grants, and the Senate increased clean water SRF grant funding to the FY2001 level. The Senate-passed total for the STAG account was $3.49 billion, including $1.35 billion for clean water SRF grants, $850 million for drinking water SRF grants, $140 million for special needs infrastructure grants specified in accompanying report language, $75 million for U.S.-Mexico border projects, $30 million for Alaska Rural and Native Villages, and $1.03 billion for state categorical program grants. Resolution of this and other appropriations bills in fall 2001 was complicated by congressional attention to general economic conditions and responses to the September 11 terrorist attacks on the World Trade Center and the Pentagon. Nevertheless, the House and Senate gave final approval to legislation providing EPA's FY2002 funding ( H.R. 2620 , H.Rept. 107-272 ) on November 8, and President Bush signed the bill on November 26 ( P.L. 107-73 ). The final bill did not include separate funds for the new sewer overflow grant program requested by the Administration, which both the House and Senate had rejected, but it did include $1.35 billion for clean water SRF grants, $850 million for drinking water SRF grants, $344 million for 337 earmarked water infrastructure project grants specified in report language, and the requested $75 million for U.S.-Mexico border projects and $30 million for Alaska Rural and Native Villages. The bill included total STAG funding of $3.7 billion. President Bush presented the Administration's FY2003 budget request in February 2002, asking Congress to appropriate $2.185 billion for EPA's water infrastructure programs (compared with $2.659 billion appropriated for FY2002). The FY2003 request sought $1.212 billion for clean water SRF grants, $850 million for drinking water SRF grants, and $123 million for a limited number of special projects (especially in Alaska Native Villages and in communities on the U.S.-Mexico border). The Administration proposed to eliminate funds for unrequested infrastructure project spending that Congress had earmarked in the FY2002 law, which totaled $344 million. Also, the Administration requested no funds for the municipal sewer overflow grants program enacted in 2000. Some Members of Congress criticized the request level for clean water SRF capitalization grants, which was $138 million below the FY2002 enacted amount. In August 2002, the Senate Appropriations Committee approved an FY2003 funding bill for EPA that would provide $1.45 billion for clean water SRF grants, $100 million more than the FY2002 level ( S. 2797 , S.Rept. 107-222 ). In addition, the Senate committee bill included $875 million for drinking water SRF grants, $140 million for special needs infrastructure grants specified in report language, $45 million for Alaska Rural and Native Village project grants, $75 million for U.S.-Mexico border projects, and $1.134 billion for state categorical program grants, which could address a range of environmental programs. The House Appropriations Committee approved its version of an FY2003 funding bill with $1.3 billion for the clean water SRF program ( H.R. 5605 , H.Rept. 107-740 ) in October. This bill also included $850 million for drinking water SRF grants, $227.6 million for special needs infrastructure grants enumerated in report language, $35 million for Alaska Rural and Native Village project grants, $75 million for U.S.-Mexico border projects, and $1.173 billion for state categorical program grants, which could address a range of environmental programs. Neither appropriations committee included funds for the sewer overflow grant program authorized in 2000 (the Administration did not request FY2003 funds for these grants). Due to complex budgetary disputes during the year, final action did not occur before the 107 th Congress adjourned in November 2002, and it extended into 2003, more than five months after the start of the fiscal year. Congress and the President reached agreement on funding levels for EPA and other nondefense agencies in an omnibus appropriations act ( P.L. 108-7 ; H.J.Res. 2 , H.Rept. 108-10 ), which the President signed on February 20. The EPA portion of the enacted bill included $1.34 billion for clean water SRF grants, $844 million for drinking water SRF grants, and $413 million more for 489 special water infrastructure project grants to individual cities specified in conference report language, plus projects in Alaska Native Villages and communities on the U.S.-Mexico border. It also provided a total of $1.14 billion for categorical state grants, which generally support states and tribal implementation of a range of environmental programs. On February 3, 2003, before completion of the FY2003 appropriations, President Bush submitted his budget request for FY2004. It requested a total of $1.798 billion for water infrastructure funds, consisting of $850 million for clean water SRF grants, $850 million for drinking water SRF grants, and $98 million for priority projects (especially in Alaska Native Villages and in communities on the U.S.-Mexico border). As in previous years, the Administration requested no funds for congressionally earmarked project grants for individual communities. Some Members of Congress and interest groups criticized the request for clean water SRF grants ($490 million below the FY2003 enacted level), but Administration officials responded by saying that the request reflected a commitment to fund this program at the $850 million level through FY2011. Funding at that level and over that long-term period, plus repayments of previous SRF loans made by states, would be expected to increase the revolving levels of the overall program from $2.0 billion to $2.8 billion per year, the Administration said. The President's budget also requested $1.2 billion for categorical state grants, which could address a range of environmental programs. On July 25, the House approved H.R. 2861 ( H.Rept. 108-235 ), providing FY2004 appropriations for EPA. As passed, the bill included $1.2 billion for clean water SRF grants, $850 million for drinking water SRF grants, $203 million for earmarked water infrastructure project grants, and $75 million in grants for high-priority projects in Alaska Native Villages and along the U.S.-Mexico border. Senate action on its version of a funding bill for EPA ( S.Rept. 108-143 ) occurred on November 18. The Senate-passed bill provided $1.35 billion for clean water SRF grants, $850 million for drinking water SRF grants, $130 million for targeted infrastructure project grants, plus $95 million in grants for projects in Alaska Native Villages and along the U.S.-Mexico border. As with the previous year's appropriations, Congress did not enact legislation providing FY2004 funds for EPA before the beginning of the new fiscal year; thus EPA programs were covered by a series of continuing resolutions (CRs). The last of these CRs ( P.L. 108-135 ) extended FY2003 funding levels through January 31, 2004. On December 8, 2003, the House passed legislation providing full-year funding for EPA and other agencies that lacked enacted appropriations ( H.R. 2673 ). The conference report on this bill ( H.Rept. 108-401 ) provided $1.34 billion for clean water SRF grants, $845 million for drinking water SRF grants, and $425 million in grants for 520 earmarked grants in listed communities, Alaska Native Villages, and U.S.-Mexico border projects. The Senate approved the conference report on January 22, 2004, and President Bush signed the legislation January 23 ( P.L. 108-199 ). The FY2005 EPA appropriation for water infrastructure funds was the lowest total for these programs since FY1997 (the first year in which Congress provided both clean water and drinking water SRF capitalization grants, as well as earmarked project grants). The decline was due primarily to a reduction in funding for the clean water SRF program from an average of $1.35 billion since FY1998 to $1.09 billion. President Bush's FY2005 budget, presented February 2, 2004, requested a total of $3.0 billion for water infrastructure assistance and state environmental program grants. It included $850 million for clean water SRF grants, $850 million for drinking water SRF grants, $94 million for priority projects (primarily in Alaska Native Villages and along the U.S.-Mexico border), and $1.25 billion for categorical grants, which could address a range of environmental programs. As in recent budgets, the Administration requested no funds for congressionally earmarked project grants. Anticipating that critics likely would focus on the clean water SRF request ($492 million below the FY2004 level), in its budget documents the Administration said that the request included funding for the clean water SRF at $850 million annually through 2011, which, together with loan repayments, state matches, and other funding sources, would result in a long-term average revolving level of $3.4 billion. Likewise, the budget anticipated funding the drinking water SRF program at the same $850 million annually through 2011, resulting in a long-term average revolving level of $1.2 billion. House and Senate Appropriations committees began review of the EPA budget request in March. On September 9, 2004, the House Appropriations Committee reported FY2005 funding for EPA in a bill that included the Administration's requested level of $850 million for clean water SRF grants, $850 million for drinking water SRF grants, and earmarked grants for priority water infrastructure projects totaling $393.4 million ( H.R. 5041 , H.Rept. 108-674 ). On September 21, the Senate Appropriations Committee reported its version of this bill ( S. 2825 , S.Rept. 108-353 ), which included $1.35 billion for clean water SRF grants, $850 million for drinking water SRF grants, and $217 million for earmarked project grants. Final action on the FY2005 appropriation did not occur before the start of the fiscal year. On November 20, the House and Senate passed H.R. 4818 ( H.Rept. 108-792 ), the Consolidated Appropriations Act, 2005, an omnibus appropriations bill comprising nine appropriations measures, including funding for EPA. The bill provided total funding for EPA of $8.1 billion, a decrease from the $8.4 billion approved in FY2004, but $340 million more than was requested by the President in February. One of the most controversial items in the final bill was a $251 million decrease for clean water SRF grants from the FY2004 level, although the $1.09 billion total was $241 million more than in the President's budget. The final measure also included $843 million for drinking water SRF capitalization grants; $401.7 million for 669 earmarked grants in listed communities, Alaska Native Villages, and U.S.-Mexico border projects; and $1.14 billion for categorical state grants, which generally support state and tribal administration of a range of environmental programs. The $2.34 billion total for water infrastructure programs and projects was $542 million more than was requested by the President, but $276 million less than Congress appropriated for FY2004. President Bush signed the legislation December 8, 2004 ( P.L. 108-447 ). The FY2006 appropriation for water infrastructure funds marked the second consecutive year in which Congress appropriated less funding for these programs, providing lower levels both for clean water SRF capitalization grants and for earmarked project grants than in FY2005. President Bush presented the FY2006 budget request in February 2005. Overall for EPA, it sought 5.6% less than Congress had appropriated for FY2005. The Administration's deepest cuts affecting EPA were proposed for the STAG account. The budget requested $730 million for clean water SRF grants (33% below FY2005 appropriated funding and 45.6% below the FY2004 level), $850 million for drinking water SRF grants (a slight increase from the FY2005 level), $69 million for priority projects (primarily in Alaska Native Villages and along the U.S.-Mexico border), and $1.2 billion for state categorical grants, which could address a range of environmental programs. As in previous years, the Administration requested no funds for congressionally earmarked water infrastructure projects. Advocates for the SRF programs (especially state and local government officials) contended that cuts to the clean water program would impair their ability to carry out needed municipal wastewater treatment plant improvement projects. Administration officials responded that the proposed SRF reductions for FY2006 were because Congress had boosted funds above the FY2005 request level. These officials said that the Administration planned to invest $6.8 billion in the clean water SRF program between FY2004 and FY2011, after which federal funding was expected to end, and the state SRFs were expected to have an annual revolving level of $3.4 billion. If Congress appropriated more than requested in any given year (as occurred in FY2005), they said, that target would be met sooner, leading to reduced requests for the SRF in subsequent years until a planned phaseout in FY2011. On May 19, 2005, the House passed H.R. 2361 , providing FY2006 funding for EPA. As passed, it provided $850 million for clean water SRF grants ($120 million more than the President's request), $850 million for drinking water SRF grants, and $269 million for earmarked water infrastructure grants. During debate, the House rejected two amendments to increase clean water SRF funding. On June 29, the Senate passed its version of H.R. 2361 , providing $1.1 billion for clean water SRF grants, $850 million for drinking water SRF grants, and $290 million for earmarked project grants. The House bill required that $100 million of the SRF funding come from balances from expired contracts, grants, and interagency agreements from various EPA appropriation accounts. The Senate bill, in contrast, called for a $58 million rescission of unobligated amounts associated with grants, contracts, and interagency agreements in various accounts, but did not specify that such monies go to SRF funding. Conferees resolved differences between the bills ( H.Rept. 109-188 ), and the House and Senate approved the measure in July; the President signed it into law on August 2 ( P.L. 109-54 ). As enacted, the bill provided $900 million for clean water SRF grants; $850 million for drinking water SRF grants; $285 million for 259 earmarked grants in listed communities, Alaska Native Villages, and along the U.S.-Mexico border; and $1.13 billion for categorical state grants, which could address a range of environmental programs. The final bill required an $80 million rescission from expired grants, contracts, and interagency agreements in various EPA accounts (not just the STAG account) not obligated by September 1, 2006. It did not direct the rescinded funds to be applied to the clean water SRF, as proposed by the House. The $2.03 billion total in the bill for EPA water infrastructure programs and projects was $386 million more than was requested by the President, but $301 million less than Congress appropriated for FY2005. Further, the funding amounts specified in P.L. 109-54 were reduced slightly. First, a provision of P.L. 109-54 , Section 439, mandated an across-the-board rescission of 0.476% for any discretionary appropriation in that bill. Second, in December 2005 Congress enacted P.L. 109-148 , the FY2006 Department of Defense Appropriations Act, and Section 3801 of that bill mandated a 1% across-the-board rescission for discretionary accounts in any FY2006 appropriation act (except for discretionary authority of the Department of Veterans Affairs). As a result of these two rescissions, the final levels for the STAG account were $887 million for clean water SRF grants; $838 million for drinking water SRF grants; $281 million for 259 earmarked grants in listed communities, Alaska Native Villages, and along the U.S.-Mexico border; and $1.11 billion for categorical state grants, which could address a range of environmental programs. FY2006 EPA water infrastructure programs and projects thus total $2.0 billion. On October 28, President Bush requested that Congress rescind $2.3 billion from 55 "lower-priority federal programs and excess funds," including $166 million from clean water SRF monies. In the end, Congress did not endorse the specific request to reduce clean water SRF appropriations. The two rescissions resulting from P.L. 109-54 and P.L. 109-148 totaled a $13.2 million reduction from the $900 million specified in the EPA appropriations act. President Bush presented the Administration's FY2007 budget request in February 2006, asking Congress to appropriate $1.570 billion for EPA's water infrastructure programs. The FY2007 request sought $687.6 million for clean water SRF grants, $841.5 million for drinking water SRF grants, and $40.6 million for special projects in Alaska Native Villages, Puerto Rico, and along the U.S.-Mexico border. When the 109 th Congress adjourned in December 2006, it had not completed action on appropriations legislation to fund EPA (or on nine other appropriations bills covering the majority of domestic discretionary agencies and departments) for the fiscal year that began October 1, 2006, thus carrying over this legislative activity into the 110 th Congress. In December 2006, Congress enacted a continuing resolution, P.L. 109-383 (the third such continuing resolution since the start of the fiscal year on October 1), providing funds for EPA and the other affected agencies and departments until February 15, 2007. The President's FY2007 budget request for clean water SRF capitalization grants was 22% less than the FY2006 appropriation for these grants and 37% below the FY2005 funding level. The request for drinking water SRF grants was essentially the same as in recent years ($4 million more than FY2006, $1.7 million less than FY2005). As in recent budgets, the Administration proposed no funding for congressionally designated water infrastructure grants, but, as noted above, it did seek a total of $40.6 million for Administration priority projects. Advocates of the clean water SRF program (especially state and local government officials) again contended, as they have for several recent years, that the cuts would impair their ability to carry out needed municipal wastewater treatment plant improvement projects. Administration officials responded that cuts for the clean water SRF in FY2007 were necessary because Congress boosted funds above the requested level in FY2005 and FY2006. On May 18, 2006, the House passed H.R. 5386 ( H.Rept. 109-465 ), providing the requested level of $687.6 million for clean water SRF grants and $841.5 million for drinking water SRF grants. The Senate Appropriations Committee approved the same funding levels for these grant programs when it reported H.R. 5386 on June 29 ( S.Rept. 109-275 ), but the Senate did not act on this measure before the 109 th Congress adjourned in December. Before adjournment, Congress enacted a continuing resolution (CR), P.L. 109-383 (the third such CR since the start of the fiscal year on October 1), providing funds for EPA and the other affected agencies and departments until February 15, 2007. Funding levels provided under this CR followed a "lowest level" concept for individual programs; that is, programs were funded at the lowest level under either House-passed FY2007 appropriations, Senate-passed appropriations, or the FY2006 funding. For clean water SRF grants, the resulting appropriation through mid-February was $687.6 million, as in House-passed H.R. 5386 . For drinking water SRF grants, the appropriation level through mid-February was $837.5 million, the FY2006-enacted level. The CR included funds for congressionally earmarked water infrastructure project grants totaling $200 million, as in House-passed H.R. 5386 . Returning to these issues in 2007, in mid-February, Congress passed H.J.Res. 20 , a continuing appropriations resolution that provides funding for EPA and the other affected agencies through the end of FY2007. As passed, this full-year resolution held most programs and activities at their FY2006 appropriated levels. However, clean water SRF capitalization grants were one of the few programs that received a funding increase under the resolution: these grants received $1.08 billion ($197 million more than in FY2006, and $396 million more than the President requested for FY2007). The resolution further prohibited project grants for congressional earmarks, but not for special project grants requested in the President's budget. The action to ban earmarks in FY2007 occurred when leaders in the 110 th Congress sought to finish up appropriations actions that were unresolved at the end of the 109 th Congress, and at the same time the newly elected Congress moved to adopt rules and procedures to reform the congressional earmarking process for the future. (Water infrastructure project earmarks totaled $281 million in EPA's FY2006 appropriation.) President Bush signed H.J.Res. 20 on February 15, 2007 ( P.L. 110-5 ). The final FY2007 amounts provided in P.L. 110-5 were $1.084 billion for clean water SRF capitalization grants, $837.5 million for drinking water SRF capitalization grants, $83.75 million for Alaska Native Village and U.S.-Mexico border project grants requested by the Administration, and $1.11 billion for categorical state grants, which could be used to administer a range of environmental programs. President Obama presented his FY2008 budget request to Congress on February 5, 2007, before finalization of the FY2007 appropriations. The budget sought $687.6 million for clean water SRF grants, the same amount requested for FY2007; $842.2 million for drinking water SRF grants; $25.5 million for special project grants for Alaska Native Villages and the U.S.-Mexico border region; and $1.065 billion for categorical state grants, which could address a range of environmental programs. In June 2007, the House passed H.R. 2643 , providing FY2008 appropriations for EPA. This bill included $1.125 billion for clean water SRF grants, $842.2 million for drinking water SRF grants, plus $175.5 million for 143 congressionally designated water infrastructure project grants. The Senate Appropriations Committee approved companion legislation ( S. 1696 ) that similarly included higher funding levels for several water quality programs. The Senate committee's bill provided less funding for clean water SRF grants than the House bill ($887 million), the same amount for drinking water SRF grants, and slightly more for congressionally designated water infrastructure project grants ($180 million). The Senate did not take up S. 1696 . By October 1, the start of FY2008, Congress had not enacted any appropriations bills for FY2008, and Congress enacted several short-term continuing appropriations resolutions to temporarily fund EPA and other government agencies until final agreement, which occurred in December 2007. Full-year funding for EPA's water infrastructure programs was included in the Consolidated Appropriations Act for FY2008 (Division F, Title II), signed by the President December 26, 2007 ( P.L. 110-161 ). The final FY2008 amounts provided in this legislation were $689.1 million for clean water SRF capitalization grants ($1.5 million more than requested by the Administration), $829.0 million for drinking water SRF capitalization grants ($13.2 million less than requested), $177.2 million for 282 earmarked grants in listed communities, Alaska Native Villages, and U.S.-Mexico border projects ($151.7 million more than requested), and $1.078 billion for categorical state grants ($13.3 million more than requested), which could address a range of environmental programs. President Obama presented his FY2009 budget request to Congress on February 6, 2008. The budget sought $555 million for clean water SRF grants, $134 million less than Congress appropriated for FY2008; $842.2 million for drinking water SRF grants, $13 million more than was appropriated for FY2008; $25.5 million for special project grants for Alaska Native Villages and the U.S.-Mexico border region, $18.8 million less than was appropriated for FY2008; and $1.057 billion for categorical state grants, which could address a range of environmental programs. As in past years, the budget requested no funds for other earmarked grants. In June 2008, a House Appropriations subcommittee approved a bill with FY2009 funding for EPA, but no further action occurred before the start of the fiscal year. At the end of September 2008, Congress and the President agreed to legislation providing partial-year funding for EPA and most other agencies and departments. This bill, the Consolidated Security, Disaster Assistance, and Continuing Resolution Act, 2009 ( P.L. 110-329 ), provided funding through March 6, 2009, at FY2008 funding levels. A second short-term continuing resolution was enacted on March 6 ( P.L. 111-6 ), while Congress was finishing consideration of a full-year omnibus FY2009 appropriations bill that the President signed on March 11 ( P.L. 111-8 ). The omnibus bill provided $689 million in regular appropriations for clean water SRF grants, $829 million for drinking water SRF grants—both at the same levels as were appropriated in FY2008—and $1.094 billion for categorical state grants, which support administration of a range of environmental programs. The omnibus appropriations act also includes $183.5 million for earmarked water infrastructure grants. In February 2009, Congress responded to the nation's economic crisis by enacting the American Recovery and Reinvestment Act (ARRA, P.L. 111-5 ), legislation providing FY2009 supplemental appropriations to a number of government programs. Part of the philosophy underlying the legislation was the concept of using federal investments to make accelerated investments in the nation's public infrastructure in order to create jobs while also meeting infrastructure needs. To that end, the legislation included $4.0 billion for clean water SRF capitalization grants (for total FY2009 funds of $4.689 billion) and $2.0 billion for drinking water SRF capitalization grants (for total FY2009 funds of $2.829 billion). The supplemental SRF funds were available for obligation through FY2010, but under the legislation, states were to give preference when awarding funds to activities that can start and finish quickly, with a goal that at least 50% of the funds go to activities that can be initiated within 120 days of enactment. States were to give priority to wastewater projects that could proceed to construction within 12 months of enactment, and funds for projects that were not under contract or under construction by February 12, 2010, would be reallocated by EPA to other states. Further, the legislation required states to reserve at least 20% of the SRF capitalization grant funds for a Green Project Reserve, that is, projects intended to achieve improved energy or water efficiency. It also specified that all assistance agreements made in whole or in part with funds appropriated under the ARRA must comply with prevailing wage requirements of the Davis-Bacon Act. President Obama presented his Administration's FY2010 budget request on May 7, 2009. For EPA as a whole, the budget sought $10.5 billion, a 38% increase above levels enacted in EPA's regular FY2009 appropriations ( P.L. 111-8 ). The bulk of the increase in the President's budget was for water infrastructure assistance, which would receive 157% above FY2009 levels (excluding ARRA supplemental funds). The request included $2.4 billion for clean water SRF capitalization grants; $1.5 billion for drinking water SRF capitalization grants; $20 million for Alaska Native Village and U.S.-Mexico border projects; and $1.111 billion for state categorical grants (1.5% above FY2009 levels), which generally support state administration of environmental programs. Congress provided FY2010 appropriations for EPA in P.L. 111-88 , passed by the House and Senate in October 2009 and signed into law on October 30. In this measure, Congress provided the following: $2.1 billion for clean water SRF capitalization grants; $1.387 billion for drinking water SRF capitalization grants; $186.7 million for 319 congressionally earmarked special project grants, including assistance for Alaska Native Villages and U.S.-Mexico border projects; and $1.116 billion for state categorical environmental grants, which could address a range of environmental programs. The FY2010 appropriations act included some restrictions that Congress also had specified in the American Recovery and Reinvestment Act, discussed above, namely a requirement that 20% of SRF capitalization grant assistance be used for "green" infrastructure and also that Davis-Bacon Act prevailing wage rules shall apply to construction of wastewater or drinking water projects carried out in whole or in part with assistance from the SRF. President Obama presented the FY2011 budget request in February 2010. For EPA as a whole, the budget sought $10.02 billion in discretionary budget authority, a 3% decrease from levels enacted for EPA in FY2010. The largest component of the reduced request, compared with FY2010, was $200 million less for grants to capitalize clean water and drinking water SRF programs. In explaining the request, EPA budget documents noted that even with a slight reduction, the budget "continues robust funding for the SRFs." As in past years, the President requested no funds for congressionally designated water infrastructure projects. The request included $2.0 billion for clean water SRF capitalization grants; $1.287 billion for drinking water SRF capitalization grants; $20 million for Alaska Native Village and U.S.-Mexico border projects; and $1.277 billion for state categorical grant programs (14% higher than the FY2010 enacted amount), which could address a range of environmental programs. Congress took only limited action on FY2011 funding for EPA before the start of the new fiscal year on October 1, 2010: a House Appropriations subcommittee approved a bill in July, but no further action followed. At the end of September, the House and Senate passed a continuing resolution to extend FY2010 funding levels for EPA and other federal agencies and departments until December 3, 2010, because no FY2011 appropriations bills had been enacted by October 1. President Obama signed the continuing resolution (CR) on September 30 ( P.L. 111-242 ). This bill was followed by six more short-term CRs before Congress came to final resolution of FY2011 spending on April 14, 2011, enacting a bill to provide funding for EPA and all other federal agencies and departments through September 30 ( P.L. 112-10 ). The final bill reduced overall funding for EPA 15% below the FY2010 level. The enacted bill included $1.522 billion for clean water SRF capitalization grants; $963.1 million for drinking water SRF capitalization grants; $19.96 million for Alaska Native Village and U.S. Mexico-border projects; and $1.254 billion for state categorical grant programs, which generally support implementation of a range of environmental programs. Policymakers began to consider the budget for FY2012 before finalizing the funding levels for FY2011. The President submitted the Administration's FY2012 budget request on February 14, 2011. It sought $9 billion total for EPA, a decrease of $1.3 billion from the FY2010 enacted level, but 3% higher than the FY2011 enacted level. The President's request included $1.55 billion for clean water SRF capitalization grants, $990 million for drinking water SRF capitalization grants, $20 million for Alaska Native Village and U.S.-Mexico border assistance, and $1.2 billion for state categorical grants, which could address a range of environmental programs. For several days in July 2011, the House debated H.R. 2584 , providing FY2012 appropriations for EPA, but did not take final action on the bill before the August recess. As reported, the bill provided $7.3 billion for EPA, 17% less than FY2011 funds and 19% less than the President's FY2012 request. It reduced funds for the clean water SRF capitalization grants to $689 million and $829 million for drinking water SRF capitalization grants (the same levels provided in FY2008), while including no funds for congressionally designated special projects (i.e., earmarks). The reported bill also provided $1.002 billion for state categorical grants, which could address a range of environmental programs. There was no action on this bill in the Senate. Final congressional action on FY2012 appropriations for EPA and most other federal agencies and departments did not occur until the end of December 2011, enacted in an omnibus appropriations act, P.L. 112-74 . The enacted bill included $1.466 billion for clean water SRF capitalization grants (3.7% below FY2011); $917.9 million for drinking water SRF capitalization grants (4.7% below FY2011); $14.976 million for Alaska Native Village and U.S.-Mexico border projects; and $1.089 billion for state categorical grants, which could address a range of environmental programs. President Obama presented the Administration's FY2013 budget request in February 2012. It sought $8.34 billion overall for EPA, or 4.7% below the level enacted for FY2012. The request included $1.175 billion for clean water SRF capitalization grants, $850 million for drinking water SRF capitalization grants, $20 million for Alaska Native Village and U.S.-Mexico border assistance, and $1.2 billion for state categorical grants, which could address a range of environmental programs. The total amount requested for SRF capitalization grants is 15% below the FY2012 enacted level, reflecting a 20% reduction for the clean water program and a 7.4% reduction for the drinking water program. The House Appropriations Committee approved legislation providing FY2013 funds for EPA in July 2012 ( H.R. 6091 ). As reported, the bill provided $689 million for clean water SRF capitalization grants (the same level provided in FY2008), $829 million for drinking water SRF capitalization grants, $994 million for state categorical grants, and no funds for Alaska Native Village or U.S.-Mexico border projects. The House did not take up H.R. 6091 , nor did the Senate act on an EPA appropriations bill (although the Senate Appropriations Committee released a draft bill in September 2012). Prior to the start of FY2013 on October 1, 2012, Congress passed and the President signed a continuing resolution bill providing funding for government agencies and departments through March 27, 2013 ( P.L. 112-175 ). This measure funded the government generally at FY2012 levels plus a 0.6% increase. Final action on FY2013 appropriations occurred in the Further Continuing Appropriations Act, 2013 ( P.L. 113-6 ). Funding enacted in this bill included $1.452 billion for clean water SRF capitalization grants; $908.7 million for drinking water SRF capitalization grants; $15 million for Alaska Native Village and U.S.-Mexico border assistance; and $1.1 billion for state categorical grants, which generally support state and tribal implementation of a range of environmental programs. However, these amounts were reduced under the March 1, 2013, sequester order of the President, which reduced affected accounts by 5.0%, and by an across-the-board rescission of 0.2% necessary to avoid exceeding the FY2013 discretionary spending limits in law. After these reductions, available FY2013 funding was approximately $1.38 billion for the clean water SRF capitalization grants, $860 million for drinking water SRF capitalization grants, $14 million for Alaska Native Village and U.S.-Mexico border assistance, and $1.0 billion for state categorical grants. President Obama presented the Administration's FY2014 budget in April 2013. It sought $8.15 billion overall for EPA, including $1.095 billion for clean water SRF capitalization grants, $817 million for drinking water SRF capitalization grants, $15 million for Alaska Native Village and U.S.-Mexico border projects, and $1.136 billion for state categorical grants. The total amount requested for SRF capitalization grants was 19% below the FY2013 enacted level. In mid-2013, the House Appropriations Subcommittee on Interior, Environment, and Related Agencies drafted a bill (unnumbered) that would have reduced overall funding for EPA by 34% from the FY2013 enacted level, including an 83% reduction for clean water SRF capitalization grants (the bill would have provided $250 million) and a 65% reduction for drinking water SRF capitalization grants ($350 million was included in the bill). According to subcommittee documents, the reduction was appropriate because, despite recent federal support, little progress has been made to reduce the known water infrastructure gap. The full committee did not complete markup of this bill. The Senate Appropriations Subcommittee on Interior, Environment, and Related Agencies drafted an alternative bill that would have maintained funding for the clean water SRF program at $1.45 billion and funding for the drinking water SRF program at $907 million. There was no further action on this bill. Congress did not reach final agreement on FY2014 appropriations before the start of the fiscal year on October 1, but did agree to a short-term continuing appropriations measure ( P.L. 113-46 ), which provided funding through January 15, 2014. Final action on appropriations for EPA and all other federal agencies and departments occurred as part of the Consolidated Appropriations Act, 2014 ( H.R. 3547 , P.L. 113-76 ), signed by the President on January 17, 2014. This bill provides $1.45 billion for clean water SRF capitalization grants (5% more than FY2013 funds and 32% higher than the President's FY2014 budget request) and $907 million for drinking water SRF capitalization grants (5% more than FY2013 funds and 11% higher than the President's FY2014 budget request). The bill also provides $15 million for Alaska Native Village and U.S.-Mexico border assistance, and $1.0 billion for state categorical grants, which generally support state and tribal implementation of a range of environmental programs. President Obama presented the Administration's FY2015 budget on March 4, 2014. It sought $7.89 billion overall for EPA, including $1.018 billion for clean water SRF capitalization grants, $757 million for drinking water SRF capitalization grants, $15 million for Alaska Native Village and U.S.-Mexico border projects, and $1.13 billion for state categorical grants. The total amount requested for SRF capitalization grants was 25% below the FY2014 enacted level. Final full-year appropriations were enacted as part of the Consolidated and Further Continuing Appropriations Act, 2015, enacted in December 2014 ( P.L. 113-235 ). The legislation provided the same water infrastructure funding levels as in FY2014: $1.45 billion for clean water SRF capitalization grants and $907 million for drinking water SRF capitalization grants. As with the FY2014 appropriations, the bill provided $15 million for Alaska Native Village and U.S.-Mexico border assistance and $1.0 billion for state categorical grants, which could address a range of environmental programs. The Administration's FY2016 budget requested $8.6 billion overall for EPA. The request included $1.116 billion for clean water SRF capitalization grants, $1.186 billion for drinking water SRF capitalization grants (31% higher than the FY2016 appropriation), $15 million for Alaska Native Village and U.S.-Mexico border projects, and $1.162 billion for state categorical grants, which generally support state and tribal implementation of a range of environmental programs. Although the House and Senate Appropriations Committees reported bills to provide FY2016 appropriations for EPA, final appropriations action for EPA and other agencies occurred as part of the Consolidated Appropriations Act, 2016, signed by the President December 18, 2015 ( P.L. 114-113 ). The bill provided $1.394 billion for clean water SRF capitalization grants ($55 million less than FY2015, but $278 million above the President's request), $863 million for drinking water SRF capitalization grants ($44 million below the FY2015 level, and $323 million less than the President's request), and $30 million for Alaska Native Village and U.S.-Mexico border water infrastructure projects. It also provided $1.06 billion for state categorical grants. President Obama presented the Administration's FY2017 budget in February 2016, requesting $8.3 billion in total for EPA ($127 million above the FY2016 enacted budget). The request for EPA included $979.5 million for clean water SRF capitalization grants ($424 million less than the FY2016 enacted level), $1.02 billion for drinking water SRF capitalization grants ($157 million above the FY2016 amount), $22 million for Alaska Native Village and U.S.-Mexico border projects, and $1.158 billion for state categorical grants, which generally support state and tribal implementation of environmental programs. During congressional hearings on the EPA request, many Members criticized the requested 30% decrease in funds for clean water SRF capitalization grants. This criticism was reflected to some degree in appropriations bills the Appropriations Committees subsequently approved that include EPA funding. In July 2016, the House passed H.R. 5538 , FY2017 Interior and Environment Appropriations Act; it included $1.0 billion for clean water SRF grants, $1.07 billion for drinking water SRF grants, and $1.06 billion for state categorical grants. The Senate Appropriations Committee reported a companion bill, S. 3068 , in June. It included $1.35 billion for clean water SRF grants, $1.02 billion for drinking water SRF grants, and $1.09 billion for state categorical grants. The Senate did not take up this bill. Congress did not reach final agreement on an EPA funding bill before the start of FY2017. However, on September 28, the House and Senate passed a 10-week continuing resolution that extended FY2016 funding levels, minus a 0.496% across-the-board reduction, through December 9, 2016 ( P.L. 114-223 ). A second continuing resolution, passed in December 2014, extended FY2016 funding levels, minus a 0.1901% across-the-board reduction, from December 10, 2016, through April 28, 2017 ( P.L. 114-254 ). The Obama Administration's FY2017 budget submission also included a $15 million request to allow EPA to begin making water infrastructure project loans under a program that Congress enacted in 2014, the Water Infrastructure Financing and Investment Act, or WIFIA. P.L. 114-254 included the first appropriation, $20 million, for EPA to do so. The FY2017 final appropriations act (discussed below) provided an additional $8 million for EPA's WIFIA program (and $2 million for EPA to administer the program). Final full-year appropriations were enacted as part of the Consolidated and Further Continuing Appropriations Act, 2017, signed by President Trump on May 5, 2017 ( P.L. 115-31 ). The act provided the same level of funding for water infrastructure as FY2016: $1.394 billion for clean water SRF capitalization grants ($414 million above President Obama's request), $863 million for drinking water SRF capitalization grants ($158 million less than President Obama's request), and $30 million for Alaska Native Village and U.S.-Mexico border water infrastructure projects. It also provided $1.07 billion for state categorical grants, which support a range of environmental programs. The Continuing and Security Assistance Appropriations Act, 2017 ( P.L. 114-254 ), included an additional $100 million in DWSRF funding to assist Flint, MI, as authorized in the Water Infrastructure Improvements for the Nation (WIIN) Act ( P.L. 114-322 ). The Trump Administration's FY2018 budget request proposed $8.6 billion overall for EPA. The request included $1.394 billion for clean water SRF capitalization grants and $863 million for drinking water SRF capitalization grants (the same amounts as the FY2017 appropriation). The request proposed $597 million for state categorical grants, a 44% reduction compared to FY2017 levels. Much of this reduction came from the elimination of funding for nonpoint source grants (CWA Section 319) and reduction of grant funding for water pollution control (CWA Section 106). In addition, the President's budget request proposed to eliminate funding for Alaska Native Village and U.S.-Mexico border projects. Similar to the previous fiscal year, Congress did not reach final agreement on an EPA funding bill before the start of FY2018. EPA and other federal departments and agencies operated under multiple continuing resolutions generally at FY2017 enacted levels (minus across-the-board rescissions). Final full-year appropriations were enacted as part of the Consolidated Appropriations Act, 2018, signed by President Trump on March 23, 2018 ( P.L. 115-141 ). EPA's STAG account (Division G, Title II) included $1.394 billion for the clean water SRF and $863 million for the drinking water SRF program (the same amounts appropriated for FY2017, less $100 million for the DWSRF provided to assist Flint, MI). Division G, Title IV (General Provisions), Section 430, included an additional $600 million ($300.0 million each) within the STAG account for both SRF programs. P.L. 115-141 also provided $63 million for the WIFIA program, more than doubling the FY2017 appropriation. The act provided $20 million for Alaska Native Village projects and $10 million U.S.-Mexico border projects. It also provided $1.08 billion for state categorical grants, which support a range of environmental programs. In addition, the act provided the first appropriations for three programs authorized in the WIIN Act ( P.L. 114-322 , Title II, the Water and Waste Act of 2016): $10 million to help public water systems serving small or disadvantaged communities meet SDWA requirements; $20 million to support lead reduction projects, including lead service line replacement; and $20 million to establish a voluntary program for testing for lead in drinking water at schools and child care programs. The Trump Administration's FY2019 budget request proposed $6.15 billion overall for EPA. The request included $1.394 billion for clean water SRF capitalization grants and $863 million for drinking water SRF capitalization grants (the same amounts requested in FY2018). The request included $20 million for the WIFIA program: $17 million to cover subsidy costs, which EPA estimated would allow the agency to lend approximately $2 billion (EPA Budget Justification), and $3 million for administrative costs. In addition, the request proposed $597 million for state categorical grants and $3 million for Alaska Native Village projects. The request proposed to eliminate funding for nonpoint source grants (CWA Section 319), reduce grant funding for water pollution control (CWA Section 106), and eliminate funding for U.S.-Mexico border water infrastructure projects. At the beginning of FY2019, EPA operated under the terms and conditions of multiple continuing resolutions (Division C of P.L. 115-245 ; P.L. 115-298 ; and P.L. 116-5 ). A "partial government shutdown" began on December 22, 2018, during which EPA operated under its shutdown contingency plans. Final full-year appropriations were enacted as part of the Consolidated Appropriations Act, FY2019 ( P.L. 116-6 ), signed by President Trump on February 15, 2019. FY2019 appropriations were provided in two titles of P.L. 116-6 . Title II included $1.394 billion for the CWSRF, $864.0 million for the DWSRF, and $10.0 million for WIFIA. Title IV included an additional $600.0 million ($300.0 million each) for both SRF programs and an additional $58.0 million for WIFIA. Title IV of P.L. 116-6 included $65.0 million within the EPA STAG account for grants authorized in the WIIN Act ( P.L. 114-322 ): $25 million to help public water systems serving small or disadvantaged communities meet SDWA requirements, $15 million to support lead reduction projects (including lead service line replacement), and $25 million to establish a voluntary program for testing for lead in drinking water at schools and child care programs. In addition, the act provided $25 million for Alaska Native Village projects and $15 million U.S.-Mexico border projects. It also provided $1.08 billion for state categorical grants, which support a range of environmental programs. The Trump Administration's FY2020 budget request proposed $6.07 billion overall for EPA. The request included $1.120 billion for CWSRF capitalization grants; $863 million for drinking water SRF capitalization grants; $25 million for the WIFIA program: $20 million to cover subsidy costs, which EPA estimated would allow the agency to lend over $2 billion (EPA Budget Justification), and $5 million for administrative costs; $3 million for Alaska Native Village projects; $10 million for testing for lead in drinking water at schools and child care programs; $61 million for sewer overflow control grants; $154 million for water pollution control grants (CWA Section 106); and $580 million for state categorical grants, which support a range of environmental programs. The Administration's request proposed to eliminate funding for the following: nonpoint source grants, U.S.-Mexico border water infrastructure projects, drinking water grants for small and disadvantage communities, and lead reduction project grants.

Question: Write a one-page summary of the report 1.

Answer: FEMA, a component of DHS, annually awards billions of dollars in grants to help communities prepare for, mitigate the effects of, and recover from major disasters. However, FEMA's complex IT environment supporting grants management consists of many disparate systems. In 2008, the agency attempted to modernize these systems but experienced significant challenges. In 2015, FEMA initiated a new endeavor (the GMM program) aimed at streamlining and modernizing the grants management IT environment. GAO was asked to review the GMM program. GAO's objectives were to (1) determine the extent to which FEMA is implementing leading practices for reengineering its grants management processes and incorporating needs into IT requirements; (2) assess the reliability of the program's estimated costs and schedule; and (3) determine the extent to which FEMA is addressing key cybersecurity practices. GAO compared program documentation to leading practices for process reengineering and requirements management, cost and schedule estimation, and cybersecurity risk management, as established by the Software Engineering Institute, National Institute of Standards and Technology, and GAO. Of six important leading practices for effective business process reengineering and information technology (IT) requirements management, the Federal Emergency Management Agency (FEMA) fully implemented four and partially implemented two for the Grants Management Modernization (GMM) program (see table). Specifically, FEMA ensured senior leadership commitment, took steps to assess its business environment and performance goals, took recent actions to track progress in delivering IT requirements, and incorporated input from end user stakeholders. However, FEMA has not yet fully established plans for implementing new business processes or established complete traceability of IT requirements. Until FEMA fully implements the remaining two practices, it risks delivering an IT solution that does not fully modernize FEMA's grants management systems. While GMM's initial May 2017 cost estimate of about $251 million was generally consistent with leading practices for a reliable, high-quality estimate, it no longer reflects current assumptions about the program. FEMA officials stated in December 2018 that they had completed a revised cost estimate, but it was undergoing departmental approval. GMM's program schedule was inconsistent with leading practices; of particular concern was that the program's final delivery date of September 2020 was not informed by a realistic assessment of GMM development activities, and rather was determined by imposing an unsubstantiated delivery date. Developing sound cost and schedule estimates is necessary to ensure that FEMA has a clear understanding of program risks. Of five key cybersecurity practices, FEMA fully addressed three and partially addressed two for GMM. Specifically, it categorized GMM's system based on security risk, selected and implemented security controls, and monitored security controls on an ongoing basis. However, the program had not initially established corrective action plans for 13 medium- and low-risk vulnerabilities. This conflicts with the Department of Homeland Security's (DHS) guidance that specifies that corrective action plans must be developed for every weakness identified. Until FEMA, among other things, ensures that the program consistently follows the department's guidance on preparing corrective action plans for all security vulnerabilities, GMM's system will remain at increased risk of exploits. GAO is making eight recommendations to FEMA to implement leading practices related to reengineering processes, managing requirements, scheduling, and implementing cybersecurity. DHS concurred with all recommendations and provided estimated dates for implementing each of them.