Page 1 GAO-12-192R TTAC Infrastructure Modernization Acquisition

United States Government Accountability Office

Washington, DC 20548

December 8, 2011

The Honorable John D. Rockefeller, IV

Chairman

Committee on Commerce, Science, and Transportation

United States Senate

Subject: Transportation Security Infrastructure Modernization May Enhance DHS Screening 

Capabilities, but It Is Too Early to Assess Results 

Dear Mr. Chairman:

Securing transportation systems and facilities requires balancing security to address 

potential threats while facilitating the flow of people and goods that are critical to the U.S. 

economy and necessary for supporting international commerce. As we have previously 

reported, transportation systems and facilities are vulnerable and difficult to secure given 

their size, easy accessibility, large number of potential targets, and proximity to urban 

areas.1 The federal government has taken steps to ensure that transportation workers, 

particularly those who transport hazardous materials or seek unescorted access to secure 

areas of federally regulated maritime or aviation facilities, are properly vetted to identify 

whether they pose a security risk. These efforts are intended to reduce the probability of a 

successful terrorist or other criminal attack on the nation’s transportation systems. 

To help enhance the security of the U.S. transportation system, the Department of 

Homeland Security (DHS) Transportation Security Administration’s (TSA) Transportation 

Threat Assessment and Credentialing (TTAC) office2 is responsible for conducting 

background checks—known as security threat assessments—for various screening and 

credentialing programs established for maritime, surface, and aviation transportation 

workers.3

 

1

See GAO, Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected 

to Help Achieve Security Objectives, 

TSA’s programs are largely focused on identifying security threats posed by those 

individuals seeking to obtain an endorsement, credential, access, and/or privilege (hereafter 

called a credential) for unescorted access to secure or restricted areas of transportation 

facilities at maritime ports and airports, and for commercial drivers transporting hazardous 

GAO-11-657 (Washington, D.C.: May 10, 2011). 2

According to TSA, the agency is making several enhancements to better align headquarters functions to enable 

its continued evolution to a high performance counterterrorism organization. This includes merging various TTAC 

functions with the Office of Intelligence to ensure vetting and intelligence informs daily operations. The TTAC 

Infrastructure Modernization program is to be housed under the TSA Office of Intelligence and Analysis while 

retaining the same program goals and objectives. 3

The security threat assessment includes a TSA review of applicant information and searches of domestic and 

international government databases to determine if the applicant meets specified eligibility requirements relating 

to, for example, immigration status and criminal history, as well as having known ties to terrorism. Screening and 

credentialing programs, as used in this report, is the entire process of determining a person’s eligibility for a 

particular license, privilege, or status, from application for the privilege or credential through issuance, use, and 

expiration or potential revocation of the privilege or credential. According to TSA officials, TTAC also has the 

responsibility to provide security threat assessments for critical infrastructure workers, such as chemical plant 

workers. 
Page 2 GAO-12-192R TTAC Infrastructure Modernization Acquisition

materials. These screening and credentialing programs were created under various legal 

and regulatory authorities, and were established at different times. As a result, according to 

TSA, these programs and their supporting systems are made up of independent, standalone business processes and systems, making it difficult to adapt them to meet expected 

growth in demand, new requirements, and new capabilities. 

According to TSA, TTAC screens and/or provides credentials to an estimated 12.5 million 

individuals per year, and this number is estimated to increase to between 52.5 million to 

62.5 million individuals by 2016. However, as indicated in the TTAC Infrastructure 

Modernization (TIM) program mission needs statement, TTAC does not currently have the 

capability to support these expanding populations in providing security threat assessment 

and credentialing services.4 To address this limitation, TTAC initiated TIM in 2008 to 

consolidate and standardize TSA’s current screening and credentialing systems to better 

serve transportation worker populations, increase efficiencies, and reduce duplication.5 In 

April 2007, we reported that several DHS screening and credentialing programs—including 

TSA programs—would benefit from additional coordination since they collect similar 

information, use similar background check processes, and operate separate enrollment 

facilities.6 We made three recommendations aimed at enhancing coordination and exploring 

options for coordinating and aligning background checks within DHS. DHS concurred and 

took actions that addressed these recommendations. For example, DHS established a 

credentialing framework initiative to help eliminate redundant activities across multiple 

screening and credentialing programs. This framework is also intended to guide screening 

and credentialing investments to improve DHS’s ability to meet its mission by, among other 

things, leveraging investments across programs, reducing costs of implementing new 

capabilities, and seeking to coordinate DHS initiatives. 

DHS has an acquisition management process intended to, among other things, help ensure 

acquisition programs meet DHS mission needs. As part of this process, the DHS Acquisition 

Review Board is to conduct systematic reviews of acquisition programs and make 

recommendations on the appropriate direction for moving forward.7 The Acquisition Review 

Board is also expected to provide a consistent method for evaluating an acquisition’s 

progress and status at critical points in the acquisition’s life cycle, and is to work with the 

acquisition decision authority, a member of the Acquisition Review Board, to approve an 

acquisition to proceed to the next phase in its life cycle.8

Given the current efforts to coordinate DHS screening and credentialing programs on a 

departmentwide basis, you asked that we evaluate TSA’s TIM implementation effort. 

Specifically, this report addresses how the TIM program is being implemented to leverage 

 

4

For the purposes of this report, services refer to individual business services that one or more DHS components 

may have access to and use to support broader business capabilities, or DHS enterprise services. For example, 

criminal history checking is a service provided by the Federal Bureau of Investigation that may be used as part of 

vetting an individual. Multiple business services could be grouped together to provide a vetting capability, or 

enterprise business service for use by others across DHS.

5

Among others, the TIM program seeks to consolidate processes and systems for the following TTAC programs 

and populations: Hazardous Material Endorsement Threat Assessment Program (HTAP); Transportation Worker 

Identification Credential Program (TWIC); Alien Flight Student Program (AFSP); International Crew Vetting 

Program (CVP); and Aviation Programs, including the Indirect Air Carrier (IAC) Population, Aviation Workers 

(AW) Program, and the General Aviation (GA) Population. 6

See GAO, Transportation Security: DHS Efforts to Eliminate Redundant Background Check Investigations, 

GAO-07-756 (Washington, D.C.: Apr. 26, 2007). 7

The DHS Acquisition Review Board was renamed the Investment Review Board as of October 1, 2011. 

8

The DHS acquisition management process designates its acquisitions to be a level 1, 2, or 3 acquisition based 

on the acquisition’s cost and risk parameters. Level 1 acquisitions are deemed to have the highest cost or risk 

parameters, and level 3 acquisitions are identified as having lower cost or risk parameters. The TIM program is 

designated a level 2 acquisition, with the DHS Under Secretary for Management designated as the program’s 

acquisition decision authority.
Page 3 GAO-12-192R TTAC Infrastructure Modernization Acquisition

and enhance existing DHS screening and credentialing capabilities in accordance with DHS 

policy and acquisition directive and guidance.

To address this objective, we reviewed pertinent DHS policies and guidance, such as DHS’s 

acquisition management directive, capital planning and investment control guidance, and 

credentialing framework.9 We also reviewed TIM program documentation, such as the TIM 

mission needs statement (March 2009), TIM analysis of alternatives (March 2011), related 

life cycle cost estimates (March 2011 and August 2011),10 and whitepaper on DHS 

partnering opportunities (August 2011).11 To further inform our understanding of DHS’s TIM 

program oversight, we reviewed DHS Acquisition Review Board decision memoranda and 

associated DHS governance tools such as the DHS screening portfolio and related 

enterprise architecture12 efforts at the DHS Office of the Chief Information Officer. We also 

interviewed TIM program officials at TSA and officials in DHS’s Acquisition Program 

Management Division,13 Screening Coordination Office, and Office of the Chief Information 

Officer. In assessing the TIM program approach, we reviewed the information obtained 

through these endeavors to assess the extent to which options for leveraging, streamlining, 

and coordinating DHS screening and credentialing services and capabilities were identified 

and considered, as well as controls were designed to ensure DHS resources are effectively 

utilized to enhance DHS screening and credentialing capabilities. 

We conducted this performance audit from April 2011 to December 2011 in accordance with 

generally accepted government auditing standards. Those standards require that we plan 

and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable 

basis for our findings and conclusions based on our audit objectives. We believe that the 

evidence obtained provides a reasonable basis for our findings and conclusions based on 

our audit objective.

 

9

DHS, Capital Planning and Investment Control Guide (Aug. 2010); DHS, Acquisition Management Directive

102-01 (Jan. 20, 2010); DHS, Acquisition Instruction/Guidebook 102-01-001 (Nov. 7, 2008); and DHS, 

Credentialing Framework Initiative (July 3, 2008). 10Life cycle cost estimate figures reported in this product were provided by TSA. We asked TSA to explain the 

steps taken to construct, verify and validate the life cycle cost estimate data. TSA stated that commercial-off-theshelf pricing information and DHS data center catalogs were used to identify cost data. To help ensure that all 

relevant costs and inputs were considered, TSA said a standardized work breakdown structure was constructed 

and tailored to the TIM program. It was then compared to similar systems to identify whether a critical piece 

could have been omitted. Cost data were input into a spreadsheet where initial calculations were made. Next, an 

automated cost estimating integrated tool was used to verify the data. Finally, TSA said all calculations were 

verified by hand. TSA included sunk costs in the life cycle cost estimates, and divided these costs into two 

categories—expended and not expended. In the March estimate, the obligated expended sunk costs were 

included, but the obligated unexpended sunk costs were not. However, in the August 2011 estimate, both 

obligated sunk cost categories were included. It is unclear what effect not including unexpended sunk costs in 

both estimates has on the reported cost savings. To identify the appropriate probability distributions for purposes 

of conducting Monte Carlo simulations, TSA said a variety of methods were used to arrive at probability 

distributions, such as using salary ranges, technical ranges, and permitting the automated cost estimating 

integrated tool to specify some boundaries based on subjective boundaries. While we did not assess the cost 

estimates against GAO’s best practices criteria, based on the steps described by TSA, we determined the life 

cycle cost estimate to be sufficiently reliable to illustrate TSA’s effort to estimate costs for TIM program 

technology acquisition alternatives.

11TSA, DHS Services Reuse for TTAC Infrastructure Modernization (August 2011). 12An enterprise architecture is a corporate blueprint that serves as an authoritative frame of reference for 

information technology investment decision making. According to DHS guidance, DHS’s enterprise architecture 

is a management practice for aligning programs and projects to improve business performance and help 

agencies better execute their core missions. Enterprise architecture describes the current and future state of the 

agency, and lays out a plan for transitioning from the current state to the desired future state. 13DHS’s Acquisition Program Management Division became part of the Program Accountability and Risk 

Management Office as of October 1, 2011.
Page 4 GAO-12-192R TTAC Infrastructure Modernization Acquisition

Results In Brief

While TSA initially focused on fixing gaps in TSA-managed screening and credentialing 

operations, it has since modified its TIM strategy to better leverage and enhance 

departmentwide capabilities, in accordance with DHS’s credentialing framework and 

acquisition directive and guidance. For example, DHS required the TIM program to identify 

additional opportunities for leveraging DHS capabilities—or enterprise services—and 

identify cost efficiencies. TSA initially did not select a course of action that would leverage 

DHS capabilities beyond what TSA already had in place under its existing programs, such 

as using or establishing a consolidated enrollment service that could be used by TIM and 

other DHS components. During the course of our review, however, TSA began to identify 

capabilities that might be leveraged across DHS. For example, in accordance with DHS 

direction, in August 2011, the TIM program identified several opportunities for leveraging 

existing DHS background checking and vetting services.14 For instance, TSA is now working 

with DHS’s Office of the Chief Information Officer and Screening Coordination Office to 

establish a common vetting service, which could reduce duplication among other DHS 

services. Eliminating redundant activities across multiple screening and credentialing 

programs could help support the goals of DHS’s credentialing framework initiative. However, 

as of the date of this report, the programs that are to use this vetting service have not yet 

been determined. It is therefore too early to tell the extent to which, once implemented, 

these initiatives would enhance screening and credentialing capabilities across DHS. In 

commenting on a draft of this report, DHS did not state whether it concurred with the 

contents but noted that the TIM effort will capitalize on opportunities to leverage and, where 

possible, consolidate existing DHS capabilities. DHS also provided technical comments, 

which we have incorporated where appropriate.

Background 

Screening Coordination Office and the Credentialing Framework

Housed within DHS’s Policy Directorate, the Screening Coordination Office was established 

in July 2006 in response to Homeland Security Presidential Directive 11 (HSPD-11), which 

announced a new U.S. policy to implement a coordinated and comprehensive approach to 

terrorist-related screening.15 As we reported in April 2007, one of the office’s goals includes 

identifying opportunities to harmonize and enhance screening and credentialing processes 

across DHS’s screening programs.16

In December 2006, the Screening Coordination Office issued a report identifying common 

problems, challenges, and needed improvements in the credentialing programs and 

processes across DHS. For example, the office identified that there was inefficient 

information and data collection and inconsistent vetting processes for similar programs. 

Among others, that report recommended that: (1) DHS establish a preference for “enroll 

once, use many” environments to promote sharing and reuse of information within DHS, so 

that component agencies do not have to build interfaces to the same systems to get to the 

information they need; (2) DHS design credentials that support multiple licenses, privileges, 

 

14Background checking and vetting services refers primarily to the resolution of derogatory information—such as 

terrorism information, criminal history, or immigration violations—to evaluate whether the person applying for a 

DHS license, privilege, or status is known to have been, or is appropriately suspected of being, involved in a 

disqualifying activity.

15See Homeland Security Presidential Directive 11: Comprehensive Terrorist-Related Screening Procedures 

(Aug. 27, 2004). HSPD-11 defines terrorist-related screening as the collection, analysis, dissemination, and use 

of information related to people, cargo, conveyances, and other entities and objects that pose a threat to 

homeland security. It also includes risk assessment, inspection, and credentialing.

16See GAO-07-756. 
Page 5 GAO-12-192R TTAC Infrastructure Modernization Acquisition

or status, based on the risks associated with the environments in which they are used; and 

(3) vetting be associated with like uses and like risks. In July 2008, and in response to that 

report, DHS established a credentialing framework initiative with the stated goal, among 

others, of improving credentialing processes across DHS by eliminating redundant activities, 

leveraging investments across programs, and reducing the costs of implementing new 

capabilities. The framework identifies the following six credentialing phases, or capabilities: 

(1) registration and enrollment; (2) eligibility vetting and risk assessment; (3) issuance; (4) 

verification and use; (5) expiration and revocation; and (6) redress/waiver. It also included 

trend analytics as another important activity that is to occur across the credentialing 

capabilities. Trend analytics is the ability to identify unusual activities across a credentialing 

program by looking at the entire credentialing process rather than just one part.

Overview of DHS Acquisition Review Process

DHS’s Acquisition Review Board is to review and approve acquisition programs at key 

stages in their life cycles before the acquisition program can move to the next phase.17

(1) “need” phase—identify a capability need (concludes with the DHS Acquisition 

Review Board granting the acquisition program approval to proceed at Acquisition 

Decision Event 1);

The 

DHS acquisition guidance has established four phases that constitute the acquisition life 

cycle:

(2) “analyze/select” phase—analyze and select the means to provide that capability 

(concludes with the Acquisition Review Board granting the acquisition program 

approval to proceed at Acquisition Decision Event 2A);

(3) “obtain” phase—obtain the capability (the Acquisition Review Board may review the 

acquisition program multiple times, at Acquisition Decision Events 2B, 2C, before 

granting the acquisition program approval to proceed with particular acquisition 

activities; the phase concludes with the Acquisition Review Board granting the 

program approval to proceed at Acquisition Decision Event 3); and

(4) “produce/deploy/support” phase—produce, deploy, and support the capability (the 

Acquisition Review Board does not have a standard, defined role in this phase, but 

may also conduct additional reviews as necessary). 

Figure 1 presents the four DHS acquisition phases, including the documents presented for 

review as defined in DHS’s acquisition directive.

 

17DHS Acquisition Directive 102-01 established the Acquisition Review Board as a cross component group within 

the department that determines whether a proposed acquisition has met the requirements of key phases in the 

acquisition life-cycle framework and is able to proceed to the next phase and eventual full production and 

deployment. The board is comprised of the Acquisition Decision Authority (chair), the Under Secretary for 

Management, the Under Secretary for Science and Technology, the Assistant Secretary for Policy, the General 

Counsel, the Chief Financial Officer, the Chief Procurement Officer, the Chief Information Officer, the Chief 

Human Capital Officer, the Chief Administrative Officer, the Chief Security Officer, user representatives from 

components sponsoring the capability, and other officials within the department determined to be appropriate to 

the subject matter by the Acquisition Decision Authority. 
Page 6 GAO-12-192R TTAC Infrastructure Modernization Acquisition

Figure 1: Overview of the DHS Acquisition Phases

As required by DHS’s acquisition directive and guidance, during the “need” phase, key 

planning documents, such as the mission needs statement, are to be completed. The 

purpose of the mission needs statement is to identify the need to be addressed by the 

department or DHS component’s acquisition. Further, during the “analyze and select” phase, 

key documents, such as the analysis of alternatives, operational requirements document, 

and acquisition program baseline, are to be completed. The purpose of the analysis of 

alternatives is to identify alternative solutions and analyze or compare the alternatives based 

on cost, risk, and capability. The operational requirements document is to select user 

requirements and identify key performance parameters for the acquisition. Lastly, the 

acquisition program baseline is to serve as an agreement between the program office and 

the acquisition review board regarding the capability that will be provided, the timeframe in 

which it will be provided, and how much it will cost. It is to be used to measure program 

performance, and summarizes critical cost, schedule, and performance parameters that 

must be met to accomplish the goals of the investment. The acquisition program baseline 

must trace directly back to the mission gap expressed in the mission needs statement and 

the requirements detailed in the operational requirements document.

TIM Acquisition History

Table 1 summarizes key TIM program events through September 2011.
Page 7 GAO-12-192R TTAC Infrastructure Modernization Acquisition

Table 1: Key TIM Program Events over Time

Date Key TIM program events

December 2008 TTAC initiated the development of the TIM program. 

June 11, 2009 TSA presented before the Acquisition Review Board on the status of the prototype. The 

program had an anticipated prototype deployment date of October 2009. The prototype 

was anticipated to be completed in fiscal year 2010. 

February 18, 2010 The Acquisition Review Board approved the TIM program’s transition from the “need” 

phase of the acquisition lifecycle to the “analyze/select” phase after approving the 

mission needs statement and determining there was a need for the program. The TIM 

program proceeded to conduct an analysis of alternatives.

Subsequent to the Acquisition Review Board review, TSA terminated the TIM prototype 

after it proved unsuccessful due to unclear requirements definition. TSA proceeded with a 

new acquisition approach for TIM, which included pursuing full and open competition for 

a full scale development contract. TSA stated that this change in acquisition strategy 

resulted in a delay of over 6 to 8 months. TSA moved the anticipated date for awarding a 

full-scale development contract to fiscal year 2011.

March 11, 2011 TIM analysis of alternatives was completed. TSA subsequently endorsed the selection of 

the recommended alternative and forwarded it to DHS for concurrence.

May 6, 2011 TSA went before the Acquisition Review Board to obtain approval for the TIM program to

issue a request for proposals. The program did not receive approval at that point to 

transition from the “analyze/select” phase of the acquisition lifecycle to the “obtain” phase. 

DHS directed the program to complete several actions in preparation for approval to 

move to the “obtain” phase. TSA moved the anticipated TIM contract award date to 

September or October 2011.

May 12, 2011 DHS granted TSA permission to release the request for proposals after incorporation of 

some specific changes. 

May 23, 2011 TSA issued a request for proposals for the TIM program acquisition. The request for 

proposals closed on August 8, 2011.

September 15, 2011 The Acquisition Review Board provided verbal approval for the program to proceed to the 

“obtain” phase of the acquisition lifecycle, giving TSA permission to move forward with 

awarding a contract for acquiring TIM, pending approval from the DHS Under Secretary 

for Management. The board also forwarded key documents such as the operational 

requirements document and the acquisition program baseline to DHS approving 

authorities for signature and approval. Source: GAO summary of TIM program events based on TTAC and DHS information.

TIM Program Is Taking Steps to Leverage and Enhance DHS Capabilities Consistent 

with DHS Policy, but Efforts Are Too Early to Assess

As TSA has progressed toward implementing the TIM program, it has modified its strategy 

to leverage and enhance existing DHS capabilities, consistent with the DHS credentialing 

framework initiative and acquisition directive and guidance. The credentialing framework 

initiative seeks to coordinate and harmonize the numerous and disparate credentialing 

initiatives within DHS by identifying potential areas for elimination of duplicative efforts, 

services with a high likelihood of reuse, and an approach to target the development of highpriority services. In accordance with DHS’s acquisition guidance, the TIM program went 

before the DHS Acquisition Review Board in February 2010 at the end of its “needs” phase 

to gain approval to enter the “analyze/select” phase. TSA presented the TIM program 

mission needs statement, which focused on fixing gaps in TSA’s screening and 

credentialing programs, to the Acquisition Review Board. The Acquisition Review Board 

granted the program approval to proceed to the “analyze/select” phase. 

The mission needs statement acknowledged DHS’s broader departmentwide credentialing 

requirements, such as promoting the reuse of enterprise services and standardization 

across DHS screening and credentialing programs, and had a stated goal of maximizing the 

use of the DHS and federal infrastructure to the maximum extent possible. Further, in 

granting the approval to proceed to the next phase, the Acquisition Review Board and TSA 

agreed that the analysis of alternatives for the TIM program would look outside of TSA’s 
Page 8 GAO-12-192R TTAC Infrastructure Modernization Acquisition

credentialing programs to other DHS modernization programs, include costs and benefits 

analyses, and assess any potential cost savings. The board and TSA also agreed that the 

TIM program would continue to work with DHS’s Screening Coordination Office to develop 

business processes for vetting screening services at an enterprise level and define how the 

TIM program fits into the overall screening capability for DHS.

TSA initially did not select a course of action that would leverage DHS capabilities beyond 

what TSA already had in place under its existing programs. Although TSA was directed to 

consider non-TSA alternatives, and DHS’s credentialing framework calls for the 

implementation of coordinated approaches to screening-related activities, the TIM program’s 

March 2011 analysis of alternatives did not lead to a solution that leveraged or established 

DHS capabilities—or enterprise services—beyond what TSA already had in place under its 

existing programs. As reported in the TIM’s analysis of alternatives, the recommended 

alternative that TSA chose as the most effective involved using TSA’s existing capabilities 

for eligibility vetting and risk assessment, and purchasing commercial off-the-shelf software 

to provide the framework for some of the other capabilities for TIM.18 In an effort to meet the 

Acquisition Review Board’s direction at Acquisition Decision Event 1—for TSA to look 

across other DHS modernization efforts at Customs and Border Protection, U.S. Citizenship 

and Immigration Services, and US-VISIT for possible reuse of enterprise services—the 

analysis of alternatives considered two alternatives that looked at leveraging one DHS 

program at Customs and Border Protection for implementing TIM.19 

However, TSA’s analysis did not present an approach that would use or consolidate a mix of 

DHS enterprise services from across different DHS component’s programs to meet TIM 

program and future DHS needs, such as enrollment enterprise services from one DHS 

component and redress and waiver enterprise services from another component. Further, 

the analysis gave less weight to improving credentialing processes across DHS, thereby 

giving less importance to eliminating redundant activities across DHS and maximizing the 

reuse of existing DHS investments. According to the TIM Program Manager, when the 

analysis was conducted, DHS did not have the technology infrastructure and architecture 

necessary to facilitate such an approach, which would have required a significant rework of 

existing systems and processes. The TIM Program Manager further noted that the exercise 

of completing the analysis of alternatives and ensuing reviews highlighted existing 

challenges for leveraging capabilities across DHS and illustrated the need for DHS and its 

components to work together to mature DHS’s capabilities.

During the course of our review, TSA began to identify capabilities that might be leveraged 

across DHS. After TSA conducted the March 2011 analysis of alternatives and selected its 

approach for implementing the program, DHS required the TIM program to identify 

additional opportunities for leveraging DHS enterprise services and identifying cost 

efficiencies. For example, according to TIM program officials, DHS directed TSA to consider 

 

18Capabilities that commercial-off-the-shelf software would provide include enrollment, expiration, revocation, 

redress, and waiver.

19Of the eight alternatives considered, two looked at leveraging U.S. Customs and Border Protection’s Global 

Enrollment System capabilities. One alternative proposed to maximize reusing existing DHS capabilities by 

having U.S. Customs and Border Protection provide all screening and credentialing capabilities for TSA. 

However, TSA did not consider the alternative viable because, among other things, the analysis determined that 

TSA and U.S. Customs and Border Protection have very different missions. Another alternative, which TSA 

considered to be viable, also focused on having U.S. Customs and Border Protection provide TSA’s registration, 

enrollment, and issuance services, and TSA continuing to provide the background checking/eligibility vetting and 

risk assessment service. However, TSA did not rank this alternative as effective for the recommended 

alternative.
Page 9 GAO-12-192R TTAC Infrastructure Modernization Acquisition

using a new DHS initiative known as DHS virtual cloud services.20 TSA subsequently 

incorporated virtual cloud services into the acquisition plans for the TIM program, allowing 

the program to leverage a pool of DHS information technology resources instead of having 

to purchase and invest in separate information technology systems, according to TIM 

program officials. A comparison of TSA’s life cycle cost estimate for using DHS cloud 

technology versus purchasing technology systems shows an estimated reduction of 

approximately $137 million, or 20 percent, from $699 million to $562 million.21

Further, on May 6, 2011, the TIM program went before the DHS Acquisition Review Board 

for approval to issue a request for proposal and Acquisition Decision Event 2A, approval to 

progress to the “obtain” acquisition phase. Approval for Acquisition Decision Event 2A was 

withheld pending the completion of specified action items. For example, the Acquisition 

Review Board required TSA to complete a strategy for leveraging other services and related 

systems architectures in DHS instead of developing new technologies or capabilities, and, 

among other things, to identify possible services that the TIM program may provide to the 

department before it would approve the program. The board further required that a 

department-level executive steering committee with responsibility for governing the TIM 

program be established. To address the Acquisition Review Board’s requirements, in August 

2011 TSA issued a document titled DHS Services Reuse for TTAC Infrastructure 

Modernization, which identified several opportunities for partnering and reuse of existing 

DHS background checking and vetting services. The document did not identify opportunities 

to leverage non-background checking and vetting enterprise services—such as enrollment, 

credential issuance, and revocation—from other DHS screening and credentialing 

programs. However, the document identified that the TIM program’s universal vetting and 

adjudication and redress service, especially its terrorist vetting component, has the potential 

for DHS-wide reuse as an enterprise service, or capability. TSA noted that it would continue 

to explore options to leverage existing credentialing services. 

Eliminating redundant activities across multiple screening and credentialing programs could

help support the goals of DHS’s credentialing framework initiative. According to DHS and 

TIM program officials, as of September 2011, the results of the DHS Services Reuse for 

TTAC Infrastructure Modernization have been used to inform the TIM program’s 

implementation strategy and fit into DHS’s screening and credentialing strategy. Specifically, 

TSA is working with the DHS Office of the Chief Information Officer and Screening 

Coordination Office to establish a common vetting enterprise service for use by TIM and 

other DHS programs, such as the U.S. Coast Guard and the Office of Infrastructure 

Protection housed in the National Program and Protection Directorate. However, according 

to Screening Coordination Office and TIM program officials, as of September 2011 the 

programs that are to use this vetting enterprise service have not yet been officially 

determined. Officials further stated that this capability is to replace stand-alone vetting 

services that are provided by various independent components, and DHS has not yet 

 

20DHS is implementing a private cloud capability within its two enterprise data centers to enhance sharing 

sensitive information across the Department. According to the DHS Chief Information Officer in an October 6, 

2011 hearing on cloud computing, cloud services enable convenient, on-demand network access to a shared 

pool of computing resources to multiple users from a centralized source. Cloud Computing: What are the 

Security Implications, Hearing Before the Committee on Homeland Security, Subcommittee on Cybersecurity, 

Infrastructure Protection, and Security Technologies, 112th Cong. (2011) (statement by Richard Spires, Chief 

Information Officer, U.S. Department of Homeland Security). 

21The stated life cycle cost estimate figures are presented as reported by TIM program officials. As reported by 

TSA, these costs represent estimates at the 80 percent confidence levels and are reported in fiscal year 2011 

dollars. Further, the life cycle costs were calculated for a 17-year period from Fiscal Year 2009 to 2025. We 

asked TSA officials to explain the steps taken to construct, verify, and validate the life cycle cost estimate data. 

While we did not assess the cost estimates against GAO's best practices criteria, based on the steps described 

by TSA, we determined the life cycle cost estimate to be sufficiently reliable to illustrate TSA's effort to estimate 

costs for TIM program technology acquisition alternatives.
Page 10 GAO-12-192R TTAC Infrastructure Modernization Acquisition

determined which component will be responsible for leading this effort, according to the 

officials. A Screening Governance Board is currently being established to look across DHS 

screening and credentialing programs to determine where existing capabilities can be 

leveraged so that efficiencies can be found. According to an official from the Screening 

Coordination Office, part of the board’s role would be to help determine which programs 

could use the vetting enterprise service being developed as part of the TIM program, as well 

as which component would be responsible for leading the effort. However, the board does 

not have a charter and had not met as of the date of this report. According to an official from 

the Screening Coordination Office, the charter has been drafted and is expected to be 

finalized by the end of December, with the first official board meeting to take place by the 

beginning of calendar year 2012. DHS and TIM program officials believe that these efforts 

will produce increased efficiencies across DHS and reduce duplication and cost, but it is too 

soon to assess the results of these efforts.

Concluding Observations

Given DHS’s current budgetary environment, it is critical that new investments in screening 

and credentialing services capitalize on opportunities to leverage and, where possible, 

consolidate existing DHS capabilities. TSA has made progress in its recent efforts to work 

with DHS to establish a common vetting enterprise service across DHS in accordance with 

DHS’s credentialing framework initiative, DHS acquisition guidance, and direction from the 

Acquisition Review Board. This effort could reduce the potential for duplication and enhance 

the effectiveness and efficiency of screening and credentialing initiatives across DHS. 

However, a number of uncertainties remain, including what programs will use the vetting 

enterprise service, who will lead it, and what capability will actually be obtained. It is 

therefore too early to tell whether, or to what extent, this service will be effective in 

leveraging and enhancing vetting capabilities across DHS and for the TIM program. As TSA 

moves forward in helping to implement the enterprise vetting service, it will be important for 

TSA to continue to partner with other DHS components to find any additional opportunities 

available for reuse by DHS and the TIM program. By exploring solutions that could eliminate 

duplication and increase efficiencies, TSA could help DHS achieve cost effective solutions 

to securing the nation.

Agency Comments

We obtained written comments from DHS, which are reprinted in enclosure I. In its 

comments, DHS did not state whether it concurred with the contents of the draft report but 

noted that the TIM effort will capitalize on opportunities to leverage and, where possible, 

consolidate existing DHS capabilities. DHS also provided technical comments, which we 

have incorporated where appropriate.

- - - - - 
Page 11 GAO-12-192R TTAC Infrastructure Modernization Acquisition

We are sending copies of this report to the Secretary of Homeland Security, appropriate 

congressional committees, and other interested parties. This report also is available at no 

charge on the GAO website at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact me at (202) 512-

4379 or lords@gao.gov. Contact points for our Offices of Congressional Relations and 

Public Affairs may be found on the last page of this report. Key contributors to this report are 

listed in enclosure II.

Sincerely yours,

Stephen M. Lord 

Director, Homeland Security and Justice Issues

Enclosures – 2 
Page 12 GAO-12-192R TTAC Infrastructure Modernization Acquisition

Enclosure I: Comments from the Department of Homeland Security
Page 13 GAO-12-192R TTAC Infrastructure Modernization Acquisition
Page 14 GAO-12-192R TTAC Infrastructure Modernization Acquisition

Enclosure II: GAO Contact and Staff Acknowledgments

GAO Contact

Stephen M. Lord, (202) 512-4379 or at lords@gao.gov. 

Staff Acknowledgments

In addition to the contact named above, Jessica Lucas-Judy, Assistant Director; David 

Alexander; Charles Bausell; Joseph P. Cruz; Chris Currie; Susan Czachor; Pawnee A. 

Davis; Geoffrey Hamilton; Richard Hung; Sairah Ijaz; Linda Miller; Sabine Paul; Nathan 

Tranquilli; and Rebecca Wilson made key contributions to this report.

(440973)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s Web site (www.gao.gov). Each weekday afternoon, 

GAO posts on its Web site newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s Web site, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs