U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

26–178 PDF 2017

THE FEDERAL INFORMATION TECHNOLOGY REFORM ACT (FITARA) SCORECARD 3.0: MEASURING AGENCIES IMPLEMENTATION 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

AND THE

SUBCOMMITTEE ON 

GOVERNMENT OPERATIONS 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

DECEMBER 6, 2016 

Serial No. 114–171 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://www.house.gov/reform 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

JASON CHAFFETZ, Utah, Chairman 

JOHN L. MICA, Florida 

MICHAEL R. TURNER, Ohio 

JOHN J. DUNCAN, JR., Tennessee 

JIM JORDAN, Ohio 

TIM WALBERG, Michigan 

JUSTIN AMASH, Michigan 

PAUL A. GOSAR, Arizona 

SCOTT DESJARLAIS, Tennessee 

TREY GOWDY, South Carolina 

BLAKE FARENTHOLD, Texas 

CYNTHIA M. LUMMIS, Wyoming 

THOMAS MASSIE, Kentucky 

MARK MEADOWS, North Carolina 

RON DESANTIS, Florida 

MICK, MULVANEY, South Carolina 

KEN BUCK, Colorado 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

JODY B. HICE, Georgia 

STEVE RUSSELL, Oklahoma 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GLENN GROTHMAN, Wisconsin 

WILL HURD, Texas 

GARY J. PALMER, Alabama 

ELIJAH E. CUMMINGS, Maryland, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STEPHEN F. LYNCH, Massachusetts 

JIM COOPER, Tennessee 

GERALD E. CONNOLLY, Virginia 

TAMMY DUCKWORTH, Illinois 

ROBIN L. KELLY, Illinois 

BRENDA L. LAWRENCE, Michigan 

TED LIEU, California 

BONNIE WATSON COLEMAN, New Jersey 

STACEY E. PLASKETT, Virgin Islands 

MARK DESAULNIER, California 

BRENDAN F. BOYLE, Pennsylvania 

PETER WELCH, Vermont 

MICHELLE LUJAN GRISHAM, New Mexico 

JENNIFER HEMINGWAY, Staff Director 

ANDREW DOCKHAM, General Counsel 

TROY D. STOCK, Information Technology Subcmmittee Staff Director 

JULIE DUNNE, Senior Counsel 

SHARON CASEY, Deputy Chief Clerk 

DAVID RAPALLO, Minority Staff Director 


KING-6430 with DISTILLER
(III) 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

WILL HURD, Texas, Chairman 

BLAKE FARENTHOLD, Texas, Vice Chair 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

PAUL A. GOSAR, Arizona 

ROBIN L. KELLY, Illinois, Ranking Minority 

Member 

GERALD E. CONNOLLY, Virginia 

TAMMY DUCKWORTH, Illinois 

TED LIEU, California 

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

MARK MEADOWS, North Carolina, Chairman 

JIM JORDAN, Ohio 

TIM WALBERG, Michigan, Vice Chair 

TREY GOWDY, South Carolina 

THOMAS MASSIE, Kentucky 

MICK MULVANEY, South Carolina 

KEN BUCK, Colorado 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GLENN GROTHMAN, Wisconsin 

GERALD E. CONNOLLY, Virginia, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STACEY E. PLASKETT, Virgin Islands 

STEPHEN F. LYNCH, Massachusetts 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(V) 

C O N T E N T S 

Page 

Hearing held on December 6, 2016 ........................................................................ 1 

WITNESSES 

Mr. David A. Powner, Director, IT Management Issues, U.S. Government 

Acountability Office 

Oral Statement ................................................................................................. 5 

Written Statement ............................................................................................ 8 

The Hon. Chip Fulghum, Deputy Under Secretary of Management and Chief 

Financial Officer, U.S. Department of Homeland Security 

Oral Statement ................................................................................................. 31 

Written Statement ............................................................................................ 33 

Mr. Luke J. McCormack, Chief Information Officer, U.S. Department of 

Homeland Security 

Oral Statement ................................................................................................. 40 

The Hon. Frontis B. Wiggins III, Chief Information Officer, Bureau of Information Resource Management, U.S. Department of State 

Oral Statement ................................................................................................. 41 

Written Statement ............................................................................................ 44 

Mr. Douglas Pitkin, Director of Budget and Planning, U.S. Department of 

State 

Oral Statement ................................................................................................. 51 

Written Statement ............................................................................................ 53 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

THE FEDERAL INFORMATION TECHNOLOGY 

REFORM ACT (FITARA) SCORECARD 3.0: 

MEASURING AGENCIES IMPLEMENTATION 

Tuesday, December 6, 2016 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY, JOINT

WITH THE SUBCOMMITTEE ON GOVERNMENT OPERATIONS, 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, 

Washington, D.C. 

The subcommittees met, pursuant to call, at 2:00 p.m., in Room 

2154, Rayburn House Office Building, Hon. Tim Walberg presiding. 

Present from the Subcommittee on Information Technology: Representatives Hurd, Farenthold, Walker, Blum, Gosar, and Kelly. 

Present from the Subcommittee on Government Operations: Representatives Walberg, Carter, Grothman, Connolly, Maloney, 

Chaffetz and Plaskett. 

Mr. WALBERG. The Subcommittee on Information Technology and 

the Subcommittee on Government Operations will come to order. 

Without objection, the chair is authorized to declare a recess at 

any time. 

In fiscal year 2017, the Federal Government plans to invest more 

than $89 billion on IT. This is a significant area of Federal spending that requires Congress’ attention. We focus so much attention 

on Federal IT acquisition and management because it’s simply important to everything agencies do and because IT acquisition remains on the GAO high-risk list. 

I would like to acknowledge that there has been progress. The 

GAO has reported that, as of October 2016, OMB and Federal 

agencies have fully implemented about 46 percent of about 800 

GAO recommendations that led to this area being put on the highrisk list. Now this hearing continues this committee’s oversight of 

agencies’ implementation of FITARA. In fact, this is the third 

FITARA scorecard hearing, or, as we like to call it, ‘‘FITARA Scorecard 3.0.’’ 

After today, we will have heard testimony from nine agencies. 

The scorecard, which the committee developed with assistance from 

GAO, continues to use the same key areas— data center consolidation, IT portfolio review savings, risk-assessment transparency, and 

incremental development—for purposes of measuring agencies 

FITARA implementation. 

There has been progress in the grades: 12 agencies improved 

their grade; 11 stayed the same; and 1 agency’s grade declined. I 

would also note that NASA, which was one of the agencies at our 


KING-6430 with DISTILLER
2 

May 2016 FITARA hearing, improved from two straight Fs to a Cplus. DHS improved its FITARA grade from a C to a B-minus. 

State’s grade declined slightly from a D to a D-minus. In fiscal year 

2016, DHS spent $6.2 billion while State spent 2 billion on IT. 

FITARA provides a critical tool to effectively manage these IT investments. We’ll continue our FITARA oversight in the next Congress, and I commend Mr. Hurd for his leadership on this oversight. 

I now want to recognize Ms. Kelly, ranking member of the Subcommittee on Information Technology, for her opening statement. 

Mr. KELLY. Thank you. 

As this session of Congress draws to an end, I want to thank 

Chairman Hurd, Chairman Meadows, and Ranking Member 

Connolly for your leadership and partnership during the 2 years 

our subcommittees have been working together to monitor how 

Federal agencies manage their information technology projects. In 

that timeframe, our subcommittee has held extensive hearings that 

examine the state of IT at almost every Federal agency and heard 

testimony from the majority of Federal chief information officers on 

the challenges they face in overhauling the management of IT resources. 

Our subcommittees also worked together to develop our very own 

scorecard for grading agency progress and implementing the requirements of the Federal Information Technology Acquisition Reform Act, or FITARA. 

Last November, we released the first of these scorecards and 

held our first hearing to discuss the grades of three agencies. Since 

then, our subcommittees have released updated scorecards at least 

twice a year and held hearings with different agencies to hold them 

accountable for implementing the FITARA provisions. Since we 

first began conducting oversight over the 24 agencies FITARA covers, we have already seen a marked improvement with several of 

those agencies. 

For example, since the release of our last scorecard, NASA’s overall grade went from F to a C-plus. The Department of Education 

and Energy also showed substantial improvement since the last 

scorecard going from an F to a C. Overall, since May of this year, 

12 agencies have shown improvement in their overall grades. 

Looking beyond the grades, I am encouraged by the responsiveness of most agencies and their progress to date in FITARA implementation. Notably, governmentwide data center consolidations 

alone have realized over 1.6 billion in savings. These are all good 

first steps, but it’s clear that there remain obstacles to overcome 

in implementation. The new scorecard shows that some agencies 

have hit roadblocks, that some have fallen behind in implementation. 

I believe that our oversight hearings have helped improve accountability of IT management in Federal agencies. I believe hearings like these will be as important next year, and I hope there will 

be bipartisan interest in holding the next administration to the 

same high standards we have held the current administration. 

The stakes are simply too high when it comes to improving the 

efficiency and security of the Federal Government’s IT systems. 

The Federal Government’s IT acquisition process isn’t just an inefVerDate Nov 24 2008 13:22 Jul 21, 2017 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 H:\26178.TXT APRIL

KING-6430 with DISTILLER
3 

ficient use of taxpayers’ money. It also poses a security risk as too 

many agencies are still having to rely on outdated legacy IT systems that, with each passing year, cost more and more to secure 

and maintain. 

I want to thank the witnesses for testifying today. I know that 

an overhaul of your IT acquisition and management is not an easy 

task, so I look forward to hearing how your agencies are handling 

the challenges in implementing FITARA. 

Thank you, Mr. Chair, and I yield back. 

Mr. WALBERG. I thank the gentlelady. 

And now I recognize Mr. Connolly, ranking member of the Subcommittee on Government Operations, for his opening statement. 

Mr. CONNOLLY. Thank you, Mr. Chairman. 

And I thank my co-collaborator, Ms. Kelly, for her leadership, 

Mr. Hurd, and Mr. Meadows. The four of us have tried to act as 

one in terms of oversight, and I think that’s been pretty effective, 

and we’re going to continue to do the same in the 115th Congress, 

so look forward to working with you again, Ms. Kelly. 

I think oversight by the two subcommittees of the Federal Information Technology Acquisition Reform Act, better known as IssaConnolly, is really important because that didn’t happen in its 

predecessor legislation known as Clinger-Cohen. Our bipartisan 

legislation represents the first major reform of laws governing Federal IT management since 1996. 

When I was chairman of Fairfax County just across the river, I 

used to tell our staff we needed three things to be successful: We 

needed a clear mission. We needed passion for that mission. And 

we needed metrics to measure progress on that mission. 

With FITARA’s passage, we clarified the mission, and these 

scorecards, I believe, give us the metrics to try to see how we’re 

doing and to keep the pressure on ourselves to implement. 

I’m pleased to see these subcommittees continuing to exercise its 

oversight responsibility. Since our last hearing in May, I, like Ms. 

Kelly, am encouraged by how quickly the administration and the 

majority of Federal agencies have in fact embraced the effort. I appreciate the leadership of Federal CIO Tony Scott and the Office 

of Management and Budget, and the GAO, Mr. Powner and Gene 

Dodaro in particular. I hope for continued leadership in the new 

administration and a renewed focus on implementation. 

As I stated at that hearing in May, the results of the scorecard 

should not be seen as some kind of scarlet letter on the backs of 

agencies but rather a guidepost, a milestone on the path toward 

self-improvement. The scorecard process ought to be dynamic, continually incorporating stakeholder feedback with the possibility of 

eventually including all seven pillars of FITARA. 

We received favorable feedback from agency CIOs on the components of the scorecard, but we do recognize that there is always 

room to improve the metrics that are used to determine agency 

progress. The enormous amount of feedback we’ve received has 

proved that agencies are taking FITARA seriously. 

Charged by Congress to provide quarterly progress reports, the 

GAO examined OMB’s steps to consolidate data centers, enhance 

agency transparency, and implement incremental development. 

These metrics were selected because their implementation will 


KING-6430 with DISTILLER
4 

have a demonstrable benefit on IT acquisition and operation, and 

this data is updated and available on a quarterly basis. 

The scorecard is a tool of both congressional oversight of FITARA 

and CIO empowerment. FITARA requires CIOs to certify that IT 

investments are adequately implementing incremental development. We wanted to include CIO authorities in the scorecard because this will tell us if CIOs are being given the tools to succeed, 

and if they are not, then that becomes either an issue of additional 

congressional oversight or a foothold for CIOs to assert themselves 

under the law. It’s important that Congress continue its oversight 

and urge OMB to clarify its guidance directing agencies to make 

information about major IT investments publicly available. 

On a related front, I was proud to join my friend Will Hurd in 

introducing the Modernizing Government Technology Act. The bill 

makes a significant upfront investment to retire vulnerable largescale legacy systems affecting multiple agencies. The bill allows 

agencies to use savings generated through FITARA and other reforms to make investments in cloud transition. 

The act passed easily through this committee and on the House 

floor. Unfortunately, because of a last-minute CBO scoring issue— 

the priesthood of the CBO, Mr. Chairman, is one that mystifies all 

of us, and the infallibility we invest the CBO with would make the 

Pope in Rome envious. I would like to express some concern on a 

different issue with the lack of perceived support for FITARA implementation many CIOs have experienced within their agencies 

because of leadership squishiness, if one could call it that. 

I find it unacceptable for any of the agencies to be working 

against the intent of FITARA. Secretaries of agencies and division 

heads and likewise ignoring the critical role of CIOs in FITARA implementation and in directing IT investment defeats the very purpose of the law. We found that some agencies are struggling to elevate the CIO position to its appropriate management level. 

I look forward to hearing from the Department of Homeland Security and the Department of State today about their efforts to 

streamline CIO reporting authorities, and this is an issue that will 

carry through in the next Congress with the next administration. 

It’s not going to go away. 

Finally, I was pleased to see that DHS surpassed its savings goal 

by reporting $248 million from consolidation of data centers. However, I have concern about the Department’s lack of a strategic 

plan. It was also disappointing to see that the State Department 

reported zero savings from data center consolidation or IT portfolio 

review. Strange, Mr. Wiggins and Mr. Pitkin. We certainly look forward to an explanation of that. 

State has also underperformed in assessing the risk in its major 

IT investments. I look forward to working with Mr. Wiggins to improve that performance moving forward. 

And, with that, Mr. Chairman, I yield back. Thank you. 

Mr. WALBERG. I thank the gentleman. 

I’ll hold the record open for 5 legislative days for any members 

who would like to submit a written statement, but now we recognize our panel of witnesses. 

I’m pleased to welcome back in front of us, Mr. David Powner, 

Director of IT Management Issues at the U.S. Government AcVerDate Nov 24 2008 13:22 Jul 21, 2017 Jkt 000000 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 H:\26178.TXT APRIL

KING-6430 with DISTILLER
5 

countability Office; the Honorable Chip Fulghum, Deputy Under 

Secretary of Management and Chief Financial Officer at the U.S. 

Department of Homeland Security; Mr. Luke McCormack, Chief Information Officer at the U.S. Department of Homeland Security; 

the Honorable Frontis Wiggins, III, Chief Information Officer at 

the Bureau of Information Resource Management at the U.S. Department of State; and Mr. Douglas Pitkin, Director of Budget and 

Planning at the U.S. Department of State. 

Welcome to you all. Pursuant to committee rules, all witnesses 

will be sworn in before they testify, so if you would please rise and 

raise your right hands. 

Do you solemnly swear or affirm that the testimony you are 

about to give will be the truth, the whole truth, and nothing but 

the truth? 

Thank you. You may be seated. Let the record reflect that the 

witnesses all answered in the affirmative. 

In order to allow time for discussion, we would appreciate it if 

you would please limit your testimony to 5 minutes. Your entire 

written statement will be made part of the record. 

And so now it’s my pleasure to recognize Mr. Powner for your 5 

minutes of testimony. 

WITNESS STATEMENTS 

STATEMENT OF DAVID A. POWNER 

Mr. POWNER. Chairman Walberg, Ranking Members Kelly, 

Connolly, and Mr. Farenthold, I’d like to thank you and your staff 

for your continued oversight on implementation of FITARA with 

this third set of grades. Clearly, we have seen improvements over 

the past 2 years from several agencies. 

The 800 recommendations GAO has made on our IT high-risk 

area are associated with many of the FITARA areas, are about 46 

percent addressed. That’s a substantial increase from last year. 

Your latest set of grades has 12 agencies improving, 11 staying the 

same, and 1 lower. Your oversight has been critical here. 

Take, for example, NASA, one of your witnesses at your last 

hearing for receiving the only F, now receiving a C-plus. NASA has 

made great strides in the data optimization area, and Renee Wynn 

deserves much credit. 

I’d like to emphasize the criticality of the four areas this committee is focused on. Although there has been progress, we still 

have too many acquisitions that use a waterfall approach; too many 

duplicative systems; transparency of IT spending isn’t as accurate 

as we need; and we have data centers that are far from being optimized. 

Let’s look at the data center situation. For the first time, we finally see inventory stabilizing around 10,000 centers. We have 

closed just over 4,300 centers. And five agencies have closed more 

than 50 percent of their centers. These are Ag, Justice, Treasury, 

GSA, and NASA. There are about another 1,300 centers planned to 

be closed. Although the closures look good, savings and meeting optimization metrics don’t. 

Our last report in my testimony highlights the fact that agencies 

have saved about $3 billion to date and another $5 billion was 


KING-6430 with DISTILLER
6 

planned. New reporting required in FITARA and to OMB is incomplete and only showing less than $500 million in outyear savings, 

a tenth of what it should be. 

Our ongoing work for this committee will be making recommendations to address this to ensure that we save at least $5 

billion so that we can use this for critical modernization needs. We 

actually believe there is more savings than the $5 billion, taking 

into account agencies’ limited progress toward meeting the five optimization metrics. 

The new grading area associated with whether the CIO reports 

to at least the DepSec is a good start towards delving into CIO authorities more completely. In fact, agencies’ CIO self-assessments to 

OMB are higher on average if they report to the agency head. 

We have ongoing work for this committee on CIO authorities 

that could further inform comprehensive grading and oversight in 

this area. Clearly, CIO authority is still a mayor issue at departments and agencies. 

As we have discussed, Mr. Chairman, there is even more this 

committee could do to help CIOs with their authorities. The first 

is ensuring that CIOs have full support from the heads of departments and agencies. We think your suggestion that the heads of 

agencies be asked to testify at these FITARA hearings in the next 

Congress is a good one. 

The Comptroller General, Gene Dodaro, held a forum recently on 

our IT high-risk area and FITARA that Chairman Hurd and Ranking Member Connolly participated in that we thank you for, along 

with former and current Federal and agency CIOs. We will soon be 

publishing the results of this forum. 

One of over 200 key things that came out of that session was the 

need for top agency support regarding cyber and IT issues. Another 

area that this committee should consider is the IT workforce under 

the CIO. We issued a report 2 weeks ago for this committee that 

showed agencies need to do a better job assessing their IT staffing 

needs by performing gap assessments and putting in place plans to 

bolster the IT workforce. Enhancements to your scorecard and 

FITARA oversight in the next Congress, we believe, should be focused on critical targeted areas. This starts with ensuring CIOs 

have support from the top. 

Next, we need qualified and accountable CIOs. By ‘‘accountable,’’ 

we mean those that welcome the strength in CIO authorities and 

this committee’s oversight and assistance in strengthening those 

authorities. 

Then we need a stronger, more robust IT workforce under the 

CIO. This would include the needed influx of private sector talent 

that is more integrated into the Federal IT workforce because at 

times the current efforts at the White House and GSA are a bit too 

much of a we-versus-them mentality. So, in addition to bolstering 

top support, strengthening CIO authorities in the IT workforce, we 

believe there needs to be better transparency, more incremental 

and agile development, and more efficient legacy spending. On the 

legacy side, we still need to focus on eliminating wasteful duplicative spending and optimizing our data centers, which would include 

far greater cloud adoption. 


KING-6430 with DISTILLER
7 

Despite the billions already saved, there are billions of dollars 

still on the table that can be saved that are directly tied to your 

scorecard. These savings can be used to modernize and perhaps fill 

agencies’ working capital funds that this committee has introduced. 

Thank you, again, for your oversight, and I look forward to your 

questions. 

[Prepared statement of Mr. Powner follows:] 


KING-6430 with DISTILLER
8 


KING-6430 with DISTILLERInsert offset folio 1 here 26178.001
9 


KING-6430 with DISTILLERInsert offset folio 2 here 26178.002
10 


KING-6430 with DISTILLERInsert offset folio 3 here 26178.003
11 


KING-6430 with DISTILLERInsert offset folio 4 here 26178.004
12 


KING-6430 with DISTILLERInsert offset folio 5 here 26178.005
13 


KING-6430 with DISTILLERInsert offset folio 6 here 26178.006
14 


KING-6430 with DISTILLERInsert offset folio 7 here 26178.007
15 


KING-6430 with DISTILLERInsert offset folio 8 here 26178.008
16 


KING-6430 with DISTILLERInsert offset folio 9 here 26178.009
17 


KING-6430 with DISTILLERInsert offset folio 10 here 26178.010
18 


KING-6430 with DISTILLERInsert offset folio 11 here 26178.011
19 


KING-6430 with DISTILLERInsert offset folio 12 here 26178.012
20 


KING-6430 with DISTILLERInsert offset folio 13 here 26178.013
21 


KING-6430 with DISTILLERInsert offset folio 14 here 26178.014
22 


KING-6430 with DISTILLERInsert offset folio 15 here 26178.015
23 


KING-6430 with DISTILLERInsert offset folio 16 here 26178.016
24 


KING-6430 with DISTILLERInsert offset folio 17 here 26178.017
25 


KING-6430 with DISTILLERInsert offset folio 18 here 26178.018
26 


KING-6430 with DISTILLERInsert offset folio 19 here 26178.019
27 


KING-6430 with DISTILLERInsert offset folio 20 here 26178.020
28 


KING-6430 with DISTILLERInsert offset folio 21 here 26178.021
29 


KING-6430 with DISTILLERInsert offset folio 22 here 26178.022
30 


KING-6430 with DISTILLERInsert offset folio 23 here 26178.023
31 

Mr. WALBERG. I thank the gentleman. 

And now I recognize Mr. Fulghum for your 5 minutes of testimony. 

STATEMENT OF THE HONORABLE CHIP FULGHUM 

Mr. FULGHUM. Chairman Walberg, Ranking Member Kelly, 

Ranking Member Connolly, and members of the subcommittee, 

thank you for the opportunity to talk to you today about the 

progress the Department of Homeland Security has made in implementing FITARA. First, I’d like to say how proud I am of the expertise and hard work of our employees, who have taken many 

steps to ensure that FITARA is fully implemented. 

It is my privilege to serve with such dedicated folks. I’m proud 

to say that there is a true collaboration between myself and Mr. 

McCormack who is a recognized leader in the Federal CIO community. In addition, we also work closely with the CIOs and CFOs at 

our components to increase integration throughout the agency. 

While we’re pleased with our progress, we recognize much more 

needs to be done to mature and strengthen our process. Since the 

Department was stood up, we’ve been working toward greater integration, transparency, and effectiveness of our IT systems. For example, we have tracked IT investment in our system of records 

since 2010 and worked closely with the CIO on several major initiatives to improve the health of our IT infrastructure. We saved 

money by focusing on more efficient ways of doing business, consolidating when it makes sense, and making strategic sourcing a 

priority. 

I applaud FITARA for reinforcing good government principles, 

ensuring accountability, and reenergizing our efforts. IT is a critical important aspect of the DHS mission space, and we are committing to get an A on the scorecard. With your continued support 

and working together across the Department, we’ll get to the top 

of the class. 

To improve, we will continue to incorporate and empower the 

CIO in our resource planning and programming actions. IT is a 

critical part of the DHS operation and touches most programs. As 

such, CIO’s input and insights are necessary throughout the planning, programming, budgeting, and execution process. 

The CIO exercises a significant role in resource decisionmaking 

for all programs that include IT resources, and we will continue to 

strengthen that role. This is also codified in our Department’s management directives. 

During our annual program and budget review, component CFOs 

and CIOs jointly provide a complete picture of IT spending and 

their component. These inputs are aggregated at the Department 

level in order to provide senior leadership with a comprehensive 

picture of IT funding needs, making sure we use the most of our 

limited resources efficiently and effectively. 

Under the leadership of the Under Secretary for Management, 

our integration is not just a close partnership between the CFO 

and the CIO but also includes a chief human capital officer, chief 

procurement officer, and the acquisition community both at the 

headquarters and at the components. The Secretary’s Unity of Effort initiative focused our efforts on institutionalizing former procVerDate Nov 24 2008 13:22 Jul 21, 2017 Jkt 000000 PO 00000 Frm 00037 Fmt 6633 Sfmt 6633 H:\26178.TXT APRIL

KING-6430 with DISTILLER
32 

esses, procedures, and operational structures that integrate component strengths in a coordinated effort to protect our homeland. We 

built a strong foundation through the Unity of Effort, and we’ll use 

that foundation to keep making improvements in the Department’s 

operations as well as its management. 

Our CIO will continue to be consulted in any and all situations 

where needed. Whether it’s an issue to be negotiated between the 

lines of business or components or a topic that requires the Secretary’s attention, our CIO is always a full and trusted participant 

in any discussion that has an IT element. Our CFO and CIO counsels work in close cooperation all year long, not just at budget time. 

Ultimately, we’re institutionalizing how our lines of business 

work together to strengthen resource requests and demonstrate 

links to mission outcomes. Although we’ve made significant 

progress, we will continue to collaborate closely across communities 

to further strengthen our ability to properly manage the Department’s IT portfolio. We fully recognize that IT is foundational to 

the success of our mission. 

Thank you, and I welcome the opportunity to answer any questions you may have. 

[Prepared statement of Mr. Fulghum follows:] 


KING-6430 with DISTILLER
33 


KING-6430 with DISTILLERInsert offset folio 24 here 26178.024
34 


KING-6430 with DISTILLERInsert offset folio 25 here 26178.025
35 


KING-6430 with DISTILLERInsert offset folio 26 here 26178.026
36 


KING-6430 with DISTILLERInsert offset folio 27 here 26178.027
37 


KING-6430 with DISTILLERInsert offset folio 28 here 26178.028
38 


KING-6430 with DISTILLERInsert offset folio 29 here 26178.029
39 


KING-6430 with DISTILLERInsert offset folio 30 here 26178.030
40 

Mr. WALBERG. Thank you, Mr. Fulghum. 

I now recognize Mr. McCormack for your testimony. 

STATEMENT OF LUKE J. MCCORMACK 

Mr. MCCORMACK. Chairman Meadows, Chairman Hurd, Ranking 

Member Kelly, Ranking Member Connolly, and members of the 

subcommittee, thank you for the opportunity to appear before you 

today to share the Department of Homeland Security’s progress on 

implementation of the Federal Information Technology Acquisition 

Reform Act. 

I would like to start by providing you with some key background 

on the management and oversight of Federal information technology at the Department of Homeland Security. In 2007, DHS instituted the information technology acquisition review process, 

which enables the DHS CIO to review and effectively guide all 

agency IT expenditures above $2.5 million to ensure their alignment with DHS missions, goals, policy, and guidelines. In 2011, 

DHS implemented an enterprise approach to the delivery of IT 

services that leverage strategic sourcing and shared services. 

In 2014, simultaneous with Congress’ work on FITARA, the Office of the CIO began to adopt a new IT business model, which was 

implemented in 2015 and has brought about initial results 

throughout 2016. Rather than procure, engineer, and implement 

our own products, we have begun to take advantage of emerging 

service-based technologies and develop multiple strategy partnerships, including with Federal shared service providers, along with 

public and private cloud service providers. 

This open-market strategy, which fosters continued competition, 

allows all DHS to gain access to a variety of world-class services 

while keeping costs low and time to market short. FITARA is helping with all of this. 

At DHS, we used a phased implementation approach for 

FITARA. In 2015, our planning year, the DHS OCIO established 

a comprehensive self-assessment report that indicated how well 

DHS aligned to each of the core FITARA requirements, identified 

current gaps, and outlined how DHS would ensure that all FITARA 

requirements are fully executed. We also updated the DHS IT strategic plan in 2015, which was in strong agreement with the goals 

and objectives of FITARA. 

This year, 2016, was the year of FITARA implementation at 

DHS. To lead the Department through the FITARA transformation, 

we strengthened the Office of the CIO. DHS now has a second deputy CIO, a chief technology officer with elevated responsibilities, 

and a newly formed DHS digital services team. This talent, which 

was all obtained from the private sector, has joined our leadership 

team, and they are playing a key role in transforming how we deliver critical IT services. 

FITARA places strong emphasis on maintaining workforce skills 

in a rapidly developing IT environment and recruiting and retaining IT talent. Efforts are under way at DHS to identify gaps between current and future skill needs to ensure employees are effectively developed. The Department is also looking to maximize the 

appropriate use of hiring authorities and flexibilities to attract diverse and highly skilled candidates. 


KING-6430 with DISTILLER
41 

On July 27 and 28 of this year, OCIO partnered with both the 

chief human capital officer and the chief security officer communities across DHS as well as the Office of Personnel Management 

to support the first ever Department-wide cyber and technology 

hiring fare. This 2-day event generated more than 14,000 applications, and the Department made more than 400 prospective job offers. 

DHS is in compliance with FITARA for conducting and submitting risk assessments for its 92 major IT investments. We 

proactively support these programs, and if any of them are rated 

as high risk for 3 consecutive months, we conduct a TechStat accountability session, which is a deep-dive review to address the root 

cause and get programs back on track. 

To advocate incremental development as the preferred development approach for applications and projects, we published the DHS 

Agile Instruction and Guidebook, established the DHS Agile Center 

of Excellence, and are in the process of conducting five pilots on 

programs in various stages of their lifecycle and across multiple 

DHS operating components. These pilots are helping the Department to mature best practices to ensure we consistently and predictably deliver solutions that meet our mission operator needs. In 

2017, we will continue our consolidation efforts, having consolidated and closed 41 of 102 data centers per the Federal Data Center Consolidation Initiative inventory. 

We are also working to provide key strategic sourcing vehicles 

that allow and encourage access to modern technologies and services. Two prime examples are ECS and FLASH. Through Flexible 

Agile Support for the Homeland, or FLASH, we are able provide 

DHS components with highly qualified agile teams focused on deploying IT capabilities quickly and securely to support their missions. Enterprise Computing Services, or ACS, is designed to provide easy open-market access to leading cloud technology providers. 

This will allow for components to purchase infrastructure-as-a-service and platform-as-a-service offerings in order to meet critical infrastructure needs in a flexible and cost-effective fashion. ECS and 

FLASH form significant building blocks for the Department service 

delivery model. 

In closing, while the Department continues to head in the right 

direction, we recognize there is still work remaining to achieve full 

implementation of FITARA. I would like to thank you for your continued support and your commitment to helping us achieve the 

goals of FITARA. DHS looks forward to working with you and our 

partners to continue to increase the value of IT acquisitions and 

better enable our mission through effective and efficient implementation of FITARA. I am happy to answer your questions. 

Mr. WALBERG. Thank you, Mr. McCormack. 

I now recognize Mr. Wiggins for your testimony. 

STATEMENT OF THE HONORABLE FRONTIS B. WIGGINS III 

Mr. WIGGINS. Chairman Hurd and Meadows, Vice Chairman 

Walberg, Ranking Members Kelly and Connolly, and distinguished 

members, thank you for inviting me to testify before the committee 

on the Department of State’s progress on its Federal Information 

Technology Acquisition Reform Act implementation. 


KING-6430 with DISTILLER
42 

I want to start by expressing my appreciation for the legislation. 

FITARA reinforces the Department’s longstanding efforts to be collaborative, transparent, and forward-thinking in how we use and 

acquire information technology. These focus areas are central to 

how the Department manages IT as a whole. 

Today, I would like to share with you how the Department approaches IT management and some recent successes. We will continue our success with the right processes, people, and tools in 

place, all of which are well aligned with FITARA’s provisions. However, we recognize that more can be done, and we will build on 

these successes and apply lessons learned to overall IT management. 

Over the past 5 months in my new role as CIO, I am working 

to strengthen the established relationships with my peers in acquisitions, human resources, and budget and planning. My focus has 

been on frequent and open communication, collaboration, and 

transparency. This approach to IT management helps us address 

the realities we face with fast-moving technology, risk from cyber 

threats, and the ongoing need to use our funding wisely. 

Like all agencies, we must tailor our IT to best meet our mission 

needs. We have a distinctive global foreign affairs mission, which 

is reflected in the Department’s organizational structure. Within 

this environment, we mapped out an approach to FITARA implementation that works best for us. 

We work in a global environment, in places no other civilian 

agency operates, including areas with limited access to Internet. 

We maintain hundreds of applications and provide around-theclock IT services, domestically and abroad. We serve 275 posts 

worldwide, including 24 Federal agencies under Chief of Mission 

authority. 

More than 100,000 computers throughout the world are connected to our networks, and 38,000 mobile devices allow on-demand communications for users globally. We drive the Department’s IT programs and resources and maximize value to our users 

who are increasingly mobile. 

We just completed our IT strategic plan for fiscal years 2017 to 

2019. We drafted the plan collaboratively with leaders from 

throughout the Department. This collaboration is not insignificant. 

It is the foundation for our approach to IT management. Let me 

provide an example to illustrate how this collaborative approach is 

benefitting our FITARA implementation. 

Our first step to FITARA involved close coordination between the 

CIO’s office and the Bureau of Budget and Planning. We consciously focused on this first because it provides the foundation for 

budget execution and acquisitions processes. I am proud to highlight that we have made significant progress in intertwining the 

budgeting process with IT management, both at a high level and 

at the working level. 

My office and the Bureau of Budget and Planning improved visibility and IT spending, for example, and jointly certified the fiscal 

year 2017 and fiscal year 2018 IT budget submission. Additionally, 

the Bureau of Budget and Planning has become a regular contributor to our internal FITARA working group meetings, and we have 


KING-6430 with DISTILLER
43 

partnered with them to strengthen guidance for requesting IT resources. 

My office also continues to strengthen its relationship with the 

Office of Acquisition Management within our Bureau of Administration. I work collaboratively with the chief acquisition officer to 

bring IT management and acquisitions management together 

through senior-level meetings and through collaboration on IT governance. 

The chief acquisition officer also dedicates staff to personally 

work with us on IT requests. Together, we discuss proposed IT solutions and coordinate with program offices to determine the most 

appropriate acquisition approaches. 

This increasing collaboration, empowered by FITARA, paves the 

way for strategic sourcing, improved IT management, and even 

more visibility in how we are using our limited resources. Looking 

forward, I am committed to building on our successes, applying lessons learned, enhancing our relationships throughout the Department and with our external partners in the spirit of FITARA. 

Thank you for your time. I am happy to take any questions you 

may have. 

[Prepared statement of Mr. Wiggins follows:] 


KING-6430 with DISTILLER
44 


KING-6430 with DISTILLERInsert offset folio 31 here 26178.031
45 


KING-6430 with DISTILLERInsert offset folio 32 here 26178.032
46 


KING-6430 with DISTILLERInsert offset folio 33 here 26178.033
47 


KING-6430 with DISTILLERInsert offset folio 34 here 26178.034
48 


KING-6430 with DISTILLERInsert offset folio 35 here 26178.035
49 


KING-6430 with DISTILLERInsert offset folio 36 here 26178.036
50 


KING-6430 with DISTILLERInsert offset folio 37 here 26178.037
51 

Mr. WALBERG. We thank you, Mr. Wiggins. 

And now, Mr. Pitkin, we recognize you. 

STATEMENT OF DOUGLAS PITKIN 

Mr. PITKIN. Good afternoon. Vice Chairs Walberg and 

Farenthold, Chairman Hurd and Meadows, Ranking Members 

Kelly and Connolly, and members of the subcommittees. Thank you 

for the opportunity to appear before the committee today to provide 

an update on the Department’s implementation of FITARA, particularly on its budget process. As the director of the Bureau of 

Budget and Planning, I coordinate the development of the Department’s annual resource request that the Secretary presents to 

OMB and Congress each year, and my Bureau is also responsible 

for overseeing the allocation of funds provided by Congress. 

Throughout these efforts, my Bureau has sought to ensure that 

the CIO and the Bureau of Information Resource Management has 

both the funding and engagement that it needs to address FITARA. 

As reported on the IT Dashboard, the Department’s 2017 IT budget request is approximately $1.8 billion. The centerpiece of 

that investment is our IT central fund, which provides nearly $300 

million for the development of enterprise-level systems infrastructure. The remaining 1.5 billion resides in other Department accounts to support both IRM’s enterprise-level operation and also 

Bureau-specific programs. 

Both our Bureaus, BP and IRM, continuously seek to improve coordination across the entire span of the IT portfolio. We are committed to transparency and accountability in the management of 

all aspects of our IT budgets, and this has been greatly enhanced 

by the partnerships, as Frontis mentioned, between the CIO and 

IT project and program managers and other bureaus. 

I also echo his views on how we have made FITARA implementation work at the Department of State for IT management. From my 

perspective, FITARA did not superimpose a brandnew budgeting 

process on the Department, rather helped codify and strengthen existing IT management principles and reinforce ongoing coordination efforts between our offices. 

As an example of this collaboration, in forming the fiscal year 

2017 budget, my Bureau leveraged the CIO’s project performance 

and schedule information to help us jointly determine the appropriate funding needed to support the Department’s electronic 

health records management project. This ongoing collaboration has 

and will enable us to make better informed resource decisions, 

manage IT investment risk, and most importantly, deliver IT services and capabilities that support the Department’s mission. 

My Bureau has also worked with the CIO’s office to include 

FITARA requirements at our annual budget formulation guidance, 

which has improved Bureau supporting documentation for IT funding, which now includes more analysis of cost-effectiveness and 

long-term planning in Bureau IT requests. 

Further, over the entire fiscal year, my Bureau works closely 

with the CIO’s team to review IT funding allocations and actual 

spending, especially for major IT investments. Our goal is to reduce 

duplication of efforts, share technology across the Department, and 

deliver best value for the taxpayer. 


KING-6430 with DISTILLER
52 

In support of this effort, my Bureau is looking at how we can further improve the transparency of IT budgets with the CIO. As part 

of our Bureau’s budget system modernization project, we’ll be implementing a commercial off-the-shelf product to track our IT assets and costs in all phases of the project lifecycle from formulation 

to financial plan and including performance metrics as determined 

by the CIO. This will improve the integration of IT portfolio management data and budget data, would also promote information 

sharing across the IT enterprise, foster more informed management decisions, and help us do both of our jobs more effectively. 

With Congress’ continued support and robust collaboration with 

our Federal and non-Federal stakeholders, we believe we are on a 

path toward improved FITARA implementation at the Department. 

We look forward to working with Congress to ensure that our efforts not only comply with FITARA but also reflect our collective 

desire to transform how the Department does its business both domestically and overseas. 

Thank you for your time, and I’m happy to answer any questions. 

[Prepared statement of Mr. Pitkin follows:] 


KING-6430 with DISTILLER
53 


KING-6430 with DISTILLERInsert offset folio 38 here 26178.038
54 


KING-6430 with DISTILLERInsert offset folio 39 here 26178.039
55 

Mr. WALBERG. I thank each of the witnesses for your testimony. 

And now it gives me great pleasure to recognize the chairman of 

the subcommittee, Mr. Hurd, for your opening statement. 

Mr. HURD. Thank you, Mr. Walberg, and good afternoon everyone. The technological change we are going to see in the next 20 

years is going to make the last 20 years look insignificant. We are 

at a pivotal point in the development and utilization of emerging 

technologies. 

And the current state of IT at most Federal agencies is, in most 

cases, decades behind the private sector. I want to be clear: we 

have made progress. Some have complained that we are not reflecting that in the scores, but we recognize there is progress being 

made, but we have a long way to go to get where we should be. 

The new administration must prioritize IT management and 

cybersecurity. As seen in the OPM breach, the consequences to allowing our government to remain in the horse-and-buggy days of 

technology implementation can be disastrous. This is not a partisan 

issue. This is a security issue. We must come together, not as Republicans or as Democrats, but as Americans to solve this pressing 

challenge. 

As I said in May when the committee released the Scorecard 2.0, 

the intent of grading agencies is not to shame agencies but to provide an objective measurement of progress and challenges so that 

we can facilitate the continued implementation of FITARA. The 

grades improve overall from the first scorecard to the second, and 

I’m pleased to see continued improvement in the grades from the 

second scorecard to the one released today. 

The committee has made two key adjustments to the scorecard. 

First, as I highlighted in the hearing in May, when CIOs are reporting—who CIOs are reporting to is important. This committee 

intends to ensure the men and women in these CIO positions are 

qualified, accountable, and empowered to make decisions and lead 

within their agencies. 

Consequently, the FITARA Scorecard 3.0 final grades include a 

plus if the CIO reports directly to the Secretary or Deputy Secretary of the agency and a minus if the CIO does not report to one 

of those two officials. Neither of the CIOs on today’s panel report 

directly to the Secretary or Deputy Secretary, and I look forward 

to discussing the implications of the reporting structures at their 

respective agencies. 

Second, the portfolio review metric has been adjusted. For a 

Scorecard 3.0, each agency’s total portfolio stat savings was divided 

by its total IT budget for the most recent fiscal year—most recent 

3 fiscal years, and then, as with the risk assessment transparency 

grades, the resulting ratio was ranked in the five agencies with the 

highest savings ratio received an A, the next B, et cetera. 

This tiered system is more accurate than the system used in the 

first two scorecards, which benchmarked all agencies to one outlier 

agency. Moving forward, the committee will continue to evolve and 

adjust the scorecard as appropriate and, in doing so, will help ensure successful implementation of FITARA. 

I urge all agency CIOs to reach out to the committee staff if you 

have questions or concerns about the scorecard generally or about 


KING-6430 with DISTILLER
56 

any aspect of their agency’s grade, because remember, this is all information you all have reported to us. 

I thank the witnesses for being here today and for their service 

to the Nation, and I look forward to the questions. 

Thank you, Mr. Vice Chair, and I’ll turn it over to you. 

Mr. WALBERG. Thank you, Mr. Chairman, and at your good 

graces, I will now recognize myself for my 5 minutes of questioning. 

I would add, as what was just stated, that these hearings are 

meant to be a partnership and support and encouragement, and I 

think seeing some of the grades of those that have been before us, 

we’ve seen some of that take place, and we want to continue that. 

And so I have an opportunity here today, as I begin my questioning, talking concerning specifically to each of the agencies, and 

I’ll let you decide which or both that would want to answer the 

questions. But I want to look at both DHS on data centers received 

a grade of A, and State received an F. So we have a complete spectrum there. So be interested to hear your answers. 

First of all, going to DHS, how many data centers does DHS currently have? 

Mr. MCCORMACK. DHS, we have approximately 102. 

Mr. WALBERG. 102 data centers. 

State, how many centers do you have? 

Mr. WIGGINS. We have 366 nontiered and 19 tiered, so about 

380-some-odd. 

Mr. WALBERG. How many centers, DHS, did you close in the last 

few years, and I guess respond beyond that, how many more can 

we expect you to close by fiscal year 2019? 

Mr. MCCORMACK. And I apologize. I should have said we had 

102. We have consolidated 40 of 102. I hesitate only because we 

are, as I had said in my opening testimony, that we are in the middle of shifting our model to not only consolidate into our internal 

data centers, of which we have two core data centers, but really 

shifting that consolidation to the public cloud. And while we expect 

that to take a little bit of time, we have done some—had some success with that already at great savings. We expect that to ramp up 

very quickly. 

So I would expect us, in 2019, if I had to have sort of rough estimate, that we would have probably less than 25, maybe less than 

a dozen at that point, and what I can’t tell you right now is how 

many of those are going to end up in our internal consolidated core 

data centers versus out into the cloud. 

Mr. WALBERG. Okay. 

Mr. MCCORMACK. We are still doing that analysis right now. 

Mr. WALBERG. Okay. But significant movement. 

I turn to State, again, how many has State closed in the last few 

years and how many more can we reasonably except to see close 

because you have a significant number of centers? 

Mr. WIGGINS. Thank you for that question. Part of 2012, we actually closed one. Since 2012, we closed six. We are targeting an additional four, one tiered and three nontiered, in coming before 

2018. I think this also brings up an interesting point and one we 

need to work with OMB and GAO on very closely because the definition of a ‘‘data center’’ or as is currently presented loops in a lot 

of our overseas posts, and it’s a challenge for us to look at closing 


KING-6430 with DISTILLER
57 

what are considered data centers at our posts due to our infrastructure. I think the definition of the ‘‘data center’’ needs to be reviewed, perhaps, in conjunction with OMB and GAO, because, 

frankly, what most people consider data center is not what we have 

at our embassies overseas. Some of them are actually communications closets with a single rack of equipment, but because they 

have got a UPS in that rack and there’s a generator in the courtyard for that embassy, it falls in the definition of a ‘‘data center,’’ 

as narrowly defined. So we need to work on that. 

The target that has been given to us is about 220 data centers 

to be closed in the next year and a half, which is going to be an 

extreme stretch for us. To Congressman Connolly’s point, if you 

don’t mind, I’ll just address this as well. You asked about data center savings. I’m not sure whether to quote Pogo or Shakespeare, 

whether the fault is in ourselves or our stars; or whether we have 

met the enemy, and it is us. 

Mr. WALBERG. Maybe both will work. 

Mr. WIGGINS. Yeah, exactly. We actually had about $35 million 

in data center closure cost savings, but our scorecard shows zero, 

so that’s on us. We have failed to report that properly through the 

database and through the scorecard, so we are getting credit for 

zero, and we should have about 35 million. 

OMB had put us down for a target of 17.1, so we have exceeded 

that by two times what the target was, but we have not properly 

reported it. So when you talk about FITARA refinements, some of 

it calls upon the individual agencies as they report them. 

So I do look forward to having continued conversation with OMB 

and GAO in exactly how we define a data center, because, again, 

I think the other thing the State perhaps doesn’t get a credit for 

is we provide a shared service for a lot of agencies overseas. There 

are a number agencies that actually ride our infrastructure, and we 

provide them service. They have collapsed their data centers because we provide that over to them. So we need to continue to refine and review that. 

Mr. CONNOLLY. Mr. Chairman, would you yield just for a second? 

Mr. WALBERG. Yeah, while I’m chairman, I can yield for just a 

second. 

Mr. CONNOLLY. Just to your point, I would hope that a refined 

scorecard would reflect the data not reported but recorded here, because the exercise again is to mark progress, not to dig into you 

because you were late or something like that. So I would hope we 

can incorporate that so the State Department is credited for the 

progress it achieved. 

Thank you, Mr. Chairman. 

Mr. WALBERG. I don’t want to miss this point, so I want to go 

to Mr. Powner. Could you comment on definition of ‘‘data center’’ 

that was brought up by Mr. Wiggins? 

Mr. POWNER. Yeah, this gets back to, you know, we have had 

many definitions of ‘‘data centers.’’ We started off with one. When 

Steve Van Roekel was the CIO, he changed the definition to include all these small closets. Now we are at a tiered, nontiered. I 

think what’s really important going forward is we have these data 

center consolidation plans required in FITARA, and I know DHS— 


KING-6430 with DISTILLER
58 

Mr. McCormack, I know you are working on yours, getting it in by 

the end of December—we are tracking those. 

I think what’s really important is that these issues and those 

plans which go to OMB get resolved through OMB. We can be part 

of those discussions to make sure that we’re focused on the right 

things, and if there are some closets and the whole bit, we can acknowledge that moving forward. That’s fair. That’s fair. 

I think what’s really important with the hearing here, Ranking 

Member Connolly, to your point, is some of this reporting that was 

one time to the Appropriation Committees is now it’s OMB, and not 

all the agencies were taking this serious enough, and we just need 

to be consistent and serious so that we get the right savings so that 

we can modernize more. 

We need to root out these inefficiencies because there’s a lot of 

modernization that everyone has, and hopefully, we can reinvest 

and do the right thing. 

Mr. WALBERG. Thank you. And my time is expired, and now I 

have the privilege to recognize the ranking member as well as the 

gentlelady who has the privilege of representing my hometown, Ms. 

Kelly. 

Mr. KELLY. Thank you. One of the things we’ve learned is the 

importance of grading whether or not an agency CIO reports directly to the Secretary or the Deputy Secretary of the agency. Mr. 

Powner, in your assessment, why is it important to the success of 

an agency’s overall FITARA implementation plan that there be a 

direct reporting relationship between the CIO and the head of an 

agency? 

Mr. POWNER. So I think the higher up you report, the better. 

Typically, that’s associated with more authorities. Now, can it work 

if you don’t? Absolutely it can, but we’ve seen plenty of situations 

in DHS—not going to revisit history here—where that reporting arrangement wasn’t great for the CIO and the CIO wasn’t really 

backed—not with the current folks. 

But I think what’s important is if you look at the FITARA implementation plans that get reports, self-assessments by the agencies, 

the self-assessments are higher for those CIOs that report to the 

DepSec or higher. So CIOs are telling us that their authorities are 

stronger the higher they report. 

Mr. KELLY. And how did you go about evaluating whether each 

of the agencies that were scored had a direct reporting relationship 

between their CIO and Secretary or Deputy Secretary? 

Mr. POWNER. We have ongoing work for this committee that 

we’re looking at CIO authorities, which include the reporting structures, and honestly, a lot of this comes right off of the agencies’ and 

departments’ Web sites, but we confirmed a lot of that through our 

ongoing work that we’re performing for this committee. 

Mr. KELLY. Thank you. In my opening I talked about there were 

agencies that improved their letter grade. For example, the current 

scorecard shows significant improvement from NASA that went 

from an F to a C-plus. Since GAO first began working with our 

subcommittee on a scorecard for monitoring agency progress in 

FITARA, have you seen a steady improvement in the overall 

grades? 


KING-6430 with DISTILLER
59 

Mr. POWNER. I think there’s some agencies that have had excellent improvement. NASA, that was highlighted, not only did Renee 

Wynn make remarkable improvements in the data center area, on 

software licensing, she’s also reporting tens of millions of dollars in 

software licensing savings. 

So I think having NASA up here at your last hearing resulted 

in great improvements. Clearly, there are some agencies that are 

in that D range that we need to get more progress on. And to comment on the F, you know, Richard McKinney at DOT is one of the 

best CIOs we have, but he has a situation there at the Department 

of Transportation that’s very difficult that he inherited, but it’s not 

from his efforts. And even though he has an F, he deserves a lot 

of credit for what he’s done. I know he’s been in front of this committee. 

Mr. KELLY. And out of the four areas, which area has been one 

that you’ve seen more improvement than others? 

Mr. POWNER. I think clearly data center consolidation has been 

on a nice track with reported savings, and then clearly, too, I think 

the adjustment that Chairman Hurd mentioned on the portfolios 

that were—tiered it—that was an appropriate adjustment. It was 

more fair to the agencies, and I think that’s part of the reason why 

you see an increase in a lot of the grades too is because of the portfolio stat grades creeped up. 

Mr. KELLY. Thank you. 

Mr. McCormack, DHS was among the agencies whose overall 

score improved, going from C to B-minus. Can you briefly explain 

what were the steps DHS has taken to improve its success? 

Mr. MCCORMACK. It was in a portfolio review. We went up significantly there. We spent a lot of attention on that, worked very 

closely with GAO to make sure that we were doing that correctly 

and thoroughly, and I think that’s where we made most of our 

strides in this particular round. 

Mr. KELLY. And while we’ve seen agencies that have improved, 

we have seen agencies that haven’t or have stayed the same. 

Mr. Wiggins, can you explain what challenges the State Department has been facing when it comes to FITARA implementation 

that would account for its overall score remaining so low? 

Mr. WIGGINS. Yes. Thank you for the question. I think, as I outlined earlier, I think part of the challenge is, when we don’t do our 

own reporting properly, then we get a failing grade in certain 

areas. But in other areas, there has been a tendency on our part 

to perhaps get into analysis paralysis. For example, when it comes 

to enterprise license agreement, we have about $47 million in software savings we’ve already realized, and there’s another 43 that 

we’re expecting to realize, but we did not report it because we could 

not confirm it 100 percent, so that’s something we have to improve. 

The other thing is when you look at incremental development, for 

example, we did not have a mandatory use of incremental development as part of our project management plan. Since I have come 

into this office 5 months ago, I have made that mandatory. 

In addition, we did not have an office that focused on workforce. 

We did have an IT strategic plan. We did not have a cybersecurity 

strategy. We did not have a cybersecurity tracker. All those things 

have been put in place since I’ve assumed the role. So we have a 


KING-6430 with DISTILLER
60 

lot of work to do to catch up. I have set a stretch goal for my staff 

to get us to a B this year, and I’ll say on the record that I will accept a C, but I would like to get us to a B. And I think we have 

a number of processes in place to get us there. We just have to 

knuckle down and do it. 

We have an excellent partnership with our colleagues in the old 

office of bureau—excuse me, Bureau of Budget and Planning, as 

well as our other peers, like the chief of human resources officer. 

We have to leverage those and kind of land the planes. We’ve got 

a lot of very good planes in place. As Mr. Powner mentioned, we’ve 

already undertaken our workforce review. Our report was given to 

us in November. We are now going through that. So there are a 

lot of things that have taken place in the last few months. We just 

have to get those things and drill into them. 

Mr. KELLY. And in what ways can Congress help you with the 

implementation? 

Mr. WIGGINS. Time. You know, the one thing that no one has 

enough of. I think, in relation to your question earlier, Congresswoman Kelly, I—again, this is coming from the new kid on the 

block who got a D-minus, so, of course, this is going to be a selfserving comment, but when you look at the CIO authorities, I 

think, if I could offer a chance of refinement, I think it’s not so 

much what box reports to what box but what you actually do with 

that opportunity. 

So, for example, I don’t report directly to the Deputy Secretary 

or the Secretary of State, but I meet with the Secretary four times 

a week, I meet with the Deputy Secretary eight times a months. 

I have a direct tasking from her on cybersecurity. I have a direct 

tasking from her on knowledge management. An outcome from that 

was our overall cybersecurity strategy, which we never had before, 

and the creation of a risk officer for the first time ever in the Department. 

So I would almost say quality of engagement, and even quantity 

is one measure, obviously, but quantity and quality of engagement 

is a little bit more nuanced than just a plus or a minus. And, 

again, this is coming from a guy who got a minus, so take that 

with a grain of salt. 

Mr. KELLY. Thank you, and I yield back. 

Mr. HURD. [Presiding.] I’d now like to recognize the distinguished 

gentleman from the great State of Texas, Mr. Farenthold, for your 

questions. 

Mr. FARENTHOLD. Thank you, Mr. Chairman. 

And I have some questions, but I want to start off with Mr. 

Powner. 

You mentioned in your testimony that there were billions of dollars in low-hanging fruit of technology fixes we could do. I don’t 

want to let that remark just slide by. You want to share a couple 

of pieces of low-hanging fruit? Anything we can do to help the 

budget is a win. 

Mr. POWNER. I think the number one area for cost savings—and 

it always has been the number one area—is data center consolidation. We have $5 billion on the table, and honestly, if you look at 

the optimization metrics at some of these agencies, I think that $5 

billion could be higher. That’s the biggest bucket. When you look 


KING-6430 with DISTILLER
61 

at your scorecard here, we need to keep the pressure on savings. 

The metrics are fine. We can weave that in down the road, but 

there’s a lot of money to be saved 

Mr. FARENTHOLD. Anything else? 

Mr. POWNER. That’s number one. Portfolio stats, some duplicative spending, I could sit here and tell you stories of agencies that 

still have component bureaus that refuse to go to emails of service, 

even though it’s can cheaper than their current email. There’s some 

low-hanging fruit there that we could still fix with duplicative 

wasteful spending at agencies, in the portfolio stat area. 

Mr. FARENTHOLD. All right. So, while your microphone is on, and 

I’m going to address this to anybody else who wants to answer it 

as well. What are we not measuring in FITARA that we need to 

be measuring? 

Mr. POWNER. I think the people measurement is very, very important. Clearly, these are four areas in the law—these are four 

areas to save money, incremental development. No one is going to 

argue that going small isn’t the right thing, so you need to continue 

to measure these areas. But if you look at the people part of it, the 

CIO authorities, to be given the right authorities with support from 

the top, that continues—should be the focus of this committee. But, 

also, if you have support from the top and a strong CIO but you 

have a workforce that has a lot of holes in it, you’re going to have 

a tough time. 

So I think that people part at the top—and we just issued a report that showed these gap assessments on IT skills, which includes the cyber workforce. Agencies have big gaps that we need 

to address more comprehensively. 

Mr. FARENTHOLD. I’ll get to people in a second. Does anybody 

else want to add a missing? 

Okay. So let’s go into people. You talked specifically within the 

cyber. I want to talk with the workforce in general. You can get 

the best technology in the world, but when you have somebody 

who’s used to doing things on a Windows XP or a, you know, outof-date BlackBerry or whatever, how are we addressing the people 

issues and training? Do we have an adequate way to look at that, 

and is that something we need to be focusing more on? 

I’ll start with Mr. Wiggins. You’re smiling over there, and I know 

we’ve had some unrelated testimony in this committee on something completely different about State Department technology. 

Mr. WIGGINS. Thank you for the question. I am chafing at the 

bit. As a former dean of our School of Applied Information Technology at FSI and a former instructor, I’m a big believer in the 

power of people. And if you allow me to wax philosophically, I’m 

a guy who started as a GS–7 who worked my way up to where I 

am. I paid my dues up full on the way, and the only way I got 

there is to be a lifelong learner. Our gap analysis is demonstrating 

that we—the Department of State has significant needs in the 

areas of skills, specifically with cyber, and since plagiarism is the 

sincerest form of flattery, we’re going after DHS’ model of enhanced 

skills incentive pay. 

Skills incentive pay actually started with the Department of 

State when I was the dean, and now DHS has expanded on that 


KING-6430 with DISTILLER
62 

for cyber skills incentive pay to try andcapture and retain the best 

talent out there, and we want do the same thing. 

The other thing I think is important, it’s not just the technologists who are behind the equipment; it’s the users. It’s the customers, and I always tell my folks we’re a customer-service organization. If we’re not giving training to our customers, we might as 

well be handing them bricks. And this also gets in the cyber realm 

because, as I think everybody knows, our biggest threat is—well, 

there is an insider threat to a certain degree, obviously, but it’s 

when our customers click on that spear phishing link or click on 

the ransomware that we’ve experience our greatest problems, and 

so it’s that education of the total workforce, not just the IT workforce, that’s very important. 

In fact, we are getting ready to deploy this month—I won’t give 

the technology, because I don’t it leveraged against us, but an artificial intelligence learning tool to combat spear phishing in particular, because we’ve been vulnerable to both spear phishing and 

ransomware. So I take it to heart that the technology training, 

both for the workforce and for the IT workforce, larger workforce, 

is vital to us. 

Mr. FARENTHOLD. One more question as I’m running out of time. 

Mr. Wiggins, I’ll hit you with it, too. The State Department is the 

only one that basically dropped in grade with your minus. Is there 

anything unique about the State Department that makes your 

challenges different from another agency? 

Mr. WIGGINS. Thank you for the question. I would say, as I alluded to earlier, it’s kind of our overseas posture and the necessity 

of providing a shared service to all those missions I discussed. It’s 

also the fact that we had a complete turnover in our senior management. It’s not just me. It’s every other deputy chief information 

officer has been changed out in the last 4 months with one exception. So we’ve got an entirely new group that’s looking at this. And 

so we’re taking—it’s an opportunity to take a fresh look at everything, but it’s also a challenge to get us geared up and going forward, so that’s when—— 

Mr. FARENTHOLD. Your staff are professional employees. They’re 

not political. 

Mr. WIGGINS. That’s correct. And every one of my members, including myself, we’re professional members. We worked our way up 

through the ranks. 

Mr. FARENTHOLD. Thank you, Mr. Chairman. I see my time is expired. 

Mr. HURD. I’d like to now recognize my friend from the Commonwealth of Virginia and the original cosponsor of the Connolly-Issa 

bill, also known as FITARA, Mr. Connolly, for his 5 minutes of 

questioning. 

Mr. CONNOLLY. Thank you, Mr. Chairman. Thank for your generosity there. 

Just a parenthetical note, Mr. Wiggins, Mr. Pitkin, compliance 

with FITARA and reporting under FITARA is not a voluntary activity. I was on the floor yesterday passing a truncated State Department authorization bill. Included in that bill is my amendment 

requiring the State Department to comply fully with the terms of 

FITARA. 


KING-6430 with DISTILLER
63 

So we are not going away, and we’ll use—I happen to be on that 

committee too. So one way or another, the State Department is 

going to have to come to grips with reality here. Every agency can 

claim, to Mr. Farenthold’s question—I think it was Mr. 

Farenthold—every agency is unique. Every agency has unique missions, and you’re no different than anybody else in that regard. 

Technology—the management of IT is potentially—and, Mr. 

Wiggins, your testimony was welcomed, a welcome addition from 

State Department—a transformative force for changing how we do 

business, how we can improve efficiency and performance and productivity, and do a better job of providing service to our clients and 

our customers, as Mr. Wiggins indicates. 

So it needs to be looked at in that way. I am concerned, Mr. 

Wiggins, that your testimony about who you report to, because, as 

Mr. Powner, we know this from our own experience, and you mentioned DOT: It’s got to come from the top. It’s got to have—that 

person, whoever is the Secretary of the agency, has got to understand the transformative nature of IT, and oh, by the way, the 

other side: What could go wrong if this goes bad? 

And I don’t know how often we have to learn that in the form 

of Web site collapses or cyber attacks that are successful. But, you 

know, this is not something tangential to the mission. It’s actually 

integral to the mission. And I can see you want to comment, Mr. 

Wiggins. I welcome your comment. 

Mr. WIGGINS. Thank you, Congressman Connolly, and can you 

hear me? I’m sorry. First off, I wholeheartedly agree with your 

evaluation of the transformative nature of IT. I like to say that IT 

is a tool. It’s a very powerful and expensive tool, but that’s just it; 

it’s a tool. And that gets back to the whole education piece of, if 

we’re going to put those tools out there, we have to make sure that 

people have the background to leverage them. 

On taking FITARA seriously and being passionate about it, I can 

tell you that my concerns about our FITARA implementation are 

such that I’ve identified five full-time employee positions I’m conferring over from programmatic status to support FITARA specifically so we can move forward on getting from a D to a higher 

grade. Because whether it’s the evaluation of incremental development or any of the other budgetary pieces or programmatic pieces, 

we have to focus on it, and I think by putting additional FTEs 

against this, it will definitely help. 

As far as the reporting structure, thank you for your comments. 

As I said, I meet on a regular basis with the Deputy Secretary. She 

is directly involved in a lot of the activities, and it’s almost a dotted 

line between me and her office—excuse me—me and my office, excuse me. But the other nuance, if you will, is that working with my 

other Assistant Secretaries, such as Mr. Pitkin—you heard a lot 

about collaboration in my testimony. That’s kind of how I like to 

operate. I like to work among peers. I don’t like to work by fiat necessarily. I feel I’m very effective in working collaboratively with my 

peers. In having that dash line to the DepSec gives me that authority. When I walk in and say, ‘‘The DepSec has identified that we 

have to do this,’’ I get a lot of responses. So your point is welltaken, though, and I will continue to review that. 


KING-6430 with DISTILLER
64 

In fact, there was an Office of the Inspector General report recommending it. In reviewing it, both the Deputy Secretary and 

Under Secretary conquered that the CIO position should remain 

where it is, at least for the time being. 

Mr. CONNOLLY. Yeah. We want to elevate your position. We 

didn’t—in writing the legislation, we weren’t overly prescriptive. 

We were hoping that the situation—I mean, the hierarchy would 

evolve to a more rational hierarchy. We have 250 people named 

CIO in 24 agencies. There is no private corporation, no matter how 

big, that would have anything like that. 

In fact, it’s one of my favorite hobbies to ask a CEO of a major 

corporation, Fortune 500, ‘‘How many CIOs have you got,’’ you 

know, and I do it with a straight face. And they always look at me 

quizzically, like, ‘‘Well, one.’’ And I go: ‘‘Well, let me tell you what 

we’ve got in the Federal Government.’’ 

So we didn’t do that, but we do expect that there is a primus 

inter pares, somebody emerges as the chief CIO, and that that person has the backing of the head of the agency, the head of the 

agency, not 16 rungs down or 3 rungs, and the alternative is we 

get prescriptive. 

I mentioned in the beginning in my opening statement, the four 

of us are not going away. We have been shepherding this, and we 

are quite capable of writing bipartisan legislation. We would prefer 

not to do that, but we’ve got to have cooperation from the very top. 

And Mr. Powner mentioned a couple that, ‘‘Well, we don’t have it,’’ 

and I don’t know if you want to comment on this, Mr. Powner, because my time is up, but on this whole issue of CIO authority and 

how well or poorly it’s evolving. 

Mr. POWNER. Yeah, I think clearly reporting higher helps. I 

think a key question we look, whether you have CIO authority of 

not, is, are you in a position that you could halt or terminate a 

troubled project? We have too many troubled projects, and we continue to throw money at bad projects. And when CIOs attempt to 

interject themselves, if they can interject appropriately and halt, 

manage risk, do the right thing, then you have authority. We don’t 

have that across the board, and having support from the top does 

help you do that. 

Mr. HURD. I would like to now recognize Mr. Blum for 5 minutes 

of questioning. 

Mr. BLUM. Thank you, Chairman Hurd. From the great State of 

Iowa, I think you omitted that. 

Welcome to the panelists today. I think it was a couple of weeks 

ago, in our IT Subcommittee hearing, we had the Social Security 

Administration sitting in your seats. In my questioning of them, we 

stumbled upon the fact that, in 2006, they undertook a massive IT 

project that lasted 7 years to around 2013, 2014. And the end result was it was scrapped. 

So I asked how much was spent. The answer was $340 million 

was wasted on that IT project in the Social Security Administration. I posted that in social media, and I can’t repeat some of the 

comments that I have received from the people in the First District 

of Iowa about wasting $340 million of the taxpayers’ money. 

The largest city in my district, Cedar Rapids, Iowa, they’ve had two 500-year floods in the last 8 years. They need $85 million for 


KING-6430 with DISTILLER
65 

a flood wall. We wasted four times that, four flood walls, in the Social Security Administration on a scrapped IT project. 

To add insult to injury, I asked, was the vendor paid, Lockheed 

Martin? They were paid. I asked, was the CEO terminated? He was 

reassigned, of course, of course. 

So incremental software development makes a tremendous 

amount of sense to me. And this question is for Mr. Powner and 

Mr. McCormack and Mr. Wiggins. Is incremental software development, A, is it working, and B, what are the challenges to implementing it? Mr. Powner first. 

Mr. POWNER. I think clearly when you look at the historical nature of incremental development—we did a report a few years ago 

on successful IT acquisitions. There were seven that agencies pointed to that were a success story deployed within—somewhere within 

cost and schedule. Users liked this system. Every one of them was 

an increment of a larger development effort. 

So I think when you look at incremental development, there’s no 

argument that’s the right way to go. Agile development incremental, we need to continue to go down that path. I think we need 

to look real hard about funding projects that you can’t deliver 

something within that budget year. OMB has a 6-month requirement on incremental development, but if you can’t deliver something within the budget year, we ought to think real hard about 

whether we ought to be throwing money at it. 

Mr. BLUM. Mr. McCormack. 

Mr. MCCORMACK. Thank you for the question. If I could rewind— 

and indulge me for just a moment on the reporting relationship situation. I’ve been a CIO of an operating component. I’ve been a CIO 

at Department of Justice and now the CIO at the Department of 

Homeland Security and the vice chair of the executive council, and 

I will tell you the number one thing, in my opinion, that makes 

this successful is what I call goal congruence and a governance 

structure at the Department. 

Mr. CONNOLLY. Did you say—I’m sorry, I couldn’t hear what you 

just said. 

Mr. MCCORMACK. Goal congruence—and I’ll explain that in a 

minute—and a governance structure. Every CxO in the Department of Homeland Security has the authority to sort of throw the 

flag in and say, ‘‘I’ve got a problem with that project,’’ and when 

I say ‘‘CxO,’’ I’m talking about the chief procurement officer, the 

chief of human capital officer, certainly myself. All of us together 

as sort of a board of directors have that authority. 

In regards to the agile development, and this is where the goal 

congruence comes into play. It works, right. It’s a private sector 

best practice. If you go out and look at any advanced private sector 

company that uses IT as a strategic weapon, I’ll call it, they are 

all developing in this kind of a process. But you cannot do that unless you have the right skills, which means you need your CHCOs 

to help you hire those folks. You cannot do that unless you have 

the right procurements in place. 

Right, I talked about FLASH and ECS, which is our cloud-based 

technology services and our agile software development capability. 

Right, that’s our chief procurement officer. If they’re not completely 

aligned with your movement, so to speak, none of this happens. 


KING-6430 with DISTILLER
66 

And so all those folks typically report into—a lot of times it’s not 

the Deputy Secretary. It’s the Under Secretary of Management, 

and that’s what’s really important. 

So if you’re going to sort of move the ball forward on whether it’s 

security with FISMA, whether it’s your digital transformation effort, whether it’s FITARA, you need to make sure that the folks 

that are reporting to that individual are on board, and particularly 

that person is on board. I think that—— 

Mr. BLUM. Are there documents signed off to make sure 

those—— 

Mr. MCCORMACK. Sorry? 

Mr. BLUM. Are there documents that are physically signed off on 

to make sure the physical parties you just mentioned are on board 

so that goals are congruent? 

Mr. MCCORMACK. Absolutely. We have—— 

Mr. BLUM. In the private sector, we sign off on—— 

Mr. MCCORMACK. —elements in their performance plans in regards to the governance process. Every single gate review gets certified and codified in writing and cannot go through that process 

and has to be approved by every one of those members in our acquisition review board going forward. That’s that governance structure I was talking about. Every one of the CxOs are sort of board 

of directors of that governance structure. It’s run by, in this particular case, the Under Secretary of Management. 

But I think it’s—I just wanted to point that out that I think it’s 

very important. While you can have the CIO report to the Deputy 

Secretary, which is important and could be powerful, if they’re not 

associated to the individual that you’re reporting to, then you’re 

still in negotiation, right, you’re constantly negotiating. 

If that individual is on board and that individual says, ‘‘Hey, 

we’re going to move,’’ then we’re going to move, right, and so that’s 

just something that I would think this group ought to think about 

and consider. 

Mr. BLUM. Mr. Chairman, can Mr. Wiggins answer my question? 

Mr. HURD. [Nonverbal response.] 

Mr. BLUM. Thank you. Mr. Wiggins. 

Mr. WIGGINS. Thank you for the time to answer. I just want to 

echo both Mr. McCormack’s comments and also Mr. Powner’s in 

getting to an earlier point. As the only CIO at the Department of 

State, I have the ability, as the authorizing official, to approve IT 

projects and kill IT projects. We have a governance structure in 

place that’s pretty comprehensive. We have an E–Gov Program 

Board that meets on a quarterly basis, and then you’ve got an E– 

Gov Advisory Board that meets on a monthly basis. We also have 

a new cloud computing governance board that started in May to review ongoing cloud efforts. 

The governance structure is extremely important, and as I mentioned earlier, when I was responding to Congressman Connolly, 

excuse me, we’ve now added that incremental development into the 

baseline change request for all IT projects going forward. We also 

have something called Managing State Projects for IT, MSPIT, that 

has control gates, and there’s a review process. Not only do you 

have to have a sponsor for your project, but it goes through a regular control gate, and agile development is a part of that. 


KING-6430 with DISTILLER
67 

There are two challenges I see with agile development. Number 

one, the user interface and the user experience has to be built into 

it. So we have what are called UX expertise that we’ve gotten from 

U.S. Digital Services to help in that whole usability phase of it and 

also for that agile loopback. 

And the other thing I would say that is a challenge is that when 

you, in our case, we use a firm-fixed-price contract, and when you 

start to look at agile, oftentimes when you say to a developer, who 

is oftentimes a contractor, ‘‘Okay, I now want you to go in a different direction,’’ and they say, ‘‘Fine, that’s a surge, and that’s 

going to cost you X amount of money in addition.’’ So I think the 

contracting aspect of it too, when you have a number of non-FTE 

who are doing contracting development—or, excuse me, programming development is another key component and a challenge. But 

absolutely, agility, agile workforce—agile development is a key 

component. Thank you. 

RPTR JOHNSON 

EDTR CRYSTAL 

[3:19 p.m.] 

Mr. BLUM. I yield back the time I don’t have, and thank you for 

your indulgence, Mr. Chairman. 

Mr. HURD. I would like to thank the gentleman for his insightful 

questions. 

Now I would like to recognize the distinguished gentleman from 

America’s Dairyland, Mr. Grothman, for 5 minutes of questions. 

Mr. GROTHMAN. Very good. I hate to pick on Mr. McCormack 

again, but I guess you’re it. How many positions at DHS have the 

title of CIO? 

Mr. MCCORMACK. Fifteen, including myself. 

Mr. GROTHMAN. Okay. And what is your relationship between 

you and the others, daily or weekly or monthly or whatever? 

Mr. MCCORMACK. Depending on the CIO, it could be daily. It’s 

certainly weekly and monthly. We have regularly scheduled CIO 

Council meetings. I have a dotted-line reporting relationship. They 

all do. I have input into their performance plans and I have the 

ultimate selection authority of all CIOs. 

Mr. GROTHMAN. So you supervise the other 14. 

Mr. MCCORMACK. Sure. 

Mr. GROTHMAN. And every part of DHS has a CIO assigned to 

it? 

Mr. MCCORMACK. They do. 

Mr. GROTHMAN. Okay. Do you provide input on their performance reviews? 

Mr. MCCORMACK. I do. 

Mr. GROTHMAN. Okay. Is there a lot of turnover in these jobs? 

First of all, I should ask, how long have you had your current position? 

Mr. MCCORMACK. This will be my third year. 

Mr. GROTHMAN. Okay. And you came, what was your position before this? 

Mr. MCCORMACK. I was the CIO at the Department of Justice. 

Mr. GROTHMAN. Okay. A lot of turnover in these positions or no? 

Mr. MCCORMACK. I’m sorry? 

Mr. GROTHMAN. Is there a lot of turnover in these positions? 


KING-6430 with DISTILLER
68 

Mr. MCCORMACK. I would say the average tenure is probably 3- 

plus years. There are some that have been there more than that, 

maybe as long as 5. But it’s fairly stable. That’s one of the things 

I spend a lot of time on, is making sure that we have a good what 

I call leadership pipeline, including the deputy CIOs, which I pay 

attention to quite a bit as well. 

I am happy to say that we have very little vacancies right now 

across our community. And we spend a lot of time paying attention 

to that because that’s just, I think, one of the leadership responsibilities that we have, is to make sure that we’re filling that pipeline, paying attention to it, and developing the future leaders. 

Mr. GROTHMAN. Okay. About what percentage of your budget is 

spent on the cloud? Kind of switching gears. 

Mr. MCCORMACK. On the cloud it’s about 4 percent right now. 

Mr. GROTHMAN. Okay. Has that increased over time? 

Mr. MCCORMACK. Yes. And that will increase significantly with 

the implementation—we have been doing a lot of pilots, which are 

really more than pilots, over the last year. I had some significant 

successes there. We just recently awarded this cloud contract, and 

we expect that to ramp up very quickly. 

Mr. GROTHMAN. Do you feel overall that’ll decrease the amount 

of money that’s spent on information technology from the government? 

Mr. MCCORMACK. Absolutely. Again, I hesitate only from the 

standpoint is there is a lot of pent-up demand for capability in the 

Federal Government. So right now all of us are making choices 

based on different types of technology and different costs associated 

to that. 

What we have found through our cloud pilots is that we’re able 

to deliver capability, incrementally, at a fraction of the cost and a 

fraction of the price. 

Mr. GROTHMAN. Okay. 

Mr. MCCORMACK. So it’s been very interesting to see the emerging technology and our ability to adopt it quickly and deliver at a 

short amount of timeframe. 

Mr. GROTHMAN. Do you believe that means, in the end, less personnel? 

Mr. MCCORMACK. I wouldn’t say less personnel. I would say different personnel, in many cases, again, simply because the demand 

signal is very high in regards to the capabilities that the operators 

need and want. 

Mr. GROTHMAN. Can you give me any specific example in which 

as you put more and more into the cloud, any one of your subgroups or whatever, that you have seen a savings? Just an anecdotal piece of evidence that you can give this committee to say this 

is how we can save money? 

Mr. MCCORMACK. Yeah. I mean, even with our traditional data 

center delivery models that we would use compared to some of the 

cloud-based delivery models, the cost is much less than the cloud. 

I will tell you in our open market strategy we’ve reconstructed 

the contracts that we were using in our private cloud data centers, 

which allowed the current vendors in those data centers to sharpen 

their pencils because we have requirements and needs at times to 

use a private cloud versus a public cloud. But what we were trying 


KING-6430 with DISTILLER
69 

to do is get the costs to balance out. So we have been able to do 

that fairly aggressively by reconstructing that. 

I will tell you, by the way, this is why the partnership is very 

important. That takes an extensive amount of work on our staff to 

figure out how to do that and on our procurement organization to 

put those contracts together. So that partnership that I was talking 

about earlier, to hiring those types of people that can do those 

types of negotiations, to work with our procurement community, to 

work through those capabilities, is very significant. 

Mr. GROTHMAN. Okay. I see my time is up. So thank you for giving me my 5 minutes. 

Mr. HURD. Thank you, sir. 

I would like to recognize myself now. 

Mr. Pitkin, what’s the IT budget for the State Department? 

Mr. PITKIN. Sir, approximately $1.9 billion. 

Mr. HURD. $1.9 billion. How much of that does Mr. Wiggins have 

responsibility over? 

Mr. PITKIN. Approximately 50 percent. 

Mr. HURD. Fifty? Five-zero? 

Mr. PITKIN. Five-zero. 

Mr. HURD. And what’s the reason for not having responsibility 

over the other 50 percent? 

Mr. PITKIN. Another 25 percent is under the control or falls 

under the Bureau of Consular Affairs. It’s essentially our visa and 

passport system. So they essentially have a very large both a legacy system as well as systems they’re developing to modernize our 

visa passport systems. And the other 25 percent is distributed 

among other bureaus. About 5 percent with our comptroller for 

payroll and the financial system 5 percent. 

Mr. HURD. So does the Consular Bureau have a CIO? Who is responsible for the implementation of their digital infrastructure? 

Mr. PITKIN. They have an information office, but it falls within 

the overall authorities of the CIO. So they have their own personnel, their own IT infrastructure but they report—— 

Mr. HURD. Who has the ability to halt or terminate a troubled 

project within the Consular Bureau? 

Mr. PITKIN. Certainly the assistant secretary for consular affairs 

would, as well as her management team, primarily the deputy or 

her—— 

Mr. HURD. Do you? 

Mr. PITKIN. On my own authority I would not. Certainly I can 

control the spigot of funds, but I would not make a unilateral decision to halt funding for a project without consultation with the 

CIO. So with the CIO I could make that determination, but of 

course I would defer to Frontis’ expertise and whether it was truly 

a troubled project. 

Mr. HURD. Thanks for the perspective. That’s why one of the reasons that we asked the deputies of your two agencies to sit and 

visit with us as well, to have this broader conversation. And in future hearings we are going to be doing that. 

Mr. Wiggins, the visa and passport system, is this the same as 

the Consular Systems Modernization program? 

Mr. WIGGINS. I believe you are referring, yes, to Consular One 

and the overall consular IT system, yes. 


KING-6430 with DISTILLER
70 

Mr. HURD. And you’ve assigned—you’ve actually assigned a medium risk rating for this IT investment. Is that right? 

Mr. WIGGINS. That’s correct. 

Mr. HURD. And yet you have no budgetary control over this? 

Mr. WIGGINS. I would say I have budgetary collaboration on it. 

We sit in on the Bureau of Consular Affairs budget review, along 

with Mr. Pitkin, and I meet on a monthly basis with the assistant 

secretary from Consular Affairs. Their principal deputy assistant 

secretary also meets with my principal deputy assistant secretary 

to review the investments and the overall projects within IT. And 

I would say that that was recently—it was at a 2 and it was upgraded to a 3. 

Mr. HURD. So about $50 million has roughly been put into this 

project. Is that correct? 

Mr. WIGGINS. That’s correct. 

Mr. HURD. Is there something working? 

Mr. WIGGINS. Yes. I believe that they overhauled part of the combined consular database. And I know that there is a DVIS system—I can’t remember exactly what the acronym stands for—but 

that’s targeted to be replaced starting this year. 

Mr. HURD. And the additional $118 million that is going to be 

spent this year, what is that going to get us? 

Mr. WIGGINS. Honestly, I do not know. I’d have to take that back 

and get back to you. 

Mr. HURD. Good copy. Please do. I’d be interested in having an 

insight on that. 

Are you responsible for all the licensing? 

Mr. WIGGINS. Enterprise license agreements? Yes, sir, I am. 

Mr. HURD. You have software and operating systems that 

stopped being supported back in 2010, and these are fairly well 

known operating systems. Is it not included in your budget or in 

the contract with those entities to upgrade those systems? 

Mr. WIGGINS. Yes. In fact we have a Global IT Modernization office, which is referred to as GITM, that is responsible for the overall upgrade of our systems. We are in the process of upgrading our 

systems worldwide right now to BladeSystems. It’s called an enterprise converged platform. We are averaging about five offices a 

month and five posts a month. We hope to get to 10 a month. 

On the enterprise license agreement, we currently have five 

ELAs or BPAs. They are with Microsoft, Oracle, VMware, Citrix, 

and Adobe. We have realized about $47 million in savings so far 

in the ELA for that and we anticipate another $43 million. And in 

addition we do partner with the other bureaus through our capital 

investment process to look at—— 

Mr. HURD. So is the plan to upgrade all the systems, all the operating systems? 

Mr. WIGGINS. Absolutely. 

Mr. HURD. And when is that going to happen? 

Mr. WIGGINS. I’d have to do my math very quickly, but if not this 

fiscal year, by the next fiscal year. 

Mr. HURD. And that includes the Bureau of Consular Affairs? 

Mr. WIGGINS. That’s correct. 

Mr. HURD. Gotcha. 

Mr. Fulghum, what is the IT budget for the DHS? 


KING-6430 with DISTILLER
71 

Mr. FULGHUM. Six billion. 

Mr. HURD. And how much does Mr. McCormack have? 

Mr. FULGHUM. He has oversight of all 6 billion during the programming phase. You know, we execute budgets decentralized, but 

he has gates throughout that process where he can exercise oversight. 

Mr. HURD. Does he have the ability to terminate or halt a troubled project? 

Mr. FULGHUM. So the chief acquisition officer in the Department 

is the one who will halt a program. No program, however, will 

move forward without his concurrence. So in essence he does have 

veto power. 

Mr. HURD. Mr. McCormack, how often do you meet with the Secretary or the deputy secretary? 

Mr. MCCORMACK. It depends on the subject. I would say, you 

know, maybe once a month. A lot of times that’s on cybersecurityrelated issues. 

Mr. HURD. How do I put this question? I don’t want to get anybody in trouble. That seems a little low. How about I just make a 

statement. That seems a bit low. 

And, ultimately, I do believe one of the most important things 

that FITARA is giving us is to strengthen the CIO’s authorities. 

And the goal of our two committees is to make sure you have all 

the tools you need so that we can ultimately hold you and your 

other 14 CIOs in your Department accountable. 

And that is why we stress this reporting, something as simple as 

how many times do you report and who do you talk to, because it’s 

not an industry standard to have the CIO and the CISO not report 

directly to someone within the C suites. 

I am going to yield to Mr. Blum for a question. 

Mr. BLUM. Thank you, Chairman Hurd. 

I just have one quick question. According to our report here it 

says the following: ‘‘FITARA requires OMB and agency CIOs to annually review the IT investments of an agency to, among other 

things, identify potential duplication and waste and identify cost 

savings.’’ 

So I will start with our two CIOs here, Mr. McCormack and Mr. 

Wiggins. My questions are, first of all, have you done exactly that 

every year? Secondly, is it in a report that I can read? And thirdly, 

are the recommendations, assuming you did it, being acted upon? 

Mr. Wiggins, start with you. 

Mr. WIGGINS. Thank you for the question. 

In the 5 months I have been in office, no, I have not. But I will 

go back and check. I do know that since I became an acting CIO 

I have been meeting on a regular basis with Tony Scott. We have 

a regular meeting, the CIO Council, talking about FITARA and implementation. I do not know factually if that report has been reviewed by OMB. I will take that back and review it. 

Mr. BLUM. But you are aware of the requirement 

Mr. WIGGINS. Oh, absolutely, yes. 

Mr. BLUM. Duplication, waste, cost savings, very, very important. 

Mr. WIGGINS. I agree. I know that. I have been doing that internally through our CCGB process and our various governance procVerDate Nov 24 2008 13:22 Jul 21, 2017 Jkt 000000 PO 00000 Frm 00077 Fmt 6633 Sfmt 6633 H:\26178.TXT APRIL

KING-6430 with DISTILLER
72 

esses. I am assuming that we are reporting that to OMB, but I 

have to make sure that we actually have done so. 

Mr. BLUM. Mr. McCormack? 

Mr. MCCORMACK. Yes, we have done that analysis. We have 

pulled that information together, done that analysis, and we do report on that. 

Mr. BLUM. Are there savings? Are there duplication? Is there 

waste? Is it substantial? 

Mr. MCCORMACK. I am sorry? 

Mr. BLUM. That number, what you have come up with in that 

report, is it a substantial dollar amount of duplication, waste, and 

cost savings? 

Mr. MCCORMACK. It was substantial. It’s less substantial now because we have done a lot of work to wring those cost savings out, 

right? So we talked about the 40 data centers that we have consolidated. And that’s where a lot of our cost savings came from. While 

we have, you know, there are 60 to go, we are not going to get the 

same kind of savings opportunities there simply because there is 

just not that much—as much savings in there because of the nature of the types of data centers. 

We’ve put together over a dozen enterprise license agreements 

based on this analysis that we had done with the duplication and 

the opportunities there. We have wrung out significant savings in 

those areas as well. And so while we continue to do this analysis 

and go after these opportunities, obviously over time they become 

less and less because the low-hanging fruit has been pursued. 

Mr. BLUM. Let me ask you a follow-up question to your answer. 

What incentives are there for Federal employees to seek out, to 

find duplication, waste, cost savings? What incentives are there? 

Are there any financial incentives? In the private sector, where I 

come from, there is financial incentives typically. Are there any in 

the Federal Government? Are there any in the IT area in DHS? 

Mr. MCCORMACK. I would like to hope I am speaking on behalf 

of every public servant that everyone wants to do the right thing. 

I would say what would incentivize a component CIO, particularly 

in the Department of Homeland Security and I think other areas 

as well, we did this at DOJ, is what I call the cut, cost, and reinvest, where if you give them the opportunity to cut those costs and 

then reinvest it into these areas that they need funding in versus 

just sweep it up and go buy Coast Guard cutters or helicopters or 

whatever it is the agency needs—and of course we make those decisions based on risk and other things—but if there is an opportunity 

for them to use those savings then there is always more incentive 

to pursue it. And so that has worked really well for us. 

Mr. BLUM. But there is no personal financial incentive. 

Mr. MCCORMACK. There is no personal financial incentive for it 

other than internal goodness to stretch the taxpayer’s dollar. 

Mr. BLUM. Would an idea to have personal financial incentives, 

would that have some merit, do you think? Is there a place for that 

in government? 

Mr. MCCORMACK. I would say personally no. That’s not why civil 

servants become Federal employees, right? I would say no. 

Mr. BLUM. What would you say to that, Mr. Wiggins? The same 

question. 


KING-6430 with DISTILLER
73 

Mr. WIGGINS. Yeah, first of all, it has been confirmed by somebody smarter than me that we do report our cost savings to OMB, 

and it is on the IT Dashboard. So I can confirm that we have done 

that. 

I would say we have taken a look at it from a slightly different 

perspective. We have an award for IT innovation, it stands for 

Sean Smith award. So we promote innovation, and there is a cash 

incentive and an award for that. 

In addition, we have something called the Thomas Morrison 

award, which is for the IT manager of the year, and there is a cash 

incentive for that, and that includes both innovation and improvement in processes. 

So we have a couple of ways of getting at it through innovation. 

It is not necessarily a cost saving metric, but oftentimes when we 

put innovation into place there is a cost savings realized through 

that. 

Mr. BLUM. Just for the record, I come from the private sector. I 

think personal financial incentives for employees are good things, 

and I think we could use more of it in government. 

Do you have a comment on that, Mr. Powner, before I yield back, 

at all? I notice you are kind of smiling. 

Mr. POWNER. I think right now in the government it’s not set up 

that way. 

I do think Mr. McCormack’s point on the reinvest is very important. If I’m at DHS, I want to reinvest money to better secure the 

homeland. There’s a lot of things we can’t get to that we need to 

get to and do a much better job to protect this country. And that 

would be the incentive, to save money on inefficiencies and do a 

better job on the mission side. 

Mr. BLUM. Thank you. 

Thank you, Chairman Hurd. And I yield back. 

Mr. HURD. And, gentlemen, we hear you loud and clear. We are 

trying to give you an additional tool to be able to use that savings 

you realize. Unfortunately, it’s likely to have to wait until 2017 to 

pull that trigger. 

I would now like to recognize Mr. Connolly again, round two. 

Mr. CONNOLLY. Thank you, Mr. Chairman. 

And I would say to my friend from Iowa, we are not entirely 

lacking in incentives. Now, Mr. Hurd and I and Ms. Kelly and others are actually—that’s what the MGT Act does writ large in rewarding agencies by reinvesting the savings. And our silly system 

here with CBO is precluding us from doing it, frankly, by double 

counting money. It’s a very strange, Druidic methodology, passive 

understanding. But at any rate we can talk about that later. 

But there are also some personal incentives. There are rewards. 

Every agency has its own reward program. There are bonuses, performance bonuses in Federal service, which they are not as generous as the private sector. I was in the private sector too for 20 

years. But it’s not nonexistent. And maybe we should take a fresh 

look at this in terms of incentivizing Federal employees a little bit 

more generously. God knows we haven’t been very generous to Federal employees in the last number of years. But I think it’s an idea 

worthy of merit, and I thank my colleague from Iowa for bringing 

it up. 


KING-6430 with DISTILLER
74 

This subject of risk, I think one of the things, Mr. Powner, we 

have discovered is it’s really hard to get people to identify high 

risk. One of the great achievements, contributions GAO made was 

by putting IT projects on the high risk list on your own really, 

which got the attention up here and I think in some Federal agencies. But you looked at 95 specific IT projects. In your conclusion, 

60 of the 95 were kind of low balled. They were actually riskier 

than identified. Is that correct? 

Mr. POWNER. That’s correct. 

Mr. CONNOLLY. And to what do you attribute that? 

Mr. POWNER. That particular study, we looked at CIOs rated 60 

investments as green, and we only agreed with 10 of those. We 

thought 50 of the 60 should have been yellow or red. And it was 

just based on the agency data. 

And our point on that is you need to acknowledge risk to effectively manage it. So that’s why the dashboard, it’s too green right 

now. By nature a large of these large IT investments are risky. A 

lot of them are moderate risk, just what we are trying to do. Just 

acknowledge it so we can more effectively manage that way. 

Actually, both these agencies do a pretty decent job, both DHS 

and State Department, on acknowledging risk. They are some of 

our higher scores. And to their credit they have yellows and reds 

appropriately. 

Mr. CONNOLLY. Correct me if I’m wrong. My memory says 

USAID had no high risk projects, is that correct, identified? 

Mr. POWNER. That is correct. 

Mr. CONNOLLY. It was all green. 

Mr. POWNER. They got an F. 

Mr. CONNOLLY. Everything is just fine. 

Mr. POWNER. Yes. 

Mr. CONNOLLY. Nothing to look at here. Keep on moving by. 

Mr. POWNER. Everything is green, yes. 

Mr. CONNOLLY. Yeah. 

Mr. Wiggins, does that make any sense? I mean, for 10 years of 

my life I wrote the authorization in the Senate for USAID. I traveled all over the world looking at their projects and doing oversight. And I am deeply committed, actually, to our foreign assistance program. But to say it’s low risk doesn’t pass the giggle test. 

What’s going on, do you think, at USAID? And Iunderstand it’s 

a sister agency and it’s not entirely within your portfolio, but you 

are as close as we are going to get at this table to them. 

Mr. WIGGINS. So as a proxy for Jay Mahanand, I would say that 

as an outsider that needs to be looked at. I would say if everything 

is green it’s—historically, IT projects are very high risk. Something 

in the neighborhood of 80 percent of them failed. I know for a fact 

that we have about 77 percent of ours that are on target. That 

leaves the other 23-odd percent. So without throwing Jay under the 

bus, I would say I probably need to have a conversation with him 

about that. 

Mr. CONNOLLY. And I would say if the motivation of some is to 

cover up risk, actually now that we are making this a formal metric you are putting yourself at risk if you call it green and it turns 

out to collapse, I thought you said it was fine. And so I think actually it’s worthy of a second look by your counterparts across the 


KING-6430 with DISTILLER
75 

board, including at AID, to take a fresh look at this, because I 

think it’s a tool that can help them and protect them and allow us 

to take some management measures to shore it up. It’s not designed to sort of give you a bad grade because you’re about to fail 

or what’s wrong with you for even undertaking a high risk project. 

That’s not the intent here. And I hope it will be seen for the management tool it was intended. 

Thank you, Mr. Chairman. 

Mr. HURD. Sure. 

Mr. Fulghum, when you signed the DHS FITARA implementation plan, was that as your role as CFO or acting CFO or your role 

as the acting deputy under secretary? 

Mr. FULGHUM. As the CFO. 

Mr. HURD. As the CFO? And how much conversation did you 

have with the Secretary and the deputy secretary on the implementation of FITARA? 

Mr. FULGHUM. As it relates to FITARA? 

Mr. HURD. Uh-huh. The FITARA implementation plan specifically. 

Mr. FULGHUM. I would say not routinely. 

Mr. HURD. Thank you. 

Has Mr. McCormack ever halted or terminated a troubled 

project? 

Mr. FULGHUM. Mr. McCormack has recommended pausing a 

troubled program, yes. 

Mr. HURD. Was the program paused? 

Mr. FULGHUM. I’m sorry? 

Mr. HURD. Was the program paused? 

Mr. FULGHUM. Yes. 

Mr. HURD. Mr. McCormack, was there only one program that 

should have been paused within DHS in your 3 years? Was there 

only one program in your 3 years that you have been at DHS, only 

one software or IT program that should have been paused or halted? 

Mr. MCCORMACK. No, there was more. 

Mr. HURD. There was more? 

Mr. MCCORMACK. There was more than one that was paused. 

Mr. HURD. And so have you had difficulty in pausing or terminating a troubled program? 

Mr. MCCORMACK. No, not at all. 

Mr. HURD. Good copy. 

Mr. MCCORMACK. Again, as I referred back to that acquisition review board, not only the CIO, quite frankly, that whole community 

has the ability to throw that flag in and say, ‘‘I have concerns 

about this,’’ in regards to a pause. So yeah, we’ve paused more 

than one for a variety of reasons. 

Mr. HURD. Some of your peers have expressed concern with the 

FITARA scorecard. I appreciate your all’s open input not only 

today, but meeting with staff on this issue. I would like my last 

question to be any insights or suggestions that you all have on how 

you would like to see this FITARA scorecard implemented or things 

you would like to see on the FITARA scorecard? 

Because the reality is I think we ought to go beyond just 

FITARA. We should be looking at the implementation of FISMA, 


KING-6430 with DISTILLER
76 

how are we implementing the Megabyte Act when it comes to software licensing. It should be a scorecard on how you do good digital 

system hygiene. 

But I would welcome, Mr. McCormack, Mr. Wiggins, whoever 

would like to go first, any feedback that you all may have. 

Mr. MCCORMACK. So I will take a crack at that. A couple things. 

One, I saw your alarm about the frequency in which I meet with 

the leadership, whether it’s once a month or two or three times a 

month or a couple times a week. It varies. 

I think what’s more important, which is what I had pointed out 

earlier, and I am not quite sure, I am looking over at GAO here 

about how to measure it, but to me, and this is the same discussion 

I had at the White House the other day, that you have got to be 

able to measure that goal congruence issue with the other CxOs for 

these different activities, whether it’s FISMA, whether it’s the digital transformation activities, whether it’s FITARA. Somehow or 

another, you have to measure more than what the CIO is doing. 

What I had explained to the deputy under secretary, CIOs in 

agencies in large part are completely dependent on their chief acquisition officers. They are completely dependent. 

Mr. HURD. Should they though? 

Mr. MCCORMACK. What’s that? 

Mr. HURD. Should they? Should they be responsible or should 

you have that authority do that? You’re the one responsible for defending that system or making sure that system is working and 

you should be responsible—— 

Mr. MCCORMACK. Right, but I don’t hold—I don’t have employees 

that work for me that hold a warrant, right? Unless you’re going 

to change those laws, then I am relying, and I should be, on the 

chief acquisition officer, the chief human capital officer. They’re the 

only ones that can issue an offer for employment to a Federal employee. I can’t do that, right? 

And so the point I’m trying to make there is that community has 

to be aligned on these various goals and objectives. And whoever 

that community reports to directly, that’s what you want to be 

measuring, right? And in this case, that’s the deputy under secretary of management. Over at DOJ, it was the equivalent of that. 

It’s different in different agencies. 

But I think it is very important to figure out how to incorporate 

that into the measurements. Not just the CIO, it’s a village that 

does these things. And it’s typically that CxO span that gets involved in this, particularly the CFO, the CHCO, and the chief acquisition officer. 

Mr. FULGHUM. Sir, could I add to that? So I think in DHS we’re 

uniquely positioned with the under secretary for management 

structure in that he gets and the other lines of business get a lot 

of attention and, as he likes to say, goal congruence in terms of 

making sure that each line of business is supporting the other. 

We have a set of integrated priorities which we get together on 

a very routine basis and measure progress. And I believe we have 

got numerous examples of how that structure is working well for 

our Department. We have got more to do. But that structure that 

we have in place, I believe, is one of the reasons we have been as 

successful as we have been. 


KING-6430 with DISTILLER
77 

Mr. HURD. Mr. Wiggins? 

Mr. WIGGINS. As I mentioned earlier, I think that one of the 

things that would be helpful is if we go from a binary on the reporting structure to a qualitative and quantitative, frequency of 

meetings and what actually are the outcomes from those meetings 

with senior leadership. 

The other thing I would say from a FITARA perspective since we 

are up to, is it, 3.0 now, is a FITARA cookbook of best practices 

that have come out from the other agencies. Either OMB can publish it or GAO. I would like to steal some of Renee’s work that she 

did to get NASA so far ahead. I do have interaction with her 

through the CIO Council, but not as often as I would like. If there 

were a step-by-step guide on some of the most successful implementations of FITARA from some of the other agencies, we could 

look to map that back, and in a very cost-effective way. 

The other thing I would suggest, and I am probably getting into 

waters that are beyond my remit perhaps, but we haven’t really 

talked today about shadow IT and some of the issues that confront 

agencies related to some of the rogue elements that are out there 

doing things and is there a pejorative or punitive element to when 

the CIO does become aware of shadow IT and they try to loop it 

in, is there some way that either people are going to be held more 

accountable or there is some, as you said, kind of incentivization 

for the CIOs who do kind of loop that in. 

Right now we are going through a process of identifying all the 

data centers, non-enterprise data centers out there as well as well 

as non-enterprise dedicated Internet networks and non-enterprise 

applications that are out there. We are trying to get our hands 

around it. We are supposed to get a report the middle of next 

month on exactly what’s happening. That’s been driven by the deputy secretary in particular. 

So once we get our hands around that and start marching 

through those, FITARA gives us authority to do a lot of things. I 

don’t want to get into the punitive aspects of it, but that might be 

helpful as well. 

The other thing, of course, cyber is woven into a lot of this, 

cybersecurity. It’s not called out specifically in some of the things 

we are currently measuring, but it touches just about everything 

we are talking about, whether it’s the workforce or it’s the status 

of our systems. So having some kind of cybersecurity measure in 

there built into some of these metrics would be helpful. 

And lastly, and again preaching to the converted, obviously, is 

this whole aspect of the workforce and gaining a better measure on 

exactly how best practices are being taken in different agencies to 

hire, train, retain, and recognize the best workforce out there for 

IT so that government can be a place that people want to come to. 

For example, in the Department of State right now, we are doing 

a public-private partnership. We are going to be sending people out 

to Silicon Valley. I am paying for that out of my budget, for people 

to go out for a 1-year sabbatical with Cisco. I am doing another one 

with a partner agency up in Maryland. People will go and spend 

18 months to 2 years up there to bring best practices back. 

So if, again, there are best practices or a workforce advisory 

piece that could be enhanced through FITARA that would give us 


KING-6430 with DISTILLER
78 

a little more leverage and more ideas, I think that would be tremendously helpful. I think there are some provisions there already, 

and we just need to flesh them out and continue to refine them. 

Mr. HURD. Mr. Wiggins, if you find shadow IT, I think you’re 

going to be patted on the back, because in 4 months it’s very hard 

to say that that shadow IT existed during your tenure. 

Mr. WIGGINS. If I can offer for the record as well, our partnership 

with our chief acquisition officer has brought to light in just in the 

last few months a $500,000 shadow IT effort that we’ve currently 

blocked. So with our partnerships through the budget and planning 

office and also our chief acquisition officer we are finding these 

things. But like so many things, when you kick over a rock you 

have to be careful what you find. 

Mr. HURD. I would like to yield to the gentleman from Virginia. 

Mr. CONNOLLY. I was just going to actually say to you, Mr. 

Chairman, I agree with you that at some point we probably want 

to broaden the scorecard. But I do think while we are still in the 

embryonic stage of implementation of FITARA, we want to get the 

fundamentals right. You look at data center consolidation, and 

there is nothing about those metrics that would allow us to conclude, well, we are pretty much over that one. In fact, until very 

recently, we kept on discovering more of them. We weren’t shrinking them, we were actually getting apparently more accurate in 

identifying them. And I think we went by a factor of six or seven 

over the original estimate by Vivek Kundra in the first year of this 

administration. 

So, I mean, I would just hope we keep in mind what you said, 

but that we also for now try to deal with the basics so that we get 

the fundamentals in place that allow us to better grapple with 

cyber threats and the like. 

So thank you, Mr. Chairman. 

Mr. HURD. Crawl, walk, run. 

And I know I said that was my last question, but this just came 

to my mind. Mr. Wiggins and Mr. McCormack, you are the two individuals within your agencies that can provide an ATO, an authorization to operate. Is that correct? 

Mr. WIGGINS. That’s correct. 

Mr. HURD. Mr. Pitkin, if Mr. Wiggins did not give or grant an 

ATO, what would happen to that project? 

Mr. PITKIN. We would look at reducing funding for it during the 

budget process, either in formulation or execution. If there were 

some other mitigating factor, of course, the subject group would 

have a chance to raise that issue. But of course the CIO would still 

have that ultimate authority. 

Mr. HURD. So is not giving an ATO, is that the equivalent of trying to halt a program? 

Mr. PITKIN. I am not an expert in the authorities, but that’s how 

I would interpret it. But he may have a better—— 

Mr. HURD. Mr. Wiggins, do you have something to comment? 

Mr. WIGGINS. Yes, but there are a couple of ways we get at that. 

We also have a capital investment process that looks at individual 

projects as they are brought to us. There is a preselect, select, control, and then review process. So we can stop projects in their 

tracks right there. Also through the advanced PIT process. 


KING-6430 with DISTILLER
79 

The ATO authority, as a DAA, the designated authority, authorizing official, I can stop things in their tracks, and I have done it, 

in particular with cloud offerings. There was a big rush to the 

cloud, but we put in place governance, the CCGB, as I mentioned 

earlier, and if something has not gone through the CCGB I do not 

give it an ATO and it should not exist either externally to our network in the cloud or internally within any of our networks. 

Mr. HURD. Good copy. Mr. 

Fulghum, how does the process work at DHS. 

Mr. FULGHUM. Depending on the circumstances surrounding, if 

it’s a renewal of an ATO or an initial issue of an ATO and what 

he recommends, we would take corresponding budgetary action. 

Mr. HURD. Good copy. 

I would like to thank our witnesses for taking the time today to 

appear before us. I think this is our first hearing that wasn’t interrupted by votes, makes it our last one of the year. If there is no 

further business, without objection, the subcommittee stands adjourned. 

[Whereupon, at 3:57 p.m., the subcommittees were adjourned.] 

Æ 


KING-6430 with DISTILLER