U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

26–560 PDF 2017

THE FEDERAL INFORMATION TECHNOLOGY ACQUISITION REFORM ACT (FITARA) SCORECARD 

4.0 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

AND THE

SUBCOMMITTEE ON 

GOVERNMENT OPERATIONS 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

JUNE 13, 2017 

Serial No. 115–27 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://oversight.house.gov 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

Trey Gowdy, South Carolina, Chairman 

John J. Duncan, Jr., Tennessee 

Darrell E. Issa, California 

Jim Jordan, Ohio 

Jason Chaffetz, Utah 

Mark Sanford, South Carolina 

Justin Amash, Michigan 

Paul A. Gosar, Arizona 

Scott DesJarlais, Tennessee 

Blake Farenthold, Texas 

Virginia Foxx, North Carolina 

Thomas Massie, Kentucky 

Mark Meadows, North Carolina 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Mark Walker, North Carolina 

Rod Blum, Iowa 

Jody B. Hice, Georgia 

Steve Russell, Oklahoma 

Glenn Grothman, Wisconsin 

Will Hurd, Texas 

Gary J. Palmer, Alabama 

James Comer, Kentucky 

Paul Mitchell, Michigan 

Elijah E. Cummings, Maryland, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Stephen F. Lynch, Massachusetts 

Jim Cooper, Tennessee 

Gerald E. Connolly, Virginia 

Robin L. Kelly, Illinois 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 

Stacey E. Plaskett, Virgin Islands 

Val Butler Demings, Florida 

Raja Krishnamoorthi, Illinois 

Jamie Raskin, Maryland 

Peter Welch, Vermont 

Matt Cartwright, Pennsylvania 

Mark DeSaulnier, California 

John P. Sarbanes, Maryland 

JONATHAN SKLADANY, Staff Director 

REBECCA EDGAR, Deputy Staff Director 

WILLIAM MCKENNA General Counsel 

TROY STOCK, Subcommittee Staff Director for Information Technology 

JULIE DUNNE, Senior Counsel 

KILEY BIDELMAN, Clerk 

DAVID RAPALLO, Minority Staff Director 


KING-6430 with DISTILLER
(III) 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

Will Hurd, Texas, Chairman 

Paul Mitchell, Michigan, Vice Chair 

Darrell E. Issa, California 

Justin Amash, Michigan 

Blake Farenthold, Texas 

Steve Russell, Oklahoma 

Robin L. Kelly, Illinois, Ranking Minority 

Member 

Jamie Raskin, Maryland 

Stephen F. Lynch, Masschusetts 

Gerald E. Connolly, Virginia 

Raja Krishnamoorthi, Illinois 

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

Mark Meadows, North Carolina, Chairman 

Jody B. Hice, Georgia, Vice Chair 

Jim Jordan, Ohio 

Mark Sanford, South Carolina 

Thomas Massie, Kentucky 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Rod Blum, Iowa 

Gerald E. Connolly, Virginia, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(V) 

C O N T E N T S 

Page 

Hearing held on June 13, 2017 ............................................................................... 1 

WITNESSES 

Mr. David A. Powner, Director, IT Management Issues, U.S. Government 

Accountability Office 

Oral Statement ................................................................................................. 6 

Written Statement ............................................................................................ 8 

Ms. Beth Killoran, Deputy Assistant Secretary for IT, Chief Information 

Officer, U.S. Department of Health and Human Services 

Oral Statement ................................................................................................. 35 

Written Statement ............................................................................................ 37 

Ms. Sheila Conley, Deputy Assistant Secretary, Acting Chief Financial Officer, U.S. Department of Health and Human Services 

Dr. Rick Holgate, Research Director, Gartner, Inc 

Oral Statement ................................................................................................. 47 

Written Statement ............................................................................................ 49 

APPENDIX 

Questions for the Record for Mr. David Powner, submitted by Ms. Kelly .......... 72 

Questions for the Record for Dr. Rick Holgate, submitted by Ms. Kelly ............ 75 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

THE FEDERAL INFORMATION TECHNOLOGY 

ACQUISITION REFORM ACT (FITARA) 

SCORECARD 4.0 

Tuesday, June 13, 2017 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY, JOINT

WITH THE SUBCOMMITTEE ON GOVERNMENT OPERATIONS, 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, 

Washington, D.C. 

The subcommittees met, pursuant to call, at 2:03 p.m., in Room 

2154, Rayburn House Office Building, Hon. William Hurd [chairman of the Subcommittee on Information Technology] presiding. 

Present from Subcommittee on Information Technology: Representatives Hurd, Mitchell, Issa, Russell, Kelly, Lynch, Connolly, 

and Krishnamoorthi. 

Present from Subcommittee on Government Operations: Representatives Meadows, Jordan, Massie, Blum, Connolly, and 

Maloney. 

Also Present: Representative Gowdy. 

Mr. HURD. The Subcommittee on Information Technology and the 

Subcommittee on Government Operations will come to order. And 

without objection, the chair is authorized to declare a recess at any 

time. 

And I think we are good on votes later in the afternoon, right, 

so that is a plus for once. 

Good afternoon. Thank you all for being here. You know, nearly 

two years ago today, we released the first FITARA scorecard, or 

what some refer to as Issa-Connolly, is that right, Mr. Connolly? 

This bipartisan committee product, produced with GAO assistance, 

has been intended to drive technology reform across all of our Federal agencies. 

Today, the committee released the fourth FITARA scorecard. And 

the committee, in coordination with GAO, has adjusted the calculation and added new metrics for each version of the scorecard since 

the beginning. For example, the FITARA Scorecard 3.0, the final 

grade included a plus to indicate that the CIO reports to the Secretary or Deputy Secretary of the agency and a minus to indicate 

if the CIO does not report to these officials. That system remains 

in place for Scorecard 4.0, and I strongly urge that all agencies 

with a minus to adjust their reporting structure. This is any easy 

fix that will help agencies continue to move towards 21st century 

IT practices. 


KING-6430 with DISTILLER
2 

For Scorecard 4.0, the committee made two adjustments to the 

grading. First, we simplified the calculation for the incremental developmental area to capture more incremental projects. Second, we 

incorporated OMB data center optimization metrics into the data 

center grade so that half the grade is now based on savings as a 

result of consolidation, and half the grade is based upon meeting 

optimization metrics. OMB published these optimization metrics 

last year, so they should not be a surprise to agencies. And we did 

this based on feedback from the agencies. 

The committee is also previewing a new grading area related to 

the FITARA and MEGABYTE Act requirements on software license 

management inventories and the effectiveness of software licenses. 

There is absolutely no excuse for agencies not to have an accurate 

inventory of the software licenses they have. This is basic IT management. 

From Scorecard 3.0 to Scorecard 4.0, four agencies’ grades have 

improved, 15 agencies’ grades have stayed the same, and five agencies have declined. Notably, the Department of Defense grade declined from a D to an F. The committee reduced DOD’s grade due 

to a lack of transparency on IT spending. DOD appears to have reclassified a significant percentage of its IT spending as national security systems, which are not covered by FITARA. This lack of 

transparency is unacceptable. My colleagues and I will be following 

up with the DOD on this issue. 

We also have our first ever ‘‘A’’ on this scorecard. USAID, after 

receiving D’s on each of the first three scorecards, significantly improved its scores, particularly in the areas of incremental developmental transparency and risk management. I applaud the work of 

the office of the USAID CIO to address the score and encourage 

other agencies to look to them as an example in these areas. 

Today’s hearing features witnesses from HHS, which has received D’s on all four versions of the scorecard, and currently has 

44 open GAO recommendations related to high-risk IT acquisitions 

and operations. I look forward to hearing HHS’ plan to close out 

those recommendations and turn those grades around. 

Before I close, I want to take a moment to acknowledge and 

thank Chairman Chaffetz. The prioritization of IT and 

cybersecurity issues on the Oversight Committee has been an integral aspect of this committee’s success, and I am thankful for 

Chairman Chaffetz’s leadership on these issues. The Congress and 

the country are better off because of his service as chairman of the 

Oversight Committee. I thank Chairman Chaffetz for his service 

and leadership, and I look forward to working with Chairman 

Gowdy as he leads the committee forward. 

Thank you, and I look forward to hearing from all of our witnesses today. 

And now, it is my pleasure to recognize my friend and the ranking member of the Subcommittee on IT for her opening statement. 

Ms. Kelly, you are now recognized. 

Ms. KELLY. Thank you, Mr. Chairman. 

And thank you, Chairman Meadows and Ranking Member 

Connolly, for your leadership and the leadership you have shown 

our subcommittees continuing to work together to oversee Federal 

information technology systems. 


KING-6430 with DISTILLER
3 

Key to this oversight has been the scorecard our committees have 

developed for grading agency progress and fulfilling the requirements of the Federal Information Technology Acquisition Reform 

Act, or FITARA, or Issa-Connolly. The latest FITARA scorecard 

shows that President Trump’s hiring freeze and plan for imposing 

deep workforce reductions to agencies may have already begun to 

reverse the gains many agencies have been making under the prior 

administration. In January, President Trump ordered a freeze on 

the hiring of Federal civilian employees, preventing agencies from 

fulfilling vacancies or creating new positions. 

This past April, the Office of Management and Budget issued a 

new directive mandating that the agencies reduce their civilian 

workforce. Under the OMB directive, agencies are now required to, 

and I quote, ‘‘begin taking immediate actions to achieve near-term 

workforce reduction,’’ the President’s plan for reducing the Federal 

workforce to make it even more difficult for agencies to hire the 

most skilled, tech-savvy workforce needed to fully implement 

FITARA. 

This past March, our subcommittees held a hearing on the challenges the Federal Government is facing in Federal IT acquisition 

and heard from some of the leading IT experts in the private sector. Many of these experts agree that one of the most critical challenges to modernizing government IT operations is the need to hire 

more IT professionals. As the new scorecard shows, several agencies have hit roadblocks, and some, like the Department of Health 

and Human Services, which is here today, continue to fall behind 

in meeting the requirements of FITARA. Forcing these agencies to 

make across-the-board cuts to their workforces on top of the hiring 

freeze can make it more difficult for them to fulfill the requirements. 

It wasn’t always this way. Prior scorecards showed steady 

progress among agencies. But for the first time since our committee 

began measuring compliance, the new scorecard shows that overall 

agency progress has stalled under this administration. More specifically, the new scorecard indicates that the grades of only four 

agencies improved, 15 agencies had no improvement whatsoever, 

and the grades for five agencies actually went down. In contrast, 

when the subcommittees released their scorecard this past December, three times as many agencies showed improvement in their 

scores, and only one agency had a decrease in their grades. The 

new scorecard highlights the fact that the Trump administration’s 

Federal workforce policies are harmful and counterproductive. 

As I pointed out at the hearing our subcommittee held this past 

December on FITARA, I hope there will be bipartisan interest in 

holding the Trump administration to the same high standards to 

which we held the last administration. 

I want to thank the witnesses for testifying and thank the chair 

again. 

Mr. HURD. Thank you, Ranking Member. 

Now, I would like to recognize the chairman of the Subcommittee 

on Government Operations, the gentleman from North Carolina, 

Mr. Meadows, for his opening remarks. 

Mr. MEADOWS. Thank you, Mr. Chairman. I just want to say 

thank you for your leadership on this critical area. You have forgotVerDate Nov 24 2008 15:21 Aug 23, 2017 Jkt 000000 PO 00000 Frm 00009 Fmt 6633 Sfmt 6633 H:\26560.TXT APRIL

KING-6430 with DISTILLER
4 

ten more about IT than I ever knew, and I appreciate your leadership. And certainly, for the Issa-Connolly law or, as the gentleman 

from Virginia would love to call it, the Connolly-Issa law, thank 

you both for your leadership as we look at moving forward. 

I want to thank all of you for being here. Some of this may be 

not so pleasant. At the same time, it is becoming critically important that we address these issues. And as you will see, in a bipartisan fashion, we are taking this extremely seriously, and it will 

have implications from a standpoint of appropriations in other 

areas that if our IT CIOs don’t take it as seriously, they will see 

other areas that potentially could be impacted because of their inaction. 

And with that, I yield back, Mr. Chairman. 

Mr. HURD. The chairman yields back. 

Now, it is a pleasure to recognize the gentleman from the Commonwealth of Virginia, Mr. Connolly, for his opening remarks. 

Mr. CONNOLLY. Thank you, Mr. Chairman. And let me thank you 

and my friend Mr. Meadows and my dear friend Robin Kelly from 

Illinois for the bipartisan leadership of these two subcommittees. I 

think one of the big differences between this period—and of course 

my co-author is here with us today as well—we have handled this 

on a bipartisan basis. There is no daylight between us or among 

us on this issue. And I think sending that message to the executive 

branch is critical. 

What was lacking under Clinger-Cohen was any continuity or 

any robust follow-up because Mr. Clinger retired, Mr. Cohen became Secretary of Defense. That is not the case here. We are still 

here and we mean it. And we are going to continue to press for 

progress on the implementation of FITARA, also known as IssaConnolly. 

We are also, I hope, going to introduce legislation shortly to extend the sunset provisions, which I think is one of the recommendations of the GAO, and Mr. Powner may elaborate on that 

today. But we don’t want to lose progress by having those provisions expire prematurely, and we need more time for implementation, not forever, but we need more time. 

I echo all of the sentiments my colleagues have shared in their 

opening statements, and I want to first begin by citing what the 

chairman cited, which is the progress at AID. Here is an agency 

that began at a fairly low score and decided, you know what, we 

can’t settle for that. What did they do? They reached out to GAO 

and they said what can we do to improve our performance? And 

you know what, they listened to advice, and they implemented it. 

And they now have the highest score and the greatest progress of 

any Federal agency, AID. 

So, when some agencies say, well, it is too complicated, et cetera, 

AID has proved that is not true. If there is the political way, if 

there is a managerial desire to self-improve and to come into the 

21st century, you will have congressional support, you will have 

GAO support, and you will have a nice grade. 

On the other hand, at the other end of the spectrum is a recalcitrant, arrogant management style at the Department of Defense. 

Don’t bother us with these troublesome requirements or standards, 

we are exempt from everything, we will police ourselves, and we 


KING-6430 with DISTILLER
5 

will set our own goals and objectives and metrics. The fact that 

they, of course, fall short of everybody else’s is immaterial. And 

what is so disturbing about that is they are the big budget. 

And I know when we met with GAO, we were very disappointed 

in DOD’s performance, and all of us agreed, again, on a bipartisan 

basis, to insist that they improve their performance, that they come 

into compliance like every other Federal agency. And the burden 

is on them even greater because they have the dollars. They have 

the biggest budget of anybody, and they are about to get bigger. So, 

it is incumbent upon the Department of Defense to ‘‘get right with 

the Lord,’’ and we are going to help them along on a bipartisan 

basis. 

I believe the scorecard is a terribly important tool for measuring 

progress, and I thank GAO for working with us and coming up 

with it. I repeat what I have always said. It is not designed to be 

a scarlet letter on anyone’s back. It is designed to prod senior management to provide the wherewithal for a CIO in a reporting sequence but also empowerment so there is accountability, there is 

transparency, there is responsibility. And it is the taxpayer who 

benefits. 

So, you know, we have set metrics against which we believe people can be fairly measured, and we think it is working, not as fast 

as we would like. And the slow pace of naming a permanent CIO 

with the transition and new administration has cost us some 

progress, and that is why we want to extend the sunset provisions, 

not the only reason, but that is a primary driver so that we can 

make up for that time and keep the goals in front of us. 

So, I look forward to this hearing. It is one of my favorite every 

year. I don’t know why there aren’t klieg lights and cameras all 

over the room, but I do think this is a terribly important subject, 

and I thank again my colleagues for their support and their commitment. 

I yield back. 

Mr. HURD. I would like to thank the gentleman. And I am going 

to hold the record open for five legislative days for any members 

who would like to submit a written statement. 

And we are now going to recognize our panel of witnesses. I am 

pleased to welcome a repeat visitor of this chamber, I think one of 

the few people none of us have yelled at in the Federal Government, Mr. David Powner, the director of IT Management Issues, 

the U.S. Government Accountability Office; Ms. Beth Killoran, deputy assistant secretary for IT, chief information officer, the U.S. 

Department of Health and Human Services. Thank you for being 

here. Ms. Sheila Conley, the deputy assistant secretary, acting 

chief financial officer at HHS; and Dr. Rick Holgate, the research 

director at Gartner, Incorporated, and former CIO of the Bureau of 

Alcohol, Tobacco, Firearms, and Explosives. Welcome to you all. 

And pursuant to committee rules, all witnesses will be sworn in 

before they testify. Please rise and raise your right hands, please. 

[Witnesses sworn.] 

Mr. HURD. Thank you. Please be seated. 

Let the record reflect that the witnesses answered in the affirmative. 


KING-6430 with DISTILLER
6 

In order to allow time for discussion, we would appreciate it if 

you would please limit your testimony to five minutes. Your entire 

written statement will be made part of the record. 

And I would like to recognize Mr. Powner for his opening remarks for five minutes. 

WITNESS STATEMENTS 

STATEMENT OF DAVID A. POWNER 

Mr. POWNER. Chairman Hurd, Meadows, Ranking Members 

Kelly, Connolly, and members of the subcommittees, I’d like to 

thank you and your staff for your continued oversight on the implementation of FITARA with this fourth set of grades. 

This is the first time we’ve seen overall grades not improve with 

only four grades higher, five lower, and 15 holding steady. I would 

attribute this in part to transitioning administrations and also to 

your expansion of the scoring methodology. For example, data centers now include how agencies report on five optimization metrics 

in addition to cost savings. This has resulted in data center grades 

going down because only EPA and SSA report good progress on 

these metrics. 

The transparent reporting on data center progress that FITARA 

requires needs to continue beyond the October 2018 date since 

there are significant expected savings beyond 2018. Extending 

FITARA’s sunset date and realizing these out-year savings is especially important given the MGT Act and this committee’s oversight 

on modernizing old, insecure legacy systems. 

Another change to the scorecard is on incremental development 

where we now capture more software development projects. This 

change was suggested by several CIO shops, and I’d like to add 

that we have had good scorecard discussions with almost half of 

the CIOs or their staff. Although we’ve seen progress in the areas 

scored to date—incremental development, data center optimization, 

and investment transparency—we think there is great room for improvement on reducing duplicative business or administrative systems under the PortfolioStat initiative. 

Your preview of agencies’ efforts to better manage software licenses, a major area of FITARA not scored today, is eye-opening. 

Your preliminary grades would be two A’s, one C, and 21 F’s, and 

if this area was incorporated into the overall grades, we would 

have three agencies going up and 12 down instead of the four up 

and five down currently. 

Only three agencies—Education, GSA, and USAID—have complete inventories of their software licenses. This is completely unacceptable, especially considering this committee’s follow-up on 

FITARA with the passage of the complementary MEGABYTE Act. 

We need better management and more cost-savings in this area. 

Again, this is another opportunity area to fill the working capital 

funds proposed in the MGT Act. 

Next, I’d like to turn, Mr. Chairman, to CIO authorities and our 

ongoing work to this committee on CIO budget visibility, contract 

approval, and incremental development. The good news is we are 

hearing that FITARA is improving the relations between chief financial officers and chief acquisition officers. But these improved 


KING-6430 with DISTILLER
7 

relations are going to take time to resolve in the outcomes we need. 

We are still finding CIOs with limited visibility into IT spending, 

IT contracts and acquisitions not being approved by CIOs, CIOs not 

certifying that all major acquisitions are taking an incremental approach, despite all these areas being required in FITARA. We plan 

to have these reports ready for your fifth scorecard, Mr. Chairman. 

The reason these authorities are needed is simple: because we 

need CIOs governing over all IT. We recently found another example of a failed IT acquisition with the Coast Guard’s electronic 

health record that illustrates why CIO authorities need strengthened. Tens of millions of dollars were wasted, nothing was delivered, and when I recently with the admiral in charge, I asked this 

simple question: Was the CIO involved? The answer: Not then, but 

they are now with the new EHR acquisition. This is exactly why 

FITARA and strengthening CIO authorities are so critically important to have better delivery of Federal IT acquisitions and to more 

efficiently manage Federal IT operations. 

Although there have been some encouraging efforts with the current administration that highlight the importance of delivering 

technologies more effectively—namely, the Office of Innovation and 

the American Tech Council—agency CIOs and the Federal CIO are 

key to carrying out these high-level agendas. In fact, history tells 

us that the best progress we’ve seen on managing Federal IT is 

when the Federal CIO takes an active and aggressive role. This 

was a major theme that also emerged from the comptroller general’s IT forum that we recently held with current and Federal 

CIOs. Currently, the Federal CIO and eight Department CIO positions are vacant, and although we have seen several capable individuals filling in, this lack of permanent leadership will negatively 

impact the progress we are making on FITARA. Your scorecard, 

Mr. Chairman, highlighting these vacancies will hopefully help 

draw appropriate attention to these critical positions. 

Chairmen Hurd, Meadows, Ranking Members Connolly and 

Kelly, thank you again for your continued leadership and oversight 

of Federal IT. 

[Prepared statement of Mr. Powner follows:] 


KING-6430 with DISTILLER
8 


KING-6430 with DISTILLERInsert offset folio 1 here 26560.001

For Release on Delivery 

Expected at 2:00p.m. ET 

Tuesday, June 13, 2017 

United States Government Accountability Office 

Testimony 

Before the Subcommittees on 

Government Operations and 

Information Technology, Committee on 

Oversight and Government Reform, 

House of Representatives 

INFORMATION 

TECHNOLOGY 

Sustained Management 

Attention to the 

Implementation of FITARA 

Is Needed to Better 

Manage Acquisitions and 

Operations 

Statement of David A. Pawner, Director 

Information Technology Management Issues 
9 


KING-6430 with DISTILLERInsert offset folio 2 here 26560.002

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However. because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this matena! separately. 
10 


KING-6430 with DISTILLERInsert offset folio 3 here 26560.003

GAO 

Highlights 

Highlights ofGA0~17-686T, a testimony 

before the Subcommittees on Government 

Operations and lnfo~matton Technology, 

Committee on Oversight and Government 

Reform, House of Representatives 

Why GAO Did This Study 

The federal government plans to invest 

almost $96 billion on IT in fiscal year 

2018. Historically, these investments 

have too often failed, incurred cost 

overruns and schedule slippages, or 

contributed little to mission-related 

outcomes. Accordingly, in December 

2014, Congress enacted FITARA, 

aimed at improving agencies' 

acquisitions of IT. Further, in February 

2015, GAO added improving the 

management of IT acquisitions and 

operations to its high-risk list. 

This statement summarizes agencies' 

progress in improving the management 

of IT acquisitions and operations. This 

statement is based on GAO prior and 

recently published reports on (1) data 

center consolidation, (2) risk levels of 

major investments as reported on 

OMS's IT Dashboard, (3) 

implementation of incremental 

development practices, and (4) 

management of software licenses. 

What GAO Recommends 

From fiscal years 2010 through 2015, 

GAO made about 800 

recommendations to OMB and federal 

agencies to address shortcomings in IT 

acquisitions and operations, and 

included recommendations to improve 

the oversight and execution of the data 

center consolidation initiative, the 

accuracy and reliability of the 

Dashboard, incremental development 

policies, and software license 

management. Most agencies agreed 

with GAO's recommendations or had 

no comments. In addition, in fiscal year 

2016, GAO made about 200 new 

recommendations in this area. GAO 

will continue to monitor agencies' 

implementation of these 

recommendations. 

View GA0-17 -686T. For more information, 

contact David A. Pawner at (202} 512-9286 or 

pownerd@gao.gov. 

INFORMATION TECHNOLOGY 

Sustained Management Attention to the 

Implementation of FITARA Is Needed to Better 

Manage Acquisitions and Operations 

What GAO Found 

The Office of Management and Budget (OMB) and federal agencies have taken 

steps to improve information technology (IT) through a series of initiatives, and 

as of May 2017, had fully implemented about 47 percent of the approximately 

800 related GAO recommendations. However, additional actions are needed. 

Consolidating data centers. OMB launched an initiative in 2010 to reduce 

data centers, which was reinforced by the Federal Information Technology 

Acquisition Reform Act (FITARA) in 2014. GAO reported in May 2017 that 

agencies had closed 4,388 of the 9,995 total data centers, and had plans to 

close a total of 5,597 through fiscal year 2019. As a result, agencies 

reportedly saved or avoided about $2.3 billion through August 2016. 

However, out of the 23 agencies that submitted required strategic plans, only 

7 had addressed all required elements. GAO recommended that agencies 

complete their plans to optimize their data centers and achieve cost savings 

and ensure reported cost savings are consistent across reporting 

mechanisms. Most agencies agreed with the recommendations. 

Enhancing transparency. OMB's IT Dashboard provides information on 

major investments at federal agencies, including ratings from Chief 

Information Officers that should reflect the level of risk facing an investment. 

GAO reported in June 2016 that agencies had not fully considered risks 

when rating their investments on the Dashboard. In particular, of the 95 

investments reviewed, GAO's assessments of risks matched the ratings 22 

times, showed more risk 60 times, and showed less risk 13 times. GAO 

recommended that agencies improve the quality and frequency of their 

ratings. Most agencies generally agreed with or did not comment on the 

recommendations. 

Implementing incremental development. OMB has emphasized the need 

for agencies to deliver investments in smaller parts, or increments, in order to 

reduce risk and deliver capabilities more quickly. Since 2012, OMB has 

required investments to deliver functionality every 6 months. In August 2016, 

GAO reported that while 22 agencies had reported that about 64 percent of 

469 active software development projects planned to deliver usable 

functionality every 6 months for fiscal year 2016, the other 36 percent of the 

projects did not. Further, for 7 selected agencies, GAO identified differences 

in the percentages of software projects reported to GAO as delivering 

functionality every 6 months, compared to what was reported on the 

Dashboard. GAO made recommendations to agencies and OMS to improve 

the reporting of incremental data on the Dashboard. Most agencies agreed or 

did not comment on the recommendations. 

Managing software licenses. Effective management of software licenses 

can help avoid purchasing too many licenses that result in unused software 

In May 2014, GAO reported that better management of licenses was needed 

to achieve savings. Specifically, only two agencies had comprehensive 

license inventories. GAO recommended that agencies regularly track and 

maintain a comprehensive inventory and analyze that data to identify 

opportunities to reduce costs and better inform decision making. Most 

agencies generally agreed with the recommendations or had no comments; 

as of May 2017, 4 agencies had made progress in implementing them. 

-------------United States Government Accountability Office-
11 


KING-6430 with DISTILLERInsert offset folio 4 here 26560.004

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, 

and Members of the Subcommittees: 

I am pleased to be here today to discuss opportunities for federal 

agencies to improve the acquisition of information technology (IT). As you 

know, the effective and efficient acquisition of IT has been a longstanding challenge in the federal government. In particular, the federal 

government has spent billions of dollars on failed and poorly performing 

IT investments, which often suffered from ineffective management. 

Recognizing the importance of government-wide acquisition of IT, in 

December 2014, Congress enacted federal IT acquisition reform 

legislation (commonly referred to as the Federal Information Technology 

Acquisition Reform Act, or FITARA). 1 

In addition, in February 2015, we added improving the management of IT 

acquisitions and operations to our list of high-risk areas for the federal 

government. 2 We recently issued an update to our high-risk report and 

determined that, while progress has been made in addressing the highrisk area of IT acquisitions and operations, significant work remains to be 

completed. 3 For example, as of May 2017, the Office of Management and 

Budget (OMB) and agencies had implemented 380 (or about 47 percent) 

of the 803 open recommendations that we had made from fiscal years 

2010 through 2015 related to IT acquisitions and operations. 

My statement today discusses agencies' progress in improving the 

management of IT acquisitions and operations. This statement is based 

on our prior and recently published reports that discuss (1) data center 

consolidation, (2) risk levels of major investments as reported on OMB's 

IT Dashboard, (3) implementation of incremental development practices, 

and (4) and management of software licenses. A more detailed 

discussion of the objectives, scope, and methodology for this work is 

included in each of the reports that are cited throughout this statement. In 

1

Car! Levin and Howard P 'Buck' McKeon Nat1onal Defense Authorization Act for Fiscal 

Year 2015, Pub L. No. 113-291. div. A. title VIII, subtitleD, 128 Stat 3292, 3438-3450 

(Dec. 19, 2014). 

2

GAO, High-Risk Senes: An Update, GA0-15-290 (Washington, DC .. Feb. 11. 2015). 

GAO maintains a high~risk program to focus attention on government operations that it 

identifies as high nsk due to their greater vulnerabilities to fraud, waste. abuse, and 

mismanagement or the need for transformation to address economy, efficiency, or 

effectiveness challenges. 

3

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GA0-17-317 (Washington, D.C.: Feb. 15. 2017) 

Page 1 
12 


KING-6430 with DISTILLERInsert offset folio 5 here 26560.005

Background 

addition. related to the current status of federal agencies' CIO position. 

we reviewed publically available data and verified that data with agencies. 

We conducted the work upon which this statement is based in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

According to the President's budget, the federal government plans to 

invest more than $96 billion on IT in fiscal year 2018-the largest amount 

ever. However, as we have previously reported, investments in federal IT 

too often result in failed projects that incur cost overruns and schedule 

slippages, while contributing little to the desired mission-related 

outcomes. For example: 

The Department of Veterans Affairs' Scheduling Replacement Project 

was terminated in September 2009 after spending an estimated $127 

million over 9 years. 4 

The tri-agency5 National Polar-orbiting Operational Environmental 

Satellite System was halted in February 2010 by the White House's 

Office of Science and Technology Policy after the program spent 16 

years and almost $5 billion. 6 

Information Technology: Management Improvements Are Essential to VA's Second 

Its Outpatient Scheduling System, GA0-10-579 (Washington, D.C.: May 

5-rhe weather satellite program was managed by the National Oceanic and Atmospheric 

Administration, the Department of Defense, and the National Aeronautics and Space 

Administration 

6

See, for example, GAO, Polar-Orbiting Environmental Satellites: With Costs Increasing 

and Data Continuity at Risk, Improvements Needed in Tri-agency Decision Making, 

GA0-09-564 (Washington, D.C.: June 17, 2009) and Environmental Satellites: Polar~ 

Orbiting Satellite Acquisition Faces Delays; Decisions Needed on Whether and How to 

Ensure Climate Data Continuity, GA0-08-518 (Washington, D.C .. May 16, 2008). 

Page 2 
13 


KING-6430 with DISTILLERInsert offset folio 6 here 26560.006

The Department of Homeland Security's Secure Border Initiative 

Network program was ended in January 2011, after the department 

obligated more than $1 billion for the program. 7 

The Office of Personnel Management's Retirement Systems 

Modernization program was canceled in February 2011, after 

spending approximately $231 million on the agency's third attempt to 

automate the processing of federal employee retirement claims. 8 

The Department of Veterans Affairs' Financial and Logistics 

Integrated Technology Enterprise program was intended to be 

delivered by 2014 at a total estimated cost of $609 million, but was 

terminated in October 2011. 9 

The Department of Defense's Expeditionary Combat Support System 

was canceled in December 2012 after spending more than a billion 

dollars and failing to deploy within 5 years of initially obligating 

funds. 10 

Our past work found that these and other failed IT projects often suffered 

from a lack of disciplined and effective management, such as project 

planning, requirements definition, and program oversight and 

governance. In many instances, agencies had not consistently applied 

best practices that are critical to successfully acquiring IT. 

Federal IT projects have also failed due to a lack of oversight and 

governance. Executive-level governance and oversight across the 

7

See, for example, GAO, Secure Border Initiative: DHS Needs to Strengthen Management 

and Oversight of Its Prime Contractor, GA0~11-6 (Washington. D.C .. Oct 18, 2010); 

Secure Border Initiative: DHS Needs to Reconsider Its Proposed Investment in Key 

Technology Program, GA0~10-340 (Washington, D.C .. May 5, 2010), and Secure Border 

Initiative: DHS Needs to Address Testmg and Performance Limitations That Place Key 

Technology Program at Risk, GA0~10-158 {Washington, D.C .. Jan 29, 2010) 

8See, for example, GAO. Office of Personnel Management: Retirement Modernization 

Planning and Management Shorlcomings Need to Be Addressed, GA0-09-529 

(Washington, D.C .. Apr. 21, 2009) and Office of Personnel Management. Improvements 

Needed to Ensure Successful Retirement Systems Modernization, GA0-08-345 

(Washmgton, DC.: Jan. 31, 2008). 

9

GAO, Information Technology: Actions Needed to Futly Establish Program Management 

Capability for VA 's Financial and Logistics Initiative. GA0-1 0-40 (Washington, 0. C .. Oct 

26, 2009). 

10GAO, DOD Financial Management: Implementation Weaknesses in Army and Air Force 

Business Systems Could Jeopardize DOD's Auditability Goals, GA0-12-134 (Washmgton. 

D.C .. Feb. 28, 2012) and DOD Business Transformation: Improved Management 

Oversight of Business System Modernization Efforts Needed, GA0-11-53 {Washmgton, 

D.C .. Oct. 7, 2010) 

Page 3 
14 


KING-6430 with DISTILLERInsert offset folio 7 here 26560.007

government has often been ineffective, specifically from chief information 

officers (CIO). For example, we have reported that some CIOs' authority 

was limited because they did not have the authority to review and 

approve the entire agency IT portfolio. 11 

FITARA Can Improve Agencies' Management of IT 

Recognizing the severity of issues related to the government-wide 

management of IT, FITARA was enacted in December 2014. The law was 

intended to improve agencies' acquisitions of IT and enable Congress to 

monitor agencies' progress and hold them accountable for reducing 

duplication and achieving cost savings. FITARA includes specific 

requirements related to seven areas. 12 

Federal data center consolidation initiative (FDCCI). Agencies are 

required to provide OMB with a data center inventory, a strategy for 

consolidating and optimizing their data centers (to include planned 

cost savings), and quarterly updates on progress made. The law also 

requires OMB to develop a goal for how much is to be saved through 

this initiative, and provide annual reports on cost savings achieved. 

Enhanced transparency and improved risk management. OMB 

and covered agencies are to make detailed information on federal IT 

investments publicly available, and agency CIOs are to categorize 

their IT investments by level of risk. Additionally, in the case of major 

IT investments 13 rated as high risk for 4 consecutive quarters, the law 

requires that the agency CIO and the investment's program manager 

conduct a review aimed at identifying and addressing the causes of 

the risk. 

t;n;•eunro.rmomon Officers: Opportunities Exist to Improve Role in 

Ma,nag•ement, GA0-11-634 (Washington. D.C ·Sept 15, 2011) 

12The provisions apply to the agencies covered by the Chief Financial Officers Act of 

1990, 31 U.S.C. § 901(b). These agencies are the Departments of Agriculture, 

Commerce, Defense, Education, Energy, Health and Human Services. Homeland 

Security, Housing and Urban Development, Justice, Labor, State, the Interior, the 

Treasury, Transportation. and Veterans Affairs; the Environmental Protection Agency, 

Genera! Services Administration, National Aeronautics and Space Administration, National 

Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management, 

Small Business Administration, Social Secunty Administration, and U.S. Agency for 

International Development. However, F!TARA has generally limited application to the 

Department of Defense 

13Major IT investment means a system or an acquisition requiring special management 

attention because it has significant program or policy implications; high executive v1sibi!ity; 

high development, operating, or maintenance costs; an usual funding mechanism; or is 

defined as major by the agency's capital planning and investment control process. 

Page4 
15 


KING-6430 with DISTILLERInsert offset folio 8 here 26560.008

Agency CIO authority enhancements. CIOs at covered agencies 

are required to (1) approve the IT budget requests of their respective 

agencies, (2) certify that OMS's incremental development guidance is 

being adequately implemented for IT investments, (3) review and 

approve contracts for IT, and (4) approve the appointment of other 

agency employees with the title of CIO. See appendix I for details on 

the current status of federal CIOs. 

Portfolio review. Agencies are to annually review IT investment 

portfolios in order to, among other things, increase efficiency and 

effectiveness and identify potential waste and duplication. In 

establishing the process associated with such portfolio reviews, the 

law requires OMB to develop standardized performance metrics, to 

include cost savings, and to submit quarterly reports to Congress on 

cost savings. 

Expansion of training and use of IT acquisition cadres. Agencies 

are to update their acquisition human capital plans to address 

supporting the timely and effective acquisition of IT. In doing so, the 

law calls for agencies to consider, among other things, establishing IT 

acquisition cadres or developing agreements with other agencies that 

have such cadres. 

Government-wide software purchasing program. The General 

Services Administration is to develop a strategic sourcing initiative to 

enhance government-wide acquisition and management of software. 

In doing so, the law requires that, to the maximum extent practicable, 

the General Services Administration should allow for the purchase of 

a software license agreement that is available for use by all executive 

branch agencies as a single user. 14 

Maximizing the benefit of the Federal Strategic Sourcing 

lnitiative. 15 Federal agencies are required to compare their 

purchases of services and supplies to what is offered under the 

Federal Strategic Sourcing Initiative. OMB is also required to issue 

regulations related to the initiative. 

14The Making Electronic Government Accountable by Yielding Tangible Efficiencies Act of 

2016, or the "MEGABYTE Act" further enhances eros management of software licenses 

by requiring agency C!Os to establish an agency software licensing policy and a 

comprehensive software license inventory to track and maintain licenses, among other 

requirements. Pub. L. No. 114-210 (July 29. 2016): 130 Stat 824 

15The Federal Strategic Sourcing Initiative is a program established by the General 

Services Administration and the Department of the Treasury to address government~w1de 

opportunities to strategically source commonly purchased goods and seiVices and 

elimmate duplication of efforts across agenc1es 

Page 5 
16 


KING-6430 with DISTILLERInsert offset folio 9 here 26560.009

In June 2015, OMB released guidance describing how agencies are to 

implement FIT ARA. 16 This guidance is intended to, among other things: 

assist agencies in aligning their IT resources with statutory 

requirements; 

establish government-wide IT management controls that will meet the 

law's requirements, while providing agencies with flexibility to adapt to 

unique agency processes and requirements; 

clarify the CIO's role and strengthen the relationship between agency 

CIOs and bureau CIOs; and 

strengthen CIO accountability for IT costs, schedules, performance, 

and security. 

The guidance identified several actions that agencies were to take to 

establish a basic set of roles and responsibilities (referred to as the 

common baseline) for CIOs and other senior agency officials, which were 

needed to implement the authorities described in the law. For example, 

agencies were required to conduct a self-assessment and submit a plan 

describing the changes they intended to make to ensure that common 

baseline responsibilities were implemented. Agencies were to submit their 

plans to OMB's Office of E-Government and Information Technology by 

August 15, 2015, and make portions of the plans publicly available on 

agency websites no later than 30 days after OMB approval. As of 

November 2016, all agencies had made their plans publicly available. 

In addition, in August 2016, OMB released guidance intended to, among 

other things, define a framework for achieving the data center 

consolidation and optimization requirements of FITARA. 17 The guidance 

includes requirements for agencies to: 

maintain complete inventories of all data center facilities owned, 

operated, or maintained by or on behalf of the agency; 

develop cost savings targets for fiscal years 2016 through 2018 and 

report any actual realized cost savings; and 

measure progress toward meeting optimization metrics on a quarterly 

basis. 

The guidance also directs agencies to develop a data center 

consolidation and optimization strategic plan that defines the agency's 

Management and Oversight of Federaf Information Technology, Memorandum M~ 

15-14 (Washington, D.C. June 10. 2015). 

170MB, Data Center Optimization Initiative (DCOJ}, Memorandum M-16-19 (Washington 

D.C .. Aug. 1, 2016) 

Page6 
17 


KING-6430 with DISTILLERInsert offset folio 10 here 26560.010

data center strategy for fiscal years 2016,2017, and 2018. This strategy 

is to include, among other things, a statement from the agency CIO 

stating whether the agency has complied with all data center reporting 

requirements in FITARA. Further, the guidance indicates that OMB is to 

maintain a public dashboard that will display consolidation-related costs 

savings and optimization performance information for the agencies. 

~~~~----~--~--~~~~~~ IT Acquisitions and Operations Identified by GAO as a High-Risk Area 

In February 2015, we introduced a new government-wide high-risk area, 

Improving the Management of IT Acquisitions and Operations.'' This area 

highlighted several critical IT initiatives in need of additional congressional 

oversight, including (1) reviews of troubled projects; (2) efforts to increase 

the use of incremental development; (3) efforts to provide transparency 

relative to the cost, schedule, and risk levels for major IT investments; (4) 

reviews of agencies' operational investments; (5) data center 

consolidation; and (6) efforts to streamline agencies' portfolios of IT 

investments. We noted that implementation of these initiatives was 

inconsistent and more work remained to demonstrate progress in 

achieving IT acquisition and operation outcomes. 

Further, our February 2015 high-risk report stated that, beyond 

implementing FITARA, OMB and agencies needed to continue to 

implement our prior recommendations in order to improve their ability to 

effectively and efficiently invest in IT. Specifically, from fiscal years 2010 

through 2015, we made 803 recommendations to OMB and federal 

agencies to address shortcomings in IT acquisitions and operations. 

These recommendations included many to improve the implementation of 

the aforementioned six critical IT initiatives and other government-wide, 

cross-cutting efforts. We stressed that OMB and agencies should 

demonstrate government-wide progress in the management of IT 

investments by, among other things, implementing at least 80 percent of 

our recommendations related to managing IT acquisitions and operations 

within 4 years. 

In February 2017, we issued an update to our high-risk series and 

reported that, while progress had been made in improving the 

management of IT acquisitions and operations, significant work still 

remained to be completed. 19 For example, as of May 2017, OMB and the 

18GA0-15-290 

19GA0-17-317 

Page 7 
18 


KING-6430 with DISTILLERInsert offset folio 11 here 26560.011

agencies had fully implemented 380 (or about 47 percent) of the 803 

recommendations. This was a 24 percent increase compared to the 

percentage we reported as being fully implemented in 2015. Figure 1 

summarizes the progress that OMB and the agencies had made in 

addressing our recommendations, as compared to the 80 percent target, 

as of May 2017. 

Figure 1: Summary of the Office of Management and Budget's and Federal 

Agencies' Progress in Addressing GAO's Recommendations, as of May 2017 

20 40 60 80 

Percent of recommendations Implemented (fiscal years 2010 through 201 5) 

Source Office of Management and 6\ldget and agency data. l GA0-17 -686T 

100 

In addition, in fiscal year 2016, we made 202 new recommendations, thus 

further reinforcing the need for OMB and agencies to address the 

shortcomings in IT acquisitions and operations. Also, beyond addressing 

our prior recommendations, our 2017 high-risk update noted the 

importance of OMB and federal agencies continuing to expeditiously 

implement the requirements of FITARA. 

To further explore the challenges and opportunities to improve federal IT 

acquisitions and operations, we convened a forum on September 14, 

2016, to explore challenges and opportunities for CIOs to improve federal 

IT acquisitions and operations-with the goal of better informing 

policymakers and government leadership. 2° Forum participants, which 

included 13 current and former federal agency CIOs, members of 

Congress, and private sector IT executives, identified key actions related 

to seven topics: (1) strengthening FITARA, (2) improving CIO authorities, 

(3) budget formulation, (4) governance, (5) workforce, (6) operations, and 

(7) transition planning. A summary of the key actions, by topic area, 

identified during the forum is provided in figure 2. 

20GAO, Information Technology: Opportunities for Improving Acquisitions and Operations, 

GA0-17-251SP (Washtngton, D.C.: Apr. 11, 2017) 

Page 8 
19 


KING-6430 with DISTILLERInsert offset folio 12 here 26560.012

------------------------------------------------------------------

• Have the Chief Information Officers (CIO) Council play an enhanced role in 

improving authorities 

• Implement collaborative mrv?!rm,,~., 

• Evolve the role of the enable change 

• Focus on cybersecuri!y to change existing cultures 

• Use information tec,hn,oiO!lY 

• Examine 

• Simplify of IT 

• Work more closely with nra>curemem 

• Work with corlgnessional 

• Obtain support from 

• Enhance ao•verna11ce 

• Use authorities lo enhance oovernar1ce 

• Strengthen oversight for as a service 

more and develop less 

procurement processes to align with new technologies 

CIOs by appealing to missions 

• Have the CIO play a more active role attracting agency CIOs 

• Give CIOs more human resource flexibilities 

• Focus on and in a more holistic IT workforce 

• Better integrate into the IT workforce 

system migration 

• Convey IT and cyber issues 

Encmm"'" Congress to focus on at 

ccr1firrnation hearings 

• Ensure that IT and cyber issues are OMB priorities 

• Ensure GAO plays a role highlighting its work and expertise 

Page 9 

2017, the Federal CIO Council concluded !hal 

over IT-related investments and spending 

incom;is!•9nc:ies in how IT is executed from agency to agency. 
20 


KING-6430 with DISTILLERInsert offset folio 13 here 26560.013

According to the Council, for those agencies where the CIO has broad 

authority to manage all IT investments, great progress has been made to 

streamline and modernize the federal agency's footprint For the others, 

where agency CIOs are only able to control pieces of the total IT footprint, 

rt has been harder to achieve improvements. 21 

The Federal Government Has Current Efforts to Improve IT 

The administration has initiated two efforts aimed at improving federal IT. 

Specifically, in March 2017, it established the Office of American 

Innovation to, among other things, improve federal government 

operations and services, and modernize federal IT. The office is to 

consult with both OMS and the Office of Science and Technology Policy 

on policies and plans intended to improve government operations and 

services, improve the quality of life for Americans, and spur job creation. 22 

In May 2017, the administration also established the American 

Technology Council to help transform and modernize federal IT and how 

the government uses and delivers digital services. The President is the 

chairman of this council, and the Federal CIO and the United States 

Digital Service" administrator are members. 

Agencies Have Taken Steps to Improve IT Management, but Full 

Implementation of FITARA Is Needed 

Agencies have taken steps to improve the management of IT acquisitions 

and operations by implementing key FIT ARA initiatives. However, 

agencies would be better positioned to fully implement the law and, thus, 

realize additional management improvements, if they addressed the 

numerous recommendations we have made aimed at improving data 

State of Federal Information Technology (Washington, D.C_ January 

22The White House Office of Science and Technology Policy provides the President and 

others within the Executive office of the President with advice on the scientific, 

engineering, and technological aspects of the economy, national security, homeland 

security, health, foreign relations, the environment, and the technological recovery and 

use of resources, among other topics 

~he Un1ted States D1gital Serv1ce 1s an office within OMS whtch aims to improve the 

most important public-facing federal digital services 

Page 10 
21 


KING-6430 with DISTILLERInsert offset folio 14 here 26560.014

center consolidation, increasing transparency via OMB's IT Dashboard, 

implementing incremental development, and managing software licenses. 

Agencies Have Made Progress in Consolidating Data Centers, but Need to Take Action 

to Achieve Planned Cost Savings 

One of the key initiatives to implement FITARA is data center 

consolidation. OMB established FDCCI in February 2010 to improve the 

efficiency, performance, and environmental footprint of federal data 

center activities and the enactment of FITARA reinforced the initiative. 

However, in a series of reports that we issued over the past 6 years, we 

noted that, while data center consolidation could potentially save the 

federal government billions of dollars, weaknesses existed in several 

areas, including agencies' data center consolidation plans and OMB's 

tracking and reporting on related cost savings. 24 In these reports, we 

made a total of 141 recommendations to OMB and 24 agencies to 

improve the execution and oversight of the initiative. Most agencies and 

OMB agreed with our recommendations or had no comments. As of May 

2017, 75 of our recommendations remained open. 

Also, in May 2017, we reported" that the 24 agencies" participating in 

FDCCI collectively had made progress on their data center closure 

efforts. Specifically, as of August 2016, these agencies had identified a 

24GAO, Data Center Optimization: Agencies Need to Complete Plans to Address 

Inconsistencies in Reported Savings. GA0-17-388 (Washington, D.C .. May 18, 2017); 

Data Center Consolidation: Agencies Making Progress, but Planned Savings Goals Need 

to Be Established [Reissued on March 4, 2016], GA0-16-323 (Washington, D.C .. Mar. 3, 

2016); Data Center Consolidation: Reporting Can Be Improved to Reflect Substantial 

Planned Savings, GA0-14-713 (Washington, D.C.: Sept 25, 2014); Data Center 

Consolidation: Strengthened Oversight Needed to Achteve Cost Savings Goal, 

GA0-13-378 (Washington, D.C.: Apr. 23. 2013}; Data Center Consolidation: Agencies 

Making Progress on Efforts, but Inventories and Plans Need to Be Completed, 

GA0-12-742 (Washmgton, D.C July 19, 2012): and Data Center Consolidation: Agencies 

Need to Complete Inventories and Plans to Achieve Expected Savings, GA0-11-565 

(Washington, D.C. July 19. 2011) 

25GA0-17-388. 

26The 24 agencies that FITARA requires to participate in FDCC! are the Departments of 

Agriculture, Commerce, Defense. Education, Energy, Health and Human Services, 

Homeland Secunty, Housing and Urban Development the Interior, Just1ce, Labor, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency, 

General Services Administration; National Aeronautics and Space Administration; National 

Science Foundation: Nuclear Regulatory Commission: Office of Personnel Management 

Sma!! Business Administration; Social Secunty Administration: and U.S. Agency for 

International Development 

Page 11 
22 


KING-6430 with DISTILLERInsert offset folio 15 here 26560.015

than 

through 2018 that 

presents a of the amounts of cost savings and av,oidan<~es 

reported by agencies to OMB and the amounts the agencies reported to 

us. 

Total planned cost savings and avoidances (in billions) 

- Reported in agency Oata Center Conso!ida!ion lnltlallva (OCO!) strareglc plans 

FITARA required ~n"nr'i"'' to 

strategies to consolidation and ontim;;?;,llion 

centers no later than the end of fiscal 

was to include such inf''"''"tinn 

optimization metrics, and Ve<lr-bv-vear 

cost savings through 

Page 12 

this 
23 


KING-6430 with DISTILLERInsert offset folio 16 here 26560.016

Further, OMB's August 2016 guidance on data center optimization 

contained additional information for how agencies are to implement the 

strategic plan requirements of FITARA. 27 Specifically, the guidance stated 

that agency data center consolidation and optimization strategic plans are 

to include, among other things, planned and achieved performance levels 

for each optimization metric; calculations of target and actual agencywide spending and cost savings on data centers; and historical cost 

savings and cost avoidances due to data center consolidation and 

optimization. OMB's guidance also stated that agencies were required to 

publicly post their strategic plans to their agency-owned digital strategy 

websites by September 30, 2016. 

As of April 2017, only 7 of the 23 agencies that submitted their strategic 

plans-the Departments of Agriculture, Education, Homeland Security, 

and Housing and Urban Development; the General Services 

Administration; the National Science Foundation; and the Office of 

Personnel Management-had addressed all five elements required by the 

OMB memorandum implementing FITARA. The remaining 16 agencies 

either partially met or did not meet the requirements. For example, most 

agencies partially met or did not meet the requirements to provide 

information related to data center closures and cost savings metrics. The 

Department of Defense did not submit a plan and was rated as not 

meeting any of the requirements. 

To better ensure that federal data center consolidation and optimization 

efforts improve governmental efficiency and achieve cost savings, in our 

May 2017 report, we recommended that 11 of the 24 agencies take action 

to ensure that the amounts of achieved data center cost savings and 

avoidances are consistent across all reporting mechanisms. We also 

recommended that 17 of the 24 agencies each take action to complete 

missing elements in their strategic plans and submit their plans to OMB in 

order to optimize their data centers and achieve cost savings. Twelve 

agencies agreed with our recommendations, 2 did not agree, and 10 

agencies and OMB did not state whether they agreed or disagreed. 

~~~~~~~=-~~--~--~~--~ Risks Need to Be Fully Considered When Agencies Rate Their Major Investments on 

OMS's IT Dashboard 

To facilitate transparency across the government in acquiring and 

managing IT investments, OMB established a public website-the IT 

Page 13 

Data Center Optimization lnttJatJVe (OCOJ), Memorandum M-16-19 (Washmgton, 

1, 2016) 
24 


KING-6430 with DISTILLERInsert offset folio 17 here 26560.017

Dashboard-to provide detailed information on major investments at 26 

agencies, including ratings of their performance against cost and 

schedule targets. Among other things, agencies are to submit ratings 

from their CIOs, which, according to OMS's instructions, should reflect the 

level of risk facing an investment relative to that investment's ability to 

accomplish its goals. In this regard, FITARA includes a requirement for 

CIOs to categorize their major IT investment risks in accordance with 

OMB guidance. 28 

Over the past 6 years, we have issued a series of reports about the 

Dashboard that noted both significant steps OMB has taken to enhance 

the oversight, transparency, and accountability of federal IT investments 

by creating its Dashboard, as well as concerns about the accuracy and 

reliability of the data29 In total, we have made 47 recommendations to 

OMB and federal agencies to help improve the accuracy and reliability of 

the information on the Dashboard and to increase its availability. Most 

agencies agreed with our recommendations or had no comments. As of 

May 2017, 17 of these recommendations have been implemented. 

In June 2016, we determined that 13 of the 15 agencies selected for indepth review had not fully considered risks when rating their major 

investments on the Dashboard. Specifically, our assessments of risk for 

95 investments at the 15 selected agencies 30 matched the CIO ratings 

posted on the Dashboard 22 times, showed more risk 60 times, and 

showed less risk 13 times. 

2840 U.S C. § 11302(c)(3)(C) 

29GAO, IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their Major 

Investments, GA0-16-494 (Washington, D.C .. June 2, 2016); IT Dashboard· Agencies Are 

Managing Investment Rtsk, but Related Ratings Need to Be More Accurate and Available, 

GA0-14-64 (Washington, D.C.: Dec. 12. 2013): IT Dashboard: Opportunities Exist to 

fmprove Transparency and Oversight of Investment Risk at Select Agencies, GA0-13-98 

{Washington, D.C.: Oct. 16, 2012), IT Dashboard: Accuracy Has Improved, and Additional 

Efforts Are under Way to Better Inform Decision Making, GA0-12-210 (Washington, D.C .. 

Nov. 7, 2011); information Technology.- OMB Has Made fmprovements to Its Dashboard, 

but Further Work fs Needed by Agencies and OMB to Ensure Data Accuracy, 

GA0-11-262 (Washington, D.C .. Mar.15, 2011); and Information Technology: OMB's 

Dashboard Has Increased Transparency and Oversight, but Improvements Needed, 

GA0-10-701 (Washington, D.C.: July 16, 2010). 

~he 15 selected agencies were the Departments of Agriculture, Commerce, Defense, 

Education, Energy, Health and Human Services, Homeland Security, the Interior, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency; 

General Services Administration; and Social Security Administration 

Page 14 
25 


KING-6430 with DISTILLERInsert offset folio 18 here 26560.018

-Lowrlsk 

Figure summarizes how our assessments compared to the selected 

investments' CIO ratings, 

M&llum risk - Hlgh risk 

Aside from the iurlan1ert!al nature of risk ratings, we identified 

three factors which contribu;!ed to differences between our assessments 

and the CIO ratings: 

during April 2015 

led to differences 

ratings, This underscores the 

which help to ensure that the 

timely and accurately reflects recent 

1 month. 

on older data, and 

As a result, we concluded that the associated risk used 

by the were the 

im<'<><'tm,ont'• risk, raising that federal investments in 

are not receiving the appropriate levels of oversight 

To better ensure that the Dashboard more accurately reflect risk, 

we recommended that the 15 agencies actions to improve the quality 

Page 15 
26 


KING-6430 with DISTILLERInsert offset folio 19 here 26560.019

and frequency of their CIO ratings. Twelve agencies generally agreed 

with or did not comment on the recommendations and three agencies 

disagreed, stating that their CIO ratings were adequate. However, we 

noted that weaknesses in these three agencies' processes still existed 

and that we continued to believe our recommendations were appropriate. 

As of May 2017, these recommendations have not yet been fully 

implemented. 

Agencies Need to Increase Their Use of Incremental Development Practices 

OMS has emphasized the need to deliver investments in smaller parts, or 

increments, in order to reduce risk, deliver capabilities more quickly, and 

facilitate the adoption of emerging technologies. In 2010, it called for 

agencies' major investments to deliver functionality every 12 months and, 

since 2012, every 6 months. Subsequently, FITARA codified a 

requirement that agency CIOs certify that IT investments are adequately 

implementing OMS's incremental development guidance. 31 

However, in May 2014, we reported" that 66 of 89 selected investments 

at five major agencies" did not plan to deliver capabilities in 6-month 

cycles, and less than half of these investments planned to deliver 

functionality in 12-month cycles. We also reported that only one of the five 

agencies had complete incremental development policies. Accordingly, 

we recommended that OMB clarify its guidance on incremental 

development and that the selected agencies update their associated 

policies to comply with OMS's revised guidance (once made available), 

and consider the factors identified in our report when doing so. 

Four of the six agencies agreed with our recommendations or had no 

comments, one agency partially agreed, and the remaining agency 

disagreed with the recommendations. The agency that disagreed did not 

believe that its recommendations should be dependent upon OMS taking 

action to update guidance. In response, we noted that only one of the 

recommendations to that agency depended upon OMB action, and we 

maintained that the action was warranted and could be implemented. 

U.S. C.§ 11319(b)(1)(B)(i<) 

32GAO, Information Technology: Agencies Need to Establish and Implement Incremental 

Development Policies, GA0-14-361 (Washington, D.C .. May 1, 2014) 

~hese five agencies are the Departments of Defense, Health and Human Services, 

Homeland Security, Transportation, and Veterans Affairs 

Page 16 
27 


KING-6430 with DISTILLERInsert offset folio 20 here 26560.020

Subsequently, in August 2016, we reported 34 that agencies had not fully 

implemented incremental development practices for their software 

development projects. Specifically, we noted that, as of August 31, 2015, 

22 federal agencies35 had reported on the Dashboard that 300 of 469 

active software development projects (approximately 64 percent) were 

planning to deliver usable functionality every 6 months for fiscal year 

2016, as required by OMB guidance. Table 1 lists the total number and 

percent of federal software development projects for which agencies 

reported plans to deliver functionality every 6 months for fiscal year 2016. 

Table 1: Federal Agency Software Development Projects that Planned to Deliver Functionality Every 6 Months for Fiscal Year 

2016, as Reported on the Office of Management and Budget's Information Technology (IT) Dashboard 

Source GAO analySis ol Dashboard data as of August 31, 20 15 I GA0-17 -686T 

"Thirteen additional agencies each reported having at least one major IT investment and a total of 20 

or fewer projects. These agencies have been totaled together because calculating a percent of 

functionality delivered for each agency's small number of projects would not provide a reliable figure 

Information Technology Reform: Agencies Need to Increase Their Use of 

Incremental Development Practices, GA0~16-469 (Washington, D.C.: Aug. 16, 2016). 

3

:>rhese 22 agencies are the Departments of Agriculture, Commerce, Defense, Education, 

Energy, Health and Human Services, Homeland Security, Housing and Urban 

Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and 

Veterans Affairs; the Environmental Protection Agency, General Services Administration, 

National Archives and Records Administration, Office of Personnel Management, Small 

Business Administration, Social Security Administration, and U.S. Agency for International 

Development 

Page 17 
28 


KING-6430 with DISTILLERInsert offset folio 21 here 26560.021

Regarding the remaining 169 projects (or 36 percent) that were reported 

as not planning to deliver functionality every 6 months, agencies provided 

a variety of explanations for not achieving that goal. These included 

project complexity, the lack of an established project release schedule, or 

that the project was not a software development project. 

Further, in conducting an in-depth review of seven selected agencies' 

software development projects, 36 we determined that 45 percent of the 

projects delivered functionality every 6 months for fiscal year 2015 and 55 

percent planned to do so in fiscal year 2016. However, significant 

differences existed between the delivery rates that the agencies reported 

to us and what they reported on the Dashboard. For example, for four 

agencies (the Departments of Commerce, Education, Health and Human 

Services, and Treasury), the percentage of delivery reported to us was at 

least1 0 percentage points lower than what was reported on the 

Dashboard. These differences were due to (1) our identification of fewer 

software development projects than agencies reported on the Dashboard 

and (2) the fact that information reported to us was generally more current 

than the information reported on the Dashboard. 

We concluded that, by not having up-to-date information on the 

Dashboard about whether the project is a software development project 

and about the extent to which projects are delivering functionality, these 

seven agencies were at risk that OMB and key stakeholders may make 

decisions regarding the agencies' investments without the most current 

and accurate information. As such, we recommended that the seven 

selected agencies review major IT investment project data reported on 

the Dashboard and update the information as appropriate, ensuring that 

these data are consistent across all reporting channels. 

Finally, while OMB has issued guidance requiring agency CIOs to certify 

that each major IT investment's plan for the current year adequately 

implements incremental development, only three agencies (the 

Departments of Commerce, Homeland Security, and Transportation) had 

defined processes and policies intended to ensure that the CIOs certify 

that major IT investments are adequately implementing incremental 

development. 37 Accordingly, we recommended that the remaining four 

agencies are the Departments of Commerce. Defense, Education, Health 

and Human Services, Homeland Secunty, Transportation, and the Treasury. These 

agencies were chosen because they reported a minimum of 12 investments that were at 

least 50 percent or more in development on the Dashboard for fiscal year 2015 

37 Office of Management and Budget, FY2017 IT Budget- Capital Planning Guidance 

Page 18 
29 


KING-6430 with DISTILLERInsert offset folio 22 here 26560.022

agencies-the Departments of Defense, Education, Health and Human 

Services, and the Treasury-establish policies and processes for 

certifying that major IT investments adequately use incremental 

development. 

The Departments of Education and Health and Human Services agreed 

with our recommendation, while the Department of Defense disagreed 

and stated that its existing policies address the use of incremental 

development. However, we noted that the department's policies did not 

comply with OMB's guidance and that we continued to believe our 

recommendation was appropriate. The Department of the Treasury did 

not comment on its recommendation. 

In total, we have made 23 recommendations to OMB and agencies to 

improve their implementation of incremental development. As of May 

2017, 17 of our recommendations remained open. 

Agencies Need to Better Manage Software Licenses to Achieve Savings 

Federal agencies engage in thousands of software licensing agreements 

annually. The objective of software license management is to manage, 

control, and protect an organization's software assets. Effective 

management of these licenses can help avoid purchasing too many 

licenses, which can result in unused software, as well as too few licenses, 

which can result in noncompliance with license terms and cause the 

imposition of additional fees. 

As part of its PortfolioStat initiative, OMB has developed policy that 

addresses software licenses. This policy requires agencies to conduct an 

annual, agency-wide IT portfolio review to, among other things, reduce 

commodity IT spending. Such areas of spending could include software 

licenses. 

In May 2014, we reported on federal agencies' management of software 

licenses and determined that better management was needed to achieve 

significant savings government-wide. 38 In particular, 22 of the 24 major 

agencies did not have comprehensive license policies and only 2 had 

comprehensive license inventories. In addition, we identified five leading 

software license management practices, and the agencies' 

implementation of these practices varied. 

Page 19 

Better Management Needed to Achieve Significant 

(Washington, D.C.: May 22. 2014) 
30 


KING-6430 with DISTILLERInsert offset folio 23 here 26560.023

As a result of agencies' mixed management of software licensing, 

agencies' oversight of software license spending was limited or lacking, 

thus, potentially leading to missed savings. However, the potential 

savings could be significant considering that, in fiscal year 2012, 1 major 

federal agency reported saving approximately $181 million by 

consolidating its enterprise license agreements, even when its oversight 

process was ad hoc. Accordingly, we recommended that OMB issue 

needed guidance to agencies; we also made 135 recommendations to 

the 24 agencies to improve their policies and practices for managing 

licenses. Among other things, we recommended that the agencies 

regularly track and maintain a comprehensive inventory of software 

licenses and analyze the inventory to identify opportunities to reduce 

costs and better inform investment decision making. 

Most agencies generally agreed with the recommendations or had no 

comments. As of May 2017, 123 of the recommendations had not been 

implemented, but 4 agencies had made progress. For example, three 

agencies-the Department of Education, General Services 

Administration, and U.S. Agency for International Development-regularly 

track and maintain a comprehensive inventory of software licenses. In 

addition, two of these agencies also analyze agency-wide software 

licensing data to identify opportunities to reduce costs and better inform 

investment decision making. The National Aeronautics and Space 

Administration uses its inventory to make decisions and reduce costs, but 

does not regularly track and maintain a comprehensive inventory. While 

the other agencies had not completed the actions associated with these 

recommendations, they had plans in place to do so. Table 2 reflects the 

extent to which agencies implemented recommendations in these areas. 

Page 20 
31 


KING-6430 with DISTILLERInsert offset folio 24 here 26560.024

Table 2: Agencies' Implementation of Software License Management 

Recommendations 

Agency 

Department of Agriculture 

Department of Commerce 

Department of Defense 

Department of Education 

Department of Energy 

Department of Health and Human Services 

Department of HomBiand Secunty 

Department of Housmg and Urban 

Development 

Department of Justice 

Department of Labor 

Department of State 

Department of the Interior 

Department of the Treasury 

Department of Transportation 

Department of Veterans Affairs 

Tracks and maintains Uses inventory to 

a comprehensive make decisions 

inventory and reduce costs 

() () 

() () 

() () 

• () 

() () 

() () 

() () 

() () 

() () 

() () 

() () 

() () 

() () 

() () 

() () 

() () Environmental Protectton::-A-;;-g:--ec:n-:-cy-------"--------:O>--

cG"'e::cnc:e-crac;-1 ""sec-rv:c:iccce::cs.-A::-dccm:cin"isc;tc:ra""tio""nc--- "------.------"-.---

National Aeronautics and Space 

Administration () . 

U.S. Agency for International Development e e 

Key: 

e Fully-the agency prov1ded evidence that it fully addressed this recommendation 

{.l Partially-the agency had plans to address this recommendation 

In conclusion, with the enactment of FITARA, the federal government has 

an opportunity to improve the transparency and management of IT 

acquisitions and operations, and to strengthen the authority of CIOs to 

Page 21 
32 


KING-6430 with DISTILLERInsert offset folio 25 here 26560.025

provide needed direction and oversight The forum we held also 

recommended that CIOs be given more authority, and noted the 

important role played by the Federal CIO. 

Most agencies have taken steps to improve the management of IT 

acquisitions and operations by implementing key FITARA initiatives, 

including data center consolidation, efforts to increase transparency via 

OMS's IT Dashboard, incremental development, and management of 

software licenses; and they have continued to address recommendations 

we have made over the past several years. However, additional 

improvements are needed, and further efforts by OMS and federal 

agencies to implement our previous recommendations would better 

position them to fully implement FITARA. 

To help ensure that these efforts succeed, OMS's and agencies' 

continued implementation of FITARA is essential. In addition, we will 

continue to monitor agencies' implementation of our previous 

recommendations. 

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, 

and Members of the Subcommittees, this completes my prepared 

statement. I would be pleased to respond to any questions that you may 

have at this time. 

GAO Contacts and Staff Acknowledgments 

If you or your staffs have any questions about this testimony, please 

contact me at (202) 512-9286 or at pownerd@gao.gov. Individuals who 

made key contributions to this testimony are Kevin Walsh (Assistant 

Director), Chris Susinsky, Rebecca Eyler, and Jessica Waselkow (Analyst 

in Charge). 

Page 22 
33 


KING-6430 with DISTILLERInsert offset folio 26 here 26560.026

Appendix 1: Status of Federal Chief Information Officers 

As of May 2017. 9 of the 25 federal CIO positions were filled by acting 

CIOs that do not permanently hold the position. Of the 9, 2 were career 

positions and the remaining positions require some form of appointment. 

Table 3 summarizes the status of the CIO position at the federal leveL 

Table 3: Status of Federal Chief lnfonnation Officer Positions, as of May 2017 

Source GAO analySIS of ageF\cy documentatton and the Government Publlsl1mg Office's 'Un•ted States Government Poi1cy ami 

Supportmg PoS>Mns {Plum Soo~)' I GA0-17-686T 

Key: 

Presidential appointment wtlh Senate confirmation "' a political appointment made by the President 

with Senate confirmation 

Page 23 
34 


KING-6430 with DISTILLERInsert offset folio 27 here 26560.027

(102094) 

Presidential appointment= a political appointment made by the President, without Senate 

confirmation 

Appointment = a political appointment generally made by the administration 

Career= a non-political appointment made by the agency 

Page 24 
35 

Mr. HURD. Thank you, Mr. Powner. 

Now, I have been told that HHS has one statement, is that correct, in who will be delivering it? 

Ms. Killoran, you are recognized for your opening remarks. 

STATEMENT OF BETH KILLORAN 

Ms. KILLORAN. Thank you. Good afternoon, Chairman Hurd, 

Chairman Meadows, Ranking Members Kelly and Connolly. Thank 

you for allowing the Department of Health and Human Services to 

come before you today. 

Since the passage of FITARA, HHS has been committed to making sure that we are cost-effective, provide high-quality IT that 

benefits the American citizens and the services by which we provide. This is a shared commitment both by the HHS CFO, our chief 

acquisition officer, our chief human capital officer, our mission programs, and myself. Together, we understand HHS’s IT budget totals $14 billion and that the spending across our entire portfolio 

compromises—consists of a number of major investments at our operating divisions and our staff divisions. 

The leadership team strives every day to make sure that we’re 

strategically leveraging IT to fulfill our mission and to make sure 

that we’re providing health and human services that foster advances in medicine, public health, and social services so needed by 

our nation. 

As a result of this effort, so far, our implementation plan, we are 

actually able to accomplish 34 of the 39 milestones set forward in 

our implementation plan and actually five additional ones just 

within the last month. 

One of the FITARA successes we’ve had is the establishment of 

a process and criteria for delegating authority to the operating division CIOs. As a large federated organization, we have to be able 

to identify, prioritize, validate, and verify our nonmajor IT acquisitions. I’m happy to say that, through the criteria that we’ve established, we’ve delegated 10 different delegations to those operating 

division CIOs, and on a year basis I am personally responsible for 

providing input into the performance of those CIOs, and we evaluate that delegation on a year basis. 

We also have been able to increase our use of agile development. 

We seek to deliver IT-enabled functionality every six months. And 

this has been able to be accomplished through a process of improving our governance and integration, solving collaboration efforts 

through development teams, and by making sure that we integrate 

at all aspects with our customers. 

Over the last two years, the CFO and I have jointly held IT 

budget reviews to review, approve, or reject the IT budgets across 

our organization. The purpose of these budgets is to review and 

discuss how each of our operating divisions is looking at their IT 

budget and how they’re prioritizing, addressing risk within their 

programs, aligning those IT dollars to agency priorities, and making sure that we understand not just the operating division proprieties but the enterprise ones as well. 

Two key accomplishments in this area to date is being able to increase the ability to add funding for our cybersecurity initiatives, 

which we have been able to over the last three years increase and 


KING-6430 with DISTILLER
36 

has dramatic success; changing our budget from 1 percent overall 

to 5 percent in cybersecurity since 2015. 

We also have been also making sure that we are looking at our 

legacy systems and making sure each of our organizations are 

prioritizing those legacy systems and how they are making initiatives and decisions to make the necessary changes to those systems 

to keep them secure and viable for those missions. 

Also in the stewardship, we’re making sure that we are looking 

at planning, proactively managing our risk across our organization, 

and to continue to mature our risk management process and evaluation techniques as we update our IT dashboard. We conduct 

portfolio reviews at individual programs, and this year, we actually 

did one at Operating Division looking at the totality of their IT programs, which we will adopt and continue to improve and implement across the organization. 

For data center consolidation, we continue to make sure that we 

are looking at the outcome metrics, but we have a challenge around 

the continuing change in definition and the changing of the goals 

and requirements. 

We’ll make sure that we are also adopting cloud technology as 

part of our strategy, and I will say that we have had success in this 

area, increasing our funding in cloud from $135 million in 2015 to 

$600 million last year, and we think we’ll have three-quarters of 

a billion dollars in cloud this year alone. 

In addition, we have to make sure we’re looking at our workforce, 

and so I have partnered with our chief human capital officer to 

make sure that we’re looking at our requirements to make sure we 

are—have the ability to attract, develop, and retain IT talent. 

Currently, we have 1,400 positions in our organization, 3,000 of 

them overall, but we actually have an over-30-percent vacancy rate, 

which makes it critical for us to understand how to do this job better to have those resources. 

Finally, as HHS continues to move forward with implementation 

of FITARA, the Department has built a collaborative, integrated 

business foundation that promotes comprehensive governance 

across the Department where we can optimize our mission, make 

sure we provide secure IT services that meet the advances needed 

for effective and meaningful outcomes for citizens. Thank you. 

[Prepared statement of Ms. Killoran follows:] 


KING-6430 with DISTILLER
37 


KING-6430 with DISTILLERInsert offset folio 28 here 26560.028

TESTIMONY OF 

Beth Anne B. Killoran 

Deputy Assistant Secretary for Information Technology 

and Chieflnformation Officer 

U.S. Department of Health and Human Services 

Before the 

Subcommittees on Information Technology and Government Operations 

Committee on Oversight and Government Reform 

U.S. House of Representatives 

June 13,2017 

Good afternoon Chainnan Hurd and Meadows, Ranking Members Kelly and Connolly, and 

Members of the Committee. Thank you for giving me the opportunity to discuss federal 

information technology (IT) and to describe progress of the Department of Health and Human 

Services (HHS) in implementing the Federal lnfonnation Technology Acquisition Reform Act 

(FITARA). 

Leveraging IT to Support Mission Outcomes 

Since the passage ofFITARA, HHS has enhanced the roles and responsibilities of the 

Department Chief Information Officer (CIO) with regard to planning, programming, budgeting, 

and execution of IT solutions and services within the agency. HHS is committed to implement 

Department IT priorities in a cost effective, efficient, and high quality manner to best serve 

HHS's beneficiaries and American taxpayers. 

FIT ARA implementation is not just about HHS' s CJO authority. Our IT efforts support an 

agency with an annual operating budget of over $1 trillion, representing almost a quarter of all 

federal outlays, and which administers more grant dollars than all other federal agencies 

combined. Through a shared commitment among the HHS CIO, Chief Financial Officer (CFO), 

Chief Human Capital Officer (CHCO), Chief Acquisition Officer (CAO), and the HHS mission 

and program communities, together we manage approximately $6 billion HHS agency IT annual 

spending. HHS CIO fully participates in the management and governance of the agency's entire 
38 


KING-6430 with DISTILLERInsert offset folio 29 here 26560.029

lT portfolio comprising major investments of its II Operating Divisions (OpDivs) and more than 

20 Staff Divisions. 

HHS, the largest civilian agency in the Federal sector, has made great strides under FlTARA by 

ensuring IT is acquired and managed to enhance and protect the health and wellbeing of all 

Americans. Through this partnership HHS leadership strives every day to strategically leverage 

IT to fulfill I-ll-IS's mission to provide effective health and human services and foster advances in 

medicine, public health, and social services for the nation. 

Overall FIT ARA Implementation Progress to Date 

HHS' s FITARA implementation strategy and progress to date is best characterized by the words: 

collaboration and dedication. HHS recognizes the intent of FITARA goes beyond processes, 

policies and reporting requirements. It is about establishing a collaborative culture in which all 

facets of the organization recognize their roles and responsibilities to acquire and manage IT in 

the most effective and efficient manner possible in order to drive mission outcomes on behalf of 

the people we serve. Under this fundamental premise, we have employed a proactive strategy to 

address programmatic risk; promote transparency; establish clear lines of authority, foster 

innovative and incremental development: leverage cloud technology; and, invest in our IT 

workforce. 

As a result, HHS has accomplished the majority of the goals we outlined within our FITARA 

lmplementation Plan-ahead of schedule in many instances. Of the 39 individual actions and 

milestones outlined in the Plan, HHS met 34 in the areas of budge! formulation, budget 

execution, acquisition, and organization and workforce. 

With such a diverse portfolio and our organization's profound commitment to long term cultural 

change, we acknowledge the significant work that still lies ahead of us in order to successfully 

meet our obligations under the law. Today we appreciate the opportunity to explain how 1-11-IS 

has established the foundation and framework to move us forward. 

HHS CIO partnership with our CFO, CAO, CHCO and HHS Operating and Staff Divisions has 

been critical to our achievements to date. With this in mind, HHS has actively engaged its policy 

leadership on the importance ofFITARA implementation by establishing a routine agenda item 

2 
39 


KING-6430 with DISTILLERInsert offset folio 30 here 26560.030

on the HHS Management CounciL In this venue, HHS's Executive Leadership is regularly 

updated on the progress ofllliS's Oftke of Management and Budget (OM B)-approved 

implementation plan. HHS will continue to identify opportunities for collaboration as FIT ARA 

evolves at the agency. Through FIT ARA-focused workgroups across the agency, HHS 

continues to make strides towards fully implementing FITARA at HHS by the end of the year. 

Establishing Clear Lines of Authority 

One of the FITARA-related successes at HHS is the establishment of the process and criteria for 

delegating authority to each OpDiv CIO upon demonstrating the ability to identify, prioritize, 

validate and verify their non-major IT investments. For major IT investments, HHS CIO 

maintains authority through an enterprise review process that better aligns Department-level IT 

governance bodies which assess and approve these investments. This delineation of non-major 

and major investments, respectively, pragmatically acknowledges that HHS is a highly federated 

and complex organization, and allows for designated IT -related decision-making based on 

financial thresholds. 

HHS issued ten delegations of authority to all the OpDiv ClOs. Upon delegating authority, 

performance is monitored quarterly against the annual HHS CIO Work Plan. Each year, the 

HHS CIO provides input into the performance appraisals of these C!Os to the director of their 

respective OpDiv. The HHS CIO and the OpDiv CIOs established the Plan in order to ensure 

shared and transparent responsibility ofHHS IT investments. In this way, we ensure the twoway communication that is necessary to maintain accountability of the overall HHS-widc IT 

portfolio. 

Incremental/ Agile Development 

Our FITARA intra-agency achievements adoption is furthermore illustrated by our commitment 

to incremental or agile development. We specifically seek to deliver IT-enabled functionality, or 

business value, every six months. This is accomplished through an iterative process by which 

requirements and solutions evolve through the collaborative efforts of development teams, 

stakeholders, and end-users--our customers. 

3 
40 


KING-6430 with DISTILLERInsert offset folio 31 here 26560.031

The HHS Enterprise Performance Life Cycle (EPLC) policy was updated this year to include 

agile development. This updated policy directs the expanded use of iterative and incremental 

development methodologies and reflects new authorities for CIO participation, delegation, and 

decision-making per FITARA. HHS expects the updated EPLC policy to have a positive impact 

on the utilization of incremental or agile development methods as well as further engagement by 

the CIO as programs consider system development and system modification activities. As more 

HHS programs adopt agile methodologies we expect to see a complementary increase in 

technical functionalities being delivered in more expeditious time frames. 

Financial Planning and Execution 

Last year, before the House Oversight and Government Reform Committee, I highlighted how 

HI-IS is working to improve its IT program review process through the adoption of revised 

program risk assessment methods, combined with in-depth reviews of our major IT programs. 

These risk evaluations. conducted in collaboration with our OpDivs, resulted in a number of 

initiatives that have resulted in improved transparency and enhanced IT governance across the 

agency. For example, the Department adopted a joint CIO and CFO budget and investment 

review process that provides an enhanced view on how 1-lf-IS OpDivs are addressing fiT ARA 

critical areas and key performance objectives. This process clarifies IT management authorities 

and accountability at all levels of the Department. The clearer delineation and alignment of ITrelated efforts in program management, finance, acquisition and human resources has resulted in 

improved IT decision-making which better account for cost, benefit and risk. 

The purpose of our budget review is to discuss with each of the OpDiv CIOs their IT budget 

priorities, current risks, alignment to agency priorities and status of their IT investments for the 

budget year under discussion. Each meeting results with the CFO and CIO jointly deciding 

whether to approve, modify or reject the IT budget; the final outcome is an IT budget statement 

issued by the CFO and CIO submitted with the HI-IS budget submission to OMB. 

Two key accomplishments from these reviews to date is our prioritization of cybersecurity and 

developmental funding; for cybersecurity this has resulted in HI-IS funding increasing from I% 

to 4% as percentage of overall IT budget. While IIHS continues to make strides in the review of 

IT planning, we understand that it is through consistent engagement between the staffs of IT and 

4 
41 


KING-6430 with DISTILLERInsert offset folio 32 here 26560.032

tlnancial management, and through better integration of data generated from these communities, 

that we can reach full FITARA implementation. 

Transparency and Risk Management 

When Congress passed FITARA, HHS made a signitlcant effort to bring its TechStat process 

into compliance with the new legislation. HHS reviewed its IT portfolio, identitled investments 

in need of remediation, and worked with the OpDivs to formulate corrective action plans which 

addressed those issues in a timely manner. HHS employs the annual CIO Work Plan to review 

OpDiv performance on a quarterly basis, helping to ensure that the IT portfolio is managed 

appropriately and that program risks are identified and quickly remediated. These efforts are 

reflected in scoring provided through the OMB quarterly integrated data call. HHS remains 

committed to maturing its risk management procedures to more proactively anticipate future 

project risk. 

From a policy perspective, HI-IS improved transparency and management of IT resources 

through the development, publication and robust implementation of an updated capital IT 

planning and control policy. This updated policy, issued in September 2016, supports visibility 

and reporting around major IT investments. 

Finally, as the HHS CIO, I am a regular participant in HHS's enterprise risk management 

discussions, which provide a Department-wide forum for HHS Executives and policy leadership 

to discuss and strategize on known areas of risk. These enterprise risk management discussions 

are led by I-IHS's CFO and is another example of the collaboration across organizational lines. 

As a result of this partnership and engagement. HHS has developed and applied methodology to 

assess risks related to technology. Based on those evaluations, I-IHS has worked with 

stakeholders in IT, tlnance and acquisition communities to mitigate those risks which may not be 

readily evident in our FITARA scorecard. 

IT Portfolio Review 

Our IT stewardship does not end with planning. HHS proactively seeks to mitigate program risk 

where changes to capabilities or requirements throughout the IT investment lifecycle may 

jeopardize the success of our programs and missions. In collaboration with OpDivs, HHS 

5 
42 


KING-6430 with DISTILLERInsert offset folio 33 here 26560.033

continues to mature its implementation of program risk assessment evaluation methods, which 

are integrated with our thorough reviews of large IT programs. For example. as the HHS CIO, I 

conducted a comprehensive review of the IT portfolio of an HHS OpDiv. This was an 

opportunity to meet directly with major program managers and the OpDiv CIO to address 

program-level issues, such as how the program uses IT to fulfill its mission, how it handles IT 

security, how does it obtains funding, and what governance structures are in place. HHS found 

the exercise valuable in that it provided a deeper level of insight into the IT portfolio than was 

previously available. HHS plans to continue these in-depth reviews with other HHS OpDivs 

going forward. HHS also leverages our IT Steering Committee governance framework at both 

the Departmental level and at the OpDiv level to ensure visibility into and oversight ofi-IHS's IT 

portfolio. 

As another illustration of our stewardship, HI-IS completed a Tech Stat review on the HI-IS Email 

as a Service investment in June 2016, based on questions of viability and direction, as well as 

uncertainty of scope and budget. The TechStat review resulted in a corrective action plan with 

28 items that were resolved by the end of July 2016. HHS is in active dialogue with three of our 

OpDivs to determine future TechStat opportunities over the course of the year. 

Another focus of FIT ARA on risk assessment encourages agencies to proactively address 

network security. Currently, HHS is working to improve security with an initiative to identify 

legacy IT risk with its most critical systems, known as the High Value Assets (JIVAs). This 

effort is identifying the software that HV As are built upon and software no longer supported or 

approaching end of vendor support. HHS will be developing modernization plans as a part of 

this initiative by October 2017 to identify mitigation strategies and steps to manage the risk 

unsupported technology presents to the agency. This effort intends to serve as a building block 

in a more proactive approach to managing legacy IT across the Department and identifying risk 

areas in the portfolio. HI-IS leveraged the National Institute of Standards and Technology, 

Cybersecurity Risk Management Framework to help standardize and integrate this endeavor 

across the agency. The framework is aligned with HHS's Agency Risk Management Profile and 

is consistent with OMB's Presidential Management Council (PMC) scorecard. HI-IS and its 

OpDivs are therefore able to measure the maturity and em:ctiveness and provide status based on 

consistent cybersecurity criteria in order to manage risk. 

6 
43 


KING-6430 with DISTILLERInsert offset folio 34 here 26560.034

HilS continues to implement the tools and processes provided by the Department of Homeland 

Security's (DHS) Continuous Diagnostics and Mitigation (CDM) program. The program will 

enable HHS to more proactively detect and identify threats while ensuring HHS has near realtime insight into the enterprise's most critical risks. In addition, this effort is complemented by 

other tools and technologies HHS is adopting or already has in place such as leveraging shared 

services such as DHS' Einstein 3A and Cyber Hygiene programs. 

Data Center Consolidation Efforts 

As stated earlier, we added the Data Center Optimization Initiative (DCOI) in late 2016 as part 

of our FITARA implementation effort. The initiative incorporates the requirements of the law 

for achieving the data center consolidation and optimization. This initiative builds upon the 

progress achieved through its predecessor, the Federal Data Center Consolidation Initiative 

(FDCCI). While we made progress under the former FDCCI plan, DCOl required us to re-work 

our approach due to the changes in outcome metries and related definitions. These changes had 

an impact on our reporting and subsequent scores. 

HHS published its updated DCOI Strategic Plan in April2017. Our primary objective is to 

leverage cloud-based technologies where feasible. HHS reviewed the current inventory of 

Federal Data Centers and is working with each HHS component to achieve the goal of 

consolidating or eliminating facilities that are duplicative, inefficient, or no longer deemed 

mission essential. In addition. over the last six months, we conducted reviews to better identify 

opportunities for cost savings and avoidance around DCOI. 

This approach helps HilS to reduce expenditures on data center operations by establishing 

infrastructure that is able to quickly scale in our dynamic business and technology environment. 

HHS increased cloud-based technology utilization from l% of the IT investments in FY20 J 5 to 

almost J 9% of our investments in FY20 !7. HHS is among the top five agencies in two of the six 

DCOI mctrics as shown on the IT dashboard. 

Implications for Acquisition Reform 

Since the implementation ofFITARA, HHS established enterprise agreements with a software 

service provider and a m3:jor software publisher. The enterprise agreements that are available 

7 
44 


KING-6430 with DISTILLERInsert offset folio 35 here 26560.035

and used by OpDivs take advantage of HHS' vast purchasing power by negotiating the best price 

for software licenses. 

The HHS software acquisition effort is also informed by the Making Electronic Government 

Accountable By Yielding Tangible Efficiencies (MEGABYTE) Act of2016, as well as by OMB 

M-16-12, Category Management Policy 16-1: Improving the Acquisition and Management of 

Common Information Technology: Software Licensing. HHS is enhancing its ability to inventory 

its software licenses HHS-wide; analyze license utilization; and report on cost savings and 

avoidance made possible by this policy. This includes identifying "best-in-class·· software 

agreements that take advantage of the best price and terms and conditions, and developing 

enterprise agreements that eliminate redundancies. 

ln addition, HI-IS actively participates in tiger teams sponsored by the General Services 

Administration focused on government-wide software publishers. Our plan for this year is to 

begin development of HHS-wide vehicles for the increasing number of services that are 

delivered over the Internet rather than provided locally or on-site. In short, optimally taking 

advantage of cloud computing. 

FITARA enhanced the relationship between the Office of the Chieflnformation Officer (OCIO) 

and the HHS CAO. OCIO is a voting member of the Acquisition Strategy Review Board where 

major HHS acquisitions are reviewed. At the staff level, our teams coordinate weekly about IT 

acquisition strategies. Currently, the OCIO Cybersecurity Team is actively engaged with the 

HHS Acquisition Team on updating standard contractual terms and conditions to ensure our 

organization and systems are as well prepared for a cyber-event as possible. These engagements 

have bolstered a mutual understanding and synchronization of our acquisition processes. 

Developing Our Staff 

In terms of the workforce requirements outlined in FITARA, HHS continues to focus on 

improving the competencies of its staff. HHS has over 3,000 IT professionals, but many do not 

have the diverse expertise necessary to support current federal IT needs including IT project and 

program management, architecture, or cybersecurity. Our IT workforce is in fact the most 

critical part ofHHS's FITARA risk management strategy. They are the primary resource to 

ensuring the health and security of our entire IT portfolio. 

8 
45 


KING-6430 with DISTILLERInsert offset folio 36 here 26560.036

In response, the HHS CIO and CHCO have partnered to comprehensively address IT workforce 

business needs and legislative requirements while improving our ability to attract, develop, and 

retain world-class IT talent. Our strategies focus on: (1) governance; (2) workforce analytics 

and planning; (3) targeted recruitment, branding, and staff planning, including succession 

planning; (4) career development and training; and, (5) talent and performance management, 

including employee engagement and retention. 

Through identification and definition of critical IT and cybersecurity role categories and 

competency requirements, HHS is growing a mature and holistic IT human capitallifecycle 

approach. HHS developed a framework for competency models and career paths that align to 

FITARA and the Federal Cybersccurity Workforce Assessment Act. This model is now being 

adopted and tailored by the Office of Personnel Management for federal-wide use. HHS has 

completed eight career paths to date-one of these was for I-ll-IS IT project and program 

managers-and four more are currently under development. 

Recently, HHS conducted an IT workforce inventory and we found that workforce shortages and 

ever increasing workload often create an imbalance that hinders employees' ability to attend 

training or obtain certifications. The HHS CIO and CHCO continue working to identify new 

methods for recruiting critical IT positions. Nonetheless we recognize that the pipeline of IT and 

cybersecurity talent remains inadequate, and Federal agencies are challenged to compete in the 

hyper-competitive market for talent. Complicated federal human resources processes impede our 

recruitment. hiring, and retention efforts. Private industry can sometimes provide more 

competitive compensation and this hinders HHS"s ability to recruit and retain top IT talent. 

Despite the above challenges, HHS continues to improve our current workforce skills by 

providing training for IT program and project managers. HHS has trained over I ,400 personnel 

since starting the program in November 2015. 

Conclusion 

As HHS continues to move forward with its implementation of FIT ARA, the agency has built a 

collaborative, integrated business foundation which promotes comprehensive governance across 

the lifecycle of a project; ensures IT investments optimally support mission; assures secure IT 

services; achieves efficiency; and, reduces duplication by leveraging acquisition strategies and 

9 
46 


KING-6430 with DISTILLERInsert offset folio 37 here 26560.037

technical advancements to drive cost effective and meaningful outcomes on behalf of the 

American people. 

HHS recognizes the need to continue strengthening standardized and transparent data sharing 

that is secure and enabled by IT in order the deliver on the promise of digital health: deliver the 

best patient-centered health care and human services, which improve the health and well-being 

of every American and every community at the best cost and of the highest quality possible. 

HHS recognizes and embraces the work and challenges ahead of us. Americans expect and 

deserve secure, reliable, easy to usc, and modern IT resources from the federal government. 

HHS has established a collaborative and culture-changing foundation and framework to move us 

forward with confidence and in support of the mission and people we serve. 

10 
47 

Mr. HURD. Thank you. 

Dr. Holgate, you are up, five minutes. 

STATEMENT OF RICK HOLGATE 

Mr. HOLGATE. Thank you, Chairmen Hurd and Meadows, Ranking Members Kelly and Connolly, and distinguished members of 

the committee. Thank you for inviting Gartner to discuss the 

FITARA scorecard. 

As the former CIO of the Naval Criminal Investigative Service 

and the Bureau of Alcohol, Tobacco, Firearms, and Explosives, I’m 

keenly aware of the challenges faced by Federal agencies in managing information technology. Both through my involvement with 

ACT–IAC and most recently as a research director at Gartner, an 

IT research and advisory firm assisting 98 percent of the Fortune 

100 serving over 10,000 global institutions and drawing on the experience of over 60,000 IT leaders in making smarter IT decisions, 

I’ve gained broad perspectives on more effective ways of using IT 

to further agency missions. 

Effective use of IT delivers strategic value and is viewed as a 

competitive differentiator. Successful organizations integrate their 

personnel and processes, including IT, to ensure the success of all 

of their initiatives, and they treat cybersecurity as part of an executive-level risk management program. 

With ever-accelerating changes and innovation, the commercial 

technology market, not to mention new and evolving cybersecurity 

threats, Federal agencies must get faster and better at acquiring, 

integrating, and maximizing the value of best-in-class technologies. 

FITARA is certainly a step in the right direction, but CIOs can 

only do so much on their own. 

First, the Federal Government must treat IT more strategically 

and engage agency leadership. Innovative and successful companies involve CIOs early and often on the front end of strategic planning to ensure that they are able to acquire the technology that enables their organizations to succeed. CIOs must be given the opportunity to shape and influence how IT enables the agency strategy 

early on. 

Second, improve acquisition, budget, and funding practices. Acquisition, budgeting, and funding can be impediments if they are 

too focused on inflexible compliance and risk aversion, as opposed 

to delivering business and mission outcomes. Adequate resourcing 

is also a concern. Transformational investments make up only 

around 21 percent of the Federal IT budget, while private sector 

firms spend about 30 percent. The average legacy system in the 

Federal Government is 14 years old compared with 10 years in the 

private sector. 

Accelerating adoption of new technology is essential. Modernizing 

acquisition practices is equally important. Federal agencies must 

stop thinking of their IT as simply a call center and reimagine it 

as an engine for innovation and transformation and have the discipline to avoid instinctive cuts during periods of austerity. 

Agencies must also be better at using available funds. CIOs, program managers, acquisition personnel, and budget offices must 

work together in a better and more unified fashion to avoid delays 

and bad outcomes. Government-specific reforms such as increased 


KING-6430 with DISTILLER
48 

access to multiyear funding, shared accountability models under 

FITARA, and meaningful maturity model reports to OMB and Congress could also improve government outcomes. 

Third, achieve greater visibility into agency activities. CIOs need 

better visibility into the business and contracting operations of the 

agency. The committee should consider clarifying FITARA’s scope. 

Using an objective, proven rationalization methodology at both the 

infrastructure and application levels can reduce system duplication, 

achieve economies in savings, and improve commonality and interoperability. Adding commodity IT measures to the FITARA scorecard and empowering CIOs to undertake these activities and work 

further with shadow or business unit IT could substantially optimize IT costs and manage security risks while enhancing productivity. 

Fourth and finally, improve organizational competence. There 

are many men and women working for the Federal Government 

who are doing their best to manage a variety of IT systems from 

multiple generations to achieve agency goals. Still, we must improve overall competence. Successful businesses rapidly discard 

outdated technologies while hiring and empowering smart IT managers. In the Federal Government, we often see legacy technologies 

operating far beyond their end of life, while talented IT managers 

rotate too quickly to make any appreciable impacts. Capitalizing on 

expanded and improved human capital flexibilities can provide 

greater access to talent and better cross-disciplinary development 

opportunities. 

In addition, CIOs in the IT workforce require a high-functioning 

team of finance, acquisition, H.R., security, and legal professionals 

for effective IT leadership. The absence of committed and skilled 

resources across all of these disciplines places an organization and 

its IT initiatives at elevated risk. 

Congress has a role to play here, too, in ensuring that agency 

planning, acquisitions, and funding are all unified. Initiatives such 

as the MEGABYTE Act, PMIAA, and the pending MGT Act all 

have productive solutions to offer, and I urge you to consider how 

each of these bills, as well as FITARA, integrate to make agencies 

smarter, more agile, and more cost-effective. 

FITARA is a positive first step, and I encourage its extension and 

expansion. I suggest three particular additional steps: encouraging 

agency heads to articulate a clear strategy for leveraging IT to improve business and mission outcomes, including optimizing enterprise, not just IT costs; adjusting scoring metrics and methods to 

incentivize desired behaviors, and creating an integrated and 

streamlined approach for assessing progress and across the diverse 

reporting demands placed on agencies. 

Thank you for the opportunity, and I look forward to your questions. 

[Prepared statement of Mr. Holgate follows:] 


KING-6430 with DISTILLER
49 


KING-6430 with DISTILLERInsert offset folio 38 here 26560.038

Testimony before the House Committee on Oversight and Government Reji>rm. Subcommittees 

on Government Operations and lf!forrnation Technology 

Legislative Hearing on the Federal information Technology Acquisition Reform Act (FITARA) 

Scorecard 4.0 

By 

Rick Holgate 

Research Director 

Gartner Inc. 

June 13.2017 
50 


KING-6430 with DISTILLERInsert offset folio 39 here 26560.039

Chairman Hurd, Chairman Meadows, Ranking Member Kelly, Ranking Member Connolly, and 

distinguished Members of the committee, thank you for inviting Gartner to discuss the FITARA 

Scorecard. As the former CIO for the Naval Criminal Investigative Service and the Bureau of 

Alcohol, Tobacco, Firearms & Explosives, I am keenly aware of the challenges faced by federal 

agencies in efficiently and effectively procuring, modernizing, and managing information 

technology. Both through my involvement with the American Council for Technology and 

Industry Advisory Council (ACT-lAC) 1 and most recently as a Research Director at Gartner. I 

have gained broader perspectives on more effective ways of acquiring and using technology in 

support of agency missions. I would like to offer some insights into the best practices in managing 

the commercial and federal systems for IT acquisition. In particular, I would like to highlight four 

key areas: treating IT more strategically and engaging agency leadership; improving acquisition, 

budget and funding practices; achieving greater visibility into agency activities; and developing 

greater organizational competence. 

l. Treating IT More Strategically and Engaging Agency Leadership 

The U.S. government is struggling to keep up with the ever-accelerating pace of changes and 

innovation in the commercial market. Even aside from cost and efficiency, new cybersecurity 

threats mean that it is more important than ever that federal agencies get better at acquiring bestin-class technologies quickly, integrating them into existing processes, and maximizing the value 

of investments. Numerous examples abound of federal agencies adopting digital initiatives more 

cautiously and tentatively than the larger population of global enterprises.2 Every year we fail to 

keep up adds to a growing technology debt that will soon become insurmountable too large to 

tackle. 

FITARA has been a step in the right direction, and innovative C!Os, for example at USDA, have 

used FIT ARA. a maturity model, and the scorecard mechanism to drive some needed 

improvements.3 However, we must realize that C!Os can only do so much on their own. Legislation 

cannot change culture. The unchanged CIO reporting relationship is evidence. IT cannot be 

eflectively acquired or implemented separately from the business and mission capabilities it 

enables IT and process are interdependent and require input from all agency leaders, including 

CIOs. In government as well as commercial environments, every process depends on IT. IfCIOs 

and agency leadership are not regularly interacting with each other, CIOs and IT professionals will 

forever be playing catch-up, leading to excess costs, performance gaps. and security 11aws.4 

This is not what we sec in the best-run organizations in the world. Innovative and successful 

1 The American Council i(lr Technology (ACT) and Industry Advisory Council (lAC) is a non-pro lit educational 

organization established to improve government through the innovative and eflicicnt application of technology. For 

more than 30 years ACT-lAC has provided an objective. trusted and vendor-neutral fixum \vhcrc government and 

industr,y executives are working together to create a more effective government. 

:Gartner's 2017 CIO Survey, MarKet Insight: What li.S"' l·cdcra! Go\l'rnmcnt BU\crs \Vant in 2017. 

'Gartner has been FITARA since enactment: I::J'l~\R/1 l~£!11\\CJll£,' J'(l\\Cr ()\_or Fcdcra,~l_,_i,_l '-'-'"""-"'.!!"" 
51 


KING-6430 with DISTILLERInsert offset folio 40 here 26560.040

companies engage C!Os early and often in their IT needs, on the front end of strategic planning, 

to ensure that they arc able to acquire the technology that enables their organizations to succeed. 

Because government must modernize its technologies and processes, government must integrate 

information and technology with the earliest stages of strategic planning. Proactive engagement 

with C!Os on IT needs and solutions may not, by itself, be sufficient to guarantee success in agency 

initiatives, but reactive and uncoordinated IT acquisitions will certainly lead to failures or missed 

opportunities for economies. FIT ARA empowers CIOs with veto and approval rights, which can 

position them as a bottleneck and an obstacle. Instead, agency leaders must consider acquisition 

approval as a safety net of last resort. CIOs must be given the opportunity to shape and influence 

how IT enables the agency strategy early on. 

It is also important to devote appropriate investment for transformation and innovation. Total 

spend dedicated to transformational IT investments in the Federal government is currently only 

around 21% of the IT budget; by contrast, the private sector devotes over 30%. 5 This is a significant 

gap in availability of funds to support innovation vs. simply keeping the lights on for legacy 

technologies. Moreover, legacy systems in the federal government are markedly older than the 

private sector (on average, over 14 years vs. 10).6 Federal agencies must stop thinking of their IT 

as simply a cost center and reimagine it as an engine for innovation and transformation and 

have the discipline to avoid instinctive cuts during periods of austerity. Similarly, though they have 

indicated substantial interest in cloud, Federal agencies reported in 2016 that they spend 3% of 

their total IT expenditures on cloud services. That is significantly less than private sector peers, 

for which benchmarking shows 12%. 7 Accelerating adoption of new technology can help shed the 

burden of a legacy portfolio. 

2. Improving Acquisition, Budget and Funding Practices 

Acquisition, budgeting, and funding can he impediments if they arc too focused on inflexible 

compliance and risk aversion, as opposed to delivering business and mission outcomes. Too often, 

the policies crafted by C!Os are never fully implemented by or through the acquisition organization 

in the agency. Even more often, and more regrettably. CIOs aren't positioned to craft policies that 

matter, instead being stuck enforcing standards instead of setting vision for technology. This is a 

result of fragmented responsibilities and complicated contracting mechanisms. CIOs are often 

excluded from the nuts and bolts of contracting, which means that CIOs can see plans developed 

over years with inputs from multiple stakeholders derailed by decisions that contracting officers 

with limited understanding of the market or of agency needs are forced to make. One approach to 

mitigating these mistakes would be to empower CIOs to see how IT acquisitions are being made, 

identify where procurements arc going awry, and have the tools to fix processes for the future. 

Modernizing acquisition practices is equally important: moving to statements of objectives instead 

of statements of work; demanding rapid prototypes that can be evaluated by operators as part of 

the selection process; shifting to outcome-based thinking; en forcing use of open standards in RFPs; 

5 See the IT Dashboard, Gartner's 2017 CIO Aecnda: A G<n ernment Perspectiv c, and CEB's IT Budget and 

Benchmarking Surn~\. 

6 According to Gartner's 2017 C!O Survey; see Mart£OLL!l,'iigi1_t: What U.S. Federal GoYernmcnt Buvg:s.l\i_anti'l 

See the ]J Dashboard, Gartner's 2017 CIO i\gcnda: A Government PcrspectiYc, and CEB's IT Budget and 

Benchmarking Surv~.l. 
52 


KING-6430 with DISTILLERInsert offset folio 41 here 26560.041

prohibiting use of proprietary protocols or technology; mandating user-centric feedback loops as 

part of incremental development; all of these should be universally understood and adopted. 

Despite years of efforts by GSA to encourage these practices and perform ''myth-busting," 

persistent misconceptions or reservations remain. 

Just as agency policies and decisions must be made in a unified fashion, it will also be important 

for agencies to unify the various budget, acquisition, and funding activities necessary for 

successful IT procurement and implementation. Currently, agencies must predict needs years in 

advance, spend months or years going through the acquisition practice, and then rush to spend 

funds before they expire. Even when the process operates smoothly, inherent delays in 

implementation can lead to the acquisition of outdated technology; when it doesn't operate 

smoothly, bad outcomes can be difficult to avoid. Access to multi-year funding is essential to avoid 

hasty and ill-advised decisions. 

While progress has been made with annual portfolio reviews and strategic sourcing initiatives, IT 

lifecycle costs continue to grow each year and absorb resources necessary for modernization. 

Outdated IT needs to be eliminated and more secure, better performing systems should be 

acquired. Agencies must make informed decisions, taking into account the business objectives, the 

cost environment, and the system's performance, and several other factors. The Modernizing 

Government Technology (MGT) Act, which passed the House in May, is an important step toward 

shifting funds away from O&M and toward modernization. It is essential for agencies to have a 

data-driven long-term acquisition strategy in place prior to receiving this money. Creative use of 

existing funding streams and authorities should also be explicitly encouraged. 

Gartner has written extensively on leading practices in these areas, including concepts such as 

bimodal IT, digital business transformation, operating successfully in a digital ecosystem, and IT 

operating models. 8 Private-sector examples of digital disruption, transformation, and reinvention 

(GE, Ford, and Amazon are a few) should be inspirational and instructive. 

With regard to !TI'ARA, I would recommend agencies adopt a shared accountability model for 

achieving delivery of better business and mission outcomes, including reducing the ongoing cost 

of doing operations. Furthermore, a uniform, meaningful maturity model to measure agencies on 

their progress, if used by OMB and Congress, could provide a more nuanced view of agencies, 

assist in assessing progress, and give agencies continued focus. 

3. Achieving Greater Visibility Into Agency Activities 

"Shadow" (or programmatic or "business unit") IT has become a significant problem for agencies 

and has made complete visibility and informed acquisition decision-making a huge challenge tor 

CIOs and CMOs.9 Much as C!Os and other agency leaders must better coordinate their activities, 

C!Os need better visibility into the business and contracting operations of the agency. 

8 See Scaling Bimodal: Raising E\ervonc·s Game; Bimodal Simplifies and Focuses Digital TransfOrmation; 

Digital to the Core; £QlLCIO Agenda: Global Perspectives on Seizing the Digital Ecosvstem Opportunit\; and The 

New IT Operating Model tor Digital. 9 Federal agencies reported 37% of IT spending outside of their formal IT budget. compared to 25% more broadly 

across all enterprises. See Gartner's Market Insight: What U.S. Federal Government Buvers Want in 2017. 
53 


KING-6430 with DISTILLERInsert offset folio 42 here 26560.042

I would further urge the committee to consider clarifying FITARA's scope. As it stands, the 

legislation requires an examination of the consolidation of information technology. This is often 

misinterpreted to mean the IT infrastructure. While savings and duplication can be found in 

infrastructure, the bulk of savings will be found in the applications. By conducting an application 

rationalization using an objective, proven methodology, agencies would likely find several 

applications performing the same functions. 

Empowering CIOs explicitly to reduce system duplication, achieve economies and savings, and 

improve agency-level commonality and interoperability would be a substantial enhancement to the 

CIO's role and mandate. Adding commodity IT measures - both inventory and purchasing 

practices - to the FIT ARA scorecard and consciously including non-"major IT investments" 

within the scope of the CIO's responsibilities for transparency and risk management can improve 

visibility. These should also help achieve otherwise overlooked economies through the more 

effective use of efforts like GSA's category management or adoption of shared services. 

4. Improving Organizational Competence 

There are many men and women working for the federal government who are doing their best to 

manage a variety of IT systems from multiple generations to achieve agency goals. Still, we must 

address the overall level of talent and competence in the government. Sometimes this will involve 

hiring new people who arc more familiar with the latest systems and skills. Sometimes it will 

involve training existing personnel on new systems and forcing migration to new procedures and 

technologies. Successful businesses regularly hire and empower smart IT leaders to make needed 

changes and investments while discarding outdated technologies. By contrast, in the federal 

system, we often see legacy technologies operating far beyond their end-of-life horizons, while 

talented IT managers rotate too quickly to make any appreciable impacts. One of the biggest risks 

can be losing a talented CIO, with resulting loss of momentum or even backsliding. 

While it may seem a cliche, successful organizations treat IT programs as the "team sport" it is: 

C!Os and IT professionals cannot do it themselves; they require a high-functioning and competent 

team of finance, acquisition, human resources, security, and legal professionals. The absence of 

committed and skilled resources across all of these disciplines places an organization and its IT 

initiatives at elevated risk. Focusing only on a subset of these talents overlooks other opportunities 

for improvement or other sources of challenges. 

Capitalizing on expanded and improved human capital flexibilities can provide greater access to 

talent (through hiring authorities, internal rotational opportunities, public/private exchange 

programs) and better (cross-disciplinary) development opportunities. With appropriate investment 

and attention and targeted expansion (including establishment of virtual communities of interest 

or practice, expansion of statutory hiring or employment authorities). significant progress is 

possible. Agency heads, of course, must also recognize the importance of, and prioritize 

accordingly, recruitment, retention, and development of a competent workforce. 
54 


KING-6430 with DISTILLERInsert offset folio 43 here 26560.043

Conclusion 

To summarize all of my points: every person and process in every agency is ultimately a part of 

the federal IT solution. IT is a strategic asset and a competitive differentiator, and successful 

organizations integrate their personnel and processes, including IT, to ensure the success of all of 

their initiatives, and they treat cybersecurity as part of an executive-level risk management 

program. 

There is one other entity, of course, that needs to be integrated into the agency planning, 

acquisition, and funding processes, and that is Congress. I am deeply appreciative that this 

committee continues to work to improve federal IT practices, both through existing laws like 

FITARA and through complementary bills such as the MEGABYTE Act, PMIAA, the pending 

Modernizing Government Technology (MGT) Act, and others. Though I realize that we do not 

have time today to address all of these acts, I would urge Congress to consider them as integrated 

parts of an overall whole, and ensure that the various legislative initiatives are all in the service of 

empowering agencies to make smart, agile, and cost-effective IT decisions. 

FIT ARA is a step in the right direction, but there remains much work to do- and not all of it 

should be done through legislation. To gain a clearer, more complete picture of IT spending, it is 

imperative that key provisions under FIT ARA do not sunset in 2018 or 2019 and that the legislation 

is amended to extend the deadlines and ensure continued progress. We suggest Congress consider 

these three additional steps: I) invite agency heads to articulate a clear strategy for leveraging IT 

to improve business and mission outcomes (including optimizing enterprise, rather than just IT, 

costs); 2) adjust the scoring metrics and methods to incentivize the desired behaviors by agencies; 

and 3) create an integrated and streamlined approach for assessing progress across the diverse 

reporting demands placed on agencies (FIT ARA, OMB M-17-22, Cybersecurity Executive Order, 

MEGABYTE Act, DATA Act, etc.). FITARA scorecards have proven to be an effective, though 

imperfect, tool for motivating agencies to make changes; continuing to refine them will help avoid 

them becoming compliance checklists or distracting from important outcomes. 

Thank you for giving me the opportunity to share my views with you, and I look forward to your 

questions. 

Acknowledgments 

I would like to acknowledge my fellow Gartner analysts tor contributing their intellectual capital 

to spur innovation across the technology industry. Specifically, I would like to thank my fellow 

Gartner government research colleagues (Katell Thielemann, Kris van Riper, Rishi Sood, Cathleen 

Blanton, and Rick Howard) for their contribution to this testimony and for their collective wisdom 

in supporting government technology issues. 
55 

Mr. HURD. Thank you, Dr. Holgate. 

I would like to now recognize the chairman, Chairman Meadows, 

for his first round of questions. 

Mr. MEADOWS. I thank you, Chairman. 

Thank each of you for your insightful testimony. Ms. Killoran or 

Ms. Conley, let me come to you. Out of the I guess it was $14 billion that you spend in IT, how much of that actually is grants to 

States? 

Ms. KILLORAN. Seven-point-two billion. 

Mr. MEADOWS. All right. So out of the $7.2 billion to States, 

which States are doing the best job of implementing that money? 

Ms. KILLORAN. So that—we would have to get back with you 

through our grants program because that is automatically done 

through our grants and is not actually part of what the CIO and 

CFO look at —— 

Mr. MEADOWS. So, you have no idea which State is doing— do 

you not see a problem with that? 

Ms. KILLORAN. Well, the way that the FITARA works—and we 

actually asked for clarification when the bill came out—is is whether agencies should be responsible for the grants funding or not. 

And the guidance we got from OMB is that grants would be excluded from the oversight. 

Mr. MEADOWS. I agree with that. So, you are not having to focus 

on this $7.2 billion according to FITARA, is that correct? 

Ms. KILLORAN. That is correct, sir. 

Mr. MEADOWS. All right. So, let me ask you the follow-up question because I thought that is where we were going. If you are only 

having to look at the remaining balance, why are we at D’s across 

the board? Why are we not making better progress? Because, you 

know, I can understand if it is a big number. Why are we not making better progress? 

Ms. KILLORAN. So, within the large Federal agencies—so, this is 

my third federated agency—so started at Treasury and then spent 

nine years and 11 years at DHS and now here. When you’re in a 

large federated agency, it takes us a little bit of time to establish 

those foundations. 

Mr. MEADOWS. So, assuming that it takes a little bit of time, 

when are we going to see an improved score? 

Ms. KILLORAN. So, you’ll actually see—when we talk a little bit, 

we actually have some cost savings that we have. We actually have 

a plan for the data centers. So, we —— 

Mr. MEADOWS. So, when are we going to see an improved score? 

Ms. KILLORAN.—expect—we’re expecting to see some scores 

change within the next 12 to 18 months. 

Mr. MEADOWS. All right. So, Mr. Powner, let me come to you. Is 

their plan aggressive enough based on other agencies? Should we 

be expecting more? 

Mr. POWNER. Yes, I think you should. So, I—clearly, they have 

a FITARA implementation plan they’ve made progress on, as Ms. 

Killoran has said. I think when you have the large Federal agencies, federated agencies, there’s a real opportunity to go after that 

commodity IT because a lot of those components, there’s an opportunity to look at duplication across those components. 


KING-6430 with DISTILLER
56 

The other thing is when you look at the data for HHS on data 

centers, they’ve actually closed a lot of data centers and done a decent job on that, but there’s not much in related savings. So, we 

need to look real hard at the related savings and also at their optimization —— 

Mr. MEADOWS. So, Ms. Conley, what happened to the money? 

Ms. CONLEY. Thank you very much for your question. Thank you 

very much for your question. 

In terms of what’s happened to the money, at HHS, Beth mentioned we’re a large federated organization. 

Mr. MEADOWS. Yes, I have only got five minutes. 

Ms. CONLEY. Yes. Okay. 

Mr. MEADOWS. Just what happened to the money? 

Ms. CONLEY. In many cases with these data center consolidations 

we have gaps in IT spending, meaning there are things that we 

need to do within our IT portfolio, and oftentimes, the savings that 

are realized through these different consolidation efforts and modernization efforts are plowed back into those respective systems 

and infrastructure to provide things that we know need to be done 

to provide secure, reliable —— 

Mr. MEADOWS. So, without oversight of Congress you are just reprogramming the dollars? 

Ms. CONLEY. So, many of those dollars are re-plowed into the 

very same systems and infrastructure —— 

Mr. MEADOWS. So, let me understand. You close down a data 

center and you plow it back into the same data center? 

Ms. CONLEY. Well, if I might give you an example with our financial systems modernization effort that we just upgraded our financial management systems in 2016. We moved to the cloud implementation. As part of doing that, we saved some money, but at 

the—and maintained our operations and maintenance costs at the 

same level, yet we were able to provide things like disaster recovery —— 

Mr. MEADOWS. All right. So —— 

Ms. CONLEY.—and more to—better value to the government —— 

Mr. MEADOWS. So, Ms. Conley, Ms. Killoran, let me be specific. 

We are looking very closely at these numbers, and it is going to 

have implications from an appropriations standpoint. So, let me 

come back to you, Mr. Powner. How much does DOD spend on IT 

annually? 

Mr. POWNER. So, it’s about close to 45 percent of the spend, 

which is $95 billion, so it’s well into $40 billion range. 

Mr. MEADOWS. So about $40 billion, and I notice they got an F 

on the transparency and IT dashboard. I mean, why is that? 

Mr. POWNER. So, what happened recently is there were about 

$15 billion that was on the dashboard that just went away. And 

what we understand is that it’s been classified, we believe, under 

the national security system umbrella. And it’s okay because there 

is an exemption for national security systems, but to have $15 billion magically appear under that umbrella doesn’t seem right and 

—— Mr. MEADOWS. Well, it doesn’t seem right to me either, and so 

here is what I would ask for you to do, and I will close with the 

chairman’s indulgence. We are being asked to fund DOD above this 


KING-6430 with DISTILLER
57 

$603 billion that the President has requested. In fact, some in our 

conference want it to be $640 billion. Take the message back to 

them, unless they get their heart right on this, there will be no 

support for increasing that. And I don’t know how to make it any 

clearer. I will let my colleagues on the other side of the aisle talk 

about perhaps HHS and some of the others. But with DOD, it is 

going to require Republican votes to increase it, and I for one, unless they get their heart right on the transparency, am not going 

to be very supportive if you will take that to them if you would. 

Mr. POWNER. Will do. 

Mr. MEADOWS. Thank you. I will yield back. 

Mr. HURD. Ms. Kelly, you are now recognized for five minutes. 

Ms. KELLY. Thank you very much. 

In my opening statement, I talked about the hiring freeze that 

was ordered, and in April, the Office of Management and Budget 

issued a memorandum to all agencies requiring them to reduce 

their civilian workforces. The OMB memorandum fulfills a key objective of the President, and I quote, ‘‘the long-term plan to reduce 

the size of the Federal Government’s workforce through attrition.’’ 

Mr. Powner, is retention a critical factor in maintaining an effective IT workforce, and how so if so? 

Mr. POWNER. Yes, clearly, you need to retain the good employees 

we have, but also, too, we have significant gaps when you look at 

the IT workforce not only from a cyber perspective but also with 

some of the other key disciplines, systems engineers and architects 

and the like. So that’s always been a big challenge in the Federal 

Government. 

Ms. KELLY. I know we have talked about that before, and do we 

attribute it to just the lack of a pool to pick from and also the salaries we might not pay? 

Mr. POWNER. Yes, that’s true, and I think that’s why it’s critical 

that when you look at your IT workforce as a whole and some of 

the challenges with the salary challenges the Federal Government 

faces, you need to supplement that appropriately and be really 

strategic about how you do that with contractors because that can 

be done with contractors, and that right mix is what you really 

want to obtain. 

Ms. KELLY. Okay. Thank you. 

Dr. Holgate, in your assessment, can agencies make the necessary improvements under FITARA if they don’t have the flexibility to hire new employees or replace vacancies? 

Mr. HOLGATE. Well, certainly, it’s highly dependent on the approach that agencies take in responding to OMB M–17–22. There’s 

latitude given in that memorandum and actually an encouragement for agencies to explore technology-enabled operational efficiencies and effectiveness. If agencies are adequately creative about 

their response to that memo, they should have the flexibility to be 

more creative and use IT more effectively in their response. 

The danger, frankly, is if they take a more reactionary tactical 

approach and treat it more as a cost-cutting exercise, in which case 

it can result in relatively haphazard across-the-board reductions 

without that strategic foresight, without that projection for longerterm opportunities that they may be foregoing. So that’s the danger 

in the memorandum itself is just the nature of the response by the 


KING-6430 with DISTILLER
58 

agencies themselves. We haven’t seen those responses yet in terms 

of how agencies are thinking about those challenges, but that’s the 

key issue there is how are agencies going to actually shape their 

response. 

Ms. KELLY. Well, off the top of your head can you give an example of what being creative means, what that could mean or could 

look like? 

Mr. HOLGATE. Yes, so, for example, you know, leveraging the IT 

talent that they already have and possibly supplementing it with 

additional talent in the near term to enable them to automate traditional tasks or mission space, to be more creative across agency 

boundaries, to reimagine the way agencies deliver services. There 

are opportunities like that that require a certain amount of creativity and are critically dependent on IT to enable those types of 

opportunities. 

So, if agencies—again, if agencies treat this more as a cost-cutting exercise and in an across-the-board fashion, they may sacrifice 

those long-term opportunities just by virtue of, you know, reducing 

cost in the short term. 

Frankly, Gartner’s written a lot of research on cost optimization 

at the enterprise level and the opportunities that IT can present 

with those opportunities. We’ve also written a fair amount about 

the risks of cost-cutting, in particular by taking a blanket approach 

and foregoing the future opportunities. 

Ms. KELLY. Thank you. Ms. Killoran, in your written testimony 

you state, ‘‘Recently, HHS conducted an IT workforce inventory and 

we found that workforce shortages and ever-increasing workload 

often create an imbalance that hinders employees’ ability to attend 

training or obtain certification.’’ This seems like a serious problem 

because, as your written testimony states, many of HHS’s 3,000 IT 

workers, and I quote, ‘‘do not have the diverse expertise necessary 

to support current Federal IT needs, including IT project and program management, architecture, or cybersecurity.’’ Did I hear you 

correctly? 

Ms. KILLORAN. That is correct. 

Ms. KELLY. What are some of the gaps in skills in staffing that 

you attribute to the shortage in IT expertise at your agency that 

you mention in your written testimony? 

Ms. KILLORAN. So, we have—as Mr. Powner indicated, we have 

significant decreases of our needs in cybersecurity, enterprise architecture, systems engineering are the predominant areas where 

we have the most significant shortfalls, and then obviously 

programmatics as well. 

We actually have worked with our chief human capital officer to 

start building true capability and roadmaps on competencies that 

needed to be done for each of these areas all the way from a GS– 

5 up to what an SES would be. We have identified over 25 different 

critical positions at this point and have roadmaps for 11 of them. 

OMB and OPM have determined that this is a great model. We 

are actually helping to do the Federal CIO workforce community at 

this, and OPM is trying to adopt that model Federal-wide at this 

time. 

Ms. KELLY. I see my time is up, so I yield back. 

Mr. HURD. I thank the gentlelady. 


KING-6430 with DISTILLER
59 

Now, I would like to recognize the gentleman from California, 

Mr. Issa. You are recognized for five minutes. 

Mr. ISSA. Thank you, Mr. Chairman. 

And I am going to follow up maybe just quickly. My question is 

one of timing. I am hearing people say we don’t have enough resources, we don’t have enough time. You know, I came to Congress 

in 2000, or was elected in 2000, sworn in first January 3rd of 2001. 

Basically, I was elected when Amazon was founded. In 2006, you 

know—well, I will give you 2009 Uber was founded, Instagram in 

2012, Snapchat in 2014. In 2014, we took an $82 billion spending 

and said we were going to deliver to the CIOs real authority to do 

a job that it had previously not had budget authority, often—and 

at least in the case of the Affordable Care Act—had three nonprofessionals each pointing at the other saying they didn’t have the 

ability to stop a bad project. We did that after we had written off in Dayton $1 billion at the 

Air Force, the Department of Defense, on a project where they simply got to the end of $1 billion in spending and said it won’t procure parts accurately. 

So, I think this first question will be for the GAO. Mr. Powner, 

tell me, why is it I should accept that companies today will launch 

on Amazon and be world-class, global with apps that allow for tremendous ability to take labor out and put efficiency into things as 

complex as a million cars around the world being there when you 

want one? Why is it I have to accept that it takes four years and 

the progress is minuscule? 

Mr. POWNER. Well, we shouldn’t accept it. I mean, we spend now for the fiscal year 2018 budget that’s north of $95 billion on IT, and 

we all know that a lot of that goes towards the old O and M. But 

20 percent of —— 

Mr. ISSA. We know the cost of a NOOK has gone down —— 

Mr. POWNER. Yes. 

Mr. ISSA.—if you are buying a desktop. 

Mr. POWNER. But 20 percent of $95 billion is a lot of money. And 

here’s the interesting thing is we do see pockets where we do it 

right, so we don’t—I don’t—we don’t want to hear that you can’t 

do it right. I mean, we see pockets within DOD, within the intelligence community. The weather satellite that we just launched 

that provides great weather warnings, I mean, yes, it took a little 

longer and maybe a little more money, but there are these pockets 

of success, so we need to continue to replicate that, hold CIOs and 

the agencies and actually agency heads accountable. I think some 

of the CIOs need some help from the agency heads to write these 

CIO authorities. And going back to the DOD story, I think DOD 

is the last organization in the world that should be exempt from 

FITARA. If any organization needs a private sector-type CIO, it’s 

DOD. 

Mr. ISSA. Oh, trust me, we negotiated to try to get less exemptions, and they have their own little world. Quite frankly, they said 

they had already fixed it with their earlier bill. And yes, we need 

to have less exemptions. 

But, Ms. Killoran, let me ask you a question, having been with 

three agencies and now as a CIO of this one. We gave you budget 

authority; we gave you the ability to work with your peers to look 


KING-6430 with DISTILLER
60 

for, if you will, interagency opportunities. Have you taken advantage of any interagency opportunities where you looked at your 

other CIOs and said let’s do this together? Let’s go up on an Amazon cloud and have one common software platform that we can 

share for certain types of uses, whether it’s H.R. or other areas? 

Ms. KILLORAN. So, at this time, not across the Federal agencies, 

but we —— 

Mr. ISSA. But why not? Do you lack authority? 

Ms. KILLORAN. The—no, it’s not a lack of authority. It’s understanding what we have within our department first and understanding what we have and where those opportunities might be 

across the Federal Government. So, what we have done internally 

is trying to get our own house in order in understanding what we 

have first, and then that allows us to be able to start interacting 

better with the other Federal agencies. 

Mr. ISSA. So, following up on that, cataloguing all the software 

and characterizing it is an element for CIOs to evaluate each other, 

right? 

Ms. KILLORAN. Yes, sir. 

Mr. ISSA. And the potential cost savings if one agency is up on 

a cloud with a next-generation software that does something and 

the others are using, I don’t know, a DEC Alpha or something, that 

means that you can get immediate savings if you only knew, right? 

Ms. KILLORAN. I think if there’s a—that’s a ‘‘yes but’’ because 

sometimes there are capabilities but then they have to be modified 

and altered based on security requirements and interfaces that different agencies need, but at least it would be nice to understand 

what’s available. 

Mr. ISSA. Well, once the student loan program gets fixed with its 

interface with the IRS, hopefully, it will be world-class, so I agree 

with you that sometimes there are security problems. 

Let me just close with one question. When I hear that $7.5 billion in grants and similar money at many other agencies were determined by the Office of Management and Budget not to be for the 

CIO to oversee in any way, shape, or form and thus, you know, basically avert the intention of FITARA, which was to give budget authority and financial control, just an opinion but I would like to 

hear your opinion. Should we speak to OMB and see if, in fact, 

they would rethink that? 

Ms. KILLORAN. I think understanding again that realm of possibility, and so just as you mentioned —— 

Mr. ISSA. Because the act doesn’t say it. That is an interpretation. 

Ms. KILLORAN. That’s correct. But, I mean, to your point of realm 

of possibility, there are a number of capabilities and services that 

the grantees are given that might also help not only our Federal 

agency but others that are doing similar-like services. So being able 

to have some, especially when you’re interfacing and having some 

commonality of services, if each of them is doing them in silos, it 

makes it very difficult to show those capabilities. 

Mr. ISSA. Thank you. And, Mr. Chairman, that is not an original 

though. Many of us remember when the Affordable Care Act gave 

many, many billions of dollars to various States, who essentially 

stood up the exact same platform but each one inventing it, some 


KING-6430 with DISTILLER
61 

succeeding and some failing. This was part of the genesis for Mr. 

Connolly and I working on this. 

So, thank you for your indulgence. I yield back. 

Mr. HURD. The gentleman from the Commonwealth of Virginia 

is now recognized. 

Mr. CONNOLLY. I thank the chair. And just to follow up on Mr. Issa’s point, obviously, if 100 percent of that $7.2 billion in grants 

were designed to support 50-year-old legacy systems, and that is all 

it did, we would be very bothered by that and we wouldn’t want 

you to persist in that investment. We would want you to pressure 

those grantees to upgrade their IT. So, at some point we are concerned about that, and you need to be, too. So, I echo what Mr. Issa 

had to say. 

Mr. Powner—and by the way, Dr. Holgate, thank you. Your testimony was terrific. I mean, I think you laid out a very powerful 

strategic framework for why this bill was passed and what we intend for it to achieve. And I just want to thank you. I think it was 

one of the best articulations of what we are about from a witness 

in a long time, so thank you. 

Mr. Powner, and thank you for all of the work you and GAO 

have done. You have done a marvelous job in making this not only 

a high-risk item but at the very top of the agenda. It is not sexy, 

but, Lord, can it lead to savings and more importantly, make us 

so much more efficient in delivering services to the people we 

serve. That is really what this is about. 

Why is data center consolidation so important? From your point 

of view, why is it such a high priority in the Issa-Connolly bill? 

Mr. POWNER. Well, we have very inefficient data centers that are 

out there. Remember, we got into this in 2010 because the average 

server in the Federal Government was utilized about 10 percent. 

That metric now, the target is 60 percent of our servers, so we have 

underutilized equipment, underutilized facilities, and frankly, some 

of them are so old we could do a lot to improve our security posture, too, by upgrading these centers. 

And I do think, back to your sunset comment earlier, I mean, 

there’s at least $1.5 billion that we’re aware of that is on the table 

beyond 2018, and I think if you really press DOD and some of the 

other large organizations, there’s probably a lot more. 

Mr. CONNOLLY. In your 2016 report on this subject, you said that the consolidation plans could save taxpayers more than $8 billion 

by 2019. Is that correct? 

Mr. POWNER. That’s correct. 

Mr. CONNOLLY. How much has been saved to date? 

Mr. POWNER. So, it’s been about $3 billion of the $8 billion has 

been saved to date, so pretty good progress. 

Mr. CONNOLLY. Real money? 

Mr. POWNER. Real money. 

Mr. CONNOLLY. Bigger than the entire grant program of HHS, $8 

billion, I mean. 

Mr. POWNER. That’s right. 

Mr. CONNOLLY. I mean, my colleague Mr. Meadows made the 

point that we got to get our arms around the savings. If you’re effectuating savings but we’re not accounting for it, you know, the 

risk is people call it zero. So, Mr. Powner, could you comment on 


KING-6430 with DISTILLER
62 

Ms. Killoran’s explanation for why we have underreported or 

underachieved data center savings at HHS even though they are, 

in fact, doing their job; they are consolidating? 

Mr. POWNER. Yes, I—there’s been consolidations. The dollars are 

minimal when you look at the millions of dollars that have been 

reported there. It sounds like there’s probably more that’s not reported that are getting reinvested. 

I think the important thing here is the transparency, and back 

to the MGT Act, you want to create these working capital funds at 

departments and agencies for reinvestment. Let’s make darn sure 

that the reinvestment is on the priorities, and if you don’t have 

transparency, there’s no assurance that it’s on the priorities. 

Mr. CONNOLLY. I would hope, Ms. Killoran—and it sounds like 

you would—you might sort of following the footsteps of USAID and 

reach out to GAO so we have a better mechanism for capturing the 

actual good work you are doing and the savings they are effectuating, but also that we in fact—where we are reinvesting, we are 

reinvesting in the priorities that Mr. Powner just talked about. Are 

you willing to do that? 

Ms. KILLORAN. So, thank you for the question, sir. We actually 

talked before the hearing to do just that. 

Mr. CONNOLLY. Okay. Great. My final question because I know 

I am going to run out of time, Mr. Powner, why is DOD so obstinate? Why are they so resistant? And you heard Mr. Meadows say 

from a Republican point of view take back a message. I don’t speak 

for all Democrats, but I think most of us on our side of the aisle 

would echo his sentiments. The enormous frustration that that is 

the biggest single appropriation of the Federal Government and it 

is getting bigger, and they seem to inoculate themselves from all 

norms of accountability. And it is very frustrating. For example, 

OMB directed agencies to submit plans for detailing data center 

consolidations, is that correct? 

Mr. POWNER. Correct. 

Mr. CONNOLLY. And what is the Department of Defense’s plan? 

Mr. POWNER. They didn’t get it in on time. It recently did come 

in, but they were very, very late. By the time we wrote that report, 

it was not in. 

Mr. CONNOLLY. So, were there other agencies also failing to submit? 

Mr. POWNER. No, they were the only remaining one. 

Mr. CONNOLLY. They were the only agency. And aren’t they also 

the only agency yet to achieve what is called an unqualified audit 

of their books? 

Mr. POWNER. That’s correct. The comptroller general has testified 

—— 

Mr. CONNOLLY. And don’t they exempt themselves from what 

other civilian agencies subscribe to in terms of a GSA list of sort 

of off-the-shelf generic products that can be purchased at a lower 

cost? 

Mr. POWNER. Yes, there’s some of that. 

Mr. CONNOLLY. Isn’t this special? And didn’t we have a hearing a few weeks ago in this committee about $125 billion, billion with 

a B, wasted by the Department of Defense that GAO uncovered? 

Mr. POWNER. Yes. Yes. 


KING-6430 with DISTILLER
63 

Mr. CONNOLLY. A hundred and twenty-five billion, right? So, my 

final question, I am sorry, but why the resistance? 

Mr. POWNER. I think when you look at the DOD accountability 

and organization structures, it’s spread over too many organizations. You have the CIO shop, you got the management organization, you have the acquisition shop, and it’s spread over those different organizations. And I think other than the CIO shop, IT 

doesn’t get the right importance and visibility. 

When you look at the data center consolidation, at one time DOD alone was about $4.8 billion in savings. They backed off of that significantly. I think you really need to look at their IT spend. Look 

at embedded IT at DOD, weapons systems, satellite systems. I 

think a CIO type would really benefit some of those large acquisitions at DOD and help with the cost overruns and the lack of delivery. 

We’ve had some discussions recently with folks on the Senate 

side on—in terms of their authorization committee, and the—we 

just laid it on the table that when you look at embedded IT and 

other things at DOD, it would benefit from a private sector-like 

CIO type. 

Mr. CONNOLLY. Thank you, Mr. Chairman. 

Mr. HURD. The distinguished gentleman from the great State of 

Michigan is now recognized for his five minutes of questioning. 

Mr. MITCHELL. Let me start, Ms. Killoran, as much entertainment as it would be to have the Department of Defense be here, 

and truly, I think everyone would be thrilled to have a discussion 

with them about their score, I would like to chat with you a little 

about your testimony. You indicated that 34 of the 39 goals that 

you had set up for your implementation plan had been achieved or 

were on target. Is that accurate? 

Ms. KILLORAN. Yes, sir. 

Mr. MITCHELL. Then how is it that you still have a D-minus 

score? 

Ms. KILLORAN. So, the goals that we have go to the different elements that are in the FITARA guidance provided by OMB, making 

sure that we are putting forward the things such as establishing 

delegations of authority —— 

Mr. MITCHELL. Okay. 

Ms. KILLORAN.—reviewing our IT budgets. 

Mr. MITCHELL. Mr. Powner, can you give me any guidance as to 

what you think that score will be shortly? Because a D-minus is 

not exactly stellar. 

Mr. POWNER. Well, clearly, when you look—incremental development, they had a high score, so they’re—HHS doing a good job 

there. The savings to—the two areas we score on savings, very low 

scores because of the reported savings on commodity IT and data 

centers. And then another thing, when you look at their dashboard, 

they’re quite green. Only about 14 percent of their investment dollars is red or yellow. That’s really—that’s not a lot of risk when you 

look at their investments, and they’ve got a lot of risky investments 

there. That’s why they get a low score there. 

Mr. MITCHELL. So, what do we expect—I appreciate that. You 

didn’t give me much indication of what we expect their score to be 

in a year from now. I think we need to have an idea where we exVerDate Nov 24 2008 15:21 Aug 23, 2017 Jkt 000000 PO 00000 Frm 00069 Fmt 6633 Sfmt 6633 H:\26560.TXT APRIL

KING-6430 with DISTILLER
64 

pect these agencies—what they expect of themselves to be 12 

months from now. 

Mr. POWNER. Well, I would hope when we get the reported savings that within six months to a year we see an improvement in 

the score. 

Mr. MITCHELL. I spent 35 years in private business. Only in government do we say things like we hope to see improvement, which, 

with all due respect, doesn’t answer the question I asked, which 

was what do we think, what do we believe the score will be? I am 

talking about HHS; they are here. What do we believe it is going 

to be? Ms. Killoran, do you have an answer for me in what your 

target is for that score a year from now? 

Ms. KILLORAN. So, as I indicated, we are working to make sure 

that we are updating and working with GAO on our numbers. So, 

for example, one problem we have is around the savings. One is 

around the fact that, as Ms. Conley indicated, we are reinvesting 

those, so working with GAO how to capture the savings as we are 

reinvesting to show that at least we did save them in these particular areas. We are getting ready to post an $85 million savings 

in data centers onto the dashboard today. We are also working to 

make sure that we are modifying our investment capability to improve our acquisitions. 

Mr. MITCHELL. Well, let me express this. I appreciate that. And 

it is obviously not just HHS. If this sheet came up at our monthly 

management meeting or my quarterly meeting with my board of directors, we wouldn’t have been in business anymore. That much 

red and yellow—and we used the same scorecard, red, yellow, 

green—and obviously, paying attention to what is red and what is 

yellow was critically important. And we had goals in terms of when 

we were going to move those. And the problem I have across the 

board is we don’t have dates, we don’t have are we going to be 

green on this within the next year or yellow on this. It is we just 

hope to see improvement. And that is—in my opinion, to get improvement is wholly inadequate. 

Dr. Holgate, let me ask you a question real quickly because I am 

running out of time as well. You talk about cultural change needs 

that are needed in these agencies in order to see meaningful gains. 

One of the things I note in, again, the scoresheet is in many cases 

the agencies that have particularly bad scores—poor scores, let’s 

put it that way—the CIO does not report to the Secretary or the 

Deputy Secretary. Now, let me explain to you, in my company the 

chief technology officer reported to me, and believe it or not, I knew 

where to find him 24/7 because we couldn’t get hacked with student data records. We could not have that happen. 

Give me some examples of how you think we—what we need to 

do to get the culture changes from these agencies so in fact it gets 

the attention it warrants? 

Mr. HOLGATE. Well, so one aspect I alluded to in my testimony 

about inviting agency heads to come in to explain to the committee 

what their attitude is toward IT on behalf of their CIO as an important enabler of business and mission outcomes that IT represents. And the question is do agency heads fully embrace that as 

an opportunity that they need to capitalize on, or do they treat IT 

as an afterthought and expense that must be minimized? And 


KING-6430 with DISTILLER
65 

that’s the cultural change I’m referring to because, frankly, most 

Federal agencies treat IT not as a strategic asset; they treat it as 

a headache that they need to minimize. 

Mr. MITCHELL. Well, and because of that, correlated to that is because they treat it as an issue like that, we also get inadequate 

cybersecurity. The two go hand-in-hand. The cost of acquisitions 

and how we efficiently acquire technology is one thing, but if you 

are treating it basically as a nuisance, guess what, we have security risks on our IT, and we have seen them across the Federal 

Government. 

Mr. HOLGATE. Absolutely. And contrary to the private sector that 

treats cybersecurity as an enterprise risk issue, as I alluded to, 

that’s a distinct cultural difference that the Federal Government 

hasn’t adjusted to yet. We’ve seen repeated encouragement that the 

Federal Government has gotten to treat cybersecurity as an enterprise risk issue. We’ve seen some recent evidence of that in the 

cybersecurity executive order that was just recently issued, but we 

haven’t seen that fully adopted yet at the Federal level. 

Mr. MITCHELL. Well, I thank you. My time is expired. 

And, Mr. Chair, I would like to have a conversation with you at 

some time about how it is we mandate some structural change to 

these departments so that the CIO gets the attention it warrants. 

Thank you. 

Mr. HURD. I am going to recognize myself for a little bit of time. 

I would like to start off by thanking the minority staff for the 

suggestion of Dr. Holgate to this panel because I think it has been 

very valuable. 

And, Dr. Holgate, am I paraphrasing you correctly when I say 

that agencies can make their IT centers not a cost center but something that drives business and mission outcomes? 

Mr. HOLGATE. Yes. 

Mr. HURD. And is it fair to say that in order to achieve that, that 

the agency head needs to recognize the importance of cybersecurity, 

of how their IT networks drive business and mission outcomes? 

Mr. HOLGATE. Absolutely. 

Mr. HURD. And would that also mean that having the CIO report 

directly to the agency head, isn’t that an important step? 

Mr. HOLGATE. It’s certainly relevant. It’s not necessarily necessary based on the relationship that the agency head has with the 

CIO, but it would certainly be an indicator that the agency head 

has taken that much more seriously. 

Mr. HURD. An indicator, great. 

Ms. Conley, you are the deputy assistant secretary, and you are 

the acting CFO? 

Ms. CONLEY. I’m not longer the acting CFO. We have another individual that’s come in as part of the new administration that is 

the acting CFO. I’m the deputy assistant secretary for finance, as 

well as the deputy CFO. 

Mr. HURD. So that is the position you are going to be in for some 

time? 

Ms. CONLEY. I believe so. 

Mr. HURD. And you had previous experience in the private sector 

in helping provide financial management strategies to private sector companies, public sector? 


KING-6430 with DISTILLER
66 

Ms. CONLEY. That’s correct. 

Mr. HURD. And how long have you been at HHS? 

Ms. CONLEY. Eleven years at HHS now. 

Mr. HURD. So, Ms. Killoran does not report directly to the deputy 

or the agency head. I think that is a problem. Would you agree or 

disagree with that? 

Ms. CONLEY. I—it depends I think I would say. How do you like —— Mr. HURD. Well —— 

Ms. CONLEY.—that pause? But I would say—so if I may —— 

Mr. HURD. So, let me rephrase the question. 

Ms. CONLEY. Yes. 

Mr. HURD. Why wouldn’t Ms. Killoran report directly to you or 

the agency head? 

Ms. CONLEY. So, we actually—Beth and I are actually peers. 

We’re both deputy assistant secretaries. She’s in charge of information technology; I’m in charge of finance. And we have a suite of 

what we would call our CXO suite. So, it covers finance, it covers 

—— 

Mr. HURD. So, who is your boss? 

Ms. CONLEY. My boss is the assistant secretary for financial resources, who then reports —— 

Mr. HURD. And who is her boss? 

Ms. CONLEY. The assistant secretary for administration. 

Mr. HURD. And who is the boss of the assistant secretary for administration? 

Ms. CONLEY. Both of those assistant secretaries report to the 

deputy secretary —— 

Mr. HURD. And then the deputy secretary’s boss is? 

Ms. CONLEY. The secretary. 

Mr. HURD. If my count is right, that is like three people —— 

Ms. CONLEY. Right. 

Mr. HURD.—right, in between the IT center and the C suite or 

the head of the organization. Would you have ever advised a private sector company to organize their organization that way? 

Ms. CONLEY. Well, it would depend upon the span of control. So, 

if you have an organization that’s headed up and the deputy, you 

look at the span of —— 

Mr. HURD. Mr. Powner, does that make sense? 

Mr. POWNER. I think if we want to have, as Dr. Holgate said, 

CIOs as strategic partners, you’ve got to report to the box at the 

top. And I think a key question is for the agencies at the head is 

what are the three things we’re doing to transform our departments or agencies? Technology will be involved in that. And what’s 

the role of the CIO in helping us get there? And I don’t think you 

get the right answers to those questions, Chairman Hurd. 

Mr. HURD. Ms. Killoran, $14.2 billion, that is the IT spend? 

Ms. KILLORAN. Thereabouts, sir, yes. 

Mr. HURD. Seven-point-two billion is these grants —— 

Ms. KILLORAN. Yes, sir. 

Mr. HURD.—which you don’t have to oversee, so that is $7 billion. How much control do you have of that $7 billion? 

Ms. KILLORAN. Of the grants, none. 

Mr. HURD. No, the $7 billion. 


KING-6430 with DISTILLER
67 

Ms. KILLORAN. Of the internal? 

Mr. HURD. Yes. 

Ms. KILLORAN. So, through the delegation, I have authority over 

all of it. 

Mr. HURD. So, you can stop any program —— 

Ms. KILLORAN. Yes, sir. 

Mr. HURD.—from happening, and you could buy anything that 

you need to put on your system? 

Ms. KILLORAN. They would have to go through the organizations 

to—the appropriations go directly to our operating divisions. 

Mr. HURD. So why do you not know what all software you have 

on your system? 

Ms. KILLORAN. So, for example, just in prepping for this hearing, 

over the last year just in Microsoft alone we have over 170 contracts that bought Microsoft products. And as you go through them, 

you have to go through individual resellers. To fix that problem, 

we’re using the cybersecurity continuous diagnostics and mitigation 

capabilities so that we can inventory ourselves —— 

Mr. HURD. So are you telling me that there is not software out 

there that would go out and figure all this out and spit back a —— 

Ms. KILLORAN. Yes, sir. And that’s what I’m saying. That’s what 

we’re actually putting in place, and we’ll be in some —— 

Mr. HURD. Okay. And how long does that take? 

Ms. KILLORAN. So, we’re putting that in place before the end of 

the year. So, we’ve done the hardware capability, and by the end 

of this fiscal year, we’re putting in software —— 

Mr. HURD. And what is taking six months to do that, to implement it? 

Ms. KILLORAN. So, the reasons is that there have been challenges 

with working with DHS in getting the license we need and the capabilities because we far under-scaled what we thought we would 

need, and so making that gap so that we have the totality of the 

licenses we need to deploy. 

Mr. HURD. Ms. Conley, does it make good financial sense to not 

know how many software licenses an organization has? 

Ms. CONLEY. No, sir, it doesn’t, and that is something that we 

recognize the need to get control over so that we can make this a 

far more efficient process. It’s very important. All the software we 

run in the Department is running off of software with licenses. 

That is a real opportunity for us to begin to consolidate and have 

greater sight across the organization to make better use of our licenses. 

Mr. HURD. Ms. Killoran, how many times have you met with the 

good director of HHS? 

Ms. KILLORAN. The Secretary, sir? 

Mr. HURD. Secretary, excuse me. 

Ms. KILLORAN. Since his appointment, three times. 

Mr. HURD. And you have been in the position since 2014? 

Ms. KILLORAN. I started—in this position I started in December 

of 2015 and actually became the permanent CIO last July. 

Mr. HURD. And how many times have you met with the number 

two? 

Ms. KILLORAN. Currently, obviously, our number two is vacant. 

The previous —— 


KING-6430 with DISTILLER
68 

Mr. HURD. The acting number two? 

Ms. KILLORAN. I have not met with the acting number two. Previous, though, the previous acting deputy secretary, we met almost 

biweekly, and I did also go to the secretary’s quarterly meetings 

with all of the operating division heads. 

Mr. HURD. Have either one of you all suggested to the new leadership team of HHS a reorganization of HHS to ensure that the 

CIO reports closer than three layers down from the Secretary of 

HHS? 

Ms. CONLEY. Well, as you may know, agencies are going through 

and implementing this new executive order and giving thoughts to 

ways in which we can reorganize our organizations to make them 

—— Mr. HURD. Have you all come to a conclusion of where the CIO 

should sit? 

Ms. CONLEY. There has—it’s still predecisional in terms of the results of those discussions. 

Mr. HURD. Predecisional, I love that word. So, are you providing 

guidance, insight, perspective on where that should be? 

Ms. KILLORAN. So, the way that we’re—the Department is looking at it is they actually looked at the totality of the work and how 

we do that better. I was personally involved in some of those working groups and made recommendations through that process. 

Mr. HURD. And what were the recommendations? 

Ms. KILLORAN. So, they were around how to change the culture —— Mr. HURD. Let me rephrase the question. 

Ms. KILLORAN.—and how to change —— 

Mr. HURD. I am trying hard not to be like—your recommendation 

should be the CIO reports to the agency head or the true number 

two, all right? This is pretty standard practice in industry. It 

should be standard practice across the government. And if agency 

heads are supposed to be responsible for the ultimate protection of 

the digital infrastructure, the person that has the authorities to do 

that should be directly under them. So, this isn’t complicated, so 

let’s stop making it complicated. And since we are in a period of 

this new implementation with the perspective that the White 

House on this, which is right, suggests that you report directly to 

the person that is—where the buck stops. This isn’t hard. This isn’t 

hard. So forward it. And maybe we need to write a letter to them 

and say, hey, just everybody do this because this is ridiculous. And 

the fact that it is going to take six months to figure out all the licensing that you have makes zero sense. 

My last is—anybody else? Yes, Robin Kelly. 

Mr. CONNOLLY. Oh, I am sorry. 

Ms. KELLY. This is not even really IT related, but, Mr. Powner, 

I know you have something to do with all the agencies under the 

Federal Government, and I was just saying to my colleague, it just 

sounds like there is just a lack of management structure, period, 

nothing to do with IT. Are all the agencies like this, like trying to 

decide who reports to whom or what the pecking order is? 

Mr. POWNER. Well, it differs. I mean, there’s—have of them report to the box, half don’t, right? Some of them that report to the 

box still don’t have authorities, some that don’t report to the box 


KING-6430 with DISTILLER
69 

do. I mean, it is so mixed, but I think the key is if you have a 

major—Chairman Hurd, back to your point. If you have a major 

cybersecurity breach at an agency, who are you going to call up in 

front of Congress for—to answer why. It’s going to probably be that 

dep secretary, along with a few others. But I don’t know why a dep 

secretary would not want to rely on a CIO to transform the agency 

and to secure an agency because if something happens, they’re 

going to be the ones up here answering. Look what happened at 

OPM. It was the director of OPM that was up here answering 

questions, and it didn’t fair very well for them. 

So, I think the focus on—keep pushing with your grades. I tell 

you what one thing that happened with your grades—I know you 

released them last night and there was some media articles—we 

have four agency CIO shops call GAO this morning and wanted to 

talk about the grades. That’s good. That’s a good thing. So, I’d say 

keep pushing. 

Ms. KELLY. And I am just asking because before I came here, I 

was the chief administrative officer of Cook County, and I know, 

you know, there were people that reported directly to me about 

what was going on. I had like 10 agencies under me. So, it just 

sounds so confusing. I am not blaming you. It just sounds so confusing and you need some advice from Dr. Holgate or something. 

It just sounds very confusing. Thank you. 

Mr. HURD. Mr. Connolly. 

Mr. CONNOLLY. I was just going to offer to cooperate with you, 

Mr. Chairman. I like your idea of maybe what we do is kind of inventory outstanding issues that could have been handled administratively and write a fairly comprehensive letter to our former colleague Mr. Mulvaney. He was a member of the committee. He is 

familiar with these issues. I think he would be receptive. And I 

would be glad to work with you, and I know Ms. Kelly would, too, 

I am sure on a bipartisan basis to get that done. 

Mr. HURD. Yes, because when the next—thank you. I am going 

to recognize myself again. When the next cyber attack happens, 

right, and we have gone through all these conversations, guess 

what? We are dragging everybody up in front here. If we have to 

use subpoenas, we will. We have done it before; we will do it again. 

And I want to make sure that you have all the authorities you can. 

That is why we are working hard to get MGT because instead of 

putting some of that money back into some of—you know, buying 

services you may not need, why not use that money that you realize and that savings on the highest-priority issues within your organization? That is the point of all this. 

And, Mr. Powner, why are the grades so bad when it comes to 

software licensing? 

Mr. POWNER. That’s a tough one because—we issued a report 

several years ago that—we had 22 of the 24 agencies had complete 

inventories. We’ve only had one uptick with three. Now, to be fair 

to the agencies, like at NASA there’s a partial inventory that 

Renee Wynn there, their CIO, has used to achieve some savings. 

I think a key thing why we don’t have complete inventories is the 

CIO authorities. I think there’s pockets within these federated 

agencies that CIOs cannot—they don’t have good visibility into 

what’s going on. And I think it’s a direct reflection on the CIO auVerDate Nov 24 2008 15:21 Aug 23, 2017 Jkt 000000 PO 00000 Frm 00075 Fmt 6633 Sfmt 6633 H:\26560.TXT APRIL

KING-6430 with DISTILLER
70 

thorities why we don’t have comprehensive software license inventories. 

Mr. HURD. Good question. Ms. Killoran, my last question. You 

have roughly 3,000 employees within the IT shop. Do we have job 

descriptions for all of them? 

Ms. KILLORAN. There are job descriptions, but they vary. That’s 

one of the things that we’re working with both internally within 

HHS and now at a Federal level to try to have standard job descriptions for the same types of work. It has been a potential issue. 

Mr. HURD. I didn’t write my note down. You named it something. 

Ms. KILLORAN. So, we actually have competency roadmaps for 

each of our workforce, and we’ve done 11 of these competency roadmaps for particular IT series from a GS–5 all the way to—up to 

an SES, including what certificates and skills they should have at 

each step. 

Mr. HURD. And you are comfortable OPM can take what you all 

are doing and export that to other agencies? 

Ms. KILLORAN. Yes. We’re actually in the process of doing that 

as we speak. 

Mr. HURD. Do you have an idea of when that process should be 

completed? 

Ms. KILLORAN. So, the first step of that they are expecting to 

have done I think it’s the first quarter of 2018. So, they’re taking 

those 13 and trying to requalify them, yes. 

Mr. HURD. Okay. That is really helpful on the next project we 

are trying to work on, so we have got to know what our gaps are 

in our IT staff. 

So, seeing no further business, without objection, the subcommittees stand adjourned. Thank you all for being here. 

[Whereupon, at 3:21 p.m., the subcommittees were adjourned.] 


KING-6430 with DISTILLER
(71) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
72 


KING-6430 with DISTILLERInsert offset folio 44 here 26560.044

Questions for David A. Powner 

Director, Information Technology Management Issues 

Government Accountability Office 

Rep. Robin L. Kelly, Ranking Member 

Subcommittee on Information Technology 

Committee on Oversight and Government Reform 

Joint Subcommittee Hearing on "The Federal Information Technology Acquisition 

Reform Act (FITARA) Scorecard 4.0" 

June 13, 2017 

1. According to the most recent FITARA scorecard, 21 agencies do not have a 

complete inventory of software assets as required by the Making Electronic 

Government Accountable By Yielding Tangible Efficiencies Act of 2016 

(MEGABYTE Act). It is my understanding that incomplete or inaccurate data pose 

significant security and management risks to federal agencies. 

a. Can you summarize the risks the federal government faces when agencies 

lack a complete inventory of software assets? 

Without a complete inventory of software assets, federal agencies may not be 

able to effectively manage their information technology (IT). In particular, 

agencies risk purchasing too many software licenses, resulting in unnecessary 

duplication and wasteful spending, or too few licenses, resulting in additional fees 

to purchase more1 In addition, if an agency exceeds the number of agreed upon 

users, it risks the possibility of noncompliance with license terms from the 

copyright owner. To help ensure that the legal agreements that come with 

procured software are adhered to and that organizations avoid purchasing 

unnecessary software, proper management of software assets, including a 

complete inventory, is essential. 

b. Can you summarize the risks that the federal government faces when 

agencies do not have a complete inventory of their IT assets, broadly? 

Without having a complete inventory of agencies' IT assets, the federal 

government faces several risks. 2 Specifically, the lack of a comprehensive IT 

asset inventory presents a security risk. If agencies are not aware of all of their 

assets, they cannot secure them, resulting in a vulnerable security posture and 

an increased risk of undetected theft and loss of assets. In addition, without such 

an inventory, an agency may not be able to effectively manage projects and 

systems, or make informed decisions regarding its IT and the associated costs. 

1GAO, Federal Software Licenses: Better Management Needed to Achieve Significant Savings Government-Wide, 

GA0-14-413 (Washington, D.C .. May 22, 2014) 

2GAO, Information Technology: Agencies Need to Improve Their Application Inventories to Achieve Additional 

Savings, GA0-16-511 (Washington, D.C.: Sept 29, 2016); Library of Congress: Strong Leadership Needed to 

Address Serious Information Technology Management Weaknesses, GA0-15-315 (Washington, D.C.: Mar. 31 , 

2015); Federal Information System Controls Audit Manual (FISCAM), GA0-19-232G (Washington, D.C.: February 

2009); Information Technology investment Management: A Framework for Assessing and Improving Process 

Maturity, Version 1.1, GA0-14-394G (Washington, D.C.: March 2004). 
73 


KING-6430 with DISTILLERInsert offset folio 45 here 26560.045

Finally, the absence of a complete inventory can increase agencies' risk of 

unnecessary, duplicative purchases and, as a result, wasted funds. 

To identify and address duplicative assets, agencies can use the PortfolioStaP 

initiative, which requires agency-wide IT portfolio reviews. Federal agencies have 

historically struggled with managing their portfolios and, as a result, in February 

2015, we added improving the management of IT acquisitions and operations to 

our list of high-risk areas for the federal government. 4 

c. For the inventories of software assets that agencies currently have, what 

checks are in place to ensure that this data is accurate? 

The agencies that have software asset inventories can use automated tools to 

collect, track, and help ensure the accuracy of data. In this regard, the 

Department of Education, the United States Agency for International 

Development, and the General Services Administration use automated tools to 

maintain their software inventories. Specifically, the Department of Education has 

implemented the "Software Asset Management Tool" that is intended to enable 

centralized software license control. In addition, the United States Agency for 

International Development tracks its software assets using an automated tool 

called System Center Configuration Manager 2007. Finally, the General Services 

Administration uses several automated tools, including IBM MaaS360, that allow 

the agency to monitor its software asset usage. 

d. What steps did the Department of Education, the United States Agency for 

International Development, and the General Services Administration take to 

earn their scores under the new "Software licensing" category that was 

previewed with the release of the current FITARA scorecard? 

The Department of Education, the United States Agency for International 

Development, and the General Services Administration regularly tracked and 

maintained a comprehensive inventory of software licenses. Further, the United 

States Agency for International Development and the General Services 

Administration demonstrated that they were analyzing agency-wide software 

licensing data to identify opportunities to reduce costs and better inform 

investment decision making. For example, the General Services Administration: 

• established an official asset repository/inventory that serves as the 

system of record for all agency software assets and is used to track 

license data, such as cost, deployment, allocation, status, and lifecycle 

stages from procurement to retirement; 

• designated IT personnel to serve as asset managers responsible for the 

creation and maintenance of proper asset documentation for all software; 

• established procedures for using automation tools to, among other things, 

track and maintain the agency's software license inventory; and 

3

Recognizing the proliferation of duplicative and low-priority IT investments within the federal government and the 

need to drive efficiency, the Office of Management and Budget launched the PortfolioStat initiative in March 2012. 

OMB requires federal agencies to conduct annual agency-wide IT portfolio reviews to, among other things, reduce 

commodity IT spending and demonstrate how their IT investments align with their agencies' missions and business 

functions. 

4GAO, High-Risk Series: An Update, GA0-15-290 (Washington, D.C.: Feb.11, 2015). 
74 


KING-6430 with DISTILLERInsert offset folio 46 here 26560.046

• established procedures to compare software usage to purchased 

software through the use of its automated inventory tools. 
75 


KING-6430 with DISTILLERInsert offset folio 47 here 26560.047

House of Representatives 

Gartner, Inc. 

4501 Fairfax Drive 

8'h Floor 

Arlington, VA 22203 

(703) 387-5600 

Committee on Oversight and Government Reform 

Subcommittee on Information Technology 

Subcommittee on Government Operations 

2157 Rayburn House Office Building 

Washington, DC 20515 

Dear Chairmen Hurd and Meadows: 

Thank you for the additional questions and the opportunity to respond. 

I. One of the major challenges and opportunities the .federal government.faces in its 

information technology (IT) reform efforts is wasteful duplicative systems. The Federal 

Information Technology Acquisition Reform Act (FITARA or Act) requires agencies to 

eliminate unneeded data centers while optimizing the remaining ones by 2018. 

a. What impact could a long-term workforce reduction have on the ability of 

agencies to meet the F1TARA time line for completing all data center optimization 

and closure efforts? 

Federal agencies require an appropriate strategy to support agency mission needs, 

and the right resources and skills to support it. A long-term workforce reduction, if 

done indiscriminately and despite broader strategic priorities, could be detrimental 

not just to data center optimization specifically, but more generally to the viability 

of agency IT organizations and to the vitality of agency operations. Agency heads 

must think strategically (over a longer horizon, in a broader context) about the 

agencies' missions, priorities, and desired outcomes, when making decisions about 

their people, technology, and investments. Among the private sector companies 

that we work with, investments in IT fuel digital innovation to transform customer 

services to a digital backbone, rather than focus on outdated paper processes or 

physical offices. Wise investments in information and technology are critical to 

strategic business restructuring and can both improve outcomes and reduce costs. 

Thinking tactically - treating government reform as a near-term cost-reduction 

exercise- and downsizing everything equally (including the workforce) is shortsighted and misguided. We have already noted the disproportionatelY large segment 

of federal IT spend - over one third that occurs outside of CIO authority 

("shadow" or "business unit" IT). Continuing to focus on IT reductions (of 

workforce or operational budget) limits the CIO's ability to deliver results. Further, 
76 


KING-6430 with DISTILLERInsert offset folio 48 here 26560.048

it encourages a spending shift that lacks proper coordination, and with little or no 

oversight- making strategic action more difficult if not impossible. 

Outdated, underfunded and undermanned "back-office" capabilities have 

disproportionate impacts on agency operations and long-term agency health. In 

general, IT, acquisition, finance, and human capital functions have a "minimum 

viable product" staffing level below which they cannot continue to support agency 

operations. Many agencies currently have workforce levels that are in danger of 

falling below the minimum viable product level. Permanent workforce reductions 

may limit agencies' ability to conduct data center optimization internally, which 

may lead to a requirement to outsource these functions to third-party vendors with 

the ability to perform the optimization tasks. Moreover, in some cases, these 

functions must potentially be increased or enriched to enable agencies to achieve 

strategic transformation- reshaping and reimagining an organization's operations. 

service portfolio, business model, or mission accomplishment requires different 

skills and competencies from the workforce. Achieving strategic objectives, as well 

as accomplishing the specific objectives outlined in FIT ARA, requires sustained 

attention from a revitalized and revamped workforce - retraining may not sut1iee. 

The focus of workforce transf(Jrmation must be on what is needed for the future, 

not just reducing what they have now. Otherwise, agencies will miss deadlines and 

strategic opportunities. 

b. What are the implications to .foderal IT more broadly if data center optimization 

and closure e.ffhrts are not completed in accordance with either the current 

time line set forth in FITARA, and any future time lines should Congress extend 

any of the deadlines? 

The continued drag on IT funds imposed by - among other factors - a persistent 

inventory of data centers would be insidious. We already highlighted1 the 

significant portion of the federal IT budget consumed by operations and 

maintenance (O&M) of current services. Furthermore, GAO has noted the 

continuous growth of O&M expenditures concurrent with a continuous reduction 

in strategic investment in development. modernization, and enhancement (DME). 

A significant portion of the O&M growth is the effect of the myriad purpose-built, 

mismatched, and/or outdated systems and applications that depend on substantial 

contractor support every time new functionality is needed, and not necessarily just 

because of data centers. Enactment of the Modernizing Government Technology 

(MGT) Act, combined with other existing flexible financing authorities, could help 

restore a healthier balance between O&M and DME by addressing the application 

inventory that complicates the data center optimization efforts. However, the ability 

1 See the IT Dashboard. and Gartner's 2017 CIO Agenda: i\ Gtl\ernment PcrspcctiYc and IT Budget and 

Benchmarking Sunn 

2 
77 


KING-6430 with DISTILLERInsert offset folio 49 here 26560.049

to act decisively requires a cogent mission- and outcomes-based strategy. Carrying 

a large data center inventory indefinitely, combined with a growing "technical 

debt" in legacy modernization, is an unsustainable combination. The shift from 

"data center consolidation" to "data center optimization" should have sent a signal 

to federal agencies to look beyond their physical footprint and focus on cloudenabled opportunities. Some smaller ledera\ agencies (e.g., the International Trade 

Administration and the Federal Communications Commission) have used deadlinedriven approaches to eliminate their data center footprint entirely within 2 years or 

less, with attendant reduction in O&M expenditures and resultant greater 

operational flexibility. Absent a similar sense of urgency, and without a greater 

level of agency business and mission ownership and accountability for overall costs 

of agency operations, the federal government risks continuing to bear an 

unsustainable level of fiscal constraints. 

2. This past April, the Office of Management and Budget (OMB) replaced the President's 

hiring freeze with a memorandum directing agencies to, "{i]dentifo workforce reductions 

over a four-year period ... consistent with discretionary outyear levels included in the FY 

2018 budget." If agencies take a broad approach to OMB 's workforce reduction 

directive and make across-the-board reductions to their workforce. what risks does such 

an approach pose to the federal government's efforts to improve in the area of IT 

acquisitions and modernization? 

Applying an across-the-board reduction would represent substantial risk, and not just in IT 

acquisition and modernization. With submission of high-level draft Agency Reform Plans 

due June 30, and submission of Agency Refonn Plans expected in fall 2017, agencies may 

be inclined to revert to historic instincts and apply non-strategic. "shared pain" approaches, 

equally distributing cuts across a workforce. Strategically assessing agency missions, 

functions, and services, and deciding which ones to enhance, downsize, streamline, 

consolidate, or discontinue - potentially in collaboration with other agencies in crosscutting fashion- are deliberations in which C!Os should be included as key participants. 

Agency heads must consider IT-enabled business efficiencies and invest accordingly, and 

take a risk-based approach to assessing the impacts of cutting IT services indiscriminately. 

Early indications have been that while CFOs and CHCOs (as keepers of money and people) 

have been invited to identify reform opportunities, C!Os have not. That omission not only 

risks missing technology-enabled opportunities, it also risks insufficiently considering the 

relationship of IT to agency operations. It not only jeopardizes goals for improved IT 

management and modernization. it also neglects opportunities for efficiency through ITenabled automation, improved operations through more effective use of technology. and 

cross-agency consolidation, collaboration and co-creation of reinvented and reimagined 

service delivery. Moreover, without adequate consideration of IT's role in agency 

operations and preserving a fully functional IT organization, agencies place their 

operations at heightened risk for system and service outages, compromise, and/or failure. 

3 
78 


KING-6430 with DISTILLERInsert offset folio 50 here 26560.050

Lastly, in light of the technology-enabled opportunities OMB invited and encouraged in 

M-17-22, thoughtful and strategic approaches to Agency Reform Plans should show 

evidence of expansion and enhancement of critical IT and IT -related functions. 

CEB (now Gartner) research on federal IT talent trends indicates that significant cuts in the 

IT workforce could have unintended consequences to modernization efforts. One study, 

the IT Talent Dashboard, indicates that 52% of the federal IT workforce is over the age of 

50, but only 9% of the federal IT workforce is less than 35 years old. These workers under 

the age of 35, often called Millennials, represent 34% of the total US workforce and a 

significant share of private sector firms' IT departments. One potential risk is that hiring 

freezes and IT workforce reductions could exacerbate generational workforce trends and 

create capacity gaps for retained staff with the skills to manage modern IT systems on 

modern IT platforms. 

3. In your written testimony for the hearing, you stated that "[ajgency heads, of course, 

must also recognize the importance of and prioritize accordingly. recruitment. retention. 

and development ofa competent workforce. " 

a. What best practices should agency heads follow for recruiting, retaining. and 

developing an effective and sustainable !Tworkforce 7 

Gartner's research on recruiting, retaining, and developing an IT workforce (see 

Overview of How to Plan, Recruit. Develop and Retain a Skilled IT Workforce) 

has identified several recommended practices, including how to: plan for the profile 

of IT talent that meets business needs; recruit top IT talent to build a highperforming IT organization; and develop and retain an IT workforce to continually 

drive competitive advantage. Similarly, our Value-Focused HR for transforming 

public sector HR advocates a similar approach, particularly in light of public sector 

resource challenges and when federal agencies have been facing workforce 

reductions. 

CEB (now Gartner) also contributed to the White House's TechHire Initiative and 

developed an Employer Playbook, designed specifically to help federal agencies 

and private sector employers better attract and retain IT talent from non-traditional 

sources. The Employer Playbook features real-world best practices of effective 

approaches to onboarding and retaining employees for tech positions across 

different industries. Our playbook is publicly available and profiles exemplar 

organizations that hire successfully from nontraditional sources and we 

documented their approaches for the benefit of other employers. 

Ultimately, successfully managing a competent workforce through a period of 

change requires a conscious, strategic approach: 

• Prioritize critical roles by understanding business and mission strategy and 

IT's role in it, and identifying critical capabilities and roles; 

4 
79 


KING-6430 with DISTILLERInsert offset folio 51 here 26560.051

• Project potential gaps through forecasting of talent needs, projecting 

potential shortfalls, and managing succession risks; 

• Mitigate risk areas through scenario planning and creating options 

(including development, advancement, and alternative staffing models) for 

employees and the organization; and 

• Engage with employees to promote effective communication and involve 

the workforce. 

b. What recommendations would you have for Congress for improving the ability of 

agencies to hire and retain the IT workforce needed to fully address the 

challenges agencies are facing in the area of IT acquisitions and modernization? 

There is already a broad portfolio of tools and statutory authorities available for 

federal agencies: Presidential Innovation Fellows; other existing excepted service. 

direct-hire. and similar hiring authorities as well as recruitment and retention 

incentives, including cybersecuritv hiring authorities; FITARA (and specifically 

Expansion of Training and Use of IT Cadres), and the Program Management 

Improvement Accountability Act (PMIAA, and its requirements for program and 

project management personnel standards). Creative approaches to acquisition 

including both "incubators" like the DHS Procurement Innovation Lab and the 

HHS Buvers Club, and more systemic initiatives like the TechFAR and GSA's 

Category Management- have been promising although not formally codified, and 

need to be sustained. Adding further legislation may be counterproductive, in light 

of existing authorities and tools. However, oversight of the use of these authorities, 

in an integrated fashion, would provide more insights into the level of their 

government-wide adoption and implementation, and should help create a broader 

understanding ot: and comfort with, the tools already at agencies' disposal. OMB 

added a requirement that federal agencies adopt additional elements in their human 

capital plans around acquisition, IT, and program management skills, intended to 

encourage maximum use of existing authorities. Greater elaboration on the 

"yes/no" responses sought by OMB could atTord an opportunity for a deeper 

discussion with agencies about the maturity of their human capital strategies and 

their level of adoption of available tools. Engaging agencies in a review of their 

human capital plans, their strategic talent deficits (particularly in IT, acquisition, 

program management, and finance), their efforts to close those gaps, the adequacy 

and sufficiency of the available authorities and llexibilities (and moreover the 

completeness of their understanding and use of them), should be an ongoing aspect 

of oversight of FIT ARA implementation. 

Agency heads, through their CIOs, ultimately need to set the standard of focusing 

on transfonnation and not just on infrastructure (or data center optimization). They 

need to empower and/or recruit CIOs with the skills and desire to pursue those 

5 
80 

Æ 


KING-6430 with DISTILLERInsert offset folio 52 here 26560.052

objectives, and reshape their workforce to give them the necessary capabilities and 

capacity. 

Thank you for the opportunity to provide additional clarification. 

Research Director 

6