U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

22–296 2017

MODERNIZING SOCIAL SECURITY’S 

INFORMATION TECHNOLOGY INFRASTRUCTURE 

HEARING 

BEFORE THE

SUBCOMMITTEE ON SOCIAL SECURITY 

OF THE

COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

JULY 14, 2016 

Serial No. 114–SS06 

Printed for the use of the Committee on Ways and Means 

( 

ii 

COMMITTEE ON WAYS AND MEANS 

KEVIN BRADY, Texas, Chairman 

SAM JOHNSON, Texas 

DEVIN NUNES, California 

PATRICK J. TIBERI, Ohio 

DAVID G. REICHERT, Washington 

CHARLES W. BOUSTANY, JR., Louisiana 

PETER J. ROSKAM, Illinois 

TOM PRICE, Georgia 

VERN BUCHANAN, Florida 

ADRIAN SMITH, Nebraska 

LYNN JENKINS, Kansas 

ERIK PAULSEN, Minnesota 

KENNY MARCHANT, Texas 

DIANE BLACK, Tennessee 

TOM REED, New York 

TODD YOUNG, Indiana 

MIKE KELLY, Pennsylvania 

JIM RENACCI, Ohio 

PAT MEEHAN, Pennsylvania 

KRISTI NOEM, South Dakota 

GEORGE HOLDING, North Carolina 

JASON SMITH, Missouri 

ROBERT J. DOLD, Illinois 

TOM RICE, South Carolina 

SANDER M. LEVIN, Michigan 

CHARLES B. RANGEL, New York 

JIM MCDERMOTT, Washington 

JOHN LEWIS, Georgia 

RICHARD E. NEAL, Massachusetts 

XAVIER BECERRA, California 

LLOYD DOGGETT, Texas 

MIKE THOMPSON, California 

JOHN B. LARSON, Connecticut 

EARL BLUMENAUER, Oregon 

RON KIND, Wisconsin 

BILL PASCRELL, JR., New Jersey 

JOSEPH CROWLEY, New York 

DANNY DAVIS, Illinois 

LINDA SA ́ NCHEZ, California 

DAVID STEWART, Staff Director 

NICK GWYN, Minority Chief of Staff 

SUBCOMMITTEE ON SOCIAL SECURITY 

SAM JOHNSON, Texas, Chairman 

ROBERT J. DOLD, Illinois 

VERN BUCHANAN, Florida 

ADRIAN SMITH, Nebraska 

MIKE KELLY, Pennsylvania 

JIM RENACCI, Ohio 

TOM RICE, South Carolina 

XAVIER BECERRA, California 

JOHN B. LARSON, Connecticut 

EARL BLUMENAUER, Oregon 

JIM MCDERMOTT, Washington 

iii 

C O N T E N T S 

Page 

Advisory of July 14, 2016 announcing the hearing ............................................... 2 

WITNESSES 

Kimberly A. Byrd, Deputy Assistant Inspector General for Audit, Financial 

Systems and Operations Audits, Office of the Inspector General, Social 

Security Administration ...................................................................................... 51 

William Hayes, Principal Engineer, Software Engineering Institute, Carnegie 

Mellon University ................................................................................................. 76 

Robert Klopp, Deputy Commissioner of Systems, Chief Information Officer, 

Social Security Administration ........................................................................... 6 

Valerie C. Melvin, Director, Information Management and Technology Resources Issues, Government Accountability Office ............................................ 60 

Richard E. Warsinskey, President, National Council of Social Security Management Associations ........................................................................................... 42 

QUESTIONS FOR THE RECORD 

Questions from The Honorable Sam Johnson, Chairman, Subcommittee on 

Social Security, to Kimberly Byrd, Deputy Assistant Inspector General 

for Audit, Financial Systems and Operations Audits, Office of the Inspector 

General, Social Security Administration ............................................................ 105 

Questions from The Honorable Sam Johnson, Chairman, Subcommittee on 

Social Security, to William Hayes, Principal Engineer, Software Engineering Institute, Carnegie Mellon University ......................................................... 110 

Questions from The Honorable Sam Johnson, Chairman, Subcommittee on 

Social Security, to Robert Klopp, Deputy Commissioner of Systems, Chief 

Information Officer, Social Security Administration ........................................ 114 

SUBMISSIONS FOR THE RECORD 

Cheryl Sullivan, BMC ............................................................................................. 119 

Claire Bailey, Director of Federal, State and Local Mainframe Solutions, 

Compuware ........................................................................................................... 122 

(1) 

MODERNIZING SOCIAL SECURITY’S 

INFORMATION TECHNOLOGY 

INFRASTRUCTURE 

THURSDAY, JULY 14, 2016 

U.S. HOUSE OF REPRESENTATIVES, COMMITTEE ON WAYS AND MEANS, SUBCOMMITTEE ON SOCIAL SECURITY, Washington, DC. 

The Subcommittee met, pursuant to call, at 10:04 a.m., in Room 

B–318, Rayburn House Office Building, Hon. Sam Johnson [Chairman of the Subcommittee] presiding. 

[The advisory announcing the hearing follows:] 

2 

ADVISORY 

FROM THE COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON SOCIAL SECURITY 

FOR IMMEDIATE RELEASE CONTACT: (202) 225–3625 

Thursday, July 7, 2016 

No. SS–06 

Chairman Johnson Announces Hearing on 

Modernizing Social Security’s 

Information Technology Infrastructure 

House Ways and Means Social Security Subcommittee Chairman Sam Johnson 

(R–TX), announced today that the Subcommittee will hold a hearing on ‘‘Modernizing Social Security’s Information Technology Infrastructure.’’ The hearing will 

focus on the current state of the Social Security Administration’s Information Technology (IT) infrastructure, the agency’s IT modernization plan, and best practices for 

IT modernization, including oversight of Agile software development. The hearing 

will take place on Thursday, July 14, 2016, in Room B–318 of the Rayburn 

House Office Building, beginning at 10:00 a.m. 

In view of the limited time to hear witnesses, oral testimony at this hearing will 

be from invited witnesses only. However, any individual or organization may submit 

a written statement for consideration by the Committee and for inclusion in the 

printed record of the hearing. 

DETAILS FOR SUBMISSION OF WRITTEN COMMENTS: 

Please Note: Any person(s) and/or organization(s) wishing to submit written comments for the hearing record must follow the appropriate link on the hearing page 

of the Committee website and complete the informational forms. From the Committee homepage, http://waysandmeans.house.gov, select ‘‘Hearings.’’ Select the hearing for which you would like to make a submission, and click on the link entitled, 

‘‘Click here to provide a submission for the record.’’ Once you have followed the online instructions, submit all requested information. ATTACH your submission as a 

Word document, in compliance with the formatting requirements listed below, by 

the close of business on Thursday, July 28, 2016. For questions, or if you encounter technical problems, please call (202) 225–3625. 

FORMATTING REQUIREMENTS: 

The Committee relies on electronic submissions for printing the official hearing 

record. As always, submissions will be included in the record according to the discretion of the Committee. The Committee will not alter the content of your submission, 

but we reserve the right to format it according to our guidelines. Any submission 

provided to the Committee by a witness, any materials submitted for the printed 

record, and any written comments in response to a request for written comments 

must conform to the guidelines listed below. Any submission not in compliance with 

these guidelines will not be printed, but will be maintained in the Committee files 

for review and use by the Committee. 

1. All submissions and supplementary materials must be submitted in a single 

document via email, provided in Word format and must not exceed a total of 10 

pages. Witnesses and submitters are advised that the Committee relies on electronic 

submissions for printing the official hearing record. 

2. All submissions must include a list of all clients, persons and/or organizations 

on whose behalf the witness appears. The name, company, address, telephone, and 

fax numbers of each witness must be included in the body of the email. Please exclude any personal identifiable information in the attached submission. 

3 

3. Failure to follow the formatting requirements may result in the exclusion of a 

submission. All submissions for the record are final. 

The Committee seeks to make its facilities accessible to persons with disabilities. 

If you are in need of special accommodations, please call 202–225–1721 or 202–226– 

3411 TDD/TTY in advance of the event (four business days notice is requested). 

Questions with regard to special accommodation needs in general (including availability of Committee materials in alternative formats) may be directed to the Committee as noted above. 

Note: All Committee advisories and news releases are available online at: 

http://www.waysandmeans.house.gov

f 

/. 

Chairman JOHNSON. Well, good morning and welcome to today’s hearing on modernizing Social Security’s information technology infrastructure. From seniors receiving Social Security benefits to young parents whose infants need Social Security numbers, 

Social Security’s IT infrastructure touches on the lives of nearly 

every American. Hundreds of computer programs, thousands of 

servers, and millions of lines of computer code make up Social Security’s IT. But even though it is so important, Social Security’s IT 

hasn’t kept up with the advances in technology. 

Today, when smartphones are common, Social Security still relies on computer code so outdated they don’t even teach it in classrooms—unless you all teach some of it. So Social Security has to 

spend time and resources training workers in ancient computer 

languages, like COBOL, or rehire retirees to update its programs, 

because they are the only ones who know how. 

Social Security has new hardware, new computers and new data 

centers, but their software is out of date and hasn’t been updated 

in years. Looking at a computer in a Social Security field office, you 

might think you have been transported back to the 1980s. Social 

Security still has many green screen programs. For those of you 

who may not remember, an example of a green screen is on the 

TVs. I can’t tell you the last time I saw one of those. 

And, as we will hear today, this old technology makes it difficult 

to keep younger workers, who grew up using lots of technology. 

And, worse, there is a true cost to the old technology, because it 

takes Social Security employees longer than it should to do a simple task. That is time that can’t be spent helping another claimant, 

processing earnings information on disability insurance beneficiaries or answering the phone. 

We will hear today that Social Security’s employees lose 20 minutes each day due to technology problems. With an agency as large 

as Social Security, this adds up quickly. And this wasted time costs 

Social Security nearly $200 million each year. 

For years, I have been sounding the alarm on the state of Social 

Security’s outdated and aging IT. And the good news is Social Security has finally recognized it has a problem. In this year’s President’s budget, Social Security admitted the patchwork approach 

isn’t working, and it is time to overhaul the entire system. 

Today, we will learn how Social Security plans to take on this 

massive program. It won’t be easy, but Social Security has to get 

it right and the American people expect nothing less. But we will 

also hear today that Social Security’s track record isn’t always good 

4 

when it comes to IT. Social Security has been trying for years to 

develop the Disability Case Processing System, DCPS, a single 

piece of software that will be used by State employees when deciding disability cases. The experience with DCPS has been rough for 

taxpayers and doesn’t inspire all that much confidence. 

While it seems the project might be getting on track, you can’t 

just ignore 300 million in taxpayer dollars spent on a failed approach before Social Security decided to just start over. Yet Social 

Security had no problem asking for $300 million to redo its entire 

IT system without sharing a plan for how it was going to do it, the 

same amount that they spent on DCPS with nothing to show for 

it. 

The American people have the right to be skeptical. Trust is 

something that is earned, and it is earned by plans that can be followed, staying within a budget, and getting the job done on time, 

if not early. Make no mistake, Social Security must modernize its 

IT infrastructure, but they have to do it responsibly. This cannot 

be some runaway project with costs spiraling out of control or, a 

few years from now, starting over from scratch after spending hundreds of millions of dollars. Social Security has to get it right the 

first time. 

Thank you all for being here. I will now recognize Mr. Becerra 

for his opening statement. 

Mr. BECERRA. Mr. Chairman, thank you very much and thanks 

to the witnesses for being here. 

The Social Security Administration has an indispensable job, ensuring that all Americans get their earned Social Security benefits 

on time and in the correct amount. No agency serves more Americans with more critical services and activities than the Social Security Administration. One in four American families receives income 

from Social Security. 

Last year, SSA, the Social Security Administration, ensured that 

more than 60 million Americans were paid their earned Social Security benefits, that they completed more than 8 million new applications, benefit applications, that they served more than 40 million 

in-person visitors and received over 66 million calls to over 1,200 

field offices nationwide. 

SSA’s IT was state of the art when it was developed. And SSA 

has over its history repeatedly harnessed technology to improve efficiency, productivity and customer service. But that was then. SSA 

had state-of-the-art systems in the 1970s, but today those legacy 

systems are increasingly obsolete. They are expensive to maintain, 

prone to breakdown, and difficult to reprogram. 

Modernizing SSA’s IT infrastructure has been a challenge, as 

budgetary constraints have limited the agency’s ability to invest beyond maintaining its current systems and implementing small upgrades to its existing infrastructure. Since 2010, the Social Security 

Administration’s basic operating budget has been cut by 10 percent 

after adjusting for inflation. At the same time, the number of beneficiaries has continued to steadily increase, rising by 7 million people since 2010. These cuts have squeezed all aspects of the agency’s 

operations, including its capacity to keep its IT up to date. 

I am glad that SSA is making a thoughtful assessment of its current IT infrastructure and determining what it will need to bring 

5 

it up to date, but none of this can happen without resources. Without an additional investment from Congress dedicated to building 

a modern, agile, and cost-efficient infrastructure, SSA’s systems 

will become even more slow, expensive to maintain, and at risk of 

catastrophic failure. 

I am glad one of our witnesses, Rick Warsinskey, is here today 

to tell us real-world effects of the agency’s aging IT systems. Rick 

represents the managers of more than 1,200 Social Security field 

offices and teleservice centers. His workers report that they lose 

about 20 minutes a day to computer problems. It can take 10 minutes to restart a computer and get back online, sometimes while 

the beneficiary is standing there waiting. 

But despite these clear problems, just yesterday, the House Appropriations Committee approved a bill that cuts the agency’s fiscal 

year 2017 operating budget below what it received this year in 

2016. It cuts it by over $263 million, which means that it is a cut 

of about $1.2 billion for the agency that it needs—more that it 

needs to be able to do its work on time. 

Mr. Chairman, we all have work to do. SSA has important work 

to do. Congress has work to do to help them out as well. I hope 

that we recognize it as a chance for us to help the Social Security 

Administration do what it must for the tens of millions of people 

who rely on the agency and not only rely on it, but pay, pay taxes 

into Social Security, to make sure that they get the service and the 

work out of the agency that is necessary for these folks, these tens 

of millions of Americans who work very hard for this country, to 

get the benefits that they earned. 

And so it is time for us to work together with the Social Security 

Administration to make sure that they have the resources and the 

talent to provide all Americans who paid into the system the services that they deserve, the type of treatment they expect. And so 

when they call on that 1–800 number or if they go visit an office, 

they will be treated with respect, they will be treated with dignity, 

because they will know that their government, our country is working for them. 

And so I am very glad that our witnesses are here with us today, 

I look forward to their testimony, and look forward, Mr. Chairman, 

to working with you and all our colleagues here in this Committee 

to make sure that we can get this done on behalf of the American 

people. 

With that, I will yield back the balance of my time. 

Chairman JOHNSON. Thank you, Mr. Becerra. 

You know, I have never been in a Social Security office that they 

haven’t been friendly, kind, courteous and very efficient. 

As is customary, any Member is welcome to submit a statement 

to the hearing record. 

Before we move on to our testimony today, I want to remind our 

witnesses to please limit your oral statements to 5 minutes. 

However, without objection, all of the written testimony will be 

made part of the hearing record. 

We have five witnesses today. Seated at the table are Robert 

Klopp, Deputy Commissioner of Systems, Chief Information Officer, 

Social Security Administration; Richard Warsinskey, President, 

National Council of Social Security Management Associations; KimVerDate Sep 11 2014 07:20 Apr 04, 2017 Jkt 022296 PO 00000 Frm 00009 Fmt 6633 Sfmt 6602 I:\WAYS\WAYSPS\22296\22296.XXX 22296
6 

berly Byrd, Deputy Assistant Inspector General for Audit, Financial 

Systems and Operations Audits, Office of the Inspector General, 

Social Security Administration; Valerie Melvin, Director, Information Management and Technology Resources Issues, Government Accountability Office; and William Hayes, Principal Engineer, 

Software Engineering Institute, Carnegie Mellon University. 

So, welcome, to all of you, thank you for being here. 

And, Mr. Klopp, please proceed. 

STATEMENT OF ROBERT KLOPP, DEPUTY COMMISSIONER OF 

SYSTEMS, CHIEF INFORMATION OFFICER, SOCIAL SECURITY 

ADMINISTRATION 

Mr. KLOPP. Thank you, Chairman Johnson, Ranking Member 

Becerra, and Members of the Subcommittee. 

As I was introduced, I am Rob Klopp. I am the CIO and Deputy 

Commissioner of Systems at the Social Security Administration. 

I want to provide testimony to you directly from the plan that 

we put together and presented to you guys. It is a plan that I 

would like to put into the record right now, because I think it is 

really what we are going to try to do going forward. So if you could 

get the plans out that we provided to you and open to page 5, I 

am going to skip very quickly through what I think are the key 

parts of this plan. Page 5 basically describes the outcomes that we 

believe will be the result of IT modernization at Social Security. 

You know, it is important to think about IT modernization as 

really about technical outcomes. It is about modernizing technology 

and stuff like that. There are some really important outcomes from 

a modernization effort. We think that we can move to cloud computing and substantially reduce the cost to compute, the cost for 

storage and the ongoing cost of operating the agency. 

We think that there are some technical techniques that we can 

use, called service-oriented architectures, that will allow us to build 

software in a way that makes it easier to extend new policies and 

ideas. For example, some of the changes that came out of the balanced budget amendment, which Congress passed, we think we can 

more easily and more cost-effectively implement them. 

We think that we can build shared services so that what we do 

can be shared with other agencies of the government and also that 

we can share what some of those other agencies are doing if we 

have modern technology at the core. 

Finally, if we build analytics into the things that we build at a 

fundamental level, we will be able to be more data-driven in our 

decisionmaking. We will also be much more responsive to the datadriven requests that come from you. There are critical technology 

outcomes that come from IT modernization. Probably most important to you is going to be cost reduction. But, if we go about modernizing IT infrastructure, it is really important that we not miss 

the opportunity to also modernize the business processes: The fundamental way that we engage with the citizens. 

Modernizing business processes probably adds a little bit of cost 

and expense to just modernizing the foundational IT, but I think 

we have to do that going forward. So, on page 5, you will also see 

that we believe if we modernize IT and we take advantage of this 

effort to actually change the way we do business that we have the 

7 

ability to potentially reduce overpayments, that we have the ability 

to improve the automatic programmatic quality assurance systems 

we have in place that improve the quality of the services we deliver, that, as was already noted, we can improve the productivity 

of the employees to the benefit of the citizens, you know, by reducing wait times and stuff like that. We believe that, very importantly, we can do more self-service applications so that citizens can 

engage with us more directly and not have to come to field offices 

in the first place. 

We have giant processing centers in Social Security and, to a 

large extent, the processing centers are in place today to handle all 

of the things that our legacy software doesn’t handle. So every edge 

case, every outlier that pops up in the system, ends up going to 

these processing centers and is handled manually. We believe that 

with IT modernization, we can eliminate some of that manual processing completely. 

And, finally, we think we can apply technology in order to actually help us with some of the decisions that we have to make, and 

that will allow us to be more effective at things like adjudications. 

So, importantly, there are outcomes that come out of IT modernization, some of which are technical, but, to a large extent, the 

more important ones have to do with business outcomes. And it is 

important that we don’t miss the business outcomes because we 

title this IT modernization, which might otherwise imply just technology. 

If you skip to the next page on the scope of what we want to 

achieve, you can see that we are going to go after the heart of the 

systems that are in the Social Security Administration. 

The scope includes a complete rewrite of title II systems; of title 

XVI systems; of our notices application, which is how we currently 

communicate with the citizens of the country; enumerations is our 

application that we actually use to create Social Security cards; 

and earnings, which is how we keep track of the money that people 

have contributed to help determine how much their benefits might 

be. We think that we can modernize these five applications as the 

scope of modernization and fundamentally change the way we engage with citizens. Importantly, we also want to modernize and reduce some of the costs of our back office. So, in our plan is an attempt to actually take our email infrastructure and move it out of 

our in-house data centers into the cloud for further cost reductions. 

Page 7, I think, is what is most important and probably the newest part of this plan, and that is that we built a roadmap that basically addresses how we think we are going to go about modernizing 

these five applications. You know, it would probably take more 

than I can get through in 5 minutes to talk about this stuff, but 

I want you to know that the work we put into coming up with 

these estimates, you know, when we walked out of the room, people 

looked at me and said, this is probably the best that we have ever 

done as an agency in trying to estimate in advance what the GAO 

would call a rough order of magnitude, which is all that is expected 

at this stage. So we think that these estimates are extremely accurate, and we feel really, really confident that we can actually do 

what is on this chart. 

Slide 8 basically talks about our approach, which is about—— 

8 

Chairman JOHNSON. Can you tie it down? Your time has expired already. 

Mr. KLOPP. Okay. 

Chairman JOHNSON. Go ahead. 

Mr. KLOPP. Oh, I’m sorry. So I just want to say we are going 

to approach this with Agile methods, and I think you know something about that. Agile methods are really the key to being able to 

do this in a completely different way than how we addressed DCPS 

before, and that is why we think we will have different results. 

And then, finally, I just want to say that Agile creates some interesting challenges in the way you implement oversight, and we 

believe that in this plan we have provided mechanisms to allow 

that oversight to happen, even though the plan will be agile. The 

mechanisms will help you guys keep on top of us to make sure this 

is not another DCPS experience. I will just wrap up by saying: We 

think we are going to approach this fundamentally differently than 

the DCPS experience. We think we are proving through some other 

things that we are doing that we can effect these approaches and 

that, you know, we deserve your confidence because of these things 

we have done in the last year to prove this, that we can actually 

move forward and make this happen. 

[The submission of Mr. Klopp follows:] 

9 


22296A.001

22296A.002

CONTENTS 

5/19/2016 

Abstract 

Executive Summary 

Outcomes 

Scope 

Roadmap and Costs 

Approach 

Oversight and Management 

Guiding Principles 

Staffing 

Conclusion 

Appendices 

22296A.003

Abstract 

This proposal describes the scope and approach required to modernize the Social Security 

Administration's IT infrastructure into a set of digital services. This proposed plan provides 

justification and establishes oversight for the $300M requested in the President's FY17 budget. 

In the pages that follow we define the problem, establish technical and business outcomes, and 

establish a series of scoped products. We suggest a user-centric agile approach and outline 

techniques to oversee this approach. We provide a set of guiding principles to help us attain the 

outcomes. We describe a roadmap with the modernization of our Title II, Title XVI, Enumeration, 

Notices, and Earnings applications. We describe ongoing efforts to modernize our data 

infrastructure and efforts to deploy these applications and databases in the cloud. We suggest 

steps to modernize our IT staff along with the technology and modernize our business processes 

at the same time. We provide a preliminary cost model that lays out spending. 

5/19/2016 

22296A.004

Executive Summary 

The Agency views IT Modernization as a critical priority. There are three reasons for th is: 

The IT staff who developed these legacy systems are retiring and we must retire the systems 

with the staff by retooling to ensure that we can continue to provide service to our customers

We cannot significantly reduce either IT costs or staff costs without modernization. In today's 

fiscal environment we need an investment to provide a return; and 

We need to retool and use technology to better serve the public. This is the real reason for th

request. The modern tech expected by the public cannot be embedded into 25 year old legac

systems. We can engage the customer better, even delight them, if we retool. 

For the $300M requested, we will modernize five crit ical applications and the data infrastructure 

under them. We 

will extend our data centers into the public cloud, develop an on premise cloud 

capability, and then tie them together into a hybrid cloud. 

Importantly, we 

will develop these new digital services with a customer focus based on the 

principles of user-centric design. 

5/19/2016 

22296A.005

Outcomes 

IT Modernization is often a technology-focused endeavor where legacy IT systems are 

refactored into modern infrastructure with little or no modification to the business process 

or to application functionality. The Agency's business processes are out of date, thus we 

believe simultaneous modernization will yield positive business and technical outcomes. 

Technical Outcomes 

- Cloud computing reduces costs to operate 

modern systems 

- Service oriented architecture reduces costs 

to maintain and extend application logic 

- Shared services and/or modern 

programming la nguages reduces the 

amount of code to be developed and 

maintained 

- Built-in support for analytic data extends 

ability to support data-based decisions 

5/19/2016 

Business Outcomes 

- Reduced overpayments due to 

improvements in automated Quality 

Assurance processing 

- Improved employee productivity due to a 

modern, user-centric, user interface 

- Self-service applications reduce workloads 

and make staff more efficient 

- Automated support for outlier cases 

reduces Processing Center workloads 

- Automated assist for determinations 

reduces adjudication wait times 

22296A.006

Scope 

Five applications will be modernized in the scope of this program: 

•Title II 

•Title XVI •Notices •Enumerations •Earnings 

For each, the data and systems infrastructure will be modernized along with the application (see 

Approach). 

In addition, the funds will be spent to modernize our email infrastructure by moving it into the 

cloud. 

Each of these applications consists of a series of inter-connected business processes. Appendix A 

lists each of these business processes as a fine-grained description of scope. 

5/19/2016 

22296A.007

Roadmap and Costs 

The picture below represents our preliminary estimates of costs for the five modern business 

applications and for the underlying infrastructure to support them. Included is the cost for each 

annual increment for each product, as well as the number of federal FTEs and contractor FTEs estimated. We will continue to refine the cost model and replace these numbers as we begin the 

Modernization Program. 

ll>/ll>ll4 

ntfell 

Notices 

Data 

Title XVI 

Enumerations 

Earnings 

Infrastructure 

5/19/2016 

'IJ/1/»>J 

Total FY19 • 

22296A.008

Approach: Agile 

We intend to develop using Agile methods and a product frame-of mind. 

Taking a product approach means that we will not suggest there is an end to the program. It is 

not a project. We will continuously improve the product as long as the improvements to be 

developed justify the expense of the development team. 

User-centric 

Agile suggests that we will develop iteratively driven by the users of systems with the aim of 

delivering significant new functionality in releases 2-4 times a year. As each release comes to a 

close the users- our employees and our customers- will help us choose the next most import 

functionality. This agility to iteratively choose what is important as you go allows us to adapt to 

changing priorities ... but it intrinsically makes the end game a moving target. In the section Cost 

Control we will suggest an approach to manage this dynamic methodology. 

5/19/2016 

22296A.009

Approach: Agile and the First Release 

The best practice around agile development suggests that the first step is to build a skeleton for a 

business process end-to-end and then to start adding functionality, meat, to those bones. 

This means that the first step is to identify the core concepts, the skeleton, for each modernized 

process. 

For example, many of our processes are built around the concept of a case. Filing for disability 

begins with establishing a case to be worked. For these processes we might build or buy software 

infrastructure to manage cases and then start building functionality to open a case, process a 

case, make a determination, and close a case ... from front-to-back. 

Our experience with modern development tools and processes suggests that we can build out a 

minimally viable product (MVP) end-to-end in 12-24 months. Once an MVP is in place 

functionality can be extended using agile methods. 

5/19/2016 

22296A.010

Oversight & Management 

The nature of an Agile development process requires a new approach to track progress and 

ensure fisca l responsibility. 

Executive Management at the SSA 

The Deputy Commissioner for Systems will manage this modernization effort through a special 

program office whose lead has the authority to manage across the Agency. 

Outside Oversight 

Congress, the OIG, GSA, and OMB require mechanisms to monitor agile product development. 

These mechanisms include: 

•Run Rate and Backlog Va lue Proposition 

•Measuring Velocity 

•Iterative Review of Deliverables, and 

•Measuring Story Points 

In the past we have provided outside oversight quarterly updates and we propose to deliver 

measurements from one or more of these mechanisms during these updates. 

5/19/2016 1

22296A.011

Guiding Principles: Customer Connect 

c CHI:US" ASSOCtAT£0 CMANH£LS o e CHAHNE:LS = e CHRIS' 

UFE EVENT ACTMTI£$ IN OUT (XP(RI[H(E 

I I I I I I I For every life II What II What are the II WJ:>at are oor II What are the II What is Chris' I 

event... assooated channels ontemal channels 

decisions? to experience like? 

Nine months ago the Agency started considering a 

dramatic proposition: what would our customers 

consider first rate government services in five years. 

We asked our agency colleagues to consider: 

•Custo

mer engagement envisioned with none of the 

current IT systems constraints ... we will rewrite the 

systems as part of IT Modernization; 

•Customer engagement from our custo

mer's 

perspect ive ... not from the Agency's perspective; and 

•Customer engagement in a world five years out where 

what we see as cutting edge today is by then passe. 

The result was remarkable ... 

5/19/2016 

Staff imagined a World where we would dispatch 

driverless cars to pick up customers with disabilities and 

transport them to and from required continuing disability 

exams ... 

They imagined a World where artificial intelligence would 

assist staff in sorting through medical evidence to make 

faster and more accurate determinations ... 

They imagined a World where customers would opt in to 

allow the Agency to fill out complex applications using 

data from other Government and non-government 

sources ... 

This New Think is critically important to our 

modernization efforts ... it informs us as we modernize and 

drives us in directions that we might otherwise over look. 

The Agency is ready for this ... 

1

22296A.012

Guiding Principles: Technology & Architecture 

What is a Modern IT Infrastructure? 

It is important to note what we mean by IT Modernization and establish a target for the resulting 

technology. It is not particularly useful to take a large monolithic chunk of legacy COBOL code an

produce a monolithic chunk of JAVA code. 

We believe that the target architecture needs to execute on a distributed cluster of commodity 

servers and be designed in a scalable manner. In other words, a modern application needs to run 

smartly in a cloud computing environment. 

A modern application should use a service-oriented architecture and should favor deployment in 

containers. 

A modern application needs to be developed in a modern open programming language currently 

taught in the majority of college and university systems in the USA. 

A modern application needs to service online transactions in real time and service analytic 

transactions in a reasonable timeframe. 

Buy vs. Build 

When there is value in buying software instead of building it, this should be the preferred course

But purchased software should follow the same tenets: it should scale, run on commodity 

hardware, and be written in or at least be customized using common open programming 

languages. It should be extensible from the outside such that all functionality is available to 

custom programs as callable services. 5/19/2016 1

22296A.013

Staffing 

In order to 

modernize our IT Infrastructure we need to modernize our IT staff to wield the 

associated modern tools, languages, and software stack. 

The best practice for training IT professional uses a full immersion coding bootcamp technique. 

The SSA will put new hires through a 90-day bootcamp and put current staff through a focused a 

30-day camp designed for those with IT experience. 

We are working to reduce our spend on outside contractors in order to ramp up our staff in 

preparation for the retirements we anticipate in the next few years. 

Thirty-seven percent of out I

staff are eligible for retirement in the next five years. 

This proactive approach further positions us to execute on the IT Modernization program we 

require. 

It is worth noting here that agile methods require a much higher, sustained, level of engagement 

from Agency business organizations. This IT modernization effort will have the effect of 

fundamentally changing the relationship between Systems and our business partners. 

5/19/2016 1

22296A.014

Conclusion 

This paper paints several pictures. We describe what a 

modern IT infrastructure looks like. We 

propose a 

modern agile approach to the develop

ment of a modern infrastructure. We suggest a 

road map 

with details to assure you that we know what we are doing. We describe how we will 

build on a sound modern extensible architecture to enable us to build something t hat will last 

awhile. We suggest a plan for building up the staff requ ired to execute on all of the above. 

Most importantly we suggest a set of ambitious but imminently achievable business objectives 

that describe a future state 3-5 years out where the SSA could deliver a customer experience tha

is on par with the experience delivered t oday by the best commercial enterprises. This objective is ambitious but feasible. 

It is this delightful customer experience that we are asking you to fund. IT modernization is just a 

platform that enables the delivery of this delightful experience. 

The SSA is proving that they can do this now by building out cloud infrastructure, developing a 

modern cloud-based application, and developing a modern data architecture. But this is just to 

assure you that we can execute. 

We ask for fu nding to modernize our IT and, at the same time, we 

will modernize our Agency's 

business processes to better serve our customers. 

5/19/2016 1

22296A.015

Business Processes in Scope for Title II Modernization 

APPENDIX A 

The following business process maps outline the key steps and main stakeholders involved in 

each process. Chris is the name of the representational customer of SSA in th is document. 

Each of the processes typically starts with an event in Chris' life and ends with a 

co

mmunication from SSA to Chris. 

5/19/2016 1

22296A.016

Non-Disability Post-Entitlements 

Co

mmoolnitiation Process 

.., ...... a ,., ......... """ I I 

CMtb'tllfWt\4 .......... 

5/19/2016 

Clllla-,....cn.e 

0.0 __ ...... 

a..-..... 0111 •• Ollila... ....... .-.. 

Oliii'-1JIIIfftlt. 

a.c.a•ntM 

01111111111 ........... 

""'"--""' 

CMttt-.r.M•lk*sntMrttJOOirt...,.. 

M ...,....M:t..,S$1...._, 

OwiflttaMI Wit Sift fl MoHr 

Common Decision 8 Notice Process 

I' 

EJIO 

,.. ..... .._ 

( 

I 

... 

..

L

1

22296A.017

Non-Disability Post-Entitlements: Chris Changes Address (Title II) 

i... --- ...... 

PCOWt.!>,.,.,_,. 

-

Non-Disability Post-Entitlements: Chris Changes Address (Title XVI) 

..... 

• 

5/19/2016 

....... 

.,..ll!dtiOutdoolcll.ab 

P<OIIM 

PaiMW:,..,.,._ 

S..'*-'tprodl 

.......... 

1

22296A.018

Non-Disability Post-Entitlements: Chris Has a New Child (Title II) 

., t __ .,,., -"'""" f\Cif'SC ' ...... ... _ 1 ----

Non-Disability Post-Entitlements: Chris Changes Student Status (Title II) 

lSC..........UC.W 

... ..... ... t,,......_., ........ 

5/19/2016 

$'!olnt!tcb ... 

I..,._.,....,.CMt I u ! ;';;.ift • .!f. .... 

1

22296A.019

Non-Disability Post-Entitlements: Chris Gets a New Job (Title II) 

-

---i=-i:-] 

____ • 1'1;1--

Non-Disability Post-Entitlements: Chris Changes Student Status (Title II) 

• 

5/19/2016 

: .. .... ...,....., _ ... 

Uf .....wt-SSIMOWt ........ 

:=SSit_... 

--

• G:J I 

-

1

22296A.020

Non-Disability Post-Entitlements: Chris Has a Not Received Payments 

-+'iii 

-· 

__ .,. 

1,__ ... ...,...... 

-

.. .. ... 

... - d 

Non-Disability Post-Entitlements: Chris Changes Student Status (Title II) 

• 

5/19/2016 

• llltMv1twtOiriiMCI _ ... ...,.. 

I::':""-

_ ..... 

.! '"" ) 

,.. HonoOiqclllr 

--

2

22296A.021

Non-Disability Post-Entitlements: Chris Has a New Child (Title II) 

• 

Non-Disability Post-Entitlements: Chris Changes Student Status (Title II) 

5/19/2016 

2

22296A.022

Non-Disability Post-Entitlements: Chris Receives a Large Sum of Money 

• -·L-;:::=-] 

-

Non-Disability Post-Entitlements Chris Earns (Title II Wage Reporting) 

-

-

I K ji-----\.

= 

..... 

5/19/2016 2

22296A.023

Non-Disability Post-Entitlements: Chris Receives 

Overpayment (Title II & 

Title XVI) pt 1 

r.

_ 

... 

_ 

... 1-

1 -«""• I . ... Wfiotr .S$A01 

-

... 

_ 

-

• 

H I• 

- .1 ., I 

... 

_ 

5/19/2016 

... 

fiiiiiiO.C. __ 

• 

.... ..... AIM)'III 

................ "'ooi: 

• 0 ol....._'""' ..... ·- • RltXVI:""'"'*'tO. 

.r:::=t 

_......... .. 

........... I 

2

22296A.024

Non-Disability Post-Entitlements: Chris Receives 

Overpayment (Title II & 

Title XVI) pt 2 

...... _ 

5/19/2016 

•·C!J 

• 

..,.. .......... """""'*--

• S.. ...... 

. -• llMitlt.trrwV 

OMS 

• MSSI3 

·

,.,.... 

--

.. 

·-............ .__. 

1 

---

-- I 

..... 

HOIW:,._..., =..,,........., 

. ....... 

__ 01'11 .. 

.. 

• 

--SI:Dm ....... 

• ltlllll: a.n.tb 

MSSICS 

--

• 

2

22296A.025

Non-Disability Redeterminations 

.. 

S51Nii:Mz..,;Sttfi. 

,. ........... 

Scheduled RedetennlnatlO<lS 

Unschedued Reclellrmlnadons 

5/19/2016 

• T 

• WS...NlCPf"Cti'U .,.,..,..,COlli«,.. . ... 

-

J.,_..:......Jr 

IIIMIIIICIOI'Wfrla. o

• 

..... .,...... -. 

"*tiiW'IIiiiiU: 

-

2
34 

f 


22296A.026

J I 

"C I • 

= l f ~ 

... 1 ~d t ~ I III i 

~ c ~ J;l f I ~ :.:: ~ & ! 

"" ... j ~~Hti i ,.Q fbA • ..... ~ 'l5 0 

... (I') 

-e 

E J !it~ "' iiif' ...... 

Q "' 5 ..... .. !•~ Jr ...... I 

~ U"l = 0 d·:lf u ... z 1.... .) 
35 

[The prepared statement of Mr. Klopp follows:] 


22296A.027

COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON SOCIAL SECURITY 

UNITED STATES HOUSE OF REPRESENTATIVES 

July 14, 2016 

STATEMENT FOR THE RECORD 

ROBERT KLOPP 

DEPUTY COMMISSIONER OF SYSTEMS 

CHIEF INFORMATION OFFICER 

SOCIAL SECURITY ADMINISTRATION 
36 


22296A.028

Chairman Johnson, Ranking Member Becerra, and Members of the Subcommittee, thank you for 

inviting me to discuss infom1ation technology (IT) at the Social Security Administration (SSA). 

ram SSA's Deputy Commissioner for Systems and Chieflnfonnation Officer (CIO). Prior to my 

appointment, I worked for a variety of technology finns based on the West Coast and in the Silicon 

Valley. I learned quickly !hat SSA has a committed and qualified IT workforce that maintains 

several significant infommtion systems to meet its mission. To provide one measure of this, during 

fiscal year (FY) 2015, the agency paid more than $930 billion to more than 67 million beneficiaries 

representing around five percent of the U.S. Gross Domestic Product. At approximately 1.3 

percent of our total outlays, SSA 's administrative expenses continue to be a small fraction of 

overall program spending, demonstrating our cost-conscious approach to managing its 

resources. To support these payments and the substant.ial other work that our agency perfonns, our 

total IT expenditures in FY 2015, including our staff a11d contractors, was about S 1.8 billion or 

about 15 percent of our total expenses. 

At the outset, let me emphasize that investing wisely in technology is one of our top critical 

priorities as we work to deliver smarter, secure, and more efficient service. We have consistently 

used our IT resources to help us efficiently and effectively deliver bcnetit payments and other 

services to millions of Americans each year. Yet we have major challenges before us. We have 

a significantly aged IT infrastructure, which is increasingly difficult and expensive to maintain. 

Wllile I am confident in the abilities of our employees to handle these challenges, I must 

emphasize that we need a multi-year investment to make essential improvements to modernize 

our systems. 

The Role of IT at SSA 

IT plays a critical role in our day-to-day operations and program efficiency. Few govemment 

agencies touch as many people as we do. Social Security pays monthly insurance benefits to 

more than60 million individuals, consisting of 41 million retired workers and 3 million of their 

spouses and children; 9 million workers with disabilities and 2 million dependents; and 6 million 

surviving widows, children, and other dependents of deceased workers. We provide 

Supplemental Security Income (SSI) benefits to over 8 million recipients. 

T11e scope of our work is immense. In FY 20 15, we: 

Handled approximately 37 million calls on our National 800 Number; 

Served more than 40 million visitors in our l ,200 field offices nationwide; 

Completed over 8 million claims for benefits and more than 660,000 hearing 

dispositions; 

Handled over 35 million changes to beneficiary records; 

Issued about 16 nlillion new and replacement Social Security cards; 

Perfonned almost 2 billion automated Social Security number verifications; 

Posted about 266 million wage reports; 

Handled over 18,000 cases in Federal District Courts; 

Completed over 2.2 million SSI non-medical redetenninations; 
37 


22296A.029

Completed 799,000 full medical Continuing Disability Reviews; and 

Completed approximately 3 million overpayment actions. 

We use most of our IT funding for ongoing operational costs such as our National 800 Number 

service and our online services, both of which help us keep pace with the recent increases in 

claims. We are exploring and developing ways we can expand our online customer base. Each 

year, we see greater numbers of people across all demographic segments doing business with us 

online. Since we launched my Social Security in 20 12, over 25 million customers have created 

accounts. In FY 2015, customers continued to increase their use of our online services to 

conduct business with us as they completed over 87 million transactions via our website. In FY 

2015, we received more than half of all Social Security retirement and disability applications 

online, including 75 percent of Medicare applications. 

Customer satisfaction with our online services also continues to shine, as five of the top ten 

ranked Federal websites were SSA online customer service products, according to tbe 2015 

ForeSee e-Govemment Report Card. We will continue to enhance our online services and 

promote them as a safe and convenient service option to increase usage and reduce um1ec.essary 

field office visits. Our goal is to increase the volume of online transactions by 25 million each 

year, which would result in 112 million transactions in FY 2016 and 137 million in FY 2017. 

With increased usage of online services, we can free up more time for customers that need or 

prefer to complete business with us in person. 

We continue to increase the services available on our online my Social Security portal. 

Individuals may access their Social Security Statement at any tinle through their personal online 

my Social Security account. In2015, we added several new services to our my Social Security 

portal including replacement Medicare Card services, and the capability for my Social Security 

users to download data from their Social Security Statement to assist them in fmancial and 

retirement planning. Other online service efforts include a successful limited rollout - up to 

eleven States and the District of Columbia over tbe last year- of a secure Internet Social Security 

Number Replacement Card application for eligible U.S. citizens age 18 and over. We expect to 

expand this service to other States in the near future. 

In this calendar year, we are enhancing our online my Social Security service so that it is more 

compatible with mobile devices to improve service to that fast-growing segment of the user 

community. In addition, we are developing new customer engagement tools including Click-toChat and a Message Center for relaying informational messages to my Social Security users. 

Other services include the development of a Smart Claim application that will allow our 

customers to get a detailed status on their benefit applications within my Social Security. We 

will later expand Smart Claim to include online service options for SSI claimants as well. 

Below, I will detail some of the efforts we are making to improve how we invest in IT and our 

efforts to modernize our IT infrastmcture. 

2 
38 


22296A.030

IT Investment 

Our IT modernization planning and investment efforts align with the recently passed Federal 

Information Technology Acquisition and Refonn Act (FIT ARA), which aims to increase Federal 

CIO authority for IT planning and decision making and enhance management of federal IT 

investments. 

FJTARA and OMB guidance require agency CIOs to provide tbe public (via the IT dashboard) 

on a regular basis information about major IT investments, including rating such investments 

according to risk. We use all of OMB 's suggested factors when considering our ratings as well 

as our knowledge of the health of each inveshnent, evolving or emerging contextual issues, cost 

and schedule perfonnance based on earned value, and operational performance metrics. 

We continue to revisit our process and rating criteria and our source documentation for 

improvement opportunities. We bave begun to expand our dashboard updates to start reporting 

the CIO ratings on a monthly basis rather than quarterly. However, we update our evaluation of 

major IT investments, including levels of risk, as soon as a new evaluation becomes available 

that changes the current assessment of any major IT investment on the dashboard. 

I am pleased to report that, over the last year, we developed a new IT Investment Process (!TIP) 

that will improve the way we manage and invest in IT at SSA. !TIP will focus on up-front 

project planning with outcomes tied to specific agency goals. Improved project planning and 

documentation will allow us to assess project costs, risks, and timelines with greater accuracy. 

In addition, an enterprise-wide executive IT investment board will meet throughout the year to 

make infonned funding decisions on projects that provide the greatest benefit to our agency's 

mission. As a result, we will be better able to deliver the right project on time and within budget, 

and provide the best tools for our employees and superior service to the American public. 

Finally, the new process will include fonnal post-implementation reviews that look at the IT 

implementation process and the ongoing return-on-investment, planned and actual, of the 

resulting business applications. 

IT Modem ization 

I appreciate the Subcommittee's interest in our efforts to modernize our legacy infonnation 

systems. The legacy infrastructure is not sustainable, but these aged systems are the very 

production tools that our employees rely upon each day to provide service to the public. We 

must maintain the legacy systems while, in parallel, developing their replacements. We are 

now at a poi,nt where we must undertake a larger, multiyear effort. 

In the late 1970s and early 1980s, because of the massive scale of our operations, SSA was 

aggressively developing systems and databases to store infonnation about tens of millions of 

citizens. These systems were leading edge systems that pushed the state of the art in the 1980s. 

Today, these legacy systems are out-of-date, and the cost required to bring them to a modem 

state represents a technical debt that accrues interest with each passing year. Their complexity 

makes it costly and challenging to add the functionality needed to meet the continually evolving 

3 
39 


22296A.031

re·quirements placed on us by the Administration, Congress, and the people we serve. The extra 

cost of building on these aging systems represents part of this technical debt. Our university 

systems generally are no longer teaching the mainframe computer application languages, 

development, and operating envirorunent, and the Federal stall's who developed and maintained 

these systems are retiring. As a result, the interest payments on this 30-year-old technical debt 

are compounding, and in the next five years, we could face a crisis keeping our systems ruruting. 

Generally, our approach to modernizing our major IT systems bas been to replace components 

of systems rather than the system as a whole. This approach tends to reduce risk by 

reducing interdependencies in a single development effort and by reducing the scope of the 

modernization effort. For several years, we worked to modernize our IT in small pieces at a 

time, reducing our technical debt, but we have exhausted nearly all of these small efforts. This 

incremental and oppornmistic approach worked well given the ebb and flow of arultlal funding. 

However, we are at a point where this approach is no longer viable; technology is advancing 

faster than we can incrementally modernize. To that end, we are focusing our modemization 

efforts in three primary broad areas: database systems, legacy code, and infrastructure. 

Our first broad area of focus is core database systems. Be.cause of limitations in the technology 

available when our databases were designed, all updates were managed via a sequential, batch 

process that applied updates queued during the day. Modem databases update in real tinte. In 

addition, legacy databases were designed around specific applications rather than organized 

around data subjects. This creation of data silos makes adding broad agency-wide capabilities 

difficult and expensive. In the last year, we have started to re-organize our data into a modem 

architecture and began development of a framework to allow real-time updates. Unfortunately, 

all the legacy code base that we have becomes the issue. 

Therefore, our second broad area of focus is modernizing that legacy code. Our efforts here are 

designed to address the complexity and pre-modem design of our oldest systems. We are 

exploring ways to capture value from the legacy code base, either through a code migration or by 

capturing the "gist" of the business rules. We are exploring different options, including "buy" as 

opposed to "build." We are also aggressively moving to modernize our software engineering 

tools and skills. In order to modernize the skill of our staff, with the aim of reducing the costs of 

modernization, we will develop an intensive training program. We have one very significant 

new project where we are using these skills to develop a brand new system and, so far, the 

impact is very positive. Finally, we are fully embracing agile development methods. This 

approach enables us to roll out more quickly new functionality to users while reducing the risk 

that what we produce will not meet users' needs. 

The third broad area of focus is modemization of our infrastntcture. For more than 30 years, we 

have been predominantly a user of mainframes for our mission-critical systems. For many years, 

only mainframes could handle our workload. In response to Acting Commissioner Colvin's 

direction to push us towards becoming a more data driven enterprise, we are deploying a modem 

business intelligence eco-system in the cloud. We are working to develop a cloud environment 

on our premises and then a hybrid cloud environment to further enable us to take advantage of 

the economics of cloud computing. We have also established a Modem Development 

4 
40 


22296A.032

Environment (MDE) in the Amazon Web Services cloud. MDE is a suite of tools and 

engineering practices for supporting modern software development. 

With our plan to leverage our new data capabilities, development techniques, and infrastructure, 

we are beginning a fundamental review of how we engage our customers and our employees. 

Through a new Customer Connect initiative, we are considering how we can improve the 

customer experience in 2020. TI1is initiative aims to reconsider not just our technology 

infrastructure, but to challenge SSA to reassess the business processes that have grown and 

evolved over the last eighty years. 

A portion of the fiscal year 2016 appropriation helps to begin the design of the legacy 

replacement systems. However, we need a sustained, long-tern1 investment to make the 

changes needed to develop a fully modern IT infrastructure that is capable of supporting the 

inm1ense responsibilities I described earlier in my testimony. TI1at is why the President's Budget 

for FY 2017 requests multiyear funding of S300 million spread over four years, to undertake an 

IT modernization project that will bring our systems cun·ent. In FY 2017, $60 million is 

included as part of the FY 2017 President's Budget. The FY 2017 President's Budget also 

contains a mandatory proposal for additional IT modernization funding- $80 million each year 

in FYs 2018-2020. The project will require effort and investment in several areas including 

modernization in c.omputer language, database, and infrastructure. 

We have demonstrated in the past that we can undertake significant, multiyear IT efforts. For 

example, in FY 2009, Congress provided S500 million for the constnaction and partial equipping 

of a new National Support Center (NSC) as part of the American Recovery and Reinvestment 

Act. We are currently transitioning our nationwide computer operations from the National 

Computer Center (NCC) to the NSC. Our systems maintain demographic, wage, and benefit 

infonnation on almost every American. While once a state-of the-art data center designed for 

mainframe use, the NCC is over 30 years old and the facility infrastmcture systems have 

exceeded their useful life. With these Recovery Act ti.mds, we took timely action to ensure a 

new facility was built and operational as the NCC nears the end of its functional life. 

Need for Adequate and Sustained Funding 

Before concluding, let me emphasize that we need adequate, sustained funding to carry out our 

important program integrity and stewardship, while also ensuring adequate levels of service to 

beneficiaries and claimants. We are working hard to manage the agency with far less money 

than we need - our FY 2016 enacted budget was around $350 million less than the President's 

request. Consequently, we have been forced to constrain every aspect of the budget including 

hiring, overtinle, and infonnation teclmology (IT), and we are seeing service degradation in 

many areas. Service delays are causing hardships for our most vulnerable citizens, who are at an 

increased risk of both homelessncss and disability. SSA is dealing with an unprecedented 

backlogs at the hearings level and in our program service centers, where we process payments. 

That being said, we are greatly concerned about FY 2017, when we will serve a record number 

of beneficiaries. With services already in a fragile state, additional funding constraints in FY 

2017 would put our services at greater risk of long-tenu damage. It is pivotal that we get a 

5 
41 

f 


22296A.033

funding level that allows us to rebound from this year's constraints and to in1prove service to the 

public. The President's Budget request of$13.067 billion will do so. 

Conclusion 

I am glad to highlight the importance of IT in how we administer our programs and the IT 

challenges we face in rhe years ahead. The systems that serve our mission are old, and they are 

primarily supported by the staff who developed them 30+ years ago. As th.is staff retires, the 

knowledge of these old applications and the knowledge of the legacy infrastructure they are built 

upon will diminish. We have to modernize these legacy systems before this knowledge is gone. 

Developing the new capabilities based on new technology to best serve the public is an 

expensive proposition if we have to build it upon this aging foundation. We have to modernize 

these legacy systems to provide these new services at a reasonable cost. We need funds to 

enable the modernization in the same way the nation needs funds to modernize other aging 

infrastructure, such as roads, dams, and tbe grid. 

We look forward to working with Congress to overcome these challenges. Thank you and I 

would be glad to take any questions. 

6 
42 

Chairman JOHNSON. Thank you for your testimony. 

Ms. Byrd. 

Okay. 

Mr. Warsinskey, would you like to testify, please? You are recognized. 

STATEMENT OF RICHARD E. WARSINSKEY, PRESIDENT, 

NATIONAL COUNCIL OF SOCIAL SECURITY MANAGEMENT 

ASSOCIATIONS 

Mr. WARSINSKEY. Chairman Johnson, Ranking Member Becerra and Members of the Subcommittee, my name is Rick Warsinskey, President of the National Council of Social Security Management Associations. Our organization represents field office and 

teleservice center management nationwide. I appreciate the opportunity to testify today. 

My testimony will focus on why modernizing SSA’s IT infrastructure is essential from the perspective of over 60,000 employees and, 

even more importantly, to the customers we serve. Ask any SSA 

employee what their number one concern is, and most will tell you 

it is the frustration they face getting their job done due to our slow 

system. Daily, we wait as our computers crawl from one system’s 

window to another. Around noon Eastern time, our system reaches 

peak usage, as almost all offices are open to serve the public. Users 

watch the spinning wheel as programs and screens attempt to load. 

Valuable time is lost which should be used to assist customers or 

address backlogs. Based on our recent survey, we believe this costs 

the agency upwards of $200 million per year in lost productivity. 

We can demonstrate the degradation of SSA’s systems by analyzing data speed tests. We surveyed our offices and found that 

these tests measured a median download speed of 2.87 Megabits 

per second and an upload speed of .25 Megabits per second. This 

speed is slower than what we measured last year. In comparison, 

Internet providers typically provide over 20 times this speed in 

your home. This degradation in data speed supports overwhelming 

feedback that our system is slowing down. Our customer service 

and productivity are not only dependent on reliable systems access 

but also on efficient programs. SSA programs are becoming more 

complex, and experiencing more malfunctions. Our computers regularly become nonresponsive, applications inaccessible, requiring a 

system reboot. It can take up to 10 minutes to restart a computer 

to get back online. 

We strongly support resources for modernizing SSA’s code and 

rewriting its programs. SSA’s systems require new architecture. 

We understand modernizing SSA’s computer systems will require 

resources and time. However, failure to address these critical concerns will delay the inevitable and costs will only increase. In the 

meantime, severe disruptions of service will intensify as the system 

further degrades. Our agency touches every American. We maintain billions of records, paying about $1 trillion a year. Payments 

must be made accurately to ensure tax dollars are not wasted. 

The current inefficient, outdated system cannot keep pace with 

the services SSA must deliver each day, costing us millions of dollars. We acknowledge there are budget challenges to addressing 

SSA’s IT infrastructure needs, especially considering SSA’s increasVerDate Sep 11 2014 07:20 Apr 04, 2017 Jkt 022296 PO 00000 Frm 00046 Fmt 6633 Sfmt 6602 I:\WAYS\WAYSPS\22296\22296.XXX 22296
43 

ing workloads, which include a record high hearings backlog of over 

1.1 million cases waiting for a decision. These cases represent vulnerable citizens facing the possibility of homelessness and severe 

health deterioration, often without the means to pay for care. SSA’s 

program service centers have a near record high pending backlog 

of over 2.8 million cases, with an average age of 4 months. These 

centers are responsible for workloads that usually require manual 

processing due to limitations in SSA’s software. 

The American public deserves an SSA with adequate resources 

to support the agency and its systems. We recognize budget dollars 

are limited. However, we strongly believe dedicated and sustained 

resources for the modernization of SSA’s IT infrastructure are necessary to ensure the agency can run efficiently, saving tax dollars. 

The longer we delay addressing these issues, the more severe disruptions will occur, risking major systems outages. 

Thank you again for this opportunity to testify. I would welcome 

any questions you have. 

[The prepared statement of Mr. Warsinskey follows:] 

44 


22296A.034

United States House of Representatives 

Committee on Ways and Means 

Subcommittee on Social Security 

Statement for the Reco•·d 

Modernizing Social Security's Information Technology Jnfrash·uctu•·e 

Rick Wauinskey 

P1·esident 

National Council of Social SecUI'ity 

Management Associations Inc. 

July 14,2016 

Chainnan Johnson, Ranking Member Becen·a and Members of the Subcommittee, my name is 

Rick Warsinskey. I am the President of the National Council of Social Security Management 

Associations (NCSSMA). I am also the District Manager of the Social Security otlice in 

Downtown Cleveland, Ohio. I have been in this office for twenty-one years, and I have worked 

lor the Social Security Administration for over forty years. 

NCSSMA is a membership organization of approximately 3,200 Soc.ial Security Administration 

(SSA) managers and supervisors who provide leadership in more than I ,230 field offices and 

tcleservice centers throughout the country. We are the frontline service providers for SSA in 

communities th.rougbout the nation. We are also the federal employees with whom many of your 

staff members work with to resolve issues for your constituents who receive Social Security 

retirement, survivors or disability benefits, or Supplemental Security Income. Since our 

organization's founding, over forty-six years ago, NCSSMA has been a strong advocate of 

prompt and efficient locally delivered services nationwide to meet the various needs of 

beneficiaries, claimants, and the general public. One ofNCSSMA's top priorities is a strong and 

stable Social Security Administration; one that delivers quality and prompt community based 

service to the people we serve, your constituents. We a lso believe we need to be good stewards 

of the taxpayers' moneys. 

Our association also helps coordinate the activities of the SSA Advocacy Group. This group of 

over 30 organizations works to intprove SSA 's services at all levels. Members include senior 

citizen organizations and disability suppo1t groups from across the country, SSA and Disability 

Detennination Services associations, federal management associations and employee unions. 

We are very appreciative of the support the Committee on Ways and Means has provided SSA 

for so many years. Your leadership in recognizing the challenges and critical needs confronting 

SSA has resulted in vital support to our agency and allowed us to adequately serve the American 

public. 

Our testimony will focus on the current challenges we are experiencing with our computer 

systems in SSA offices throughout the counlTy. 

If you visited any Social Security office in our nation today, whether it be a field office, 
45 


22296A.035

teleservice center, program service center, hearing otTice or even headquarters, you would hear 

one common and overriding complaint - our computer systems are slow and problematic. 

Last summer, when NCSSMA surveyed our members, we found, that on average, we were losing 

about l 5 minutes per employee per day because of computer issues and slowness. In a more 

recent survey we completed this past May, the estimated lost time increased to 20 minutes per 

employee per day. We believe this costs the agency upwards of$200 million per year in lost 

employee productivity. 

Every day, SSA employees wait and watch as their computers crawl from one system's window 

to another. Users watch the spinning wheel move as programs and screens attempt to load, 

losing va luable time that could be used to assist other customers or address workload backlogs. 

Around noon Eastern Time every day our system reaches peak capacity and the slowness 

becomes most apparent, as almost all the offices in the country are open to the public and taking 

claims, talking to the public on the telephone, or handling some aspect of a claimant's record. 

We can demonstrate the degradation ofSSA computer speed in real numbers. We surveyed our 

offices and found that data speed tests showed these median Megabits per Second (Mbps) 

speeds: 

Download: 2.87 Mbps 

Upload: .25 Mbps 

A year ago when we surveyed the same measurements, the median speeds were: 

Download: 3.45 Mbps 

Upload: 2.0 Mbps 

This degradation in data speeds supports the nearly universal feedback we are receiving that our 

system is slowing down significantly. It is important to note the data speeds you can typically 

expect to receive from cable internet service providers are now over 50 Mbps for download and 

I 0 Mbps for upload speed. 

One key solution to addressing our slow system is increasing the bandwidth at SSA. This would 

apply to every point through which our traffic runs: from the field office computer; through their 

servers; to the lines running out of the office; to the regiona l servers and to our data centers at 

SSA's headquarters. 

As frustrating as the problems with our slow system are, our employees are also experiencing 

many other issues with our system every single day. Our computers often freeze or applications 

become iJJaccessible and re.quire a reboot. It can take I 0 minutes to restart a computer and get 

back online. We are often unable to run live video training or engage in video communications 

with the public due to lack of bandwidth. 

Once we open more than five programs on our computers, they often freeze, requiring us to 

reboot the system. Internet access and our e-mail communications are also excruciatingly slow. 

2 
46 


22296A.036

Our online time and attendance system (WebTA), which is the system used to pay employees, 

periodically freezes and is often down on the day we certify payroll for employees. Additional 

time is spent on the telephone waiting to talk to our internal help desk to resolve computer issues 

that we are experiencing. The need to call the help desk will only increase as SSA expands 

telework and calls to resolve access issues increase. 

The following is sample feedback from our survey: 

It is ve1y time consuming and fmstmting to run into issues where rhe remedy is to reboot your 

system - this does takes many minllfes out of the day's operations, when not planned, and wastes 

time f01· clients and staff. 

The main system issue that we experience is with the laptops ji-eezing up. They ji·equently ji·eeze 

or will not open web-based programs, and 1he only way to fix it is to reboot the compurer. This 

ji-equently happens at/east once a day, but can often be up to 3-4 times a day. Each time, it 

costs valuable time rhatthey could be using to process work just to wait for the reboot and log 

on process again. ! would estimate that we waste up ro 15 minllles a day per employee due to 

this issue. 

Before taking this survey, I had to restart my computer due ro system slowness and connectivity 

issues. This is something that happens to me regularly during the week. 

Our system has consistently gotten worse. It takes forever to read your card when you unlock 

the computer. Outlook takes much longer 10 open up in the morning than previously. Opening 

programs ji-om the regional Intranet page takes a long time. It takes a long time for the Intranet 

page to open. 

Muliiple employees each day must restart/heir workstations. Eve1yone is ji-ustrated. 

We have regular Outlook e-mail slowness and freezing throughout the day. Intranet and Internet 

sites freeze up on a regular basis. Several users have to resrart their laptops multiple times a 

day so the Interner, Intranet, Personal Communication System (PC OM), and other systems will 

work properly. These restarts can take I 0-15 minutes and lots of productivity is lost during 

these times, especially when in the middle of an interview. 

We have constant sysrems issues. Our compwers nm extremely slow all of the time. We have 

consistent connectivity issues, issues with applicarions, and laptop failures. Our systems 

continue to be a bloody mess that prevents us from operating at ourftiii potential. 

The sysrem is ve1y slow mosr days and seems to be getring slower each week. 

The sysrem is incredibly slow and often leads to necess01y resrarts ... which take lots of time. 

The slowness is a daily even!-- especially on the East Coast at abour noontime when the rest of 

the counfly is coming on. 
47 


22296A.037

Internet Explorer constantly locks up for eve1yone in the office eve1y day. That is equivalem to 

abow 4 hours of lost productivity eve1y day for my office because they have to restart their 

computers. We also have issues with Outlook being really slow when sending emails. It's only 

about a 30-second delay most of the time when this happens, but over a week or month if starts 

to add up. We generally receive several reports from employees each week that Online Retrieval 

System Notices (ORS) or Claims File Record Management System (CFRMS) is going really slow. 

Sometimes it takes more than 1-2 minutes just to open a document. The transition from COBOL 

Modernized Supplemental Security Income Claims System (A1SSICS) screens to web-based 

MSSICS screens is another area that needs improvement. This process gets bogged down 

sometimes. Nearly eve1y pay period we have slowness and access issues with WebTA. We also 

have monthly problems with Treaswy Check Information System (TCIS) at the beginning of the 

month. It just seems like so many of our problems could be resolved by increasing our download 

and upload speeds. 

Some days it feels like I sit and wait while the computer decides to complete a task I need done. 

Daily there are employees who contact me about Internet Explorer (IE) • either they can 'I get in 

to the Electronic Disability Collection System (EDCS) or some site because if is a while screen 

with a circling ball or IE crashes. I can only recommend that they restart. This wastes so much 

lime and is not foolproof This will allow users 10 gel in to the website I hey need. But after a few 

hours, they have the same trouble. Other web programs we use reacl the same way. 11 just spins 

with "non-responding" in the menu bar. Most of us do nol have enough time in the day to wail 

for the system to decide to work. 

Ou1look has been lerrible for several months. I1 takes a ve1y long lime to open up and even 

longer to open my calendar. I have compressed my Outlook, archived old items and it does not 

seem to help. WebTA is typically slow on days that require verification or certiflcalion. 

Our efficiencies and productivity are not only dependent on reliable systems access, but also on 

efficient programs. SSA programs are becoming more complex and we are experiencing more 

bugs in them. Upgrades to our system have been problematic and sometimes cause additional 

issues, which adversely affect public service. For example, our Representative Payee System 

(eRPS) was recently upgraded. Since this upgrade, we have experienced numerous issues and 

problems with the new eRPS system. We literally have hundreds of stuck cases, and have had to 

develop many work arounds to process cases and to make changes to the representative payees. 

In many sin1ations, it has been necessary to issue manual payments. There have been numerous 

fixes to address these systems problems and many more are plalllled. This program is extremely 

complex, but there was no pilot testing of the program before it was released. 

The eRPS program interfaces with a number of COBOL-based programs that have extremely 

intricate coding and mles to mn the programs. Our two largest programs, Modemized Claims 

System (MCS) for the Title li program and Modernized Supplemental Security Income Claims 

System (MSSICS) for the Title XVI program, which were first written over two decades ago, are 

cumbersome and outdated programs that arc very difficult to train staff on. Because of necessary 

changes and fixes to these programs, today they are extremely complex with mixed coded 

screens built on top of screens. There is an age limit to keeping these programs operating 
48 


22296A.038

effectively and there is a very strong need to rewrite the programs using an agile process with 

databases that can be updated in real time. 

The following example helps to illustrate problems with SSA systems. When you want to 

change your address for your Google contacts, it is done instantly across all platfonns, whether 

you access your contacts on a desktop, laptop, iPad or smart phone. However, when SSA wants 

to update an address, it must be input separately into each system, and then mn overnight, 

se·quentially, to affect the actual record. This is not efficient and is an outdated process that 

needs to be remedied. 

Going forward, what can SSA do to resolve systems access issues so users can perfonn their jobs 

efliciently? From our perspective there are four areas that need to be addressed: bandwidth, 

web-based applications, laptop hardware and software. 

First, the most cost effective issue to address is the bandwidth problem. NCSSMA suggests that 

a pilot be conducted to increase the bandwidth I 0 times over our current rates to assess if this 

provides relief. If this is successful, then the bandwidth speed across all of SSA should be 

increased. 

Second, the web-based applications need to be improved- WebTA, Visitor Intake Process 

(VIPr), MSSICS web-based screens, and Electronic Disability Collect System (EDCS). Perhaps 

when they were developed, bandwidth consumption was not appropriately considered. Is there a 

way to make these applications more bandwidth efficient? 

Third, SSA needs more robust laptops and docking stations, or as an alternative, software 

modifications that alleviate slowness and docking/undocking problems. 

Fourth, laptops need to be updated immediately from a 32-bit operating system to a 64-bit 

operating system. 

NCSSMA strongly supports resources for modernizing SSA's code and rewriting its programs. 

SSA needs new systems architecture and cannot continue to keep patching its problematic and 

antiquated systems. 

We understand modemiz.ing SSA's computer systems will be costly and take time. However, 

failure to address this critical concern is delaying the inevitable. The cost to remedy the problem 

will only increase if it is delayed. ln the meantime, severe disruptions of service will intensify as 

the system degrades further and the problems continue to get worse. 

Our agency touches every American and we maintain billions of records and pay out nearly a 

trillion dollars a year. We need to ensure that these payments are made accurately and tax 

dollars are not unnecessarily wasted on an inefficient and problematic system that cannot keep 

up with the essential services our agency provides. 

We are extremely concerned that the funding available for SSA through the annual 

appropriations process will not be sufficient to address the agency's needs. As increased 
49 


22296A.039

demands are placed on the agency's aging systems and IT infrastructure, services will continue 

to degrade with claims processing delays and increased workload backlogs. The funding level 

recently proposed by the House Labor, Health and Human Services, Education, and Related 

Agencies Appropriations Subcommittee may force SSA to consider some extremely difficult 

decisions. Our testimony demonstrates the real need for additional resources to address SSA 's 

systems issues. 

The resources to address these IT infrastntcture needs will be difficult to provide. SSA currently 

has record high bearings backlogs. Over 1.121 million people are waiting for a bearing decision. 

The number of disability hearing cases pending bas now increased 37 out of the past 38 months. 

The average age of a hearing case is 327 days, and of more concern is that the average 

processing time is a record setting 566 days. As a result, our most vulnerable citizens are faced 

with the possibility of homelessness or severe health deterioration without the means to pay for 

health care. 

SSA's program service centers also have a near record backlog of over 2.8 million cases 

pending, with the average age of a case over four months. The program service centers are 

responsible for processing workloads that usually require manual processing due to limitations in 

SSA 's system software, which is yet another reason to address modernization and resources for 

systems. 

Examples of backlogged workloads in the program service centers are: 

• Medicare issues such as Part B reinstatements, premium payments and income related 

monthly adjustment amounts (IRMAA); 

• Workman's compensation and government pension offsets; 

• Windfall offsets; 

• Overpayment collections; 

• Check remittances; 

• Recalculations of monthly payments due based on work (AERO) and other check 

adjustments; 

• Underpayment actions; 

• "Return to Work" reports for disability beneficiaries; 

• Payment of attorney fees; 

• Critical check payments; 

• Garnishments; 

Non-medical reconsiderations; and 

• Resumption of benefits that have been suspended due to payee or address changes. 

These centers were scheduled to hire staff this summer, but a near agency wide hiring freeze was 

imposed at the end of May due to concerns about the Fiscal Year (FY) 2017 budget. We will 

likely see an increase in improper payments, as additional benefit actions are delayed and 

backlogs grow further. The delays will also increase follow-up contacts to field offices and the 

Nationa l 800 Number, which are a lready an issue. 

6 
50 

f 


22296A.040

The level of funding proposed by the House Labor, Health and Human Services, Education, and 

Related Agencies Appropriations Subcommittee could also lead to one to two weeks of 

furloughs for SSA employees and severely restricted overtime. Field offices may see a reduction 

in the number of hours they are open to meet with the public and available io answer incoming 

telephone calls. Wait times and answer rates in field offices could reach record levels. In 

addition, there will likely be severe deterioration in the busy rates for our National 800 Number. 

Finally, the likelihood of the need to close some field offices will resurface as SSA will be 

challenged to cover the costs of these offices. 

SSA needs to have adequate funding to support the agency and its systems. We recognize that 

budget dollars are tight. We strongly believe some kind of dedicated funding for modernization 

ofSSA's infonnation technology infrastructure is necessary to ensure the agency can run 

etliciently and effectively without disruptions of its services. 1l1e chances of such a disruption 

will increase the longer we wait to address these issues. 

On behalf of the members ofNCSSMA, I thank you again for the opportunity to submit this 

written testinlony to the Subcommittee. NCSSMA members are not only dedicated SSA 

employees, but they are also personally committed to the mission of the agency and to providing 

the best service possible to your constituents. We respectfully ask that you consider our 

comments, and would appreciate any assistance you can provide in ensuring the American public 

receives the necessary service that it deserves from the Social Security Administration. 
51 

Chairman JOHNSON. Thank you, sir. 

You know we built two brand new computer centers not too long 

ago. That was supposed to solve all your problems. 

Thank you. Ms. Byrd, you are recognized. 

STATEMENT OF KIMBERLY A. BYRD, DEPUTY ASSISTANT 

INSPECTOR GENERAL FOR AUDIT, FINANCIAL SYSTEMS 

AND OPERATIONS AUDITS, OFFICE OF THE INSPECTOR 

GENERAL, SOCIAL SECURITY ADMINISTRATION 

Ms. BYRD. Good morning, Chairman Johnson, Ranking Member 

Becerra, and Members of the Subcommittee. Thank you for the invitation to testify today. SSA administers programs that result in 

payments of $2.5 billion per day, and holds sensitive data for more 

than 300 million people. Given SSA’s increasing service and data 

storage responsibilities, the agency must modernize its IT infrastructure. It is a significant challenge to upgrade the IT systems 

that an organization as vast as SSA needs to conduct business. 

However, the agency must make IT modernization a top priority. 

The need for long-term IT planning has been a concern at SSA 

for many years. As far back as 1982, SSA announced aggressive 

plans to restructure and upgrade its systems. At the time, the 

agency told Congress that, without major IT improvement, SSA 

could suffer a disruption of services which are critical for millions 

of Americans. 

Despite upgrading several systems, SSA has yet to tackle some 

of its major IT projects, such as replacing its legacy programming 

code and databases. Specifically, SSA continues to rely on decadesold applications to process core workloads, such as retirement and 

disability claims. Many of the agency’s applications run on COBOL, 

a programming code first developed more than 55 years ago. Further, SSA’s workforce, while proficient and experienced, is aging. 

Thus, institutional knowledge of older technologies is diminishing 

due to retirement. Modernization is critical, because SSA’s next 

generation of employees will expect to work with current, mainstream technologies. 

In its Information Resources Management Strategic Plan, SSA 

outlines general multi-year efforts to modernize data so it exists in 

forms that are widely used today; rewrites business applications 

with modern coding so those applications can interact with SSA’s 

online and mobile service; and moves servers to environments like 

the cloud, that could increase efficiency. All of these efforts are 

worthwhile. But going forward, SSA should describe specifically 

how and when it will bring these ideas to fruition. 

Long-term strategic planning is critical to any significant IT 

project. For example, the Disability Case Processing System, or 

DCPS, is one of SSA’s largest active IT investments. SSA began 

planning this project in 2008. During development, DCPS has incurred cost overruns and schedule delays. After development resulted in limited functionality and user concerns, SSA reset the 

project last year and changed its approach. The agency moved 

DCPS to an Agile environment, which is expected to deliver software updates incrementally. Agile practices are relatively new to 

SSA. Implementing them on a project as complex as DCPS could 

introduce additional risks. 

52 

At the end of fiscal year 2015, SSA reported it had spent more than $350 million on DCPS. Going forward, the project requires 

diligent oversight and continued user involvement. Also, any IT 

modernization plan should address SSA system security. In our 

most recent FISMA report, we identified a number of weaknesses 

that may limit SSA’s ability to adequately protect its systems. The 

risk and severity of these weaknesses met OMB’s definition of a 

significant deficiency in internal controls, a conclusion that we 

have reached in prior FISMA reports. SSA needs to address these 

weaknesses to protect its information systems, just as the agency 

works to ensure the integrity of its benefit programs. 

To conclude, SSA needs a detailed IT plan that clearly outlines 

how it will modernize its databases, applications, and infrastructure, so agency employees can work effectively and SSA customers 

can receive timely, accurate services. Of course, we will continue to 

monitor these issues closely and work with SSA and the Subcommittee. 

Thank you again for the invitation to testify, and I am very 

happy to answer any questions. 

[The prepared statement of Ms. Byrd follows:] 

53 


22296A.041

United States House of Rcp•·esentatives 

Committee on Ways and Means 

Subcommittee on Social SecUI·ity 

SOCIA L SECURITY 

ADMINISTRATION 

OIG 

Statement for the Record 

Modernizing Social Secul'ity's 

Inf01·mation Technology Inf•·astmctUJ·e 

Kimberly A. Byrd 

Deputy Assistant Inspector General for Audit 

Office of the Inspector General 

Social Security Administration 
54 


22296A.042

Good morning, Chairman Johnson, Ranking Member Becerra, and Members of the Subcommiuee. 

Thank you for the invitation to testify today, to discuss the modernization of the Social Security 

Administration's (SSA) inforn1ation technology (IT) infrastructure. 

The Office of the Inspector General (OJG) for many years has placed oversight of SSA 's IT 

infrastrucmre among its top priorities. As the Deputy Assistant Inspector General for the OJG's Office 

of Audit. I direct and oversee our fmancial and IT audits of SSA's operations. so I appreciate the 

opportunity to discuss these critical issues with your Subcommiuee. 

Background on SSA's IT Profile 

Last year. SSA provided about $930 biiJion in payments to about 67 million Americans; aln10St a ll of 

these transactions are electronic. and SSA encourages its customers to interact with the Agency through 

various online services. SSA also houses sensitive information for nearly every U.S. citizen-living and 

deceased- including individual medical and financial records. 

Given SSA 's significant and increasing service and data-storage responsibilities, SSA must modernize 

its IT infrastn•cmre to support current and fillure workloads. SSA 's IT environment includes hundreds 

of applications and an array of technologies. To process its core workloads, such as retirement and 

disability claims, the Agency relies on decades-old applications programmed with Common Business 

Oriented Language (COBOL). SSA maintains more than 60 million lines of COBOL today, along with 

millions more lines of other legacy progranm1ing languages. 

Additionally, SSA 's workforce, while extremely proficient and experienced, is aging, thus employee 

knowledge of. and ability to work with, older teclmologies is diminishing due to retirement. SSA's next 

generation of employees will expect to work with current, <~ins ream teclmologies. such as open-source 

databases and cloud computing. 

While it is undoubtedly a significant and ongoing challenge to enhance the databases, applications, and 

infrastrucmre that an organization as vast and complex as SSA needs to conduct business. it is a 

challenge that Agency leadership must meet. The need for long-tern1 IT plam1ing bas been a major 

concern for SSA for many years. As far back as 1982, SSA ann01mced a Systems Modernization Plan to 

restmcture and extensively upgrade its systems. At that time, the Agency told Congress that, without this 

major upgrade, there might be a serious d isruption of its services, which are essential to the welfare of 

millions of Americans. Despite progress in modernizing many of its systems since then. the Agency has 

yet to tackle some of its most complex and critical IT projects. 

The OIG, for many years, has said that any IT modernization effort at SSA should be part of a long-term 

comprehensive strategic plan. SSA needs a detailed IT roadmap that clearly outlines how it will enhance 

its data, applications. and infrastructure so Agency employees can work effectively <~nd SSA customers 

can receive timely, accurate services. While we do not know the content of SSA 's newest modernization 

plan-as SSA is still drafting the p lan- we do believe it is critical that the plan be long-term and fully 

developed. 

My statement will focus on SSA 's IT modernization efforts and re levant OIG audit work ou these 

efforts, and I will discuss the OIG's oversight of the Disability Case Processing System (DCPS). one of 

SSA's largest active IT investments. Also, I will note that SSA 's IT modernization plans and efforts. 

while critical, should not supersede a commitment to infortn ation systems security; infonnation security 

efforts should be included in any long-term IT planning at SSA. 
55 


22296A.043

SSA's IT Modernization Efforts 

SSA 's spending on infonnation technology in FY20 16 totals S 1.5 billion, according to the Office of 

Management and Budget's (OMB) IT Dashboard; about 65 percent of those funds are dedicated to 

operations and maintenance; 32.5 percent are dedicated to development, modernization and 

enhancements; and the balance to provisioned services. 

SSA recently reported to the OJG that the Agency's fonnal IT modernization plan is still in draft status, 

so the OIG has not received or reviewed a finalized plan from SSA, thus I am not in a position to 

commem on any new strategies the Agency may have recently plam1ed. However, according to SSA 's 

In[(mnation Resources Managemem Strategic Plan (FY20 16-20 19), the Agency has identi lied several 

multi-year efforts to update its data architecture and applications and deploy a cloud infrastntcture. We 

have conducted various reviews on SSA 's progress in these areas. 

Data Modemization and Consolidation 

SSA reported that it is executing a two-part strategy to connect its master data with contemporary 

technologies. The Agency said it would move its master data from legacy storage systems to a standard 

database platform, and it would examine the fonn of its master data, recognizing that the data should 

exist in fonns that are widely used in modem IT applications and databases. 

In 2010, we reported on SSA 's eftorts to convert its legacy file management system. At the time, we 

found that SSA had effe.ctively implemented the project to replace its master database, however, the 

project implementation strategy was not efficiem because the strategy resulted in less-than-optimal 

database design. We recommended that SSA establish a long-tenn, comprehensive strategic plan for the 

project and related major IT initiatives, and ensnre it performed an analysis of alternatives for future 

major IT investmentS. 1 

Application Modernization 

SSA said it would use modem programming language in the development for all new and modernized 

applications. The Agency reports it plans to modemize its "line-of-business" application systems, 

including the Earnings and Wage Reporting, Retirement and Disability Benefit Management, 

Representative Payee, and Supplemental Security Income Managemelll systems, with a goal to integrate 

modernized applications with SSA 's online and mobile services. 

Ideally, Social Security technicians could work with applications that provide immediate access to 

transactions that customers have conducted online or via mobile device. SSA said it wants to move away 

from monolithic, single-use applications, which have higher costs and limited flexibility. 

In 2012, we reviewed SSA 's reliance on COBOL to process its core workloads. Onr review, at the time, 

detenuined SSA did not have a strategic plan to convert its legacy COBOL application programs to a 

more modernized prograJllllling language. Rather, the Agency developed and has continued what it calls 

an "opportunistic" approach to, gradually, reduce its reliance on COBOL to process its core program 

transitions. We also reported then that SSA 's continued use of and reliance on COBOL affected its IT 

system environment and limited its potential modernization efforts.2 

1 SSA 010. Com·ersiou o[the Soria/ Securifl• Admifli.Stratiou 's LPgfi(T Fill' Mtmagtmeut Svsrem. May 2010. 

2 SSA OIG. Tlte Social SitctJrio· Atlmlnlstrmiou's Sofrware ModenJI:Oiion and Use of Common Busiuess Orlemetl Limgunge 

May 2012. 

2 
56 


22296A.044

Jnfrastruclllre 

SSA said, after a 2015 pilot-use of a Linux server, SSA would undertake a multi-year project to migrate 

away from. and ultimately retire, its proprietary mid-tier UNIX servers to more flexible Linux servers. 

SSA is also exploring how cloud computing can help the Agency conduct business. SSA 's cloud 

strategy involves implementing and examining private cloud-computing models before it extends that 

capability to public service functions. 

In 2014, we evalnated SSA's cloud computing technologies. We conducted the review early in SSA 's 

cloud-adoption process, so we encouraged SSA to consult with OMB on Federal requirements for cloud 

use.3 SSA recently reported that the Agency's cloud implementations have complied with Federal Risk 

and Authorization Management Program security assessments. 

SSA 's IT Investments 

The Agency is currently managing 14 "major" IT investments, including the National Support Center 

(NSC) and DCPS. We have monitored both projects closely. 

National Support Center 

SSA is curremly migrating systems from the National Computer Center (NCC) in Woodlawn, Maryland 

to the new NSC in Urbana, Maryland. The systems moving from the NCC to the NSC contain 

demographic, wage, and benefit infonnation for almost every American, and the data are essential for 

SSA to provide services to its customers. 

SSA built and partially equipped the NSC to replace the aging NCC with $500 million provided by 

Congress in FY2009 under the American Recove1y and Reinvestment Act. The NSC is a modem, 

efficient data center that is expected to meet the Agency's IT needs for at least 20 years. SSA also 

operates the Second Support Center in North Carolina. which provides data computing redundancy. 

The Agency is on schedule to complete systems migration to the NSC in August 2016. To date, we have 

not identified any significant issues that would delay migration efforts; however, a seamless transition of 

data management to the NSC is critical to SSA operations. The Agency should continue to monitor the 

risks associated with data migration efforts until the process is complete. Going forward, SSA should 

maintain appropriate data security plans, disaster recovery plans, and access management controls4 

Disability Case Processing System 

State disability determination services (DDS) evaluate disability claims and make disability 

detenninations for SSA; there are 54 DDSs across the cotmtry, and they use various customized systems 

to process disability claims. 

SSA envisioned DCPS as a single tool for case processing for the DDSs. which SSA believed would 

simplify system support and maintenance, improve the speed and quality of the disability process, and 

reduce the overall growth rate of infrastructure costs. Since SSA conceived of this conu110n processing 

' SSA OIG~ 111e Social Securitv AdmhtisJration'$ Cloud Computlng Environmelll, December2014 . 

.. SSA OJG, Progress Reoort on the Social Sel'urin• AdministrationS National Suoeort Ceme-r, Aug.usl 2015. 
57 


22296A.045

system in 2008, SSA has invested over $300 million in DCPS- for which the Agency will receive very 

little value. 

In March 2014, the Agency hired a consultant to provide an in-depth analysis of the project. In Jtme 

2014, the consultant reponed that although SSA had invested $288 million in DCPS over six years, the 

project delivered limited functionality and faced schedule delays amid increasing stakeholder concerns. 

At the consultant's recorrmtendation, SSA perfonned proof-of-concept evaluations of two other 

alternatives, including whether off-the-shelf software or a modernized version of SSA 's software could 

he integrated into DCPS. 

At the request of Chairman Johnson, we followed up on the contractor's report and responded to several 

questions about the project. In November 2014, we issued a report and reconunended that SSA suspend 

OCPS development while it evaluated these other project altemativcs.s SSA disagreed and continued 

developing OCPS-spending another $23 million on additional coding and design. This work was never 

rolled out to the test sites. In May 2015, SSA decided to discontinue DCPS development and later 

"reset" the project with a new technical approach. Teams of SSA staff and vendors began redeveloping 

the system and are currently working in an "Agile" environment. which emphasizes collaboration 

between developers and business experts to deliver software incrementally. 

SSA 's goal is to deliver the first release of the new DCPS system to some-but not all- DOSs by the 

end of2016. However, this "Core" release will require DOSs to run parallel systems wnil SSA develops 

additional functionality and designs specific customization for many State agencies. State-specific 

customization proved to be the most complex task in SSA 's previous attempt to design DCPS. 

Further, we recemly examined SSA's analysis ofaltematives for DCPS after the consultant's report 

raised concerns about the project. We concluded that SSA did not fully analyze all potemial a lternatives. 

including whether to discontinue all efforts entirely and continue maintaining its legacy systems. 

At tbc end ofFY2015, SSA reponed it spent $355 million on DCPS (including the first year of its reset). 

SSA projected DCPS contract and development costs for FY20 16 and FY2017 to be $84 million, 

bringing the total estimated DCPS cost through FY2017 to $439 million. Additionally, SSA estimated 

that the annual cost of maintaining the legacy systems until d iscontinuing usc of these systems is $32 

million. SSA has not estimated costs beyond FY2017 to maintain and enhance DCPS. Going forward, 

DCPS needs diligent oversight from Agency management and continued user involvement. 

Agile Development in DCPS 

I mentioned that when SSA reset DCPS in 2015, the Agency decided to implement Agile development 

practices. Agile differs from the traditional "waterfall" developmelll method, in that Agile calls for brief 

development "sprints," with rounds of design. testing, and feedback to deliver incremental product 

updates. The waterfall model is more traditional, in that it is a sequential design process, flowing 

downward through the development phases of re{!uirements, design, implementation, verification. and 

maintenance. With the waterfall method, a project, a t some point, is considered "delivered" and 

"complete," while with the agile model, development is ongoing, as tests and adjustments continue after 

the project is in use. 

5 SSA OJG, n ,e Social Securltv Administrmion 's Disnbilill' Case Processing System November 2014. 

4 
58 


22296A.046

The consultant that analyzed DCPS in 20 14 recommended SSA consider the Agile development 

approach. Agile can speed project development and reduce costs. but the consultant camioned that 

transitioning to a new development methodology mid-project carries risk, and that large-scale projects 

often face challenges despite implementing Agile. 

SSA has sought Agile training and coaching services from industry experts; nonetheless. Agile software 

development practices are relatively new at SSA, and implementing them on a project as complex as 

DCPS could introduce additional risks to a project that has already encountered such significant costs 

and delivery delays.6 OMB issued draft perfonuance measurement guidance on Agile in April; when the 

guidance is finalized, we will begin a review of SSA 's use of Agile for DCPS. 

SSA 's Information Security 

Any long-term plan SSA develops with regard to IT modemization also needs to address efforts to 

secure the Agency's infonnation systems. Recent data breaches at govennnent agencies have 

underscored the need for Federa l agencies like SSA to make every effort to secure and protect 

infonnation systems. 

The Federallnfonnation Security Modernization Act (F!SMA) requires each Federal agency to 

implement an agency-wide program to provide infonnation security for the agency's data and systems. 

The law also requires inspectors general to evaluate its agency's information security programs and 

practices on an annual basis. 

In our most recent repon on SSA 's compliance with FISMA, we determined that SSA had established 

an infonuation security program and practices that were generally consistent with FISMA requirements. 

However, we identified a number of deficiencies that may limit the Agency's ability to protect the 

confidentiality, integrity. and availability of SSA 's infonuation systems and data.' The deficiencies 

identified in several FISMA reporting metrics-configuration management, identity and access 

management, risk managemem, and security training- are consistent with those that we have cited in 

prior reports on SSA 's FISMA compliance. 

In our review of SSA 's overall infom1ation security program and practices. we concluded that the risk 

and severity of the weaknesses identified constituted a significant deficiency in internal controls over 

FISMA.

3 

SSA continues to pursue a risk-based approach to information security, and weaknesses continue to 

exist, we believe, because of one, or a combination, of the following: 

SSA 's risk-mitigation strategies and related control enhancements require additional time to 

implement or become fully effective. 

'SSA OIG. Congressional Resoouse Reoorl; The Social Securitv Administration's Aualvsis ofA/temalfltes tor I he Disabilill• 

Case Processiug Svstem. May 2016. 

7 Under a contrae:tlhc OlG monitored. an independent certified publjc: aetountiog: finn audited SSA ·s compliauee with 

FISivlA for fiscal year 2015. The OIG was responsible for technical and adminislra1ive oversight oftbe contractor's review. 

8 SSA OIG, The Social Securif\.' Admiui.srrmion 's Compliance with the Federtll lnformaliou Securirv Modemi:orion Act of 

2014 (Or Fiscal Y.u~r 2015, November 2015. 

5 
59 

f 


22296A.047

SSA focused resources on higher-risk weaknesses, and thus it was unable to take corrective actions 

on all prior-year deficiencies. 

New controls do not completely address the risks and recommendations in past reports. 

SSA should make all effons to address the weaknesses identified. We also made several additional 

recommendations to the Agency, which we have detailed in our most recent report on SSA 's compliance 

with FISMA. As FISMA requires, we will continue to assess annually the effectiveness ofSSA 's 

infonnation security policies, procedures. and practices. 

Conclusion 

It is imperative that SSA clearly define its plan to modernize its IT infrastrucrure. The Agency's 

increasing service and data-storage responsibilities require SSA to transition from legacy coding and 

applications to current, maiostream programing languages. software. and storage capabilities. SSA has 

general plans to, gradually, reduce its reliance on legacy systems and convert to modem applications and 

cloud storage, but these efforts will take significant planning. time. and resources, as well as careful 

oversight. The OIG. for many years, has recommended that SSA incorporate its IT development strategy 

into its long-term strategic planning process. Despite some progress by SSA to identify areas for 

modernization, the OIG has not reviewed a fonnal IT modernization plan from the Agency. 

Oversight ofSSA 's IT planning is a top priority for the OIG. We will continue to monitor these and 

related issues closely and will work with SSA and this Subconnnittee to enhance the Agency's IT 

capabilities and security, so it can improve operations and serve its customers effectively. 

Thank you again for the invitation to testify. and I am happy to answer any questions. 

6 
60 

Chairman JOHNSON. Thank you, ma’am. 

Ms. Melvin, welcome. Please proceed. 

STATEMENT OF VALERIE C. MELVIN, DIRECTOR, INFORMATION MANAGEMENT AND TECHNOLOGY RESOURCES ISSUES, 

GOVERNMENT ACCOUNTABILITY OFFICE 

Ms. MELVIN. Good morning, Chairman Johnson, Ranking Member Becerra, and Members of the Subcommittee. 

Thank you for inviting me to testify on modernizing SSA’s information technology. As you know, the agency relies heavily on IT resources to accomplish its mission, and as has been emphasized, 

SSA’s IT environment is aging, with the agency reporting that 

some of its systems are more than 30 years old. 

Over the years, SSA has undertaken various projects aimed at 

updating and improving its systems and infrastructure and, as 

noted today, it recently announced a new plan to pursue an agencywide modernization initiative. Our prior reports on SSA’s IT identify numerous challenges that impeded the agency’s ability to effectively manage and modernize its IT, and at your request today, my 

testimony summarizes results from those reports. Further, in anticipation of the new modernization initiative, the testimony highlights selected practices that we have identified as essential to effectively planning for and managing modernization efforts. 

Overall, our prior work identified weaknesses in SSA’s systems, 

development practices, IT governance, requirements management 

and strategic planning, among other areas. For example, we previously noted that the agency had proceeded with implementing an 

earlier disability system without consistently applying established 

procedures to guide the systems development and without conducting adequate testing to evaluate the performance of all system 

components collectively. Additionally, the agency’s IT modernization approach had not included an updated IT strategic plan to 

guide its efforts. Weaknesses such as these hindered SSA’s ability 

to successfully deliver the new capabilities. 

We made numerous recommendations to address the weaknesses 

we identified, and the agency agreed with some, but not all of 

them. Overall, the agency has continued to be challenged in its efforts and currently faces increasing costs to operate and maintain 

its at-risk legacy systems. 

Our work has shown that successfully acquiring and modernizing 

IT depends on Federal agencies, including SSA, having effective 

management and oversight processes in place. Otherwise, investments frequently fail, incur cost overruns and schedule slippages, 

or contribute little to the missions-related outcomes. 

With this in mind, we have identified a set of essential and complementary management disciplines that provide a sound foundation to support IT modernization efforts. These include, among 

others, strategic planning to define what an organization seeks to 

accomplish and how it will achieve the desired results, IT investment management that includes an investment board and effective 

investment oversight, systems development and acquisition practices that include defining the requirements, managing project 

risks, and reliably estimating costs, and leadership for driving 

change, providing oversight and ensuring accountability for results. 

61 

Given the longstanding challenges with its IT management and 

modernizations, it is important for SSA to have in place a clearly 

established, rigorous and disciplined approach for its latest efforts 

to modernize its IT. The management disciplines noted provide a 

sound foundation for doing so. Otherwise, challenges like those 

that SSA experienced in its past initiatives could continue to be an 

impediment to the agency achieving the more modernized IT environment necessary to support its service delivery mission. 

This concludes my oral statement, and I would be pleased to respond to your questions. 

[The prepared statement of Ms. Melvin follows:] 

62 


22296A.048

For Release on Delivery 

EJ<pected at 10 a.m. ET Thursday, July 14, 2016 

GA0-16-815T 

United States Government Accountability Office 

Testimony 

Before the Subcommittee on Social 

Security, Committee on Ways and 

Means, House of Representatives 

SOCIAL SECURITY 

ADMINISTRATION 

Effective Planning and 

Management Practices 

Are Key to Overcoming IT 

Modernization Challenges 

Statement of Valerie C. Melvin, Director 

Information Management and Technology Resources 

Issues 
63 


22296A.049

Chairman Johnson, Ranking Member Becerra, and Members of the 

Subcommittee: 

I am pleased to be here today to participate in your hearing on 

mOdernizing the Social Security Administration's (SSA) information 

technology (IT). SSA is responsible for delivering services that touch the 

lives of almost every American, and the agency relies heavily on IT 

resources to do so. Its computerized information systems support a wide 

range of activities-from processing Disability Insurance and 

Supplemental Security Income payments to calculating and withholding 

Medicare premiums and issuing Soc·ial Security numbers and cards. For 

fiscal year 2015, the agency reported spending approximately $1 .3 billion 

on hardware and software, computer maintenance, and contractor 

support, among other things. 

SSA has acknowledged the increasing age of its IT environment and has 

reported that some of its databases are at least 40 years old. Moreover, 

our recent reporting on federal agencies' legacy IT' has noted the 

increasing cost for agencies, including SSA, to operate and maintain their 

outdated systems. SSA has initiated various projects over the past two 

decades that were intended to update and improve parts of its 

infrastructure. More recently, it announced plans to pursue an agencywide IT mOdernization initiative. 

At your request, my testimony today summarizes results from a number 

of our previous reports on SSA's IT efforts. Additionally, in anticipation of 

the agency's planned modernization initiative, my testimony highlights 

selected best practices that we have identified as being essential to an 

agency's effective planning and management for such an initiative. 

In developing this testimony, we relied on reports that we have previously 

issued. These reports, cited throughout this statement, include detailed 

information on the scope and methodology for our reviews. The work on 

which this statement is based was conducted in accordance with 

generally accepted government auditing standards. Those standards 

require that we plan and perform audits to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions. 

1

GAO, Information TechnokJgy: Fedora! Agoncies Nood lo AddtiJss Aging Legacy 

Systems, GA0-16-468 (Washington. D.C.: May 25, 2016). 

GA0·164t5T 
64 


22296A.050

Background 

We believe that the evidence obtained provided a reasonable basis for 

our findings and conclusions based on our audit objectives. 

SSA's mission is to deliver Social Security services that meet the 

changing needs of the public. The Socia/ Security Act and amendments• 

established three programs that the agency administers: 

Old-Age and Survivors Insurance-provides monthly retirement and 

survivors benefits to retired and disabled workers, their spouses and 

their children, and the survivors of insured workers who have died. 

SSA has estimated that, in fiscal year 2017, $813 billion in old-age 

and survivors insurance benefits are expected to be paid to a monlhly 

average of approximately 52 million beneficiaries. 

Disability Insurance provides monthly benefits to disabled workers 

and their spouses and children. The agency estimates that, in fiscal 

year 2017, a total of approximately $149 billion in disability insurance 

benefits will be paid to a monthly average of about 11 million eligible 

workers. 

Supplemental Security Income is a needs-based program financed 

from general tax revenues that provides benefits to aged adults, blind 

or disabled adults. and children with limited income and resources. 

For fiscal year 2017, SSA estimates that nearly S59 billion in federal 

benefits and state supplementary payments will be made to a monthly 

average of approximately 8.4 million recipients. 

SSA relies on its IT resources to support the administration of its 

programs and related activities. For example, among other things, its 

systems are used to handle millions of transactions on the agency's 

website, maintain records for the millions of beneficiaries and recipients of 

its programs, and evaluate evidence and make detenminations of 

eligibility for benefits. According to the agency's most recent Information 

2 Title II. Federal Old~Age Survivors, and Disability Insurance, alld Title XVI, Supplemental 

Security Income fe< the Aged, Blind and Oisallled. of the Social Security Act are 

administere<l by the Soeial Security AdministJation. See 42 U.S.C. §§ 401-434 and 42 

u.s.c. §§ 1381·13831. 

Pago2 GA0·16-815T 
65 


22296A.051

Resources Strategic Plan.' its systems supported the processing of an 

average daily volume of about 185 million individual transactions in fiscal 

year 2015. 

SSA's Office of the Deputy Commissioner for Systems is responsible for 

developing, overseeing, and maintaining the agency's IT systems. 

Comprised of approx.imately 3,800 staff, the office is headed by the 

Deputy Commissioner, who also serves as the agency's Chief Information 

Officer (CIO). 

SSA's acting commissioner has stated that the agency's aging IT 

infrastructure is not sustainable because it is increasingly difficult and 

expensive to maintain. Accordingly, the agency has requested $300 

million in its fiscal year 2017 budget to be spread over 4 years to 

modernize its IT environment. As reflected in the budget. these 

modernization efforts are expected to include projects such as updating 

database designs by converting them to relational databases, eliminating 

the use of outdated code, and upgrading infrastructure. 

Among the agency's priority IT spending initiatives expected to be 

covered in the budget is its Disability Case Processing System. This 

system is intended to replace the 54 disparate Disability Determination 

Services·• component systems, support, and maintenance processes with 

a modern, common case processing system. According to SSA. the new 

system was to modernize the entire claims process, including case 

processing, correspondence, and workload management. However, SSA 

and others have reported substantial difficulty in the agency's ability to 

carry out this initiative, citing software quality and poor system 

performance as issues. Consequently, as of June 2016, the initiative had 

been placed on the Office of Management and Budget's government-wide 

list of 10 high-priority programs requiring attention.• 

3

SSA. Social Security Admlnistratlon lnfOtmatlon Resouroos Management Strategic Plan 

2076-2019 (Baltimore. Md.). 

"ssA has agreements with state Disability Determination Services agencies to initially 

determine whether applicants are disabled. 

5

0ffice of Management and Budget. Re{X>IIto Congress: 10 High PriOrity Programs 

(Washington, D.C.: June 9. 2016). 

P>~J•3 OA0·16 .. 1ST 
66 


22296A.052

SSA Has Faced 

Long-Standing 

Challenges in IT 

Management and 

Modernization Efforts 

We have issued previous reports highlighting various challenges in $SA's 

management of its IT. Overall, these reports Identified weaknesses in, 

among other areas. system development practices, IT governance, 

requirements management, and strategic planning. Our reports. 

collectively. stressed the need for the agency to strengthen its IT 

management controls. 

In previously reporting on SSA"s Implementation of a new electronic 

disability system, we noted that the agency had proceeded without 

(1) conducting testing that was adequate to evaluate the performance 

of all system components collectively and (2) evidence that it had 

consistently applied established prooedures to guide the system's 

development.• In view of the risks and the technological complexity, 

scope, and size of the initiative. we recommended that the agency, 

before continuing w~h its national rollout of the electronic disability 

system, ensure that all critical problems identified in pilot testing of the 

system were resolved and that end-to-end testing of the Interrelated 

systems was performed; and ensure that all software that had been 

developed was approved and that systems were certified for 

production. SSA disagreed with the need for the end-to-end testing, 

stating that to perform such testing would delay the project and the 

agency's ability to realize benefits from this initiative. However, the 

agency did subsequently take measures to ensure that users 

approved new software and that it certified its systems for production. 

In an evaluation of SSA"s investment management approach.' we 

noted that, while the agency had executed a majority of key IT 

investment management practices. the critical prooess of providing 

oversight was not being fully executed. Further. we reported that a 

gap existed in the agency's management of its IT in that more than 

half of its budget- for acquisitions- was not being overseen as part of 

the agency's investment management process. We made seven 

recommendations related to strengthening the agency's investment 

management capability. SSA agreed with six of our seven 

recommendations, and took actions to address five of them. For 

example. it established portfolio-level performance evaluation policies 

and procedures and criteria for assessing portfolio performance; it 

also tracked the status of corrective actions for underperforming IT 

GA0.1W1$T 
67 


22296A.053

projects. However, the agency did not implement post-implementation 

reviews and was not managing its acquisitions within its IT investment 

management framework. Further, the agency disagreed with our 

recommendation that it develop policies and procedures for managing 

its IT acquisitions as investments and manage them using the 

investment board and investment management processes. The 

agency disagreed because it believed its existing investment 

management framework was adequate. Given that IT product and 

service acquisitions made up the majority of SSA's IT budget, 

however, the investment board's involvement was essential to helping 

ensure effective management of and lull accountability lor these 

acquisitions. 

In previously reporting on SSA's efforts to ensure that its IT 

infrastructure can support the agency's future data exchange 

environment.8 we noted that a detailed analysis needed to project the 

workload and performance requirements was not performed. In 

addition, we reported that the agency's target enterprise architecture 

environment did not address specific business and technical 

requirements lor supporting its data exchange program. We 

recommended that SSA conduct the analyses needed to define 

requirements lor delivering data exchange services to its partners in 

the future and use the results of these analyses to update its target 

architecture. SSA agreed with these recommendations and, in 

September 2013, took actions to address them. For example, it 

conducted an assessment of its existing electronic exchange 

architecture and identified challenges it expected to encounter as 

requests for data increased, as well as descriptions of target 

architectural components intended to meet requirements for 

addressing the challenges. 

In an examination of the agency's IT modernization approach, we 

pointed out that the approach tacked key practices to effectively guide 

its efforts.• Specifically, SSA did not have an updated IT strategic plan 

to guide its modernization efforts and its enterprise architecture lacked 

important content that would have allowed the agency to more 

effectively plan its investments. We recommended that SSA take four 

actions. For example, we recommended that in updating the IT 

8GA0 -09-966. 

9GA0 ·12-495. 

GA0·16 .. 1ST 
68 


22296A.054

strategic plan to support the agency's strategic plan, SSA include key 

elements-such as results-oriented goals, strategies, milestones, 

performance measures, and an analysis of interdependencies among 

projects and activities- and use the plan to guide and coordinate IT 

modernization projects and activities. We also recommended that the 

agency establish an enterprise architecture plan that included key 

components called for by federal guidelines '

0 and GAO's enterprise 

architecture management framework "-such as the development of a 

service-oriented architecture road map-to effectively guide its 

modernization activities. The agency neither agreed nor disagreed 

with our recommendations. However, it subsequenUy took action to 

address two of the four recommendations by ensuring that 

performance measures were defined for ongoing IT modernization 

initiatives and updating its IT strategic plan to support the agency's 

strategic plan. As of this testimony, we have not yet completed our 

evaluation of the agency's actions to address the other two 

recommendations related to establishing an enterprise architecture 

plan and developing and clearly documenting investment review 

guidance and procedures to ensure oversight reviews will be effective 

in evaluating and controlling investments. 

Beyond the challenges identified in the aforementioned reports, our 

recent report on federal agencies' IT legacy systems highlighted the 

increasing costs that agencies, including SSA, may be faced with as they 

continue to operate and maintain at-risk legacy systems.'2 We identified 

SSA's investment in infrastructure operations and maintenance as being 

among the 10 largest expenditures of federal agencies in fiscal year 

2015. Further, we pointed out that legacy systems may become 

increasingly more expensive as agencies have to deal with issues, such 

as obsolete parts and unsupported hardware and software, and may pay 

or example, Federal CIO Council, A Practical Guide to Federal S8f'Vice OrientBd 

Architectur&, V$rsion 1.1 (Washington, O.C.: June 2008): Office of Management and 

Budget (OMB). MM91Jement of Federal lnfomJation Resources, OMB Circ.Jiar No. A-130 

Transmittal Memorandum #4 (Washington. O.C.: Nov. 28. 2000); and OMB. Information 

Technology Architectures, Memoranda 97-16 (Washington. O.C.: June 18, 1997). 

i1GAO. Organizational Transformation: A Frameworlc for Assessing and Improving 

Enterprise ArcMtecture Management (Version 2.0}. GAQ..1()..846G (Washington. D.C.: 

August 2010). 

12GAO, InformatiOn Technology: Federal Agencies Need to Address Aging Legacy 

Systems. GA0-16-468 (Washington. O.C.: May 25. 2016). 

POIJ•6 GA0·16 .. 1ST 
69 


22296A.055

Key Practices Are 

Essential for 

Managing Successful 

Modernizations 

a premium to hire staff or engage contractors with the knowledge to 

maintain outdated systems. For example, SSA reported re-hiring retired 

employees to maintain its systems that include many programs written in 

Common Business Oriented Language (COBOL). 

Our prior work further emphasized the importance of federal agencies 

using investment operational analyses-a key performance evaluation 

and oversight mechanism required by the Office of Management and 

Budget- to ensure operations and maintenance investments continue to 

meet agency needs." We noted that SSA had not previously conducted 

this analysis tor its investments. An analysis such as this is important 

because, among other things, it provides information to agency decision 

makers on whether an investment's actual annual operations and 

maintenance costs are as they were planned to be and whether there is a 

need to examine more cost-effective approaches to meeting agency 

mission objectives. We recommended that SSA perform such an analysis 

on its investment, and in January 2014 the agency did so. 

Our prior work has shown that effectively managing IT needs depends on 

federal departments and agencies. including SSA, having key processes 

in place.•• Toward this end, we have identified and reported on a set of 

essential and complementary management disciplines that provide a 

sound foundation to support IT modernization efforts. These include the 

following: 

Strategic planning: Strategic planning defines what an organization 

seeks to accomplish and identifies the strategies it will use to achieve 

desired results. A defined strategic planning process allows an 

agency to clearly articulate its strategic direction and to establish 

linkages amcng planning elements such as goals, objectives, and 

strategies. A well-defined IT strategic planning process helps ensure 

that an agency's IT goals are aligned with its strategic goals. 15 Also, 

'

3GAO. Information Technology: Agencies Need to Strengthen OveiSight of Mu/Ubillion 

Dollar lnvtJstments In OJXJratlotls and Malntenai1C9, GA0-14-66{Washlngton, O.C.: Nov. 

6. 2013). 

14GAO. Library of Congress: Strong Leadership Needed to Address Serious Information 

Technology Mall8gement WeaknesS<>s, GA0-15·315 (Washington. D.C.: Mar. 31. 2015). 

15GA0·12-495. 

Pago7 GA0·16-815T 
70 


22296A.056

as part of its strategic planning efforts, an organization should develop 

an enterprise architecture, which is an important tool to help guide the 

organization toward achieving the goals and objectives in its IT 

strategic plan'" In addition, the organization should implement human 

capital management practices to sustain a workforce with the skills 

necessary to execute its strategic plan, which includes assessing 

current and future agency skill needs.

17 

IT investment management: IT projects can significantly improve an 

organization's performance, but they can also become costly, risky, 

and unproductive. Agencies can maximize the value of these 

investments and minimize the risks of acquisitions by having an 

effective and efficient IT investment management and governance 

process, which would include instituting an investment board, 

selecting investments that meet business needs, providing investment 

oversight, and capturing investment information. '

8 Emphasizing the 

importance of investment management, the Clinger-Cohen Act 

requires executive branch agencies to establish a process for 

selecting, managing, and evaluating IT investments in order to 

maximize the value and assess and manage the risks of the 

acquisitions. 

19 

Systems development and acquisition: Our prior reviews have 

shown that proper implementation of disciplined practices for 

developing or acquiring IT systems can significantly increase the 

likelihood of delivering promised system capabilities on time and 

18GAO, Organizational iransformatk>n: A Framework for Assessing and Improving 

Enterprise ArcMecture Monagemont (Version 2.0) (Supersedes GA0.03-584G), 

GA0-10·846G (Washington, D.C.: August 2010). 

17Such practices have been identifted by both the Offtce of Personnel Management and 

GAO ~ Office of Personnel Management. The Human Capftal Assessment and 

AccountabHily Framework-Systems, Standards. and MetricS 

(http://www.opm.gov/hcaaf_resoorce_center/) and GAO. Human Capital: Key Principles 

for Effective Strategic Workforce Planning. GA0-04·39 (Washington, D.C.: Dee. 11. 

2003). 

'

8GAO. Information Technology Investment Management: A Framework for Assessing 

and Improving Process Maturity (Supersedes AIMD-10.1.23). GA0-04-394G (Washington. 

D.C.: March 2004). 

1940 u.s.c. § 11312. 

GA0·16 .. 1ST 
71 


22296A.057

within budget.20 These practices include defining the requirements 

that address the needs of the system users, managing project risk to 

identify potential problems before they occur. reliably estimating cost 

to help managers evaluate affordability and performance against a 

project's plans, and developing an integrated and reliable master 

schedule that defines when and how long work will occur and how 

each activity is related to the others, among other actions. Best 

practices in these areas have been identified by organizations such as 

the Software Engineering Institute and GA0.21 

Information security and privacy: Effective security for federal IT 

systems and data is essential to prevent data tampering, disruptions 

in critical operations, fraud, and inappropriate disclosure of sensitive 

information, including personal information entrusted to the 

government by members of the American public. Recognizing the 

importance of information security and privacy. Congress enacted the 

Federal Information Security Modernization Act of 2014,

22 which 

requires executive branch agencies to develop, document, and 

implement an agency-wide information security program.23 

Additionally, in order to help agencies develop such a program, the 

National Institute of Standards and Technology has developed 

guidance for information security and privacy. 

Service management: Agencies should develop and implement a 

process for ensuring that IT services. such as server management 

and desktop support, are aligned with and actively support the 

business needs of the organization. The Information Technology 

Infrastructure Library2

• identifies key practices for successful service 

20see, e.g .. GAO, Information Technology: Critical F8Ctors Und8rlying Successful Major 

AcquiSitions, GA0 -1 2-7 (Washington, D.C.: Oct. 21 , 201 1), 

21SEI, CMMI® for CXJve/opment ano Acqv/Sitlon, Versk>ns 1.3: GAO, GAO Cost 

Estimating and Assessment Guide: Best Practices lor Developing and Managing Capital 

Program Costs, GA0 ·09-3SP (Washington, D.C., March 2009); and GA0-16·89G. 

22Pub. L. No. 113-283. 128 Stat. 3073 (Dec. 18. 2014). 

23-rhe Fedora/Information Security ModemizaliOn Act o/2014. Pub No, 11 3-283. 128 

Stat. 3073 (Dec. 18. 2014) partially superseded the Federallnformalion Security 

Management Act of 2002. enacted as Trtle Ill, E·Govemment Act of 2002. Po b. L. No. 

107-347. 116 Stal2899, 2946 (Dec. 17, 2002). 

24~ou HunnebeCk and Cohn Rudd, /Tit: Service Design O(London: The Stationary Office. 

2011). 

GA0·16 .. 1ST 
72 


22296A.058

management. These include developing a service catalog that 

identifies all IT services delivered by the service provider. as well as 

establishing service-level agreements between the IT service provider 

and its customer on the expected service-level targets."" 

Leadership: Effective leadership, such as that of a CIO, can drive 

change, provide oversight, and ensure accountability for results. 

Congress has also recognized the importance of having a strong 

agency CIO. For example, as part of the Clinger-Cohen Act, Congress 

required executive branch agencies to establish the position of 

agency CI0.26 The act also gave these officials responsibility and 

accountability for IT investments, including IT acquisitions, monitoring 

the performance of IT programs. and advising the agency head on 

whether to continue, modify. or terminate such programs. More 

recenUy, in December 2014, Congress passed federal information 

technology acquisition reform legislation (commonly referred to as 

FITARA). which strengthened the role that agency CIOs are to play in 

managing IT.v For instance, the law requires the head of covered 

agencies to ensure that the CIO has a significant role in the decision 

process for IT budgeting, as well as the management, governance, 

and oversight processes related to IT. 

In conclusion, given SSA's longstanding challenges with IT management 

and modernization efforts, it will be important for the agency to implement 

a clearly established, rigorous, and disciplined approach for its current 

efforts to manage and modernize its aging IT systems. Leveraging IT 

management best practices that we and others have identified and dearly 

documenting what is to be achieved. in what time frame, and at what cost 

could help position the agency to overcome challenges like those 

25examptes of service-level targets Include the hours that cust001ers can expect the 

service to be available (e.g., 8:00a.m. to 6:00p.m .. Monday through Friday), availability of 

a servioe during the agreed secvice hours (e.g .. 99.5 percent). and maximum number of 

failures ex incidents that can be tolerated within an agreed time period. 

26Pub. L. No. 104· 106, § 5125.110 Stat. 186,684 (Feb. 10. 1996); 40 U.S.C. § 11315 

and 44 u.S.C. § 3506(a). 

27 Carl t..evin and Howard P. -suck" McKeon NsUonsl Defense AuthorizaUon Act for Fiscal 

Year2015. Pub. L. No. 113·291, Oiv. A, TiUe VIII, Svbtille 0. § 831, 128 Slat. 3292. 3438 

(Dec. 19. 2014): 40 U.S.C. § 11319. 

Pago10 GA0·16-815T 
73 


22296A.059

GAO Contact and 

Acknowledgments 

encountered with past IT efforts. Without doing so. such challenges could 

continue to be an impediment to the agency achieving the more 

modernized IT environment that it needs. 

Chairman Johnson, Ranking Member Becerra. and Members of the 

Subcommittee, this concludes my prepared statement. I would be 

pleased to respond to any questions that you or other members of the 

Subcommittee may have. 

If you or your staff have any questions about this testimony, please 

contact Valerie C. Melvin, OirectOf, Information Management and 

Technology Resources Issues. at (202) 512·6304 or melv~nv@gao gov. 

Contact points for our Offices of Congressional Relations and Public 

Affairs may be found on the last page of this testimony statement GAO 

staff who made key contributions to this statement are Nioole Jarvis 

(Assistant OirectOf), Nancy Glover. Monica Perez-Nelson. Scott Pettis, 

and Christy Tyson (Analyst in Charge). 

P,.11 GA0.1W1$T 
74 


22296A.060

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. HoweV8f, because this work may contain 

copyrighted images or other material, permission from lhe oopyright holder may be 

necessary i1 you wish to reproduce this material separately, 
75 

f 


22296A.061

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

Strategic Planning and 

External Liaison 

The Government Acoountabilily Office, the audit, evaluation, and Investigative 

arm or Congress, exists to support Congress In mooting its constitutional 

responsibilities and to help improve tho performance and accountability or the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and pollcles; and provides analyses, 

recommendations, and other asslstanoe to help Congress make Informed 

oversight, policy, and funding decisions. GAO's commitment to good government 

is reftected in its core values of acoountabitlty. Integrity. and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost is 

lhrough GAO's website (http://Www.gao.gov). Each weekday afternoon, GAO 

posts on its website newty released reports, testimony, and correspondence. To 

have GAO e-mai you a lost of newly posted products, go to http://Www.gao.gov 

and select "E·mai Updates." 

The price of each GAO publication rellect$ GAO's actual cost of production and 

distribution and depends on lhe number of pages in lhe publication and whelhe< 

lhe publication is printed in color 0< black and whHe. Pricing and O<Oering 

infa<malion is posted on GAO's website, http://Www.gao.gov/O<denng.htm. 

Placea<ders by calling (202) 512~ toll free (866) 801·7077, 0< 

TOO (202) 512·2537. 

Orders may be paid fa< using American Express, OISCIOVOr Caro, MasterCard. 

Visa. check. 0< money order. can fa< additional infonnatJon. 

Connect with GAO on Faoebook. Flod<r, Twtlter. and YouTube. 

Subscribe to our RSS Feeds 0< E·mail Updates. Listen to our Podcasts. 

Visit GAO on lhe web at www.gao.gov. 

Contact: 

Website: http://Www.gao.gov/fraudneVfraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512·7470 

Katherine Siggerud. Managing Director. slggorudk@gao.gov. (202) 512-4400. 

U.S. Government Accountability Offioe, 441 G Street NW. Room 7125, 

Washington, DC 20548 

Chuck Young, Managing Director. youngc1@ljao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW. Room 7149 

Washington. DC 20548 

James-Christian Blackwood, Managing Director. spel@gao.gov, (202) 512-4707 

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548 

.... 

-...: Please Print on Recycled Paper. 
76 

Chairman JOHNSON. Thank you, ma’am. 

Mr. Hayes, welcome. You may proceed. 

STATEMENT OF WILLIAM HAYES, PRINCIPAL ENGINEER, 

SOFTWARE ENGINEERING INSTITUTE, CARNEGIE MELLON 

UNIVERSITY 

Mr. HAYES. Chairman Johnson, Ranking Member Becerra, 

Members of the Subcommittee, thank you for the opportunity to address you today. 

My name is Will Hayes and I am a member of a research team 

at the Software Engineering Institute, a federally funded research 

and development center operated by Carnegie Mellon University. 

For over 7 years, we have been working with major software-intensive programs across the government, where a great deal of experience is accumulating about Agile. My testimony today will focus 

not on the Social Security Administration but on what we at the 

Software Engineering Institute have learned about Agile development in government settings. Our research encompasses both successes and failures in applying Agile approaches. In our work as a 

federally funded research and development center, it is our goal to 

help others benefit from this experience base. 

It bears mentioning at the outset, Agile cannot solve all your IT 

transformation problems. As you may know, Agile software development is typified by small, cross-functional teams working in 

short iterations to deliver software capabilities incrementally. Our 

research in large programs indicates that there are several factors 

that are essential to successful application of Agile development at 

scale: Effective communication between leadership and developers; 

alignment on strategy across teams and roles; and a workforce experienced in the disciplined application of software engineering 

methods, such as architectural analysis, cyber security practices, 

and building sustainable systems, among other things. 

Make no mistake, to consistently deliver working software on a 

short timeframe and to do this over the course of months or years 

requires a tremendous amount of discipline and ongoing planning. 

For those charged with oversight responsibilities, we must recognize that Agile at scale is different from traditional approaches, 

and this process requires a different approach to oversight. 

Agile methodologies place a premium on consistent use of short 

iterations, with stable staffing dedicated to a single stream of technical work. This new cadence offers more oversight opportunity but 

with different measures of success. For example, short-term deviations in cost and schedule are much less likely to occur under 

such a regime. Leading indicators of performance that rely strictly 

on cost and schedule information will not serve us the way they 

have in the past. We will need to understand performance in terms 

of delivered value rather than resources consumed. 

In Agile, there is a strong emphasis on uncovering user needs for 

the system through collaborative interaction. Given this focus, we 

have the opportunity to assess the quality of the software products 

based on how well they support the mission of the user base. This 

focus on quality in terms of user value is seen by many to be superior to an exclusive focus on software defects and technical data. 

Agile moves the focus away from reliance on detailed and comVerDate Sep 11 2014 07:20 Apr 04, 2017 Jkt 022296 PO 00000 Frm 00080 Fmt 6633 Sfmt 6602 I:\WAYS\WAYSPS\22296\22296.XXX 22296
77 

prehensive specifications as the primary way of assessing the technical challenge to be solved. Incremental development allows teams 

to hone their understanding of real user needs as the system is implemented in waves. 

Agile development emphasizes full-resolution visibility into nearterm work and a less detailed focus on the work to be done later. 

This approach to managing the inevitable change in what we demand of our IT systems when implemented with strong leadership 

and a well-considered roadmap has helped government programs to 

deliver systems that are better suited to their intended use. 

There are a number of potential challenges to using Agile approaches in government settings that still remain. First, it is not 

yet clear how we will build the capacity for government personnel 

to interact more frequently with developers. Our Federal workforce 

must continue to accomplish more each year with limited ability to 

add resources. 

Second, government personnel overseeing software systems must 

be able to consider broad-reaching impacts of their technical strategy over the long term. A focus on short-term technical goals to the 

exclusion of a sense of building for the future can be a destructive 

force. This can inappropriately constrain the budgetary decisions 

we must make. 

Last, we must continue to battle the recurring software challenges that have been pervasive for decades. This includes managing technical debt and making timely modernization investments. We have a very long tradition of deferred maintenance to 

overcome. Just as we might worry about the condition of roads and 

bridges in our country, we need to be mindful of the work we defer 

in our software systems. 

In conclusion, I would like to suggest two broad focus areas for 

government on these matters: First, we need to start asking different questions about software systems in which we invest. We 

need to focus on what the software system enables and how the 

work supported by the system is improved by the capabilities we 

deploy. Second, a focused workforce development effort is needed to 

develop the skills necessary to utilize these new methodologies. 

It is an honor to participate in this process, and I will be happy 

to answer any questions you have. Thank you. 

[The prepared statement of Mr. Hayes follows:] 

78 


22296A.062

~ Software Engineering Institute I Cnmegie Mellon University 

Agile in Government 

Written Testimony of Software Engineering Institute's Agile in Government 

Team to House Ways and Means SSA Subcommittee 

Authors 

Suzanne Miller, Principal Researcher 

William Hayes. Principal Engineer and Testimony Speaker 

Eileen Wrubel, Proeram Manager 

SEI Agile in Govemment Team 

Provided by: 

Software Engineering Institute 

A Federally Funded Research and Development Center 

operated bo/ Carnegie Mellon University 

Date: 

July 14, 2016 
79 


22296A.063

1 SEI Testimony to House Ways and Means Subcommittee: 

Bottom Line Up Front 

In the following testimony. the Software Engineering Institute (SEI) Agile in Govenuneut team addresses these 

points: 

Agile is not a "'silver bullet" that solves all the complex management and engineering problems of govemment 

IT Transformation efforts. but it has contributed to successful IT Transfonnation efforts. 

The benefits achievable when development organizations use Agile methods only manifest when the develop· 

ment (govemment or contractor developer) and oversight (govenunenlacquisition) efforts are aligned. 

The approach and mindset to govemment obligations in oversight must change when Agile is the focus of development and the SEI bas observed negative consequences in organizations that do not address these changes. 

Changing the oversight approach in Agile settings means asking different questions on a new cadence than 

oversight organizations have in the past. Tlris leads to different measurement and reportiug approaches as well. 

A focused govemment workforce development effort is required to enable the knowledge, sl-.'ills, and abilities 

needed for effective oversight and interaction in Agile settings. 

2 Software Engineering Institute's Agile in Government Team 

Perspective on Agile in IT Transformation 

2.1 Introduction 

The Software Engineering lustinue's (SEI) Agile in Government team is pleased to provide testimony to the 

House Ways and Means Comurittec on the topic of Agile oppommitics and challenges in IT u·ansfom1atiou 

oversight. Fo1· over three decades, the SEI has been helping govemment and industry organizations to acquire, 

develop, operate, and sustain software systems that are im1ovative, affordable. enduring, and tmstworthy. We 

serve the nation as a Federally Ftutded Research and Development Center (FFRDC) sponsored by the U.S. Department of Defense (DoD) and are based at Cameg.ie Mellon University, a g.lobal research university annually 

rated among the best for irs prog.rants in computer science and enginee1ing. 

Overseeing the acquisition of large software intensive systems in govenunent settings b•ings many challenges; 

however, we believe our observations and experiences with govcnlllletll programs using Agile methods in IT 

transfonnation can elucidate the issue. Our observations focused on senior oversight aspects of these projects 

revea l p•·actical application and policy implications. 

2.2 Major Observations 

Agile is an iterative approach to software delivery that builds and delivers software incrementally fi·om the start of 

the project, instead of trying to deliver it all at once near the end (for more detail. see the Appendix). In the case of 

an Agile life cycle, requirements and solutions evolve through collabonuion among self-organizing teams and project sponsors to encourage rapid and flexible response to change. The following observations reflect over seven 

years of SEI involvement iu research and field suppot1 of the application of Agile methods and principles in govemment settings. 

The SEI's Agile in Govennneut team was chartered in2009ro initially answer the question posed by a setrior US 

Air Force official: "Can Agile methods actually be used in govcmment settings?" '01at question led to researching 

multiple dimensions oftlle application of Agile metltods and p•·inciples in a wide variety of govenuuent scopes and 

settings. (Ward & Miller 2016] 

0\U' first observation is one that may seem obvious- Agile cannnot solve all your IT Transformation problems. IT 

Transfonnation is a mt~ti-dimen ional challenge. Agile approaches, although not a silver bullet, can contribute to 

successful transformations when appropriate conditions are met. Ina recent article titled "'Embracing Agile," the 

Harw~rd Business Review asserts several conditions that reflect an appropliate setting for Agile success [Rigby 

2016]: 

11 
80 


22296A.064

The problem to be solved is complex. 

Solmions are initially mlknown. 

Product requiremeots will most likely change. 

Work can be rnodulatized. 

Close collaboration with end users (and rapid feedback from them) is feasible. 

We have worked in several goveromem settings that meet all of these criteria and have often fotmd Agile to provide 

benefits that are valued by the sponsors of the projects as well as the end users of the software products, albeit not 

\vilhoul challenges. The SEl is familiar \vilh many of the par1icular adoption hurdles of Agile development and n.,n. 

agement, especially in a contracted setting. [Lapham 20 II] 

Table 1: SEI Observations on the Significant Benefits of Agile 

I Benefit Summary 

ea~y opportunity lor course correction, es· 

pecially wtlen the environment changes after a program has begun 

ea~y risk rediJCiion, especiafty in user-lac· 

ing areas of the system 

Shorter "idea to realization"' cycle which results in fast user feedback for future increments of functionality 

Notes 

II is amazing how perspectives ohange on what a system should do or contain 

once users actually see the W'Ofking softw'are. Several times the SEI Agile in 

Govell'Vllent team has heard statements like '"Thank goodness we implemented 

that aspect of the system ea~y. We never WQUid have known to ohange X ff we had just been working with the requirements and design documents.· 

Agile's emphasis on ea~ teaming by implementing allows a program to locus 

risk reduction via implementation, rather than speculation through documents 

that might or might not be correct. 

In the Defense arena we call the tlfe cycle •concept to capability: The ideas are 

the same. The faster we get feedback from real usefS on what we have provided. 

the faster we can improve the product to meet evolving needs. 

However, the benefits are only achievable when oversight and development are alig11ed in several areas to include 

both development execution and mindset changes arotmd the topics listed in Table 2. [Miller 2014] 

Table 2. Factor Categories for Focusing Alignment in Agile Settings 

Business and Acquisi1ion 

Team. project and customer environment 

Technology envirolllll"ll 

Organizational Climate 

System attributes 

Developmont practices (panieularly small batches. collaboration and engage01eut and continuous integration) 

Lastly, particularchaUenges relevant to oversight are catalogued in Table 3. 

Table 3: Summary of Challenges Observed by the SEI in Overseeing Agile Programs in Government 

Challenge SUmmary 

The need for requirements to be allowed to 

evolve. and the need for ongoing government involvement in their priotitization 

Lack of communication and atigM'Ient of 

progr'am goals and strategic initiatives 

Lack of workforce knowledge, skills, and 

abilities related to overseeing Agile projecl$ 

21 

Treating initial requirements as final requirements has never ted to successful IT 

projects. (Nielsen 2009] This is primarily due to the wlatile technical and operationaJ environments our systems are expected to robusUy WOt1<. -Mthin. 

Although this is a chaRenge in any IT Transfonnation setting, the ellect of poor 

communication and alignment Is mote visible in settings where the delivery ca .. 

denett is on the order of weeks rather than months. Fr~uent deli'l;'eries auow the 

course correction that may be needed to mitigate this issue. 

This J\as been a consistent chaUenge across multiple programs adopting Agile 

and lean methods. EOIIy adopters stOJggle to find training to prepare them IO< 

new duties. Invariably the second wave of adol>ters oets more tralnino than the 

I 

I 
81 


22296A.065

nrst. after the exper1enoe or the 11rst Wf)ve In adjusting to government oversight 

obligations.. 

Difficulties ln aligning acquisition policy with 

small balch approaches like Agile 

Slowty tne acquisition policy environment is changing: until recenUy, enabling in· 

crementaJ delivery, review, and ptoduction of documentation and software products was challenging. We have seen multiple programs who had to deal with the 

overhead of large-scale document reviews at the same time they were trying to 

implement small batches or the software described in the documents. 

2.2.1 Agile in Software Acquisition 

Agile, as an altemative to traditional project management. can be a response 10 conunon acquisition failures. Large 

lechnology projec1s are fundamemally uncenain- lirne and leclmological advaocemeol ensures I hal whal you want 

loday. is almosl never what you waul tomotTOW or whal you will gel iJ1 a week. Agile's inherent flexibility can reduce some of the adaptability risks ingrained into large software projects. 

for example, requirements creep is a wliversally acknowledged problem, and dealing with changes in requirements 

is considered tl>e bane of program managers; yet, regrenably "Previous experience shows that changes within au SIS 

[soflware·intensive sys·1em] are inevitab1e, whether or not there are cbrulges in requirements or teclu1ology." [Ken· 

nedy 2011] 

A strength of Agile approaches is to explicitly anticipate and factor in the e!Iecls of inevitable change: however, 

oversight of sys1ems developmeut is often nol consistent with Agile principles and methods. (See the Appendix) 

2.2.2 Oversight for Agile has Different Questions 

Organizations tllat are successful ask differenl questions- not U1e ones typically found in oversight gu.idance. We 

observe 1he following themes in effective orga>lizations: 

empl~asis on mission needs priority vs. cost 

continual focus 011 produc1 quality 

evolving systems based on leaming vs. big bang 

oversight cadence aligned with delivery of small batches of work 

3 Overseeing Agile Settings in a Government Context 

In most cases, govenuneut organizations are not doing Agile developmelltlhemselvcs: more often they engage witlt 

Agile development co11rractors. Even in the case where organic developmcut is oectllTing witllin a goverumem organization, senior level oversight of Agile should take on a different cadence and focus than iu traditional, large 

balch developrneol seuings. 

3.1 Focus Areas of Oversight Approach in Agile Settings 

The responsibility for oversight and due diligence does not change. but the approach to oversight in an Agile seuing 

does. Topics relevant for senior government oversight personnel include. but are not linlited to: 

31 

level of understanding government personnel have for the complex u·adeoff space involved when making 

decisions 10 replace, evolve, or fix an aging legacy system 

level of •mderstanding govemment personnel have of Agile concepts and their relevance 10 program performance~ examples to discuss might include: 

o identifying clashes between Agile timeli.nes and traditional long-lead time expectations 

o managing technical debt and appropriately investing in modemiziJtg legacy sys1e.m components 

o assuring investment in technical infrastrncrme required to enable rapid delivery of quality producls 

(e.g., lest environn>ents) 

level of understanding of govenuuenl ptogram about how to partition system del.ivel"ies to gain incremental 

value on a regulal", sbon-lernll>asis while maintaining alignment with enterprise architee!UJ"e vision 
82 


22296A.066

level of willingness of govenunent program office to engage in small batch intet·actions on a fi·equent (as 

much as every two weeks) cadeuce with the developer organizatioo(s). 

Although these areas of focus are oot all directly amenable to traditional measurement, the discussion of tbe topic 

with the govenuneut program office is likely to lead the senior oversight staff to greater or lesser confidence in the 

govemmcot program's ability and conunitmcm to execute in an Agile fashion. 

3.2 Progress Measurements that are Relevant for Oversight of Agile Settings in 

Government 

The following suggestions are offered with the caveat that relevamleading indicators of progress are highly specific 

to a particular context. The adage "what gets measured, gets done" is both fonunately and mtfommately trne. 

Measures often lead to mtinteoded consequences that are in opposition to the goals of those who established the 

measures. 

Many of the typical measures you will see with Agile methods in the literature are focused on development team 

measures; however, those are not relevam for senior oversight, and their use by senior-level oversight is likely to 

skew the focus of the work being done. [Austin 1996) [Hayes 2013) 

We offer two types of suggestions with regard to measmes: 

Categories of measures that should be discussed with the govetlllllent program in terms of bow lltings relevant 

to the particular elTon are being measmed. Agreement on measures to send forward to the senior oversight 

group would be a result of this discussion. 

Measurement examples and their comtection to tbe categories discussed above. 

Table 4. Categories of Measures to Consider in Senior Oversight of Agile Settings 

Category 

Flow 

Engagement 

Quality 

Risk 

Description 

Flow measures oome out of the lean engineering and management environment. They focus on un· 

derstanding the •idea to realaation• cycle time. Flow measures for senior ovetSight focus on lhe development organization's ability to consistently meet timelines for deployment of IT 1\Jnctions aecoollng to a roadmap. Thes.e: are eyciK measur~ In weeks and months, rather than quarterly or annual 

eydes seen traditionally. 

Engagement measures help oversight organizations understand the level of coUaboratlon that has 

been achieved. Timely involvement ot stakeholders from the workflow supported by the IT system 

result$ in a deeper under$tanding of intended usage. Evolution of the WOtkflow to better utilize tech--

nology r~utts from ~ngagement with th~ correct decision makers. 

Quality measures at senior oversight levels have less to do With software defect rates than they do 

with the quality of the services supported by the IT systems. For example. improvements in wait 

times for key services, or percentage of "made it through in one pass" attempts to use a service are 

potential quality measures. These measures. in tum, drive the priorities for quality measures among 

software teams. 

Risk measures for senior oversight can focus on the development organizations' performanoe in 

managing threats to their sueoe$$, mote than those threats themselves. When using Agile methods. 

confidentty asserting the expected success of a program is no longer ba-sed on the comprehensiveness or u~front specification documents. Therefore, an oversight approach for Agile cannot rely on 

review and approval of such projective documents as the primary mode of risk identificatK>n. The 

shoo and steady cadence of Agile promotes rapid learning. 

Tile following arc examples of measures we have seen used in executive-level dashboards for services sitnilar to 

those provided by govermuent agencies. 

41 

I 
83 


22296A.067

Tallie !>. EXamples 01 Executive oasnooarr1 Measures Related to Agile mac SEI Has seen 

Deployment according to roadmap (flow) 

P~ictable delively volume (flow) 

Deployment speed (now) 

Stakehoidef inwlvement (engagement) 

Description 

An indicator ol reliable delively (into production) ol software 

capabilities in accordance with the roadmap for identified features and technologies. 

The percentage ol planned capdities oucoessltllly released 

(\\il-into a staging area or production) at the conclusion ol 

a set of Iterations. 

The typical cycle time to deploy IT capabilities Into produetion 

can be dramatically reduced using concepts in OevOps. 

Participation olstakehoidefs. as well as subject matter experts 

involved m tecfvlieal wor1<, in the events and oommunic:ation 

mechanisms intended for them. 

Synchronization of cadence across the supply chain() Agile prime contractors work with subcontractors to synchronize incremental delivery plans. Agile methods drive the synchronization points to occur more frequently than is typical in 

the past. and with a wider array of contributors. 

IT -enabled WOI1dlow performance (quality) Measurements of the ser\llce system performance before and 

after deployment of,._ IT capabiities (e.g., speed, accuracy, 

and capacity) 

Defeo! backlog (quality) 

First pass fix rate (quality) 

Deferred complexity (risk) 

Defect severity, concentration in particular system oompcr 

nents, and defect age measures help to de~be the backlog 

of defects managed by an organization. 

An indicator ol elf1ciency in rewo<k, this is the percentage ol 

defects that are correcUy repaired and pass testing on the first 

attempt. 

Many Agile organizations choose to solve the hard problems 

ear1y, rather than deferring them in favor of lorw--risk work. Appropriate focus on enablers including architecture and infrasttucture enable this pattern to a greater extent as well. 

4 IT Transformation Challenges Beyond Agile 

Agile approaches in major IT trausfonnation efforts must successfully account for key success/failure drivers that 

persist regardless of the development cadence and methodology chosen. 

Table 6. Important IT Transformation ConsideraUons Beyond Agile 

l tmportant IT Transformation Area 

Managing technical debt 

Effeolivefy dealing with cybersecurity 

51 

Explanation ollmportonoe 

At its simplest. technical debt is the Sl.l'n of both intentional and uni.nt&ntional (usually 

via defects) deferral of techn.ical 'NOrk on a system to a later po4nt in its evolution. In* 

tentional doferral - sometimes related to postponing high difficulty WOt1< 0< avoiding 

architecture change$ until a later point - also affect the rHilience and evolvability of 

the system. Practices related to technical dabt in Agile settings are sugge-sted by the 

SEI's Sollware Solutions OMsion. 

http:lfv.N.tw.sei.cmu.edu/ar'Chitecture/fesearohlarch_tech_debVarch_teeh_debLii4 

brary.cfm 

Cybersecurity and s interaction with IT systems has led to NISTs Risk-based Man· 

agement Framewo<k. [NIST 2010) Understanding and responding to the security risks 

in any IT transformation is a priority. Practices like secure coding and SQUARE (a 

method for eticiting relevant security requirements) are supported by the SEI's CERT 

Oivisioin. Agile methods may change the implementation pattern for some best practices - potentlalty amplifying their effectiveness with more frequent iterations. 

I 
84 


22296A.068

http;JIWww,cen.orglsecure-codlnQ! and l'lttp:ttwww.cert,orWcybersecur1ty·enolneerinQ/p!oducts--$ei'Vices/sguare.cfm 

Understanding the qualrty attributes A focus on quatity attributes (non·functional requirements). such as security, safety, 

dependability, performance, affordabitity, achievability, effectiveness, and flexibility, allows us to categorize a subset of system requirements that tend to pervade multiple elements, or sometimes the entire, system. For example, security of an IT system is not 

typically satisfied within a single element of the system, just as air worthiness of an aircraft does not rest in a single component. The prioritization of quality attributes is usu· 

ally visible via the system'! architecture. Not all Agile methods explicitly include quality 

attribute requirements in their approach. Methods for understanding the interactions 

and tradeoffs among quality attributes are available from the SEI's Architecture Prac,. 

tioesteam. 

http:/1\WM'.setcmu.edularohitec:tureJtoolslestablishlqaw.cfm 

Architeding for evolution and nc~ 

mental delivery 

Architecting a system for evolvability and sustainability is an ongoing prooess within a 

system development. Concepts like architecture runways are used in some Agile 

methods to ensure that sufficient framewori<: for making design decisions Is in place for 

teams to work effectively. Incremental development and delivery aJso encourages an 

evolvable architecture that is sustainable throughout the long life of many government 

IT systems. The SEt's Arcl1itecture team provides concepts and P<Octices to support 

evolVable. sustainable software architeetures. 

http://www.sei.cmu.edu/architecturel 

Communicating needs effectively to 

system developers 

Particularly ear1y in development. when system concepts are still being fonnu1ated, 

communicating aeros.s the developer/user organi%ations can be difficult Agile methods 

contaJn approaches (like us.e:r storie!) to help address this challenge. Frequent interaction, using wortcing software products to demonstrate implementation choices. helps 

address this topic, as v.oell. SEI's Measurement and Anatys.is team also offers methods 

like QUELCE (Quantifying Uncertainty In Early Ufeeycle Co$t Estimation) that help 

stakeholders specificalry identify and assess ambiguities in earty fife cycle activities. 

https:Jfw.Hw.seLcmu.edulmeasuremenVresearchfqoe4celindex.cfm 

5 Call to Action 

If asked for reconunendations, the SEI Agile in Govenunent Team would emphasize two areas: 

Ask different questions of those using Agile as pa11 of their IT Transfomtation strategy 

Support development of Agile oversight knowledge, skills, and abilities for the govenunent workforce 

5.1 Ask Different Questions 

Any sttccessft~ IT transfonnatiou involves more than the dedication oflaleuled development staff. supetvisors musl 

ask abour alignment of people, processes (Agile or otlterwise), reclmology supp011, or business context. There are 

rwo particular contexts for which different questions could be relevam-evaluation of an agency's IT transfonnarion 

strategy, and oversight of an agency's ongoing IT transfol1ltation effort. 

About the (Agile) ITTmnsfonuation Strategy 

61 

If iterative and incretnental approaches to modentization are intended, how does the cadence of work done 

by I he conrributiug elcmeors of the organization align to the modernization road map? How will leadership 

keep the effot1 synchronized, wben the pace of deployn>ent is expected to increase dramatically? 

Depending ou tlte scope of workflow activities setved by the IT transfomJarion effort, bow large and di· 

verse is tbe cohort of service delivery staff who will see an IT -driven chaoge? How deep into the Oow of 

110ntl81 work activities will this rr -driven change penneate? 

Is there evidence of consideration for resolving bigb·uncerraiuty or higb·risk areas at appropriate times in 

rhe rimclinc-rathct· tlJan defetTing mtdue amotmts of risk? 

Wirh a roadmap for incremcnral deploymcnr of these IT -driven changes in hand, stakeholders ean ask fo· 

cused questions abour the value retumed to rhose served by rhe organization. Queslions can focus on tltc 
85 


22296A.069

time frame and/or scope of deploying certain new tecllnologies (or the retiremem of old subsystems) in light 

of the scope of anticipated impact. 

About the ongoing (Agile) IT Transfomllltion Effort 

How successful is the organization in defining snlllll batch approaches to the work? Are tlte developmeot 

reruns able to sustain a sho11 iteration length (measured in weeks, notmomhs)? 

Wllllt is the trend in the time it takes to manu·e a concept all the way through development activities to the 

point where it is an accepted elemeot of a service or maintenance worldlow'? 

How consistently does the organization deploy capabilities in accordance 1vith the transfomtation roadmap? 

Are plam1ed n~1jor technology updates/introductions occwTing according to the road~1p? 

How well is tbe balauce of routine system maintenance. defect repair. and new deployments being anan· 

aged? Does the pattern of activity match the plan, and is the organization's capacity adequate? 

What patterns of feedback are seen from the users of IT systems involved in tl1e transfomllltion? User experiences associated 1vith the IT systems as well as the Agile approach should be sought. 

No matter what specific measures are chosen to provide oversight, it is vitally important to avoid limiting visibility 

to tneastn·es expressed in units of resource consumed (be it time or money). Most Agile methodologies call for 

steady resource loading and fixed iteration lengths. Schedule and cost ovemms are lagging indicators. which can be 

anticipated by examining the flow of delivered capabilities in Agile development. 

5.2 Workforce Development of Government Staff Working in Agile Settings 

ln<:reasing access to Agile-related training for govenunent staff bas already started in some areas. OMB Digital Service has sponsored development of customi2ed leaming paths and related courses to help contracting officers and 

others involved in managing Agile efforts in government to understand the concepts and to offer guidance in fulfilling agency needs with Agile projects. (OMB 2016) The U.S. Digital Service has also sponsored several outreach 

and awareness building conummicatiou activities targeted at govemment agencies. [USDS 2016) 

Several federal agencies, including Departmem of Homeland Security and the lmemal Revenue Service, llllve written guidance or policies related to enabling Agile IT projects to productively occw·. 

In the Depattmem of Defense arena, the Defense Acquisition University is in the process of enhancing its IT acquisition curricuh.tm lo include contenl related to Agile. A continuous learning course on Agile considerations in gov· 

enunentacquisition is in work, for which the SEI Agile in Govenm1ent team is an author. 

One caution: There are many cettifications available intbe conunercial conummity related to Agile, and almost all 

of them focus on roles directly involved in software development. Although ~1ny have useful comem for govemment staff to know, a certification program that focuses on the conunonly available Agile methodologies wot~d not 

serve the knowledge and skill needs oflhe staff who write the contracts and do the oversight of govenunent IT projects. 

Appendix: Agile Tenets and Principles 

The basis for all Agile methods is a set of four tenets and 12 principles tllllt were developed by a group of software 

methodologists in 2000. They were coucemed thai more and Jnore software projecls in the coi_wnercial space (their 

primary area of work) were becoming larger, more uuwieldy, and less successfhl than srnaller, more agile projec.rs 

they bad observed. Throughout two days of collaboration, ~1ey establislled ~le Manifesto ~tat is reproduced bere. 

Any method that claims to be Agile should be able to discuss how its practices and methods express these tenets and 

principles. 

With each principle, we have iucluded a sh011 statement of adaptations that we see being needed to express the principle in government settings. 

Manifesto for Agile Software Development 

http://www.agilemanifesto.org/ 

71 
86 


22296A.070

"We are lUJcovering better ways of developing software by doing it and helping others do it." Till'ougll this wot'k we 

have come to vaJue: 

Individuals and Interactions over processes and tools 

Working software over compt'ehensive documentation 

Customer collabo•·atton over contract negotiation 

Responding to change over following a plan 

That is1 while there is value in the itenlS on 1he rigb1, we va lue the items on the left more. 

Table A 1. Twelve Agile Principles Derived from the Agile Manifesto. 

Agile Principle Useful lnte<pretations in Goverrment Settings 

The highest p<iority is to satisfy the wstomer In government. the custOI'I'ler is not always the end user. The CU$totner in--

through early and continuous delivery of valuable dudes people who pay for. people who use, people who maintain, as -well 

software. as others. These stakeholders often have conflicting needs that mYst be 

reconciJed. 

Welcome changing requirements .• even late In de· Rather than saying •competitive" advantage, we usualty say *operational• 

velopment. Agile processes harness change IO< advantage. This prineip&e causes culture clash with the "all requirements up 

the customer's competitive advantage. rronr perspective or many large, ttaditional approaches. 

Deliver woll<ing software frequently, frO<n a coople What it means to *deliver-- an inetement ol softwal'e may well depend on 

of weeks to a couple of months, with a pl'efe,-enee context. With large embedded systems, we are sometimes looking at a r~ 

for the shorter timescale. lease into a testing lab. AJso, for some systems, the operational us-ers are 

not able to accept all deliveries on the development cadence--because 

there are accompanying ehanges in the wor1<flow suppo<ted by the soft· 

ware that require updates. 

Business people and developeB must work to- In ~mrnent settings, v.oe interpt'et "business" people to be end users and 

gether da!ly throughout the projeel operators. as 'Well as the other types of stakeholders mentioned in Principle 

1. since in many government settings. the business people are interpreted 

as the contracts and finance gl'oup. 

Build projects around motivated Individuals. Give A frequent challenge in govemment Is to pto\lide a suitable technical and 

them the environment and support they need. and management environment to foster the trust that is inherent in Agile settrust t11ern to get the job d011e. lings. Allowing teams to stay intacl and focused 011 a single wcri< stream is 

another ohallenge. 

The most efficient and effective method of eon- In today's WO<Id. even In commercial $e!tings, this is often interpreted as 

veying infOf'l"nation to and within a development "lllgh bandwidth" rather than only face-to-lace. Telepresenoe via video 0< 

team is face-t~ face oonversation. sc:reen-sharing aJIO'W'5 more distributed work groups than in the past. 

WOC'king software is the primary measure of pr~ OUr typical government system development approaches use s.ooogates 

gross. ror software - documents that pro;ec.t the needed requirements and design 

- rather than the softwate itself, as measures of ptogress. Going to small 

batches in short incrl!ments allows this principle to be enacted. even in 

government set1ings. although delive<y may \VOII to be a test environment 

or some internal group other than users themselves.. 

Agile processes promote sustainable develop- This principle is a caution against seeing agility just as - do it raster: Note 

ment. The sponsors, de~lopers, and users that this principle includes stakeholders outside olthe development team 

should be able to maintain a constant pace indefi· as part of the pacing. 

nitety. 

Continuous attention to technicaJ excellence and This is a principle that often is cited as already being compatible with tradi· 

good design enhanoes agility. tiooal government development. 

Sinplicity-tlle art ol maximizing the amount ol One issue with this principle in government settings is that our contracts 

work not done--is essential. are often written to penatize development organization if they don't produce 

a product that reflects 100% of the requirements. This principle recognizes 

that not all requirements we think are needed at the onset of a project will 

necessarily tum out to be things that shoUld be included in the Pfoduc:t. 

81 

I 
87 


22296A.071

The best arctitectures. requirements. and designs emerge from self-organizing teams.. Note that the principle does not suggest that the development team is necessarily the correct team for requirements and architecture. It is, however, 

encouraging teams focused in these areas to be alkwled some autonomy 

to organize their work. Another complication in many government settings 

is that we are often re-architecting and re-designing existing systems. 

At regular intervals, the team reftects on how to 

become more effective, then tun~ and adjU$tS its 

behavi()( accordingly. 

Thl!: principle is a.n attempt to ensure that , essonsleamed"' are actually 

learned and applied rather than just being , essons written. • 

References 

(Austin 1996] 1n addition to providing excellent guidance, this book offers oo- Austin, R. Measuring and Managing Performance in Organiza- herent advice on avoiding the misuse of measurement. lions. New YO<I<: Dorset House Publishing. 1996. 

(Hayes 2013] This SEI report provides initial guidance on issues to address 

Hayes. W. et al. Agile Metrics: Progress Monfforing of Agile when ~signi119 a program of Agile progress meltics In a gov· 

Ccnlraclot$. CMU/SE1·201$-TN.029. Software Engineering In- emment setting. 

stitute, Camegle Mellon Univef$ity. 2014. http:/Jre-. 

souroes.sei.anu.eduJ1ibrary/asset-view.cfm?as.setid=77747 

o<ennedy 2011] This presentation from (at the time) DAU professOC' Matthew 

nnedy, M. "Achieving Better Acquisition Outcomes in Aus .. Kennedy, reviews relevant aspects of Agile devek>pment for 

lere rKnes." Oefense Aequisftion niv~ity Symposium. April government program offices. 

2011, 

(Laph•m 2011] This SEI report addresses several topics of conoem to acquisiLapham, M.A et al. Agile Methods: Selected DoD Acquisffion tion professionals considering or already taking on adoption of 

and Management CCHtCems. CMUISE1·2011·TN.002. Soft· Agile methods and principles. This report includes a chapter 

ware Engineering Ins-tiMe, Carnegie Melton University. 2011. on cutturaJ issues that commonly must be addressed in Agile 

http://resoorces.sei.cmu.edullibrary/asset·view.ctm?as.- adoption. 

selid=9769 

(Miller2014] This white paper summarizes a method that the SEI has deMiller. S.M. "'The Readiness & Fit Analysis: Is Your Organiza- veloped to hetp government and other regulated organizations 

tion Ready fOC' Agile?'" Software Engineering Institute, came- understand the adoption risks they may face wllen they under· 

gje Mellon University. 2014. http://resources.sei.cmu.edul take adoption of Agile methods and principles. 

libfary/asset·view.cfm?ass.etid-=90977 

(Nielsen 2009] Or. Nielsen's testimony outlines the major challenges that the 

Nielsen, P. '"Challenges to Effective Acquisition and Mana_ge- SEI has seen in suppoc1ing major software aoqui$itions over 

ment of Information Teehnology Systems." Invited testimony the previous twenty years. 

for the U.S. Senate Anned Services Committee. 2009. 

httpsJiwww.gpo.gov/fdsys/pl<g/CHRG-111 hhrg51959/ 

pdfiCHRG-111hhrg51959.pdf 

(NIST2010] This guide pro\1des organizations in the federal space v.ith 

Various auth<>r$, ·Guide IO< ApplyiJ19 the Risk Management guidance on applyiJ19 NISrs Risk Management Framework, 

Framework to Federal Information Systems. • SP-8()().37. Na· designed to provide a risk-based approach to cybersecurity 

tionallnstitute of Standards and Technology. 2010. threat management. 

http11csrc.nist.gov/groups/SMAifJSmalframework.html 

(OMB2016] This program ts meant to help acquisition professionals under· 

Various authOfS. Announcement of Agile Contracting Curricu- stand various aspects of Agile and lean concepts so as to bet· 

lum. 2016. http:/lwww.icfi.com/contracts/fealured/<f.gilal-ser· ter prepare contract materials in Agile settings. 

vice-<:antracting-professionaJ-training-and-development·program 

(~igby 2016] This article provides a high-levef summary or issues in leaderRigby, D. el al. "Embracing Agile. • Harvard ness Review. ship of an O<ganiution movi119 towards Agile. Although the 

May2016. examples go beyond IT transformation settings, they are still 

relevant to IT transformation. 

91 
88 


22296A.072

[USDS2016) 

Various authors. United StatH Digital Service blog. 

hnps:llwww.usds.gov/blog 

[Ward & Miller 2016) 

Ward. D. and Miller. S. Update 2016: CoMldoratlom Using 

Agile in DoD Acquis;tion. 2016·TN-oo1. Software Engineering 

nSI~ute . Carnegie Mellon nive~ ty. Pittsburgh, PA 15213 

Thfos ~ite provide$ ongoing infotmation about the 'NOrte that 

U.S. Digital St-rvice sponsors and engages in. 

This is an update to the original TN that started the SEt Agile 

Adoption research. It adds In a case study and references 

2015version of DoD 5000.02 and its changes that better support Agile use in DoO settings. 

Selected SEI Agile in Government Resources 

I Lapham. M. A. e1 al. "How /1\it Force Acquisition can Ellleotively Adopt AtJH Methods". Joint Mitre and SEI briefing lo 

General E. Pawlikowski, April 8, 2016 

Carney, 0 ., Miller, S. and Korze<:, K. AgHoln Government: 

Myth5, Monsters, 11nd FabiM. Software Engineering Institute, 

C<lmegie MeUon University, 2015. 

Lapham, M. and Miller, S. "Applying Agile in the Do[Y. podcast 

series. Software Engineering lnstftule. 2014-2015. 

«p twww.sel cm edu/podcas sl gile-in-the-dOd/ 

SEI Home Page for Agile Adoption Researc:ll 

http:/.!Ytww".sei.cmu.edu/acquisitiootresearch 

Palmquist, S. et at. Parallel Worlds: Agile and Waterlall Difference$ and Similarities, 2013-TN-021, Software Engineering lnstftute. Carnegie Mellon Unive~ity, Octot>e< 2013. 

Acknowledgements 

This briefing, a joint eflo<t between Mitre and SEI. p<ovicled 

General Pawlikowski wl1h the organizations' perspedive on 

INifriers and enol>lenllo Agile acfo!llion in the USAF. 

This booklet provides acquisition ptofes$lonals new to Agile 

methods with a set of common myths related to Agile methods 

and basic infonnation to help them unde~tand the potential ef· 

fects of Agile on their wol1c, 

Thin is series of podcasts relates the experiences of the SEI 

researchers working wtth OoO programs using Agile to the 

twelve Agile principles. 

This horne page provides links to an the publicly available resources related to SEt's Agile Adoption in Regulated Settings 

research and transition efforts. 

This report helps acquisition professionals accustomed to 

common US government acquisition language with a ·Cl0$s· 

walk• between Agile tenns and mOC'e common terms used in 

waterfall·styte acquisitions. 

Tile Agile in Govemmentteam would like to provide a special thank you to two individuals atllle SEJ who 

have constantly championed and shepherded our Agile adoption research since its inception in 2009: John 

Foreman authorized the origiJ1al USAF project that began our research in Agile adoption, and bas been a consistent, stalwru1 champion of the work both inside and outside the SEI. Mary Ann Lapham was the original 

leader of the research and continued in that role until her upcoming retirement from l11e SEI. She bas shaped 

tl1e research and provided uncompromising supp011 to the team of researchers involved in the Agile in Government research and b·atJSition work. Our sincere thanks to you bol11 from the Agile in Govenunent team. 

10 I 
89 

f 


22296A.073

For more Information, please contact: 

Eileen Wrubel 

Senior Member of the Technical Staff 

S8 Software Solutions Division 

P: 412.268.9976 

E: eow@sei.cmu.edu 

Suzanne Miller 

Senior Member of the Technical Staff 

SEJ Software Solutions Division 

P: 412.268.9143 

E: smg@sei.cmu.edu 

William Hayes 

Senior Member of the Technical Staff 

SEI Software Solutions Division 

P: 412.268.6398 

E: Wh@sei.cmu.edu 

Alyssa Le Sage 

Legislative Analyst 

P: 703.247.1346 

E: 412·297·9023 

About 

For tour decades. the sonware El1glneettng Institute (SEI) has 

been helping government and Indus tty organllatlons to acquire. 

develop, operate, and sustain software systems that are 

lnnovaUve, affordable, endurtng. and trustworthy. 

02016CarnttiGMdonUniYersity 1 07.11.2016 

Contact Us SOilware Engineering Institute 

4500 Afth Avenue. Pittsburgh. PA 15213-2612 

Phone: 412.268.5800 1 888.201.4479 

WOb: www.sel.cmu.edu 1 www.cert.org 

Email: JnfO@sel.cmu.edu 
90 

Chairman JOHNSON. Thank you, sir. 

It seems like we should have gone over all those things when we 

built the new centers, right? 

Mr. Klopp, the President’s budget requested $300 million to modernize Social Security, and after asking for months for a plan, this 

week, Social Security finally provided something to the Congress. 

Given that Social Security already wasted $300 million on the Disability Case Processing System before starting over—money taxpayers can’t get back—I want to ask you, are you confident that 

the proposed $300 million will cover the entire modernization 

project, as the budget claims? 

Mr. KLOPP. First, I guess I would just get out of the way the 

fact that the DCPS stuff and the $300 million that was spent before was spent before I got here, all right. 

What I did was, about 9 months ago, started the agency on a 

path to build the plan which is now in front of you, and as you can 

imagine, building a plan as comprehensive as a plan to modernize 

all of the IT infrastructure, 9 months is not a bad effort. The plan 

has been in continuous improvement. And, you know, frankly, we 

have briefed your staff continuously over the course of that 9 

months, so there is really very little in the plan that was new and 

a surprise. What was new was the roadmap and cost model that 

we built in the plan, and so I am hoping that later on we will have 

some questions that will let me go into that in more detail. What 

I will tell you is that the cost model also has been built up 

iteratively over the course of the last 9 months. 

We believe, at this stage, that the model we have put together 

and the commitments that are implied by the roadmap that is in 

the plan are extremely high quality. We worked very hard to create 

what GSA would call a rough order of magnitude estimate that is 

extremely high fidelity. So we think we can do what is in the plan. 

We believe the effort that we put into building up those cost models 

is a level of effort that is not usually seen in the government in 

building a rough order of magnitude, and I stand behind it. 

Chairman JOHNSON. Well, are you protecting taxpayer dollars, 

is what the question is, and are you going to stay on budget? 

Mr. KLOPP. You know, I think we are going to stay on budget. 

I think, you know, one of the things that Mr. Hayes said that I 

think is really important to keep in mind is that, in this new Agile 

world, what we focus on is trying to deliver value every time we 

go through an iteration, an Agile iteration. And so we think that 

the Agile process is going to allow you to look at the things that 

we have in the backlog, the amount of money that we are spending 

as a run rate and, at a very regular interval, be able to determine 

whether or not we are adding the value with these increments that 

we claim we are adding. 

I think that Agile is less about defining an end point in advance 

and driving to that end point and then declaring that we have hit 

something on time and on budget. So we are going to use Agile. We 

are going to expect you to watch over us like a hawk. And we think 

that we will be able to consistently deliver value through this entire plan. 

91 

Chairman JOHNSON. Let me ask you a little different question. 

You know, you are a political appointee and that means, in January, are you going to leave Social Security? 

Mr. KLOPP. We will see, alright? I don’t have a long-term contract, alright? 

Chairman JOHNSON. What are you doing to make sure that 

this project stays on track once you leave? 

Mr. KLOPP. We think we have detailed plans that we are going 

to put in place, but right now, we are at the stage where the detailed plans are highly dependent on the $300 million request we 

have for additional funding. If we don’t get the $300 million, I 

think that the plan really completely unravels. We are undergoing 

some pretty severe budget cuts, and it is going to impact IT I think 

more than anywhere else. So I don’t see much opportunity for us 

to take on IT modernization without the additional funding. 

Chairman JOHNSON. Thank you. 

Ms. Byrd and Ms. Melvin, you have seen the impact of turnover 

in Social Security, what else should be done to make sure that taxpayer dollars are not wasted? Either one of you. 

Ms. BYRD. I will go first. From the OIG perspective, what we 

really want is a long-term plan. We can’t have an annual plan that 

then goes away. As I mentioned in my oral testimony, SSA has 

gone back 25 years in saying that this must happen, and we are 

now here again today discussing this modernization effort. 

So what we would like to see is a very detailed plan going forward that is sustained beyond 1 year, beyond one Administration. 

Chairman JOHNSON. Well, you know, when we built those two 

processing buildings, they told us that was the end of the problem, 

and it hasn’t seemed to happen. I am out of time. I am going to 

recognize Mr. Becerra. 

Thank you for your comments. 

Mr. BECERRA. Mr. Chairman, thank you for this hearing, and 

I hope we are able to follow it up with more, because I think it has 

become very clear that we need to do something, but we have to 

make sure that whatever that something is, it is going to work. 

May I suggest, Mr. Chairman—we were just chatting a second 

ago—that we try to bring together the Inspector General’s Office 

and the GAO’s Office, who are watchdogs, sit them down with 

Mr. Klopp and his folks, and that we, the Members of Congress, 

those of us who sit on this Committee of jurisdiction, we get to sit 

with you all to hear what is going on, because if you are going to 

ask for the money, I think we want to have a sense that it is going 

to work. 

And, as Ms. Byrd just said, this is a long-term project. And as 

Mr. Klopp just said, you are going to need the money. You can’t 

do a long-term project without knowing you have a stable source 

of funding to help it happen. And I think what you are probably 

going to hear from this dais is that people want to know if you are 

going to get the money, there will be a product that works at the 

end. 

And I don’t think we have much more time to wait or waste, 

right, because my understanding is it is getting worse every day. 

You are running out of broadband. Your folks are taking longer 

and longer to access information, and you are getting more and 

92 

more people coming through the doors of Social Security offices. 

And so I think it becomes really important for us to work on—it 

is almost like diving out of the plane together. We all have to trust 

that we will all know how to pull each other’s parachute string at 

the right time, and we can’t afford—failure is not an option if we 

are all hanging together. 

I think it is also going to be important, as Mr. Hayes has testified, to have someone from the outside, especially those who are 

doing this and have done it well, to instruct us, because sometimes 

we get in our shells and don’t recognize all the best technologies 

that are out there or some of the failures and we will have someone 

that can inform us. 

Ms. Byrd and Ms. Melvin, do you think your offices would be 

willing, if the Chairman and Members on this Committee were interested, to sit down, not necessarily having to do a hearing but 

just to sit down, to have a working group, that your offices would 

be willing to participate in that? 

Ms. BYRD. Absolutely. 

Ms. MELVIN. Yes, definitely, we would. 

Mr. BECERRA. Mr. Klopp, I don’t know if you can speak for everyone at Social Security, but would you be interested in participating in something like that? Would your folks at SSA sign off on 

allowing you to have additional meetings with Members of Congress who are interested in following up with you on this? 

Mr. KLOPP. Absolutely. I think we have already tried to engage 

with your staff much more effectively than maybe has been going 

on in the past. 

Mr. BECERRA. Mr. Warsinskey, do you think that would be 

something that the folks who actually have to do this on the 

ground that you represent would be supportive of? 

Mr. WARSINSKEY. Very much so. I think that is the key, with 

everyone getting together and being on the same page and going 

in the same direction. 

Mr. BECERRA. And, Mr. Hayes, I am assuming that you think 

it is better to look from the inside versus from the outside at how 

this is happening, because all of us, whether we are in the Federal 

Government or not, are going to deal with Social Security at some 

point in our lives. 

Mr. HAYES. Yes, sir. 

Mr. BECERRA. So, Mr. Chairman, I would really urge us to see 

if we can sit down, whatever all of you think is a good group, to 

just try to follow this up, because I think the Chairman’s admonition is absolutely correct: We can’t afford to have someone come up 

here and say, you need the resources, whether it is to have those 

new buildings in which we are going to house a lot of the IT capabilities, move forward, then all of a sudden find that it is just not 

cutting it. 

And I hope that what we will do is we will get a clear sense of 

the path on the budget numbers that you really need, because, 

well, as you just saw, yesterday the Appropriations Committee actually cut SSA’s budget and, as I think, Mr. Klopp, you mentioned, 

it would be impossible to move forward on any IT improvement if 

your budget is cut. And so I think people are going to demand some 

real precise numbers to feel comfortable about allocating the reVerDate Sep 11 2014 07:20 Apr 04, 2017 Jkt 022296 PO 00000 Frm 00096 Fmt 6633 Sfmt 6602 I:\WAYS\WAYSPS\22296\22296.XXX 22296
93 

sources for this without taking it from another very important aspect of Social Security Administration’s work. The last thing we 

want to do is take it from Peter to give it to Paul. 

Is there something, Mr. Warsinskey, that we should know that 

the folks, the frontline folks would like Members of Congress to 

know, in terms of how we could do this and do it right? 

Mr. WARSINSKEY. I think, as I was saying in my testimony, 

our biggest concern right now is that, as we interview the public, 

every member that walks in, they are waiting longer. Our interviews are taking longer. Every part of our work is just—there is 

a frustration building, because, especially in the middle of the day 

where you are just waiting for things to move. The Social Security 

employees are really under the gun to move, to use every second 

they can. They need to use every second. It is very frustrating 

when they can’t use the time they have to do something. 

Mr. BECERRA. I appreciate that. 

Mr. Chairman, thank you for holding this hearing. 

Thank you to all the witnesses for their testimony. 

Chairman JOHNSON. Thank you, sir. 

Mr. Smith, you are recognized. 

Mr. SMITH. Thank you, Mr. Chairman. 

And thank you to our witnesses. 

Mr. Klopp, how far along would you say you are in this plan? I 

mean, there was the assertion made previously that some of the 

documentation and so forth is brand new. How far along would you 

say you are? 

Mr. KLOPP. I have been at SSA for about 18 months, and it is 

so apparent the minute you get there that IT modernization is almost an existential problem. About 37 percent of our staff will be 

eligible to retire in the next 5 years. So IT modernization is something we jumped on right away. 

What we have done in the last 18 months is to start the cultural 

change to get our heads wrapped around Agile. As Mr. Hayes 

points out, the workforce, cultural change like that is critically important. But we also started working on the technology. 

So we are now at a point where we are rolling out our first production applications in the cloud. We are building applications 

using very modern software languages like Node.js, and we are 

using Agile in an agile way. I think we are doing well at that. So 

a lot of the 18 months has been preparation to be in a position 

where we could actually execute on the plan. The plan itself has 

really probably grown up I am going to say in the last 8 months, 

and that basically started when we asked ourselves, what would 

we do if we were going to completely rewrite systems and engage 

customers in a completely different way? So we started a project 

that we call Customer Connect. 

And, really, the major upgrade that I mentioned, the roadmap 

and costing, was only—we could only really do that, without just 

making really big ridiculous swags, in the last few weeks as the 

Customer Connect team developed for us descriptions of the business processes that drive the whole agency. 

So the answer I think is we have a toehold. We have a beachhead. The workforce has learned enough to be able to move forward 

on this thing. And, really, we are just waiting for the funding. 

94 

Mr. SMITH. So would you say the funding is the largest obstacle? 

Mr. KLOPP. It is. We have to have the funding. 

Mr. SMITH. So, once you get the funding, do you see any other 

obstacles changing or evolving along the way? 

Mr. KLOPP. You know, it is never going to be perfect, right? But, 

we think that we can do this. The other thing I think that is important is we have turned DCPS around. We have turned it around 

by using all these Agile modern methods. And it is really DCPS 

and our ability to develop code in DCPS that has become the yardstick that allows us to come up with these estimates. 

We believe, now knowing the kind of velocity that we can get out 

of programmers in a modern environment and being able to relate 

the business problems we are solving in DCPS to the business 

problems that we have to solve if we modernize title II, that we can 

get this rough order of magnitude and say, yeah, it looks like about 

the same thing. 

So I actually don’t believe that there are technical obstacles; I 

just think we have to get on with it. 

Mr. SMITH. You know, in the Federal Government, as it relates 

to dollars being spent and so forth, there are oftentimes a lot of 

boxes that need to be checked. Oftentimes, those don’t have anything to do with quality or efficiency. 

Do you feel that you have the flexibility, that there is enough 

flexibility in the system or, you know, in the surroundings, that 

there is enough flexibility to get the job done? 

Mr. KLOPP. That is really a very interesting question. I think 

you can actually see a little bit of tension at the table here between 

the Agile side of the world, which is really sort of about get on with 

it, manage things in an iterative way, work very hard to make sure 

you are adding value with each iteration, as opposed to, you know, 

the counterview, which is, we have to have detailed plans that lay 

everything out several years in advance and how we have to work 

to these detailed plans. 

Agile is about agility. It is not about prescriptive plans. And so 

what we have done is engage the IG and OMB and start trying to 

find a way to work in this agile way to provide all the value that 

Agile provides and still provide the kind of management oversight 

on top of this thing to make sure that we are delivering value as 

we go. 

But in the same way that it requires me to retrain my programming staff in how to deal with Agile and to deal with some of the 

cultural concepts that Mr. Hayes suggested, I think that also some 

of those cultural changes are going to have to impact the way we 

provide oversight on these things, and it is going to impact folks 

like GAO and, you know, the Inspector General’s Office. 

Mr. SMITH. All right. 

Thank you, Mr. Chairman. I yield back. 

Chairman JOHNSON. Thank you. 

Mr. Kelly, you are recognized. 

Mr. KELLY. Thank you, Chairman. 

And thank everybody for being here. 

Mr. Hayes, I am from right above Pittsburgh, so I know the wonderful work that you have done. I am from the private sector, and 

95 

just as a lead into it, not only you but all of us are going to find 

out in January if we are still here. So it doesn’t really—we are all 

in temporary service. 

Coming from the private sector, though—and this is something 

I have watched now for the 5 years I have been here—we are always trying to find out who to blame for things not working right. 

But in the private sector, in the business I have been in my whole 

life, I would have the folks that I work with come to me and say: 

‘‘Hey, there is a new machine we have to get’’—I am an automobile 

dealer—‘‘we need to get this new paint room.’’ And I would say: 

‘‘How much does it cost?’’ 

And they would say: ‘‘$250,000.’’ 

And I would say: ‘‘Well, how are we going to pay for it?’’ 

They would say, ‘‘Well, there is a great loan program, or you can 

lease it.’’ 

I said, ‘‘No, no, how are we going to make the payments?’’ Because if we don’t have enough business to cover it, it doesn’t make 

sense. So I would never buy anything—if it didn’t kill more than 

it ate, it couldn’t come in the store. 

The problem that you face is huge, because without more people 

participating—I am talking about now the labor rate participation. 

I am not talking about unemployment, because people looking for 

jobs and not finding a job are the only ones considered unemployed. 

The people that don’t have any hope and aren’t even looking for a 

job aren’t considered in the market anymore. 

But the real elephant in the room is not the program that you 

are trying to put forward. The real elephant in the room is the fact 

that we don’t have enough revenue to continue to build a business 

model that would make sense in the private sector. Nobody in the 

private sector would sit there and say: ‘‘You know what? This is a 

new program I am going to institute. Let’s go ahead with it.’’ Because the next question is, who’s going to pay for it? My understanding—and this is from signing payroll twice a month—6.2 percent from the person that is out there working, 6.2 percent 

matched by the people who pay him or her, 12.4 percent out of 

every paycheck up to about $118,000. 

If we don’t get more people back to work, if we don’t have a dynamic and robust economy, all of this talk that we are having is 

just that. It is just talk. You have my—I think you have around 

65,000 people working in Social Security right now. You need a lot 

of money to update. You need a lot of money to continue to grow. 

In our business, if we stop spending, we are going to die. We have 

to constantly move, all the time, move up, move up, ratchet up. 

What you are doing is making more people more effective, more efficient through technology. That is the way you fix it. The question 

is, how do you pay for it? 

I think too often we worry here about the political ramifications 

of, who are we going to blame? Who are we going to blame for us 

not being able to get there? First of all, Social Security is a business. We have to have more money coming in than going out. It 

is just that simple. These are not hard things to figure out. Then 

the question becomes, if we are going to have this constant conflict 

all the time and it is always a tit for tat and telling us who is responsible for it not failing, the reason it is not working is because 

96 

we don’t have an economy that is functioning right now. You can’t 

do a darn thing about that. We can through policy. We can look at 

things and say, why aren’t we growing? Why aren’t we fulfilling 

our full potential? The answer in most cases is the private sector 

can’t continue under the heavy burden of taxation and regulation 

and then being held responsible for not providing enough revenue 

to run the business. See, I look at it just that simple. And all the 

things you are trying to do are wonderful. But if we can’t afford 

to pay for them, they never get done. So I think I would rather be 

looking at—I want to sit down and talk with you. I want to hear 

from you how you could fix this, what you have to do to update, 

what you have to do to modernize. As you look at the growing number of people on Social Security, we have to make sure that we fulfill that promise to people, but we also have to make sure the 

model isn’t a flawed model that is not sustainable. 

Too many programs right now are unsustainable. They were 

unsustainable from their very concept. From the time they went 

into effect, they couldn’t be held on that long. We knew we couldn’t 

do it. But you know what, if we could just get through the next 

election, then we would work on it again. 

So I appreciate everything you are doing. I mean this sincerely. 

If anybody gives you a hard time—listen, you are working for the 

same people we work for, that is hard-working, American taxpayers. And they expect the flat level best from us every single day 

we come to work. So I don’t want to blame you for anything. I want 

to work with you. I want to finally do it. But you know what? What 

you need to demand from us is not just more money to operate but 

a stronger economy that can fund it, because I know where the 

money comes from. Every single penny comes from a hard-working, 

American taxpayer. It is in their paycheck. It is matched by their 

employer, but it only matters if they are working. It only matters 

if their wages are rising. All of the rest of this, we are just chasing 

ourselves around about the real problem. 

The real problem in this country right now is an economy that 

is not growing. With the assets that we have and the opportunities 

that we have facing us right now, if we really want to make America great again, then we have to have policies that allow America 

to be great again, that don’t hold us down. You need more money 

to operate, and we need to come up with policies that will allow 

the people who fund this wonderful government—and that is a private sector—allow them to grow, allow them to succeed, allow them 

to be profitable, allow them to be a bigger participant when it 

comes to revenue. And you only do that through working toward 

a mutual end that is beneficial for everybody. 

I have no questions for you because you are all on the right 

track. The question is, who is going to pay for it? And the answer 

is the labor force. We have more people working. That is where it 

comes from. It is not a mystery. The money does not come from the 

government. It comes from working people who pay taxes. We collect it, and then we redistribute it. 

Chairman, thank you for having this. 

Mr. Becerra, I agree with you. Listen, if we can’t fix this, shame 

on us. The big thing we have to fix first is our tax system and regulation system because the people who provide all the revenue are 

97 

the people that we whip every day. We whip them every day, and 

we hold them responsible for not paying their fair share, and then 

we make it impossible for them to win. That just doesn’t make 

sense to me, not from the world I come from. 

Thank you, Mr. Chairman. I yield back. 

Chairman JOHNSON. Thank you. 

Mr. Renacci, you are recognized. 

Mr. RENACCI. Thank you, Mr. Chairman. 

I want to thank you for holding this hearing to further understand the Social Security Administration’s IT infrastructure. I also 

want to thank the panel for their testimony, especially Mr. Warsinskey, who I have had the opportunity to meet with in the past 

and discuss many of these issues that have been brought up today. 

Thank you for your service. Thank you for traveling here from 

Cleveland and for everything you do for northeast Ohio. 

I take great pride in the work that my office has done in Congress in helping northeast Ohioans access earned Social Security 

benefits. Oftentimes, I hear from constituents about the struggles 

they are having with the Social Security Administration and how 

long it takes for issues to be resolved. One example, Denise from 

Akron, Ohio, worked with my office for more than 6 months, had 

her claim resolved after spending 6 months on her own working 

with the Social Security Administration on her case. 

It is clear that the IT infrastructure must be dramatically improved in order for the Social Security Administration to meet the 

needs of the American people. I was a businessowner as well for 

three decades before I came here. In your testimony, Mr. Warsinskey, you shared results from an SSA employee survey that showed 

how frustrated Social Security Administration employees are with 

the current system. It is clear the aging IT structure has not only 

reduced productivity but negatively impacted the services constituents receive. 

You know, it is interesting. Ultimately, frontline employees have 

to bear that burden. I saw the green screen, which I probably 

haven’t seen since I was in college. And then you talked about 

COBOL, which I had to chuckle at. I remember COBOL. I remember dropping the cards on the floor and having to pick all the cards 

back up and having to reshuffle them to make the program work. 

So I hope the COBOL you are talking about isn’t the same one I 

was working on back in college, or we really have some problems 

with Social Security. But I can tell you that has to be a problem 

in retaining high-quality employees. 

Mr. Warsinskey, can you tell me how that—tell me some of the 

instances? Are you having problems? Especially younger employees, what do they say when they see these screens in COBOL and 

things they have never probably even heard of? 

Mr. WARSINSKEY. It is interesting when we interview people 

that are starting out that we tell them that you only maybe know 

one-millionth of what you are going to learn, because you don’t go 

to college to learn what you get trained in Social Security. We have 

a completely unique system that only we do. And when they start 

working, they say, ‘‘This is so convoluted.’’ It is very hard for them 

to really comprehend. They spend a couple years really just trying 

to understand all the screens because it is so inefficient and it 

98 

takes so much time. It is frustrating. And I think we lose staff, and 

it does affect our morale, many of the new staff members coming 

in because they learned under a different system just in the way 

they train. We have issues with just doing online training now because we don’t have the bandwidth, and we have to often download 

things overnight. But the kind of modern way we do training and 

go about our business is just not there. We are working in a very 

old system, and I think our staffs would relish seeing this kind of 

plan that hopefully will provide a great deal of hope for our agency 

and for our public in the next few years. 

Mr. RENACCI. I would agree. You mentioned something about 

the speeds declining, oftentimes outages throughout the workday 

that slow processes down. Do you have any measure of the amount 

of productivity hours that are lost due to all of that? 

Mr. WARSINSKEY. Well, in our surveys, we found that, on average, we are losing about 20 minutes per employee per day of productivity. Now that is throughout the day and that is everyone in 

the field offices. But I talk to people from all over the country, 

whether they work in a field office or in our headquarters or in the 

hearings offices or the payment centers, they all have the same 

frustration with the loss of time because their computers are slowing down, and they are just waiting. So that adds up. I mean, all 

that time costs money. And then you build all this infrastructure, 

as I say, with the buildings and everything else you pay for. All of 

that is supporting the staff. And it is not an efficient use of our tax 

dollars. And, you know, we could do a lot more with less if we could 

improve this. 

Mr. RENACCI. I think your last line was the most important 

one, and that is the one that I was getting at in the business world 

which I was in, and you heard Mr. Kelly. You know, infrastructure 

is important. And sometimes if you have the right infrastructure, 

you—I hate to say this—you gain productivity. You don’t need 

many personnel. But one thing I have learned today and I keep 

hearing—and I think most of the Members here on the panel are 

agreeing—that your infrastructure needs to be changed. But what 

we need to do is make sure that we spend it properly, because it 

is taxpayer money, and that we come up with a plan that works 

for the long term, not the short term. 

And I would be willing to work in this group that Mr. Becerra 

talked about to come up together with a plan, working together, to 

say: Here is how much we are going to spend. Here is why we need 

it, which I have had to do all my life in the business world. They 

would come and say: I need to spend X amount of dollars on infrastructure. 

I said: Okay. Explain it to me. Tell me how long it is going to 

last. Tell me the—these are the kinds of things that would be important because we are spending taxpayer dollars, but there is definitely a need. 

So I thank all of you for your testimony. 

I yield back. 

Chairman JOHNSON. Mr. Rice, you are recognized. 

Mr. RICE. Thank you, Mr. Chairman. 

I want to start out with you, Mr. Hayes. Why is it so hard? I 

mean, I know there are a lot of records, but it is not like we are 

99 

using this computer system to design a rocket ship or something. 

We are just keeping records, right? This is a database, right? 

Mr. HAYES. The demands on how the data are used do evolve 

rather rapidly, and the ability to try to keep up with the operational use of the software systems can be very challenging. 

Mr. RICE. What you are saying is to replace it and keep the old 

one running at the same time is what makes it hard? Is that what 

you are saying? I mean, this is a database program. 

Mr. HAYES. Database structures have evolved. The technology 

that allows us to quickly access data, especially as the volume of 

data grows, the new technologies don’t tend to work on old platforms, because those old platforms didn’t have in mind—— 

Mr. RICE. But you can convert it. 

Mr. HAYES. Yes, you can. 

Mr. RICE. I don’t understand why this is so difficult. Is it that 

the people running it are incompetent and cannot get it done? Is 

that the problem? 

Mr. HAYES. Certainly not. It has been my experience, most people who have jobs like these do this out of a sense of loyalty to the 

mission they serve. So they are working as hard as they are able 

to in the structure they are working. This is for many men and 

women in uniform that defend our country as well as those working in the offices you have heard described today. 

Mr. RICE. Well, certainly, we want to make sure the men and 

women in uniform are well taken care of and that the American 

public is, but we hear this threat that if we don’t do something 

about this thing and get it modernized, then we can have disruptions in service, and it affects a lot of our GDP, what Social Security deals with every month. 

What I am frustrated with is sitting here reading these reports, 

in particular yours, Ms. Byrd, about the fact that we have spent 

$300 million here and $280 million here, and we are still using 

COBOL, for God’s sake. 

Mr.—I don’t know how you say your name. Warsinskey or—— 

Mr. WARSINSKEY. Warsinskey. 

Mr. RICE. How long have you been at Social Security? 

Mr. WARSINSKEY. A little over 40 years. 

Mr. RICE. Four years? 

Mr. WARSINSKEY. Forty years. I have seen a lot of change. 

Mr. RICE. You are still using COBOL? You haven’t seen that 

much change. You are still using COBOL, for God’s sake. 

Mr. WARSINSKEY. When I first started, we just had teletype 

machines, and we didn’t even have dumb terminals. 

Mr. RICE. Maybe we should go back to abacuses. I mean, I guess 

maybe there is some advantage to using COBOL, because probably 

the hackers out today, they probably don’t know how to hack into 

it because they have never seen such antiquated stuff. 

What is your position there? 

Mr. WARSINSKEY. What is my position? 

Mr. RICE. Yes. 

Mr. WARSINSKEY. I am the District Manager in downtown 

Cleveland. And I am also—that is my regular job. I am also President of the Social Security Management Association, but my regular job is I manage every day. I work with my staff. I hire—— 

100 

Mr. RICE. Okay. So you are not over IT? 

Ms. Melvin, you are, right? 

What is your position, Ms. Melvin? 

Ms. MELVIN. I would point to some underlying management 

problems. 

Mr. RICE. What is your position, Ms. Melvin? 

Ms. MELVIN. I would point to some underlying management 

problems. We have noted over time—— 

Mr. RICE. What is your job, Ms. Melvin? 

Ms. MELVIN. What is my job? 

Mr. RICE. Yes. 

Ms. MELVIN. I am the Director for Information Technology 

within—— 

Mr. RICE. So you are over IT? 

Ms. MELVIN. Yes, I do look at IT issues. We audit them. 

Mr. BECERRA. Do you look at IT issues within GAO? 

Ms. MELVIN. Yes, within GAO. I am not with SSA. 

Mr. RICE. Okay. So you don’t control this, but you do, sir. How 

long have you been with Social Security? 

Mr. KLOPP. Eighteen months. 

Mr. RICE. Are you not embarrassed about using COBOL? I 

mean, good grief. 

Mr. KLOPP. I am not embarrassed. I take it as a challenge, and 

it is my job to try to fix it, which is why I’m here. 

Mr. RICE. Why is it so hard? It is not like we are asking for 

these incredibly advanced systems. This is a database system. 

Mr. KLOPP. I think, first off, it is more than a database. We 

make decisions about who gets disability from the data. We make 

decisions about who gets SSI. There is a lot of complexity in there. 

It is much more than just a database system. 

Mr. RICE. Now, the COBOL system, that is the primary database, right? And that is the central function, right? COBOL is the 

foundation on which this whole database is built, right? 

Mr. KLOPP. COBOL is the business logic. The database itself is 

actually called DB2. COBOL is where we put the business logic. 

DB2 is where we put the data. 

Mr. RICE. We have heard about these problems modernizing 

computer systems, not just from all of you but from the IRS and 

I think other governmental entities as well. Why is it so much 

harder in government to modernize than it is in the private sector? 

Why is that so much more difficult? 

Mr. KLOPP. I think that there are two answers to that. One is— 

it is very interesting. There are some commercial industries, in 

particular the insurance industry, which is a close analogy to SSA 

anyway, that basically is not modernizing. They are sticking with 

COBOL, and they insist they are going to stick with COBOL. I find 

that to be a very odd stance. But there are several large insurance 

companies that are not modernizing. They are going to try to stick 

with what they have. 

I think that the issue comes back to funding. And I think you 

guys are spot on when you talk about, how do you fund this? How 

do you get return on investment? How do we demonstrate that 

there is a return on investment? I think what you are hearing from 

101 

everybody today is that we know there is return on investment. 

The question is, where do we come up with the investment? 

Mr. RICE. Okay. I just have—Ms. Byrd, you noted that we just spent $300 million on this DCPS with very little in return. Please 

tell me that the people who oversaw that are not going to oversee 

this, please tell me that those people are not—no longer with Social 

Security, please. 

Ms. BYRD. Mr. Klopp is new, and he has a new team supervising DCPS. And they have, in resetting the program, they created a single owner, which was one of the recommendations. So the 

original folks are not really involved. 

Mr. RICE. But they are still there. 

Ms. BYRD. They are still there. I don’t really know. I can’t speak 

to every single person. Mr. RICE. Do we hold people accountable for $300 million failures? I am just curious. 

Ms. BYRD. In the IG world, we certainly report that and are 

very concerned about that. As far as what SSA management does, 

I can’t speak to that. 

Mr. RICE. I yield. 

Thank you, Mr. Chairman. 

Chairman JOHNSON. Thank you. 

Mr. Dold, you are recognized. 

Mr. DOLD. Thank you, Mr. Chairman. 

I appreciate it and apologize for being late but certainly appreciate you taking your time. I would like to follow up on some similar questions, because I think this is the thing that has people 

scratching their heads asking, ‘‘What in the world?’’ 

Mr. Klopp, you have been with the Social Security Administration for 18 months. Where were you before that? 

Mr. KLOPP. I am sort of a Silicon Valley guy. I bounced around 

in some of the start-up and technology companies all over. 

Mr. DOLD. Perfect. So let’s put your private sector hat on and 

let’s consider this a board meeting. We understand how important 

Social Security is. It is absolutely vital. And the fact that we are 

looking at a database here that is basically out of date. We are still 

working on COBOL. And if we sat around a board of director’s 

meeting here and you spent $300 million to be where we are today, 

what do you think a board would do based on the results that have 

been produced thus far? 

Mr. KLOPP. In regard to the previous project where $300 million 

was spent and we didn’t get much out of it, I believe the board 

would be very unhappy, and there would be some heads that would 

roll. 

Mr. DOLD. I find it also interesting that, as of just a week before 

this hearing, we hadn’t received more than about three slides on 

what the plan of attack is going forward for this. And so I am just 

wondering in terms of the detailed plan going forward—and I recognize you have a monumental task in front of you. So please hear 

me: We want to be wildly successful. I just want to make sure that 

we are giving you the tools to be successful, because we can’t be 

back here going through another hearing like this after wasting 

taxpayer dollars to come up with something that is not going to be 

functional. 

102 

Tell me about the plan. Is it adequate? 

Mr. KLOPP. Sir, I believe that it is adequate. I mean, there is 

a lot behind the plan. The fact is the plan is 20 pages. I think as 

I mentioned earlier, we have briefed your staff multiple times, so 

as the plan evolved, they have been briefed on it as it evolved. 

There is not very much in the plan that we had not briefed your 

staff on. As it evolved, with the exception of the financial models— 

and by the way, I probably owe them a briefing to walk through 

in detail exactly how we came up with those financials and to help 

them share the confidence that I share that the financials we put 

together are actually accurate and supportable. I think we are 

there, I do believe it. 

Mr. DOLD. Well, that is certainly good news. So, in your estimation, how long is it going to take to implement so that we can 

actually have an updated system over at the Social Security Administration? 

Mr. KLOPP. Using these Agile methods, what we believe is that, 

in each of the five areas that I talked about—title II and title XVI, 

et cetera—we are going to be able to work to deploy some parts of 

the system in production in pretty short order once we get funded 

and get started, where the definition of short order is it should not 

exceed a year. I will tell you the users have something to say about 

when we have built enough stuff to be sufficient to actually roll in 

production. So this part of—Agile is I can’t say exactly when I roll 

the first bit in production. But our experience with the restart of 

DCPS is that we should be able to roll significant functionality, 

modern functionality, into production in the agency within a year 

of starting. 

Mr. DOLD. The team that was responsible before that is apparently still over at the Social Security Administration that didn’t 

produce the system and the team that you are assembling, do you 

have the team that you need, or is it still some of the folks that 

didn’t get the job done the last time that you are relying upon? 

Mr. KLOPP. It’s interesting, the last time we did this, for reasons that are historical and go so far back before my time I actually don’t even—I haven’t heard the stories, right, because it goes 

back to 2008. The decisions in 2008 were made that this system 

would not be built by SSA’s systems department. This was built 

completely by contractors, and it was managed more directly by the 

business than by systems. That doesn’t say that we weren’t, you 

know—we knew what was going on, and we provided a little bit of 

financial oversight and stuff like that. So I wouldn’t sit here and 

say that we had no skin in the game, but we were not the primary 

drivers in that system. So what we are now doing is driving this 

new plan through SSA’s systems organization. It is fundamentally 

different people. 

Mr. DOLD. Okay. I’m delighted to hear that. 

Ms. Byrd and Ms. Melvin, just turning to you for a second. Both 

your organizations have conducted some pretty extensive oversight 

in the area of the IT modernization. How important is it in your 

estimation for the SSA to have a detailed plan in place? Is the plan 

that has been provided sufficient, in your estimation? 

Ms. BYRD. We only received the plan 2 days ago. Mr. Klopp was 

very kind to brief my staff for a couple of hours last evening. I can’t 

103 

really opine on the adequacy of the plan. We will be happy to take 

a deeper dive and get with you at a later date. 

As far as the importance of this, the OIG has gone back many, 

many years recommending that these changes be made, that the 60 

million lines of COBOL be modernized. So we clearly believe that 

we are at a critical point. Technology changes every single day, so 

we can’t wait for—we have people retiring. We have a new generation coming in, so it is imperative in our opinion. 

Ms. MELVIN. From my perspective, also, we only recently saw 

the plan, so I can only speak preliminarily. Based on what I am 

seeing, I would certainly have questions about the content and 

what exists behind the slides that we have all spoken to today. 

When I speak in particular about the cost estimation, I think there 

are some important questions to be asked there relative to what information and analysis is underlying the cost figure that is included in the plan. 

The GAO cost estimation guide identifies a number of characteristics of what we call comprehensive, well-documented, accurate 

and credible cost estimations. So, from our perspective, it would be 

extremely important to know more about what exactly supports the 

figures that are being presented in this plan, how they are justified, and what analysis is there to support that. 

Mr. DOLD. Thank you. My time has expired. But let me just 

close by saying we need you to get this right, and we want you to 

be successful. The country is counting upon it. 

I yield back. 

Chairman JOHNSON. Thank you. 

And listen, I appreciate all of you testifying today. Keep up the 

good work. It seems like it is a never-ending problem to fix this. 

You know, we built two new facilities with four systems, and it 

seems like we should have gotten it fixed then, but we didn’t. So 

I just want to thank all of you for your testimony and thank the 

Member that is left. 

Mr. BECERRA. Mr. Chairman, may I add something before you 

close? 

Chairman JOHNSON. Yes. 

Mr. BECERRA. I think we are beginning to recognize how important it is to try to be with them as we try to stay on top of them. 

Those two centers that were built, my understanding is they were 

hardware. They gave you more infrastructure capacity, but your 

issues are more software and the interconnectivity and all the 

issues that come with making use of the better hardware you have. 

And COBOL and all that, that is software. What we have to do is 

make sure that they now complement what you have now in your 

hardware with up-to-speed, up-to-date software. It can be pretty 

tricky and complex. I think that is where it is going to be really 

important that you have eyes from outside of this system watching 

you as well. 

Mr. Chairman, I think this is clearly one of those areas if we just 

sort of stay on top of it ourselves, we will have a greater comfort 

level about where to go with this proposal they have put forward. 

Chairman JOHNSON. Social Security’s aging and outdated IT is 

a real problem. So I think it is time to fix the systems, and I appreciate you all taking the effort to get it done. 

104 

Social Security has to get it right the first time, because we can’t 

keep throwing money at it. The American people deserve no less. 

I thank each and every one of you for being here and for helping 

resolve this problem. Thank you so much. 

With that, the Subcommittee stands adjourned. 

[Whereupon, at 11:27 a.m., the Subcommittee was adjourned.] 

[Questions for the Record follow:] 

105 


22296A.074

COMMITTEE ON WAYS AND MEANS 

Ms. Kimberly Byrd 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

August 5, 2016 

Deputy Assistant Inspector General for Audit 

Financial Systems and Operations Audits 

Office of the Inspector General 

Social Security Administration 

640 I Security Boulevard 

Woodlawn, MD21207 

Dear Ms. Byrd: 

Thank you for your testimony before the Committee on Ways and Means Subcommittee 

on Social Security at the July 14, 2016 hearing on "Modernizing Social Security's 

Information Technology Infrastructure." Tn order to complete our hearing record, we 

would appreciate your responses to the following questions: 

I. What does a successful Information Technology (IT) modernization plan need to 

consist of, and, to date, has the Social Security Administration (SSA) provided an 

IT modernization plan that is sufficient? 

2. How confident are you in the timcline and cost estimates provided by the SSA? 

3. What are the challenges to auditing a project that uses Agile IT development? 

How are you adapting to these challenges? 

4. The SSA Office of Inspector General recently released a report indicating that the 

SSA did not adequately evaluate Comrnercial-Off-The-Shelf(COTS) products 

when analyzing a lternatives to internal development of its Disability Case 

Processing System. What are the best practices for evaluating COTS products as 

an alternative to internal IT development? 

We would appreciate your responses to these questions by A.!!gJISt Ul. 2016. Please send 

your response to the auention of Amy Shuart, Staff Director, Subcommittee on Social 

Security, Committee on Ways and Means, U.S. House or Representatives, B-317 

Rayburn House Office Building. Washington, DC 205 15. In addition to a hard copy, 

please submit an electronic copy of your response in Microson Word format to 

mm.russell@mail.house.gov. 
106 


22296A.075

Thank you for taking the time to answer these questions For the record. IF you have any 

questions concerning this request, you may reach Amy at (202) 225-9263. 

Sam Johnson 

Chairman 

Subcommittee on Social Security 
107 


22296A.076

OIG Office of the Inspector General 

ll1e Honorable Sam Johnson 

Chainnan, Subcommittee on 

Social Security 

Committee on Ways and Means 

United States House of Representatives 

Washington, DC 205 IS 

Attention: Amy Shuart 

Dear Chairman Johnson: 

SOCIAL SECURITY ADMINISTRATION 

August 18,2016 

This is in response to your questions for the record, further to testimony by Deputy Assistant 

Inspector General Kimberly Byrd on July 14, 20 16, before the Subcommittee on Social Security, 

Conunittee on Ways and Means, at a hearing on Moderni zing Social Security's Infonnat1on 

Technology Infrastructure. I appreciate the opporttmity to provide additional infonnarion on 

these issues to the Subconmlittee. Please see responses to your specific questions below. 

1. \Vhat does a successful Information Technology (11) modernization plan need to consist 

of, and, to date, has the Social Security Administration (SSA) provided an IT 

modernization plan that is sufficient? 

We received a copyofSSA's IT Modernization Plan on July 12,2016, and SSA briefed us 

on the plan on July 13, 2016. We have not yet conducted an in-depth review of the Agency's 

plan, thus we cannot express an opinion about the sufficiency of the plan at this time. That 

said, we believe a modernization plan should clearly document what SSA expects to achieve, 

in what timefrarne, and at what cost. The legislation that would fund SSA for Fiscal Year 

2017, if enacted, would require SSA to provide Congress a detailed report on its IT 

modernization plan in its Fiscal Year 2018 budget request. We believe the reporting 

requirements in the proposed legislation are very comprehensive, and the report would 

provide the level of detail the Office of the !J1Spector General, the Congress, and the public 

needs to understand and track SSA's IT modernization efforts. 

2. How confident are you in the timel.ine and cost estimates provided by the SSA? 

We received a copyofSSA's IT Modernization Plan on July 12, 2016, and SSA briefed us 

on the plan on July 13, 2016. We have not yet conducted an in-depth review of the Agency's 

plan, thus we cannot express an opinion about the timeline or cost estimates at this time. We 

will be available to meet with Subcotmnittee staff and share our thoughts after we review and 

evaluate the Agency's plans. 

WEB: OIG.SSA.GOV I FACEBOOK: OIGSSA I TWIITER: @rHESSAOIG I YOUTUBE: THESSAOIG 

6401SECUR11YBOULEVARO I BAtnMORE, MD 21235·0001 
108 


22296A.077

Page 2 - The Honorable Sam Johnson 

3. What are the challenges to auditing a pt·oject that uses Agile development? How are 

you adapting to those challenges? 

Agile is a software development approach that involves building software incrementaUy and 

requires close collaboration among programmers and business experts. Agile does not easily 

align with certain Federal processes and requirements and, as a result, introduces challenges 

for those responsible for auditing/evaluating proj ects that employ Agile methodologies. For 

example, Federal contracting procedures generally call for detailed plans and requirements be 

established up-front. However, with Agile, requirements are not known in advance. 

According to SSA, the iterative nature of Agile makes it challenging to conduct long-range 

project planning. However, we believe SSA should deliver cost estimates for the "sprints" 

required to deliver software incrementally. 

In April 2016, the Office of Management and Budget (OMB) released a guide outlining best 

practices and examples to support Agile development. OMB expects to develop Agile 

performance measurements, create an Agile Dashboard, and update IT-investment reporting 

mechanisms this fisca.l year. Once OMB releases its fonnal guidance on Agile, we will 

review the guidance and incorporate it into our ongoing audit work planning effort. 

4. The SSA Office of Inspecto1· General recently •·eJeased a report indicating that the SSA 

did not adequately evaluate Commet·cial-Off-The-Shelf (COTS) products when 

analyzing altei'Oatives to internal development of its Disability Ca se Pt·ocessit•g System. 

What are the practices for evaluating COTS products as an altemative to internal IT 

development? 

To clarify, we stated in our May 2016 report, The Social Securitv Administration's Analysis 

o(AiternMives for the Disabiliry Case Processing System (A-14-16-50078), that SSA did not 

li.tlly evaluate all potential alternatives after " resetting" the DCPS project. With regard to 

COTS alternatives, SSA limited its evahtation to one specific product as a potential 

alternative to the case-management component of DCPS. According to SSA, another full 

alternatives analysis would have resulted in additional project costs and delays. 

Per OMB, agencies should update alternatives analysis periodically to capture changes in the 

context for an investment decision, and they should generally consider upgrading, sharing, or 

converting existing systems or maintaining the legacy systems. We asked SSA whether it 

considered other alternatives- for example, phasing an existing system into all Disability 

Detennination Services or procuring and modemizing one of the vendor-supported legacy 

systems. Agency personnel informed us they held "high-level brainstonning sessions" 

around these altematives but ultimately dismissed them. According to SSA, the estimated 

costs, and the Jack of intemal expertise for the legacy systems that the Agency does not own, 

made these alternatives not viable. Consequently, we concluded SSA did not sufficiently 

evaluate all alternatives for DCPS. We reported that, without a comprehensive ana lysis of 

altematives, the Agency cannot be assured the chosen option will be the best path to simplify 

system supp011 and maintenance and reduce infrastructure costs. 
109 

f 


22296A.078

Page 3 - The Honorable Sam Johnson 

Should you have further questions, please feel free to contact me, or your staff may contact 

Special Agent Kristin Klima, Congressional and Intra-governmental Liaison, at (202) 358-6319. 

Sincerely, 

Gale Stallworth Stone 

Acting Inspector General 
110 


22296A.079

COMMITTEE ON WAYS AND MEANS 

Mr. William Hayes 

So frware Engineering Institute 

Carnegie Mellon University 

4500 Fitlli Avenue 

Pittsburgh, PA 15213 

Dear Mr. Hayes: 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

August 5, 2016 

Thank you for yO\Ir testimony before the Committee on Ways and Means Subconm1ittee on 

Social Security at the July 14,2016 hearing on "Modernizing Social Security's Infom1atioo 

Technology Infrastructure." In order to complete our hearing record, we would appreciate your 

responses to the following questions: 

1. What mctrics generated by the Agile development process can Congress use in the 

oversight of Agile projects? 

2. What are the best practices for employing Agile development methods within a Federal 

framework? 

3. Is it possible to estimate total project costs for an IT project using Agile development 

methods? What about lifecycle costs? 

We would appreciate your response,s to these questions by A!!gust 18,2016. Please send your 

response to the attention of Amy Shuart, Staff Director, Subcommittee on Social Security, 

Committee on Ways and Means, U.S. House of Representatives, B-317 Rayburn House Office 

Building, Washington, DC 20515. In addition to a hard copy, please submit an electronic copy 

of your response in Microsoft Word format to mm.russeU@mail.house.gov. 

·nank you for taking the time to answer these questions for the record. lfyou have any 

questions concerning this request, you may reach Amy at (202) 225-9263. 

s~~~ Sam Johnson 

Chairman 

Subcommittee on Social Security 
111 


22296A.080

The Agile In Government Team at Carnegie Mellon University's Software Engineering Institute (SEI) is 

pleased to provide the following responses to Questions For the Record. Where appropriate, we have 

referenced the w ritten t estimony provided in advance of the hearing to support the information 

supplied here. 

1. What metrics generated by the Agile development process can Congress use in the oversight of Agile projects? 

Most Agile methods specify team level metrics and do not provide information that would meet needs 

for Congressional oversight. However, this does not mean that metrics do not exist to help Congress 

provide oversight on projects using Agile. 

The performance of t he software should be assessed against the performance of t he business processes 

the software supports. Agencies undertaking IT modernization must have targets for business 

performance. Examples include: 

reduced cycle time for key functions 

increased case·handling capacity for high demand processes 

increased reclaimed efficiency due to resolution of chronic problems 

increased volume of workload redirected from exception·handling 

increased integration of previously redundant business processes 

Such business outcomes should determine which software functions are prioritized. Agile principles 

explicitly focus development on prioritized value delivered to customers. Congressional oversight would 

focus on measures related to t he value derived from the software deliveries. The incremental delivery of 

software emphasized in Agile development allows such assessments of business impact as the 

modernization effort progresses- rather than as a summary evaluation at the end of the program. 

In addition to business measures, software engineering technical measures that focus on the product, 

rather than the performance of development activities, are still relevant. For example, software 

attributes can be measured w ith automated tools, and careful analysis can help to determine thresholds 

that warn about increased difficulty in maintaining the system or likely cyber vulnerabilities. 

Our publication on Agile Metrics, referenced in our written testimony, provides descriptions of a 

number of metrics amenable to program-level use. One such measure commonly used in large-scale 

government projects is earned value management. 

Across the Department of Defense (DoD), major software programs over a certain dollar value are 

obliged to report information using a certified earned value management system (EVMS). The primary 

motivation for EVMS is to quantify progress independent of dollars spent, time passed, or resources 

consumed. Programs applying Agile at scale in the DoD have tailored EVMS approaches to focus on the 

delivery of major capabilities (rather than decomposing the work in terms of management and 

engineering activities performed). These approaches help those charged w ith oversight to use a familiar 

mechanism, while taking advantage of Agile's user-value focus. 

In summary, Agile development approaches applied at scale are typically driven by a road map for 

deployment of prioritized software functions over months and quarters, rather than t he annual (or 

longer) cycles seen under traditional development regimens. Because software delivery occurs 

incrementally rather than as a single batch at the end, many detailed progress metrics and technical 

Page 1 13 
112 


22296A.081

measures of product performance will be analyzed over time, but these generally fall below the level of 

actionable information for Congressional oversight. The timely deployment of software capabilities into 

the workflow they support is a productive focus for this oversight. Rather than relying on proxies (such 

as dollars spent and time passed), this approach supports incremental evaluation of important 

outcomes. 

2. What are the best practices for employing Agile development methods within a Federal framework? 

With Agile projects, the agent performing the oversight must have a strong understanding of both the 

project parameters and Agile principles to judge whether the practices being followed are the "best" for 

that project. 

Below we highlight several suggestions that, based on our experience, are of particular importance to 

software development efforts supporting the Federal government. These suggestions amend those 

addressed in our previous written testimony (section 3.1 Focus Areas of Oversight Approach in Agile 

Settings). 

First, the participation of people who can authentically represent the true needs of the system user is 

essential. In the Federal space, this may encompass a diverse set of perspectives. To help navigate this 

concern, most Agile methods tend to rely on a role called "Product Owner." Our research shows that the 

"Product Owner" role may be filled by a team or some other collaborative process. 

Second, it is important to staff programs adequately from the start. The gradual build-up of staff at the 

start of many federal IT programs creates waste from lack of momentum. In addition, once the program 

is up and running, developer turnover on Agile teams breaks continuity and is particularly disruptive. 

Agile methods emphasize rapid and iterative development of potentially shippable working software 

code from the very start. 

Finally, our research shows that government personnel with direct oversight responsibilities must be 

able to adapt to the more rapid cadence of Agile delivery. Traditional mechanisms that assure duediligence might not inherently accommodate the pace of Agile development without some adaptation. 

Of particular importance is the expectation that implementation work will drive the most detailed 

design decisions rather than the specifications approved in advance. Keeping pace with development 

teams and driving beneficial design choices may be out of reach for federal oversight regimens that rely 

exclusively on quarterly or annual reviews. 

3. Is It possible to estimate total project costs for an IT project using Agile development methods? What about 

lifecyde costs? 

Yes. Modern tools for estimating major software programs currently support estimation of Agile 

development. Many commercial software estimation tools provide users with benchmarks collected by 

the vendor from projects in their customer base. Many of these tools support development of custom 

cost models populated by data derived from local projects rather than published benchmarks. The DoD 

Integrated Lifecycle Framework recommends the use of analogy and parametric estimation in the early 

phases of the program. As the program progresses into implementation, however, ongoing refinement 

of estimates as well as estimation of more fine-grained work elements should be based on historical 

team performance. Because of the incremental delivery of software in short timeframes, evolving the 

Page 2 13 
113 

f 


22296A.082

estimates with the new information provided is much more feasible than in traditional development 

settings. 

The SEI's Team Software Process is an Agile-compatible method that incorporates a strong 

measurement framework into the software development process. The collected data help the team 

understand its own performance, adjust plans and make more realistic estimates of future work. 

(http:/ /www.sei.cmu.edu/tsp/index.cfm). 

SEI research on Quantifying Uncertainty in Early Lifecycle Cost Estimation (QUELCE) may be of particular 

interest in this area. Working with major programs in the DoD, SEI researchers have developed rigorous 

methods for establishing statistically sound risk models. These models help stakeholders identify cost 

drivers and associated probabilities and magnitudes based on calibrated expert judgment. 

(https:Uwww.sei.cmu.edu/measurement/research/quelce/index.cfm). 

The Agile approach to rapid iterations, when executed with appropriate discipline and measurement, 

promotes on-going refinement of lifecycle cost estimates. In addition, tactical choices made by 

development teams can be more directly tied to strategic needs of the enterprise that drive system 

architecture, design of high-value functionality, lifecycle costs, and deployment timelines. 

Page 313 
114 


22296A.083

COMMITTEE ON WAYS AND MEANS 

Mr. Robert Klopp 

Chief Information Officer 

Social Security Administration 

640 I Security Boulevard 

Woodlawn, MD 21207 

Dear Mr. Klopp, 

U.S. HOUSE OF REPRESENTATIVES 

WASHINGTON, DC 20515 

August 5, 2016 

Thank you for your testimony before the Committee on Ways and Means Subcommittee on 

Social Security at the July 14,2016 hearing on "Modernizing Social Security's Information 

Tcclmology Infrastructure." In order to complete our hearing record, we would appreciate your 

responses to the following questions: 

I. How will the SSA ensure that the Information Technology (IT) modernization plan that 

the SSA bas outlined doesn't change course with subsequent changes in leadership? 

2. Mr. Warsinskey testified at length about system outages, lag time, and bandwidth issues 

that cost the SSA work hours and lengthen wait times for the public. How will 

modernization address these concerns? In the interim, what is the SSA doing to fix this? 

3. Part of the IT modernization plan involves the use of Agile IT development methods that 

require working with end users which would include front service employees in the field. 

How is the Office of Systems collaborating with the Office of Operations to engage with 

end users? 

4. The OMB Circular A-130 requires Federal agencies to conduct an alternatives analysis 

prior to making an IT investment that includes the consideration of commercially 

available options. Has the SSA conducted a Commercial-Off-The-Shelf (COTS) 

altematives analysis for its IT modernization needs? 

5. Given that tecllllology can change over the course of an IT development project, and new 

COTS alternatives that didn't exist at the outset of a project may become available, how 

does the SSA ensure this analysis stays current? How do you determine if a new COTS 

product is available once a pr~ject is underway? 
115 


22296A.084

We would appreciate your responses to these questions by August 18. 2016. Please send your 

response to the attention of Amy Shuart, Staff Director, Subcommiuee on Social Security, 

Committee on Ways and Means, U.S. House of Representati ves, B-317 Rayburn House Office 

Building, Washington, DC 205 15. In addition to a hard copy, please submit an electronic copy 

of your response in Microsoft Word format to mm.russell@mail.house.gov. 

Thank you for taking the time to answer these questions for the record. If you have any 

questions concerning this request, you may reach Amy at (202) 225-9263. 

Sam Johnson 

Chairman 

Subcommittee on Social Security 
116 


22296A.085

Enclosure - Page I - The Honorable Sam Johnson 

House Committee on Ways and Means Subcommittee on Social Security 

Modernizing Social Security's lnfonnation Technology lnf•·astructure 

July 14, 2016 

Questions for the Record for Chief Info•·mation Office•· Robert Klopp 

from Chairman Sam J ohnson 

1. How will the SSA ensUJ"e that the Information Technology (IT) modernization plan 

that the SSA bas outlined doesn' t change course with subsequent changes in 

leade•·sbip? 

Areas requiring modernization (stn1ctured code and databases, updated infrastructure 

utilizing modem techniques, and languages and tools) have progressed from the 

conceptual to detailed plan phase. We have developed clearly outlined executable project 

plans and begun several initiatives - such as Amazon web services development and 

modem data warehousing. We will also continue with the progress made to date in 

modernizing our vast databases and data analytics capabilities. 

Training hundreds of staff in modem applications and tools is progressing via a number 

of means including intensive boot camps and consultative engagements. Dual emphasis 

is made on acquiring modem languages and tools (i.e., Hadoop and Node.js) and 

effectively structuring code and data. 

Career employees (rather than appointees), such as the Chief Technology Officer and 

Assistant Deputy Commissioners, are at the forefront of modemization plan execution. 

Continuity at this level will ensure that we remain on track. The modernization course of 

action is set and we are making good progress. At the levels proposed in both the FY 

201 7 House and Senate marks, the IT modernization projects will not start in FY 2017 

and will be delayed another year causing delays in these important plans. 

2. M•-. Wa1·sinskey testified at length about system outages, lag time, and bandwidth 

issues that cost the SSA wo•·k hours and lengthen wait times fo•· the public. How 

will modemization address these concem s? In the iote1·im, what is the SSA doing to 

fix this? 

The issues Mr. Warsinskey raised were related to the agency's Wide Area Network 

(WAN) and SSANet- the foundation for the digital platfom1: bandwidth, integrated data 

and voice communications, video teleconferencing, wireless infrastructure, mobile device 

management, and secure logical and physical access. We will solve each of the listed 

concerns in the short and long tenn by measures to increase the size/capacity and 

speedltlu-oughout the SSA network tlu-ough our Quantum Leap Transition Project. 

Quantum Leap is centered on consolidating, leveraging, and optinlizing SSANet 

bandwidth to 100 Megabits per second (Mbps) connectivity, which facilitates data 
117 


22296A.086

Enclosure- Page 2 - The Honorable Sam Johnson 

sharing, streamlines communications, and optimizes network investments by our agency. 

This upgrade will deliver from 3X to IOOX speed improvements to resolve the issues. 

3. Part of the IT modernization plan involves the use of Agile IT development methods 

that r equiJ·e wo..t<ing with end use•·s which would include f•·ont service employees in 

the field. How is the Office of Systems collaborating with the Office of Operations to 

engage with end users? 

Our Office of Systems recently reorganized to address this ve1y issue. The Office of IT 

Business Support is an Assistant Deputy Commissioner level oftlce focused on 

understanding the precise needs of our internal and external customers and effectively 

translating them into the IT products we deliver. Hundreds ofhusiness analysts engage 

directly with end users and stakeholders continually throughout the development process 

to ensure each incremental production release meets the user's intended needs and 

expectations. This portion of the reorganization was designed specifically to improve the 

ability of Systems to interact with the Office of Operations and our other major 

operational component, the Office of Disability Adjudication and Review. 

4. The m Circula•· A-130 •·cquircs Federal agencies to conduct an a lternatives 

analysis p•·ior to making an IT investment that includes the consideration of 

comme•·c.ially available options. Has the SSA conducted a Commercia l-Off-TheShelf (COTS) alternatives a nalysis for its IT modernization needs'? 

We conducted our IT Modernization Major IT Program level alternatives analysis based 

on various levels of funding, tin1eframes and wholescale versus piecemeal approaches. 

Elements comprising the entire program go through a series of make versus buy analyses. 

First, our IT investment review process develops business cases that require COTS 

solution examinations. Our Enterprise Architecture team helps develop proposed IT 

initiative businesses cases and, in doing so, considers COTS as part of the technical 

approach. Our Enterprise Architecrure team also engages with project release teams 

early enough in the life cycle to ensure it analyzes COTS solutions. Our Architecture 

Review Board bas a responsibility to identify and consider applicable COTS solutions. 

In addition, when feasible, we conduct proofs of concepts to test the viability and 

functionality of conunercial offerings. For example, prior to continuing in-house 

development of the Disability Case Processing System, we hired a contractor to perfom1 

a proof of concept on the COTS solution. Further, we recently concluded a very 

comprehensive multi-year evaluation of a COTS solution to support the delivery of 

notices to the public. 

5. Gi,•en that technology ca n change ove1· the coune of an IT development p•·oject, a nd 

new COTS alternatives that didn' t exist at tbe outset of a project may become 

available, how does the SSA ensure this a nalysis stays cuJTent? How do you 

detenuiue if a new COTS product is available once a project is unde1·way? 
118 

f 


22296A.087

Enclosure - Page 3 - The Honorable Sam Johnson 

Our Chief Technology Officer and his staff continually learn about and assess new 

technologies through multiple means, including regular engagement with the Federal CIO 

Council and members, constant dialogue with our business partners and leading edge 

technology firms, frequent interactions with Gartner and other leading IT research firms, 

and emerging technology forums and conferences. 

Our assessment of COTS products is founded on finding value in buying software instead 

ofbuildiug it. However, purchased software must follow the same tenets as build efforts: 

it should scale, run on commodity hardware, and be written in or at least be customized 

using common open programming languages. It should be extensible from the outside 

such that all functionality is available to custom programs as callable services. Inflight 

COTS alternatives are measured against remaining build efforts, rather than total build 

costs. Sunk costs are not c-onsidered, in accordance with best industry practices. 
119 

[Submissions for the Record follow:] 


22296A.088

Statement for the Record 

"Modernizing Social Security's Information Technology Infrastructure" 

United States House of Representatives 

Committee on Ways and Means 

Subcommittee on Social Security 

Cheryl Sullivan 

BMC 

Hearing Date 

July 14, 2016 
120 


22296A.089

Chairman Johnson, Ranking Member Becerra, and Members of the Subcommittee, thank you for the 

opportunity to submit a statement for the record on information technology (IT) at the Social Security 

Administration (SSA). 

BMC is a global leader in software solutions that enable IT transformation of traditional government 

processes into digital enterprises for the ultimate competitive advantage. Our Digital Enterprise 

Management set of IT solutions is designed to make digital services fast, seamless, and optimized. From 

mainframe to mobile to cloud and beyond, we pair high-speed digital innovation with robust IT 

industrialization-allowing our customers to provide intuitive user experiences with optimized 

performance, cost, compliance, and productivity. BMC solutions serve more than 10,000 customers 

worldwide including 82 percent of the Fortune 500. 

To keep pace with the rapid change in today's market place, government must have t he digital plat forms 

and processes in place to cont inually refine existing products and seamlessly rollout new initiatives 

without impacting core operations or customer experiences. 

To accomplish this, organizations must strike the proper balance between speed, scale and quality, 

ensuring that key teams are aligned on deliverables and results. By adopting a more open and flexible 

approach to innovation, the SSA is better positioned to respond to the growing demands and increased 

number of citizens using services. 

One area of focus for SSA continues to be modernizing the infrastructure. SSA has for more than 30 

years used mainframes to meet the high computing needs for mission-critical systems. With many of the 

Federal directives pushing for adoption of cloud computing, it should be noted that companies are 

working together to bring down t he cost of mainframe software. In general, these new offering should 

enable organizations that have deployed mainframes to save as much as 20 percent on t heir mainframe 

software costs. 

What would BMC suggest to SSA leadership moving forward? Behave like a startup to ensure continued 

productivity and development by remaining a nimble and driven organization. Some of those key steps 

to enable IT employees to leverage digital tools to better aut omate processes would include: 

Accelerate Collaboration· Enable collaboration by building frameworks and harnessing tools 

that align disparate departments and clearly define shared goals and priorities. This will invite 

employees to share insights and know-how across team lines. 

Empower The Workforce- An organization's most valuable asset is its dedicated employees and 

their knowledge and insight. Empowering these workers to be able to act on ideas for 

improvement will prove to be mutually beneficial, offering increased project ownership to 

employees that in turn deliver tailored innovation concepts back to the SSA. It is imperative to 

provide intuitive, self-service tools to enable and empower t he government knowledge worker. 

Focus On The Citizen - Citizen services should be at the core of any government programs and 

with more data driven citizen insight readily available, it is important t hat organizations and 

decision makers harness digital tools to further understand the motivations of the consumer. 

Balance Speed With Quality · Traditional cycles for modernization and updates have been 

replaced by continuous and incremental developments, more successfully balancing speed of 
121 

f 


22296A.090

delivery with quality of product. This would allow SSA to do minor rollbacks of faulty updates 

instead of extensive shutdowns of complete offerings. 

The reality is a large percentage of the mission-critical applications and systems that run on the 

mainframe today are going to remain on that platform for many years to come. So it's crucial for the 

Agency to find savings without trading off reliability. SSA's largest mainframe budget challenges could 

find efficiencies and savings by optimizing mainframe workloads, reduce Monthly License Charges 

(MLC), and increase productivity. 

Controlling MLC costs up t o this point has been manual in nature and fundamentally limits SSA's ability 

t o attack the problem in the way it must be attacked. Software automation is required. 

Importantly, the savings recovered from the Mainframe Optimization Program can then be used to help 

fund t he investments that will be required for the new Cloud environments. We see this as an 

alternative to requesting more funding from the Legislature. These types of cost reduction efforts mirror 

the intent of the Federal IT Acquisition Reform Act and the bipartisan and bicameral Modernizing 

Outdated and Vulnerable Equipment and Information Technology (MOVE IT) Act. 

These efforts will help SSA to focus on eliminating waste and on lowering the cost of services for the 

taxpayer. Citizens should be at the core of all government programs and delivering those services at the 

rate and level that they deserve. 

The drive towards digitization is just as relevant and compelling for Federal Government agencies as it is 

in the private sector. In fact, the rapid adoption of digital technology in the commercial world is 

changing citizens' expectations of how they should interact with their government. These changes are 

also driving agencies' IT department s to fundamentally rethink how they deliver the best service while 

also managing cost s. 

Thank you for the opportunity to submit written testimony and BMC would be happy to answer any 

questions you may have. 
122 


22296A.091

Statement for the Record 

"Modernizing Social Security's Information Technology Infrastructure" 

United States House of Representatives 

Committee on Ways and Means 

Subcommittee on Social Security 

Claire Bailey 

Director of Federal, State and Local Mainframe Solutions 

Compuware 

July 14, 2016 
123 


22296A.092

Chairman Johnson, Ranking Member Becerra, and Members of the Subcommittee, thank you for the 

opportunity to submit a statement for the record on Information Technology {IT) at the Social Security 

Administrat ion (SSA). I am the Director of Federal, State and Local Mainframe Solutions at Compuware, 

the world's leading mainframe-dedicated software company. We are headquartered in Detroit and I am 

proud that 99% of our development team is located onsite. Like the city itself, Compuware has 

demonstrated its ability to reinvent itself and modernize. 

Prior to joining Compuware, I had the opportunity to serve as the Agency Director for the Arkansas 

Department of Information Systems on the Cabinet of Governor Mike Huckabee. I was honored with the 

opportunity to continue to serve as t he Agency Director of the Arkansas Department of Information 

Systems and Arkansas Chief Technology Officer on the Cabinet of Governor Mike Beebe. In this role, I 

had firsthand experience with ensuring t he operational and cost effective delivery of services to 

Arkansans and our federal partners. When I retired from the state, I joined Compuware because of their 

new leadership and dedication to innovating the tools needed to maximize the mainframe platform 

which is a critical asset for the public sector. Compuware was the only company coming forth with 

solutions to help innovate citizen centric services, leverage assets owned by public entities and assist 

emerging technologists. 

A new generation of Federal IT leaders are assuming responsibility for guiding the Social Security 

Administrat ion (SSA) to success as citizen demands become increasingly t ech-centric. Having forged 

their careers through a period of int ensive t echnological innovation, these leaders are by and large wellprepared to do so. However, many of t hese IT leaders should look at t he modernization efforts for the 

single most important IT asset: the mainframe. 

Federal IT leaders who don't view the mainframe strategically can be lured into a migration to inferior 

operational tools and platforms plagued by security threats by vendors offering aggressive discounts. 

This kind of tactical, short-term thinking should be nipped in the bud to avoid compromising the 

strategic, long-term future of the technical architecture for SSA. And, what might appear as a short term 

financial cost savings in reality can have excessive cost overruns. 

SSA's current asset s can be leveraged t o modernize syst ems on and off platform as necessary with a 

focus on cost savings. Critical to this type of transformation is simplifying mainframe operations, 

empowering IT workers wit h easy-to-learn and use development tools that provide visualization across 

platforms, and insulating the complexity of the mainframe platform for a new generation of IT 

professionals. 

As mentioned in oral testimony from Robert Klopp, the Deputy Commissioner and Chief Information 

Officer at the Social Security Administration, the mainframe will remain the insurance industry's premier 

data server for mission-critical workloads. According to Forrester Research', "Mainframe systems of 

record are the beating heart of most large businesses. The mainframe is essential to 92 of the top 100 

banks worldwide, 23 of the top 25 US retailers, alllO of the world's 10 largest insurers, and 23 of the top 

25 largest airlines. Since PCs have emerged in the early 1980s, pundits have been predicting the end of 

the mainframe, yet while PCs and now mobile and cloud platforms have enabled new kinds of 

applications unimagined a generation ago, mainframes still run the core processes of most 

organizations." Because outcomes are paramount in all lines of business, organizations in critical 

industries continue to leverage the multiple decades of investment in business rules, intellectual 

property surrounding their calculations and process logic in their modernization efforts. 
124 

Æ 


22296A.093