```

[House Report 115-344]
[From the U.S. Government Publishing Office]



115th Congress    }                                 {        Report
                        HOUSE OF REPRESENTATIVES
 1st Session      }                                 {         115-344
======================================================================

 
                     FITARA ENHANCEMENT ACT OF 2017

                                _______
                                

October 10, 2017.--Committed to the Committee of the Whole House on the 
              State of the Union and ordered to be printed

                                _______
                                

   Mr. Gowdy, from the Committee on Oversight and Government Reform, 
                        submitted the following

                              R E P O R T

                        [To accompany H.R. 3243]

      [Including cost estimate of the Congressional Budget Office]

    The Committee on Oversight and Government Reform, to whom 
was referred the bill (H.R. 3243) to amend title 40, United 
States Code, to eliminate the sunset of certain provisions 
relating to information technology, to amend the National 
Defense Authorization Act for Fiscal Year 2015 to extend the 
sunset relating to the Federal Data Center Consolidation 
Initiative, and for other purposes, having considered the same, 
report favorably thereon without amendment and recommend that 
the bill do pass.

                                CONTENTS

                                                                   Page
Committee Statement and Views....................................     2
Section-by-Section...............................................     5
Explanation of Amendments........................................     5
Committee Consideration..........................................     6
Roll Call Votes..................................................     6
Application of Law to the Legislative Branch.....................     6
Statement of Oversight Findings and Recommendations of the 
  Committee......................................................     6
Statement of General Performance Goals and Objectives............     6
Duplication of Federal Programs..................................     6
Disclosure of Directed Rule Makings..............................     6
Federal Advisory Committee Act...................................     6
Unfunded Mandates Statement......................................     7
Earmark Identification...........................................     7
Committee Estimate...............................................     7
Budget Authority and Congressional Budget Office Cost Estimate...     7
Changes in Existing Law Made by the Bill, as Reported............     8

                     Committee Statement and Views

                          PURPOSE AND SUMMARY

    H.R. 3243, the FITARA Enhancement Act of 2017, reauthorizes 
several provisions in the Federal Information Technology 
Acquisition Reform Act (FITARA).\1\ These provisions relate to 
requirements aimed at increasing transparency and improving 
risk management of major federal information technology (IT) 
investments and establishing agency reviews of IT portfolios to 
reduce duplication and realize savings. This bill also extends 
requirements related to goals and deadlines for the agency data 
center consolidation initiative from 2018 to 2020.
---------------------------------------------------------------------------
    \1\National Defense Authorization Act for Fiscal Year 2015, Pub. L. 
No. 113-291, Title VIII, Subtitle D, 128 Stat. 3292, 3438-3450 (2014).
---------------------------------------------------------------------------

                  BACKGROUND AND NEED FOR LEGISLATION

    In fiscal year 2017, the Federal Government will spend more 
than $89 billion on IT.\2\ Over 75 percent of this spending is 
on operating and maintaining legacy IT systems.\3\ Legacy IT is 
often inefficient, costly to maintain, and can have greater 
security vulnerabilities. The taxpayer's return on IT 
investments is often at risk with an acquisition system plagued 
with delays and rising costs. Generally, the IT acquisition 
system does not reward innovation and excellence. Large 
government IT investments can take years while the private 
sector rewards speed and innovation. Given this state of 
affairs, Congress recognized the need for reform to address IT 
management and acquisition challenges.
---------------------------------------------------------------------------
    \2\U.S. Budget Fiscal Year 2017, Analytical Perspectives: 
Information Technology 287 (Feb. 2016).
    \3\Gov't Accountability Office, GAO-16-468, Federal Agencies Need 
to Address Aging Legacy Systems (2016).
---------------------------------------------------------------------------
    In December 2014, Congress passed the Federal Information 
Technology Acquisition Reform Act (FITARA) to address some of 
these challenges.\4\ FITARA represented the first serious IT 
acquisition and management reform effort since the Clinger-
Cohen Act of 1996.\5\
---------------------------------------------------------------------------
    \4\National Defense Authorization Act Fiscal Year 2015, Pub. L. No. 
113-291, Title VIII, Subtitle D (Dec. 19, 2014).
    \5\40 U.S.C. Sec. 11101 et seq.
---------------------------------------------------------------------------
    In February 2015, the Government Accountability Office 
(GAO) added ``Improving the Management of IT Acquisitions and 
Operations'' to its annual High Risk List for the first time, 
confirming the need for the reforms codified in FITARA. As of 
January 2015, only 23 percent of the 737 recommendations were 
fully implemented.\6\ GAO designates areas as ``high risk due 
to their greater vulnerabilities to fraud, waste, abuse, and 
mismanagement or the need for transformation to address 
economy, efficiency, or effectiveness challenges.''\7\
---------------------------------------------------------------------------
    \6\Gov't Accountability Office, GAO-15-290, 2015 High Risk Report 
39 (2015).
    \7\Id. at i.
---------------------------------------------------------------------------
    FITARA provides a vital tool for Congress to conduct 
oversight of federal IT management and acquisition. Key FITARA 
provisions include clarifications related to Chief Information 
Officer (CIO) authority, requirements for agency CIOs and the 
Office of Management and Budget (OMB) related to the management 
and acquisition of IT, and directives to the GAO for further 
oversight.
    First, FITARA enhances existing CIO authorities by ensuring 
the CIO has a significant role in the budgeting, execution, 
management, and governance processes related to IT management 
and acquisition.\8\ Second, FITARA establishes key requirements 
to enhance transparency and improve risk management for federal 
IT investments. FITARA does this by requiring OMB to publish on 
the IT Dashboard a list by agency of major IT investments with 
data on cost, schedule, and performance, and requiring agency 
CIOs to certify the accuracy of this data.\9\ This provision 
expires on December 19, 2019. Third, FITARA requires OMB and 
agency CIOs to review annually agency IT investments and 
evaluate their entire IT Portfolio.\10\ Specifically, CIOs must 
identify: (1) ways to increase efficiencies and effectiveness 
of IT investments; (2) potential duplication and waste; and (3) 
cost savings. This provision expires on December 19, 2019. 
Fourth, FITARA requires agencies to develop implementation 
plans to inventory and consolidate data centers and to report 
to OMB on their performance under these plans.\11\ OMB is also 
required to develop metrics, including cost savings, for 
government-wide data center consolidation and optimization 
plans. Further, GAO must review and verify agencies' data 
center consolidation efforts. This provision expires on October 
1, 2018.
---------------------------------------------------------------------------
    \8\Pub. L. No. 113-291, Sec. 831.
    \9\Id. at Sec. 832; see https://www.itdashboard.gov.
    \10\Pub. L. No. 113-291, Sec. 833.
    \11\Id. at Sec. 834.
---------------------------------------------------------------------------
    These provisions were established with sunset dates to 
evaluate the effectiveness of the requirements. These 
provisions have proven valuable in the Committee's IT oversight 
activities and improving federal IT management and operations, 
and therefore should be permanently authorized. The Committee 
has furthered the goals of FITARA with vigorous oversight, 
including the development of a FITARA Scorecard to evaluate 
agencies' FITARA implementation activities and holding several 
FITARA-related hearings since the law was passed in 2014.
    The Committee, with technical assistance from GAO, 
developed the Scorecard to assess implementation of four key 
FITARA provisions.\12\ The Scorecard relies on agency self-
reported data and GAO verification of such data. The Scorecard 
assesses the following areas: (1) CIO authority enhancements; 
(2) enhanced transparency and improved risk management; (3) IT 
Portfolio review; and (4) federal data center consolidation 
initiative. For Scorecard area one (CIO authority 
enhancements), the Scorecard assesses agencies' use of 
incremental development, which is a preferred approach to IT 
development, and requires agency CIO certification of its use. 
For area two (enhanced transparency and improved risk 
management), the Scorecard rewards agencies that are reporting 
more risk on major IT investments because GAO found agencies 
were typically under-reporting risk; thereby putting the 
success of these IT investments at risk. For area three (IT 
Portfolio review), the Scorecard calculates a grade by dividing 
agency's reported savings through the IT Portfolio review 
process by the agency's total IT budget for the most recent 
three fiscal years and assigns a grade relative to other 
agencies' performance in this area. For area four (data center 
consolidation), the Scorecard grades generally are based on the 
percentage of planned savings realized through data center 
consolidation.
---------------------------------------------------------------------------
    \12\The Federal Information Technology Acquisition Reform Act 
(FITARA) Scorecard 4.0: Hearing Before the Information Technology and 
Government Operations Subcommittees of H. Comm. on Oversight & Gov't 
Reform, 115th Cong. (June 13, 2017), available at https://
oversight.house.gov/hearing/federal-information-technology-acquisition-
reform-act-fitara-scorecard-4-0/.
---------------------------------------------------------------------------
    H.R. 3243 permanently authorizes areas two (enhanced 
transparency and improved risk management) and three (IT 
Portfolio review) of FITARA and extends the sunset for area 
four (data center consolidation). This will ensure the 
continuation of FITARA requirements that inform the Congress's 
oversight of federal IT acquisition.
    The Committee highlighted the results of the Scorecard and 
the priority the Committee places on FITARA implementation with 
hearings. Overall, the Committee has held five FITARA-related 
hearings of the Subcommittees on Information Technology and 
Government Operations:
           June 10, 2015, hearing titled, The Federal 
        Information Technology Acquisition Reform Act's Role in 
        Reducing IT Acquisition Risk;\13\
---------------------------------------------------------------------------
    \13\The Federal Information Technology Acquisition Reform Act's 
Role in Reducing IT Acquisition Risk: Hearing Before the Subcomms. on 
Information Technology and Government Operations of the H. Comm. on 
Oversight & Gov't Reform, 114th Cong., Serial NO. 114-43 (June 10, 
2015).
---------------------------------------------------------------------------
           November 4, 2015, hearing titled, The 
        Federal Information Technology Acquisition Reform Act's 
        (FITARA) Role in Reducing IT Acquisition Risk, Part II: 
        Measuring Agencies' FITARA Implementation (first FITARA 
        Scorecard released);\14\
---------------------------------------------------------------------------
    \14\The Federal Information Technology [Acquisition] Reform Act's 
(FITARA) Role in Reducing IT Acquisition Risk, Part II: Measuring 
Agencies' FITARA Implementation: Hearing Before the Subcomms. on 
Information Technology and Government Operations of the H. Comm. on 
Oversight & Gov't Reform, 114th Cong., Serial NO. 114-89 (Nov. 4, 
2015).
---------------------------------------------------------------------------
           May 18, 2016, hearing titled, The Federal 
        Information Technology Acquisition Reform Act Scorecard 
        2.0;\15\
---------------------------------------------------------------------------
    \15\The Federal Information Technology [Acquisition] Reform Act 
Scorecard 2.0: Hearing Before the Subcomms. on Information Technology 
and Government Operations of the H. Comm. on Oversight & Gov't Reform, 
114th Cong., Serial NO. 114-159 (May 18, 2016).
---------------------------------------------------------------------------
           December 6, 2016, hearing titled, The 
        Federal Information Technology Acquisition Reform Act 
        (FITARA) Scorecard 3.0: Measuring Agencies 
        Implementation;\16\ and
---------------------------------------------------------------------------
    \16\The Federal Information Technology [Acquisition] Reform Act 
(FITARA) Scorecard 3.0: Measuring Agencies Implementation: Hearing 
Before the Subcomms. on Information Technology and Government 
Operations of the H. Comm. on Oversight & Gov't Reform, 114th Cong., 
Serial NO. 114-171 (Dec. 6, 2016).
---------------------------------------------------------------------------
           June 13, 2017, hearing titled, The Federal 
        Information Technology Acquisition Reform Act (FITARA) 
        Scorecard 4.0.\17\
---------------------------------------------------------------------------
    \17\The Federal Information Technology Acquisition Reform Act 
(FITARA) Scorecard 4.0: Hearing Before the Subcomms. on Information 
Technology and Government Operations of the H. Comm. on Oversight & 
Gov't Reform, 115th Cong., Serial NO. 115-27 (June 13, 2017).
---------------------------------------------------------------------------
    In light of the improvements agencies made and the 
effectiveness of the FITARA Scorecard, the Committee recognized 
the need to eliminate the sunsets and extend the original 
expiration date for several key FITARA provisions. 
Consequently, H.R. 3243 will: (1) extend the requirements for 
agencies to publicly report schedule and cost information and 
assess the risks of major IT investments; (2) extend the 
requirement for each agency to regularly assess its IT 
portfolio, looking for opportunities to reduce duplication and 
find savings; and (3) continue to hold agencies accountable for 
consolidating and optimizing their data centers by extending 
these requirements through 2020.
    In the June 13, 2017, hearing, GAO, which has been 
instrumental in assisting the Committee with overseeing FITARA 
implementation, expressed support for extending these 
provisions.\18\ GAO has also reported that agencies have made 
progress in addressing GAO recommendations to address the high-
risk status of the management of IT acquisition and operations. 
In a March 28, 2017, hearing, GAO acknowledged that as of 
December 2016, OMB and agencies fully implemented approximately 
46 percent of about 800 related recommendations made by GAO 
(compared to 23 percent in 2015).\19\ In sum, the tools 
provided in FITARA and the Committee's vigorous oversight of 
FITARA implementation by Federal agencies have resulted in 
demonstrable improvements and focused the attention of agencies 
on this high-risk area. H.R. 3243 will facilitate the 
Committee's work in this area by eliminating the sunset 
provisions and extending a deadline for key FITARA provisions.
---------------------------------------------------------------------------
    \18\The Federal Information Technology Acquisition Reform Act 
(FITARA) Scorecard 4.0 Hearing Before Information Technology and Gov't 
Operations Subcommittees of the H. Comm. on Oversight & Gov't Reform, 
115th Cong. (June 13, 2017) (Testimony of David A. Powner, Director of 
Information Technology Mgmt Issues, Gov't Accountability Office).
    \19\Gov't Accountability Office, GAO-17-494T, Implementation of IT 
Reform Law and Related Initiatives Can Help Improve Acquisitions 
(2017).
---------------------------------------------------------------------------

                          LEGISLATIVE HISTORY

    On July 14, 2017, Representative Gerald Connolly (D-VA) 
introduced H.R. 3243, the FITARA Enhancement Act of 2017, with 
Representatives Darrell Issa (R-CA), Mark Meadows (R-NC), and 
Robin Kelly (D-IL). H.R. 3243 was referred to the Committee on 
Oversight and Government Reform. The Committee considered H.R. 
3243 at a business meeting on July 19, 2017, and ordered the 
bill reported favorably by voice vote.

                           Section-by-Section

Section 1. Short title

    The short title is the ``FITARA Enhancement Act of 2017''.

Section 2. Elimination of sunset relating to transparency and risk 
        management of major information technology investments

    Section 2 strikes a sunset related to section 11302(c) of 
title 40, United States Code.

Section 3. Elimination of sunset relating to information technology 
        portfolio, program, and resource reviews

    Section 3 strikes a sunset related to section 11319 of 
title 40, United States Code, and makes a technical amendment.

Section 4. Extension of sunset relating to Federal data center 
        consolidation initiative

    Section 4 extends a sunset related to section 834 of FITARA 
from 2018 until 2020.

                       Explanation of Amendments

    There were no amendments to H.R. 3243 offered or agreed to 
during Committee consideration of the bill.

                        Committee Consideration

    On July 19, 2017, the Committee met in open session and, 
with a quorum being present, ordered the bill favorably 
reported by voice vote.

                            Roll Call Votes

    There were no roll call votes during consideration of H.R. 
3243.

              Application of Law to the Legislative Branch

    Section 102(b)(3) of Public Law 104-1 requires a 
description of the application of this bill to the legislative 
branch where the bill relates to the terms and conditions of 
employment or access to public services and accommodations. 
This bill reauthorizes several provisions of the Federal 
Information Technology Acquisition Reform Act (Pub. L. No. 113-
291, Title VIII, Subtitle D, 128 Stat. 3292, 3438-3450). As 
such, this bill does not relate to employment or access to 
public services and accommodations.

  Statement of Oversight Findings and Recommendations of the Committee

    In compliance with clause 3(c)(1) of rule XIII and clause 
(2)(b)(1) of rule X of the Rules of the House of 
Representatives, the Committee's oversight findings and 
recommendations are reflected in the descriptive portions of 
this report.

         Statement of General Performance Goals and Objectives

    In accordance with clause 3(c)(4) of rule XIII of the Rules 
of the House of Representatives, the Committee's performance 
goal or objective of this bill is to eliminate the sunset of 
certain provisions relating to information technology and to 
extend the sunset relating to the Federal Data Center 
Consolidation Initiative.

                    Duplication of Federal Programs

    In accordance with clause 2(c)(5) of rule XIII no provision 
of this bill establishes or reauthorizes a program of the 
Federal Government known to be duplicative of another Federal 
program, a program that was included in any report from the 
Government Accountability Office to Congress pursuant to 
section 21 of Public Law 111-139, or a program related to a 
program identified in the most recent Catalog of Federal 
Domestic Assistance.

                  Disclosure of Directed Rule Makings

    The Committee estimates that enacting this bill does not 
direct the completion of any specific rule makings within the 
meaning of section 551 or title 5, United States Code.

                     Federal Advisory Committee Act

    The Committee finds that the legislation does not establish 
or authorize the establishment of an advisory committee within 
the definition of Section 5(b) of the appendix to title 5, 
United States Code.

                      Unfunded Mandates Statement

    Pursuant to section 423 of the Congressional Budget and 
Impoundment Control Act (Pub. L. 113-67), the Committee has 
included a letter received from the Congressional Budget Office 
below.

                         Earmark Identification

    This bill does not include any congressional earmarks, 
limited tax benefits, or limited tariff benefits as defined in 
clause 9 of rule XXI of the House of Representatives.

                           Committee Estimate

    Pursuant to clause 3(d)(2)(B) of rule XIII of the Rules of 
the House of Representatives, the Committee includes below a 
cost estimate of the bill prepared by the Director of the 
Congressional Budget Office under section 402 of the 
Congressional Budget Act of 1974.

   New Budget Authority and Congressional Budget Office Cost Estimate

    Pursuant to clause 3(c)(3) of rule XIII of the House of 
Representatives, the cost estimate prepared by the 
Congressional Budget Office and submitted pursuant to section 
402 of the Congressional Budget Act of 1974 is as follows:

                                                September 29, 2017.
Hon. Trey Gowdy,
Chairman, Committee on Oversight and Government Reform,
House of Representatives, Washington, DC.
    Dear Mr. Chairman: The Congressional Budget Office has 
prepared the enclosed cost estimate for H.R. 3243, the FITARA 
Enhancement Act of 2017.
    If you wish further details on this estimate, we will be 
pleased to provide them. The CBO staff contact is Matthew 
Pickford.
            Sincerely,
                                                        Keith Hall.
    Enclosure.

H.R. 3243--FITARA Enhancement Act of 2017

    H.R. 3243 would amend the Federal Information Technology 
Acquisition Reform Act (FITARA) to permanently extend some 
expiring provisions. FITARA was enacted as part of the National 
Defense Authorization Act for Fiscal Year 2015 and primarily 
made changes to how the U.S. government buys and manages 
computer technology. Specifically, the bill would extend the 
Federal Data Center Consolidation Initiative (FDCCI), 
PortfolioStat reviews, and the information technology (IT) 
dashboard.
    The FDCCI aims to reduce costs and save energy, 
PortfolioStat reviews are face-to-face meetings between each 
agency's IT officers and the Office of Management and Budget 
(OMB), and the IT dashboard provides online details of federal 
information technology spending. Information from OMB suggests 
that implementing those efforts costs a few million dollars 
annually for agencies to produce the necessary information; 
however, OMB expects that much of this work would continue 
regardless of the expiring authority to conduct them. Thus, CBO 
estimates there would be no significant additional cost or 
savings to continue those efforts under H.R. 3243.
    Enacting the bill could affect direct spending by agencies 
not funded through annual appropriations; therefore, pay-as-
you-go procedures apply. CBO estimates, however, that any net 
increase in spending by those agencies would not be 
significant. Enacting H.R. 3243 would not affect revenues.
    CBO estimates that enacting H.R. 3243 would not increase 
direct spending or on-budget deficits in any of the four 
consecutive 10-year periods beginning in 2028.
    H.R. 3243 contains no intergovernmental or private-sector 
mandates as defined in the Unfunded Mandates Reform Act and 
would impose no costs on state, local, or tribal governments.
    The CBO staff contacts for this estimate is Matthew 
Pickford. The estimate was approved by H. Samuel Papenfuss, 
Deputy Assistant Director for Budget Analysis.

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, and existing law in which no 
change is proposed is shown in roman):

TITLE 40, UNITED STATES CODE

           *       *       *       *       *       *       *

SUBTITLE III--INFORMATION TECHNOLOGY MANAGEMENT

           *       *       *       *       *       *       *

 CHAPTER 113--RESPONSIBILITY FOR ACQUISITIONS OF INFORMATION TECHNOLOGY

SUBCHAPTER I--DIRECTOR OF OFFICE OF MANAGEMENT AND BUDGET

           *       *       *       *       *       *       *

Sec. 11302. Capital planning and investment control

  (a) Federal Information Technology.--The Director of the 
Office of Management and Budget shall perform the 
responsibilities set forth in this section in fulfilling the 
responsibilities under section 3504(h) of title 44.
  (b) Use of Information Technology in Federal Programs.--The 
Director shall promote and improve the acquisition, use, 
security, and disposal of information technology by the Federal 
Government to improve the productivity, efficiency, and 
effectiveness of federal programs, including through 
dissemination of public information and the reduction of 
information collection burdens on the public.
  (c) Use of Budget Process.--
          (1) Definitions.--In this subsection:
                  (A) The term ``covered agency'' means an 
                agency listed in section 901(b)(1) or 901(b)(2) 
                of title 31.
                  (B) The term ``major information technology 
                investment'' means an investment within a 
                covered agency information technology 
                investment portfolio that is designated by the 
                covered agency as major, in accordance with 
                capital planning guidance issued by the 
                Director.
                  (C) The term ``national security system'' has 
                the meaning provided in section 3542 of title 
                44.
          (2) Analyzing, tracking, and evaluating capital 
        investments.--As part of the budget process, the 
        Director shall develop a process for analyzing, 
        tracking, and evaluating the risks, including 
        information security risks, and results of all major 
        capital investments made by an executive agency for 
        information systems. The process shall cover the life 
        of each system and shall include explicit criteria for 
        analyzing the projected and actual costs, benefits, and 
        risks, including information security risks, associated 
        with the investments.
          (3) Public availability.--
                  (A) In general.--The Director shall make 
                available to the public a list of each major 
                information technology investment, without 
                regard to whether the investments are for new 
                information technology acquisitions or for 
                operations and maintenance of existing 
                information technology, including data on cost, 
                schedule, and performance.
                  (B) Agency information.--
                          (i) The Director shall issue guidance 
                        to each covered agency for reporting of 
                        data required by subparagraph (A) that 
                        provides a standardized data template 
                        that can be incorporated into existing, 
                        required data reporting formats and 
                        processes. Such guidance shall 
                        integrate the reporting process into 
                        current budget reporting that each 
                        covered agency provides to the Office 
                        of Management and Budget, to minimize 
                        additional workload. Such guidance 
                        shall also clearly specify that the 
                        investment evaluation required under 
                        subparagraph (C) adequately reflect the 
                        investment's cost and schedule 
                        performance and employ incremental 
                        development approaches in appropriate 
                        cases.
                          (ii) The Chief Information Officer of 
                        each covered agency shall provide the 
                        Director with the information described 
                        in subparagraph (A) on at least a semi-
                        annual basis for each major information 
                        technology investment, using existing 
                        data systems and processes.
                  (C) Investment evaluation.--For each major 
                information technology investment listed under 
                subparagraph (A), the Chief Information Officer 
                of the covered agency, in consultation with 
                other appropriate agency officials, shall 
                categorize the investment according to risk, in 
                accordance with guidance issued by the 
                Director.
                  (D) Continuous improvement.--If either the 
                Director or the Chief Information Officer of a 
                covered agency determines that the information 
                made available from the agency's existing data 
                systems and processes as required by 
                subparagraph (B) is not timely and reliable, 
                the Chief Information Officer, in consultation 
                with the Director and the head of the agency, 
                shall establish a program for the improvement 
                of such data systems and processes.
                  (E) Waiver or limitation authority.--The 
                applicability of subparagraph (A) may be waived 
                or the extent of the information may be limited 
                by the Director, if the Director determines 
                that such a waiver or limitation is in the 
                national security interests of the United 
                States.
                  (F) Additional limitation.--The requirements 
                of subparagraph (A) shall not apply to national 
                security systems or to telecommunications or 
                information technology that is fully funded by 
                amounts made available--
                          (i) under the National Intelligence 
                        Program, defined by section 3(6) of the 
                        National Security Act of 1947 (50 
                        U.S.C. 3003(6));
                          (ii) under the Military Intelligence 
                        Program or any successor program or 
                        programs; or
                          (iii) jointly under the National 
                        Intelligence Program and the Military 
                        Intelligence Program (or any successor 
                        program or programs).
          (4) Risk management.--For each major information 
        technology investment listed under paragraph (3)(A) 
        that receives a high risk rating, as described in 
        paragraph (3)(C), for 4 consecutive quarters--
                  (A) the Chief Information Officer of the 
                covered agency and the program manager of the 
                investment within the covered agency, in 
                consultation with the Administrator of the 
                Office of Electronic Government, shall conduct 
                a review of the investment that shall 
                identify--
                          (i) the root causes of the high level 
                        of risk of the investment;
                          (ii) the extent to which these causes 
                        can be addressed; and
                          (iii) the probability of future 
                        success;
                  (B) the Administrator of the Office of 
                Electronic Government shall communicate the 
                results of the review under subparagraph (A) 
                to--
                          (i) the Committee on Homeland 
                        Security and Governmental Affairs and 
                        the Committee on Appropriations of the 
                        Senate;
                          (ii) the Committee on Oversight and 
                        Government Reform and the Committee on 
                        Appropriations of the House of 
                        Representatives; and
                          (iii) the committees of the Senate 
                        and the House of Representatives with 
                        primary jurisdiction over the agency;
                  (C) in the case of a major information 
                technology investment of the Department of 
                Defense, the assessment required by 
                subparagraph (A) may be accomplished in 
                accordance with section 2445c of title 10, 
                provided that the results of the review are 
                provided to the Administrator of the Office of 
                Electronic Government upon request and to the 
                committees identified in subsection (B); and
                  (D) for a covered agency other than the 
                Department of Defense, if on the date that is 
                one year after the date of completion of the 
                review required under subsection (A), the 
                investment is rated as high risk under 
                paragraph (3)(C), the Director shall deny any 
                request for additional development, 
                modernization, or enhancement funding for the 
                investment until the date on which the Chief 
                Information Officer of the covered agency 
                determines that the root causes of the high 
                level of risk of the investment have been 
                addressed, and there is sufficient capability 
                to deliver the remaining planned increments 
                within the planned cost and schedule.
          [(5)  Sunset of certain provisions.--Paragraphs (1), 
        (3), and (4) shall not be in effect on and after the 
        date that is 5 years after the date of the enactment of 
        the Carl Levin and Howard P. ``Buck'' McKeon National 
        Defense Authorization Act for Fiscal Year 2015.]
          (5) Report to congress.--At the same time that the 
        President submits the budget for a fiscal year to 
        Congress under section 1105(a) of title 31, the 
        Director shall submit to Congress a report on the net 
        program performance benefits achieved as a result of 
        major capital investments made by executive agencies 
        for information systems and how the benefits relate to 
        the accomplishment of the goals of the executive 
        agencies.
  (d) Information Technology Standards.--The Director shall 
oversee the development and implementation of standards and 
guidelines pertaining to federal computer systems by the 
Secretary of Commerce through the National Institute of 
Standards and Technology under section 11331 of this title and 
section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g-3).
  (e) Designation of Executive Agents for Acquisitions.--The 
Director shall designate the head of one or more executive 
agencies, as the Director considers appropriate, as executive 
agent for Government-wide acquisitions of information 
technology.
  (f) Use of Best Practices in Acquisitions.--The Director 
shall encourage the heads of the executive agencies to develop 
and use the best practices in the acquisition of information 
technology.
  (g) Assessment of Other Models for Managing Information 
Technology.--On a continuing basis, the Director shall assess 
the experiences of executive agencies, state and local 
governments, international organizations, and the private 
sector in managing information technology.
  (h) Comparison of Agency Uses of Information Technology.--The 
Director shall compare the performances of the executive 
agencies in using information technology and shall disseminate 
the comparisons to the heads of the executive agencies.
  (i) Monitoring Training.--The Director shall monitor the 
development and implementation of training in information 
resources management for executive agency personnel.
  (j) Informing Congress.--The Director shall keep Congress 
fully informed on the extent to which the executive agencies 
are improving the performance of agency programs and the 
accomplishment of the agency missions through the use of the 
best practices in information resources management.
  (k) Coordination of Policy Development and Review.--The 
Director shall coordinate with the Office of Federal 
Procurement Policy the development and review by the 
Administrator of the Office of Information and Regulatory 
Affairs of policy associated with federal acquisition of 
information technology.

           *       *       *       *       *       *       *

SUBCHAPTER II--EXECUTIVE AGENCIES

           *       *       *       *       *       *       *

Sec.  11319. Resources, planning, and portfolio management

  (a) Definitions.--In this section:
          (1) The term ``covered agency'' means each agency 
        listed in section 901(b)(1) or 901(b)(2) of title 31.
          (2) The term ``information technology'' has the 
        meaning given that term under capital planning guidance 
        issued by the Office of Management and Budget.
  (b) Additional Authorities for Chief Information Officers.--
          (1) Planning, programming, budgeting, and execution 
        authorities for cios.--
                  (A) In general.--The head of each covered 
                agency other than the Department of Defense 
                shall ensure that the Chief Information Officer 
                of the agency has a significant role in--
                          (i) the decision processes for all 
                        annual and multi-year planning, 
                        programming, budgeting, and execution 
                        decisions, related reporting 
                        requirements, and reports related to 
                        information technology; and
                          (ii) the management, governance, and 
                        oversight processes related to 
                        information technology.
                  (B) Budget formulation.--The Director of the 
                Office of Management and Budget shall require 
                in the annual information technology capital 
                planning guidance of the Office of Management 
                and Budget the following:
                          (i) That the Chief Information 
                        Officer of each covered agency other 
                        than the Department of Defense approve 
                        the information technology budget 
                        request of the covered agency, and that 
                        the Chief Information Officer of the 
                        Department of Defense review and 
                        provide recommendations to the 
                        Secretary of Defense on the information 
                        technology budget request of the 
                        Department.
                          (ii) That the Chief Information 
                        Officer of each covered agency certify 
                        that information technology investments 
                        are adequately implementing incremental 
                        development, as defined in capital 
                        planning guidance issued by the Office 
                        of Management and Budget.
                  (C) Review.--
                          (i) In general.--A covered agency 
                        other than the Department of Defense--
                                  (I) may not enter into a 
                                contract or other agreement for 
                                information technology or 
                                information technology 
                                services, unless the contract 
                                or other agreement has been 
                                reviewed and approved by the 
                                Chief Information Officer of 
                                the agency;
                                  (II) may not request the 
                                reprogramming of any funds made 
                                available for information 
                                technology programs, unless the 
                                request has been reviewed and 
                                approved by the Chief 
                                Information Officer of the 
                                agency; and
                                  (III) may use the governance 
                                processes of the agency to 
                                approve such a contract or 
                                other agreement if the Chief 
                                Information Officer of the 
                                agency is included as a full 
                                participant in the governance 
                                processes.
                          (ii) Delegation.--
                                  (I) In general.--Except as 
                                provided in subclause (II), the 
                                duties of a Chief Information 
                                Officer under clause (i) are 
                                not delegable.
                                  (II) Non-major information 
                                technology investments.--For a 
                                contract or agreement for a 
                                non-major information 
                                technology investment, as 
                                defined in the annual 
                                information technology capital 
                                planning guidance of the Office 
                                of Management and Budget, the 
                                Chief Information Officer of a 
                                covered agency other than the 
                                Department of Defense may 
                                delegate the approval of the 
                                contract or agreement under 
                                clause (i) to an individual who 
                                reports directly to the Chief 
                                Information Officer.
          (2) Personnel-related authority.--Notwithstanding any 
        other provision of law, for each covered agency other 
        than the Department of Defense, the Chief Information 
        Officer of the covered agency shall approve the 
        appointment of any other employee with the title of 
        Chief Information Officer, or who functions in the 
        capacity of a Chief Information Officer, for any 
        component organization within the covered agency.
  (c)  Limitation.--None of the authorities provided in this 
section shall apply to telecommunications or information 
technology that is fully funded by amounts made available--
          (1) under the National Intelligence Program, defined 
        by section 3(6) of the National Security Act of 1947 
        (50 U.S.C. 3003(6));
          (2) under the Military Intelligence Program or any 
        successor program or programs; or
          (3) jointly under the National Intelligence Program 
        and the Military Intelligence Program (or any successor 
        program or programs).
  [(c)] (d) Information Technology Portfolio, Program, and 
Resource Reviews.--
          (1) Process.--The Director of the Office of 
        Management and Budget, in consultation with the Chief 
        Information Officers of appropriate agencies, shall 
        implement a process to assist covered agencies in 
        reviewing their portfolio of information technology 
        investments--
                  (A) to identify or develop ways to increase 
                the efficiency and effectiveness of the 
                information technology investments of the 
                covered agency;
                  (B) to identify or develop opportunities to 
                consolidate the acquisition and management of 
                information technology services, and increase 
                the use of shared-service delivery models;
                  (C) to identify potential duplication and 
                waste;
                  (D) to identify potential cost savings;
                  (E) to develop plans for actions to optimize 
                the information technology portfolio, programs, 
                and resources of the covered agency;
                  (F) to develop ways to better align the 
                information technology portfolio, programs, and 
                financial resources of the covered agency to 
                any multi-year funding requirements or 
                strategic plans required by law;
                  (G) to develop a multi-year strategy to 
                identify and reduce duplication and waste 
                within the information technology portfolio of 
                the covered agency, including component-level 
                investments and to identify projected cost 
                savings resulting from such strategy; and
                  (H) to carry out any other goals that the 
                Director may establish.
          (2) Metrics and performance indicators.--The Director 
        of the Office of Management and Budget, in consultation 
        with the Chief Information Officers of appropriate 
        agencies, shall develop standardized cost savings and 
        cost avoidance metrics and performance indicators for 
        use by agencies for the process implemented under 
        paragraph (1).
          (3) Annual review.--The Chief Information Officer of 
        each covered agency, in conjunction with the Chief 
        Operating Officer or Deputy Secretary (or equivalent) 
        of the covered agency and the Administrator of the 
        Office of Electronic Government, shall conduct an 
        annual review of the information technology portfolio 
        of the covered agency.
          (4) Applicability to the department of defense.--In 
        the case of the Department of Defense, processes 
        established pursuant to this subsection shall apply 
        only to the business systems information technology 
        portfolio of the Department of Defense and not to 
        national security systems as defined by section 
        11103(a) of this title. The annual review required by 
        paragraph (3) shall be carried out by the Deputy Chief 
        Management Officer of the Department of Defense (or any 
        successor to such Officer), in consultation with the 
        Chief Information Officer, the Under Secretary of 
        Defense for Acquisition, Technology, and Logistics, and 
        other appropriate Department of Defense officials. The 
        Secretary of Defense may designate an existing 
        investment or management review process to fulfill the 
        requirement for the annual review required by paragraph 
        (3), in consultation with the Administrator of the 
        Office of Electronic Government.
          (5) Quarterly reports.--
                  (A) In general.--The Administrator of the 
                Office of Electronic Government shall submit a 
                quarterly report on the cost savings and 
                reductions in duplicative information 
                technology investments identified through the 
                review required by paragraph (3) to--
                          (i) the Committee on Homeland 
                        Security and Governmental Affairs and 
                        the Committee on Appropriations of the 
                        Senate;
                          (ii) the Committee on Oversight and 
                        Government Reform and the Committee on 
                        Appropriations of the House of 
                        Representatives; and
                          (iii) upon a request by any committee 
                        of Congress, to that committee.
                  (B) Inclusion in other reports.--The reports 
                required under subparagraph (A) may be included 
                as part of another report submitted to the 
                committees of Congress described in clauses 
                (i), (ii), and (iii) of subparagraph (A).
          [(6) Sunset.--This subsection shall not be in effect 
        on and after the date that is 5 years after the date of 
        the enactment of the Carl Levin and Howard P. ``Buck'' 
        McKeon National Defense Authorization Act for Fiscal 
        Year 2015.]

           *       *       *       *       *       *       *

                              ----------                              

NATIONAL DEFENSE AUTHORIZATION ACT FOR FISCAL YEAR 2015

           *       *       *       *       *       *       *

DIVISION A--DEPARTMENT OF DEFENSE AUTHORIZATIONS

           *       *       *       *       *       *       *

  TITLE VIII--ACQUISITION POLICY, ACQUISITION MANAGEMENT, AND RELATED 
MATTERS

           *       *       *       *       *       *       *

Subtitle D--Federal Information Technology Acquisition Reform

           *       *       *       *       *       *       *

SEC. 834. FEDERAL DATA CENTER CONSOLIDATION INITIATIVE.

  (a) Definitions.--In this section:
          (1) Administrator.--The term ``Administrator'' means 
        the Administrator of the Office of Electronic 
        Government established under section 3602 of title 44, 
        United States Code (and also known as the Office of E-
        Government and Information Technology), within the 
        Office of Management and Budget.
          (2) Covered agency.--The term ``covered agency'' 
        means the following (including all associated 
        components of the agency):
                  (A) Department of Agriculture.
                  (B) Department of Commerce.
                  (C) Department of Defense.
                  (D) Department of Education.
                  (E) Department of Energy.
                  (F) Department of Health and Human Services.
                  (G) Department of Homeland Security.
                  (H) Department of Housing and Urban 
                Development.
                  (I) Department of the Interior.
                  (J) Department of Justice.
                  (K) Department of Labor.
                  (L) Department of State.
                  (M) Department of Transportation.
                  (N) Department of Treasury.
                  (O) Department of Veterans Affairs.
                  (P) Environmental Protection Agency.
                  (Q) General Services Administration.
                  (R) National Aeronautics and Space 
                Administration.
                  (S) National Science Foundation.
                  (T) Nuclear Regulatory Commission.
                  (U) Office of Personnel Management.
                  (V) Small Business Administration.
                  (W) Social Security Administration.
                  (X) United States Agency for International 
                Development.
          (3) FDCCI.--The term ``FDCCI'' means the Federal Data 
        Center Consolidation Initiative described in the Office 
        of Management and Budget Memorandum on the Federal Data 
        Center Consolidation Initiative, dated February 26, 
        2010, or any successor thereto.
          (4) Government-wide data center consolidation and 
        optimization metrics.--The term ``Government-wide data 
        center consolidation and optimization metrics'' means 
        the metrics established by the Administrator under 
        subsection (b)(2)(G).
  (b) Federal Data Center Consolidation Inventories and 
Strategies.--
          (1) In general.--
                  (A) Annual reporting.--Except as provided in 
                subparagraph (C), each year, beginning in the 
                first fiscal year after the date of the 
                enactment of this Act and each fiscal year 
                thereafter, the head of each covered agency, 
                assisted by the Chief Information Officer of 
                the agency, shall submit to the Administrator--
                          (i) a comprehensive inventory of the 
                        data centers owned, operated, or 
                        maintained by or on behalf of the 
                        agency; and
                          (ii) a multi-year strategy to achieve 
                        the consolidation and optimization of 
                        the data centers inventoried under 
                        clause (i), that includes--
                                  (I) performance metrics--
                                          (aa) that are 
                                        consistent with the 
                                        Government-wide data 
                                        center consolidation 
                                        and optimization 
                                        metrics; and
                                          (bb) by which the 
                                        quantitative and 
                                        qualitative progress of 
                                        the agency toward the 
                                        goals of the FDCCI can 
                                        be measured;
                                  (II) a timeline for agency 
                                activities to be completed 
                                under the FDCCI, with an 
                                emphasis on benchmarks the 
                                agency can achieve by specific 
                                dates;
                                  (III) year-by-year 
                                calculations of investment and 
                                cost savings for the period 
                                beginning on the date of the 
                                enactment of this Act and 
                                ending on the date set forth in 
                                subsection (e), broken down by 
                                each year, including a 
                                description of any initial 
                                costs for data center 
                                consolidation and optimization 
                                and life cycle cost savings and 
                                other improvements, with an 
                                emphasis on--
                                          (aa) meeting the 
                                        Government-wide data 
                                        center consolidation 
                                        and optimization 
                                        metrics; and
                                          (bb) demonstrating 
                                        the amount of agency-
                                        specific cost savings 
                                        each fiscal year 
                                        achieved through the 
                                        FDCCI; and
                                  (IV) any additional 
                                information required by the 
                                Administrator.
                  (B) Use of other reporting structures.--The 
                Administrator may require a covered agency to 
                include the information required to be 
                submitted under this subsection through 
                reporting structures determined by the 
                Administrator to be appropriate.
                  (C) Department of defense reporting.--For any 
                year that the Department of Defense is required 
                to submit a performance plan for reduction of 
                resources required for data servers and 
                centers, as required under section 2867(b) of 
                the National Defense Authorization Act for 
                Fiscal Year 2012 (10 U.S.C. 2223a note), the 
                Department of Defense--
                          (i) may submit to the Administrator, 
                        in lieu of the multi-year strategy 
                        required under subparagraph (A)(ii)--
                                  (I) the defense-wide plan 
                                required under section 
                                2867(b)(2) of the National 
                                Defense Authorization Act for 
                                Fiscal Year 2012 (10 U.S.C. 
                                2223a note); and
                                  (II) the report on cost 
                                savings required under section 
                                2867(d) of the National Defense 
                                Authorization Act for Fiscal 
                                Year 2012 (10 U.S.C. 2223a 
                                note); and
                          (ii) shall submit the comprehensive 
                        inventory required under subparagraph 
                        (A)(i), unless the defense-wide plan 
                        required under section 2867(b)(2) of 
                        the National Defense Authorization Act 
                        for Fiscal Year 2012 (10 U.S.C. 2223a 
                        note)--
                                  (I) contains a comparable 
                                comprehensive inventory; and
                                  (II) is submitted under 
                                clause (i).
                  (D) Statement.--Each year, beginning in the 
                first fiscal year after the date of the 
                enactment of this Act and each fiscal year 
                thereafter, the head of each covered agency, 
                acting through the Chief Information Officer of 
                the agency, shall--
                          (i)(I) submit a statement to the 
                        Administrator stating whether the 
                        agency has complied with the 
                        requirements of this section; and
                                  (II) make the statement 
                                submitted under subclause (I) 
                                publicly available; and
                          (ii) if the agency has not complied 
                        with the requirements of this section, 
                        submit a statement to the Administrator 
                        explaining the reasons for not 
                        complying with such requirements.
                  (E) Agency implementation of strategies.--
                          (i) In general.--Each covered agency, 
                        under the direction of the Chief 
                        Information Officer of the agency, 
                        shall--
                                  (I) implement the strategy 
                                required under subparagraph 
                                (A)(ii); and
                                  (II) provide updates to the 
                                Administrator, on a quarterly 
                                basis, of--
                                          (aa) the completion 
                                        of activities by the 
                                        agency under the FDCCI;
                                          (bb) any progress of 
                                        the agency towards 
                                        meeting the Government-
                                        wide data center 
                                        consolidation and 
                                        optimization metrics; 
                                        and
                                          (cc) the actual cost 
                                        savings and other 
                                        improvements realized 
                                        through the 
                                        implementation of the 
                                        strategy of the agency.
                          (ii) Department of defense.--For 
                        purposes of clause (i)(I), 
                        implementation of the defense-wide plan 
                        required under section 2867(b)(2) of 
                        the National Defense Authorization Act 
                        for Fiscal Year 2012 (10 U.S.C. 2223a 
                        note) by the Department of Defense 
                        shall be considered implementation of 
                        the strategy required under 
                        subparagraph (A)(ii).
                  (F) Rule of construction.--Nothing in this 
                section shall be construed to limit the 
                reporting of information by a covered agency to 
                the Administrator, the Director of the Office 
                of Management and Budget, or Congress.
          (2) Administrator responsibilities.--The 
        Administrator shall--
                  (A) establish the deadline, on an annual 
                basis, for covered agencies to submit 
                information under this section;
                  (B) establish a list of requirements that the 
                covered agencies must meet to be considered in 
                compliance with paragraph (1);
                  (C) ensure that information relating to 
                agency progress towards meeting the Government-
                wide data center consolidation and optimization 
                metrics is made available in a timely manner to 
                the general public;
                  (D) review the inventories and strategies 
                submitted under paragraph (1) to determine 
                whether they are comprehensive and complete;
                  (E) monitor the implementation of the data 
                center strategy of each covered agency that is 
                required under paragraph (1)(A)(ii);
                  (F) update, on an annual basis, the 
                cumulative cost savings realized through the 
                implementation of the FDCCI; and
                  (G) establish metrics applicable to the 
                consolidation and optimization of data centers 
                Government-wide, including metrics with respect 
                to--
                          (i) costs;
                          (ii) efficiencies, including, at a 
                        minimum, server efficiency; and
                          (iii) any other factors the 
                        Administrator considers appropriate.
          (3) Cost saving goal and updates for congress.--
                  (A) In general.--Not later than one year 
                after the date of the enactment of this Act, 
                the Administrator shall develop, and make 
                publicly available, a goal, broken down by 
                year, for the amount of planned cost savings 
                and optimization improvements achieved through 
                the FDCCI during the period beginning on the 
                date of the enactment of this Act and ending on 
                the date set forth in subsection (e).
                  (B) Annual update.--
                          (i) In general.--Not later than one 
                        year after the date on which the goal 
                        described in subparagraph (A) is made 
                        publicly available, and each year 
                        thereafter, the Administrator shall 
                        aggregate the reported cost savings of 
                        each covered agency and optimization 
                        improvements achieved to date through 
                        the FDCCI and compare the savings to 
                        the projected cost savings and 
                        optimization improvements developed 
                        under subparagraph (A).
                          (ii) Update for congress.--The goal 
                        required to be developed under 
                        subparagraph (A) shall be submitted to 
                        Congress and shall be accompanied by a 
                        statement describing--
                                  (I) the extent to which each 
                                covered agency has developed 
                                and submitted a comprehensive 
                                inventory under paragraph 
                                (1)(A)(i), including an 
                                analysis of the inventory that 
                                details specific numbers, use, 
                                and efficiency level of data 
                                centers in each inventory; and
                                  (II) the extent to which each 
                                covered agency has submitted a 
                                comprehensive strategy that 
                                addresses the items listed in 
                                paragraph (1)(A)(ii).
          (4) GAO review.--
                  (A) In general.--Not later than one year 
                after the date of the enactment of this Act, 
                and each year thereafter, the Comptroller 
                General of the United States shall review and 
                verify the quality and completeness of the 
                inventory and strategy of each covered agency 
                required under paragraph (1)(A).
                  (B) Report.--The Comptroller General of the 
                United States shall, on an annual basis, 
                publish a report on each review conducted under 
                subparagraph (A).
  (c) Ensuring Cybersecurity Standards for Data Center 
Consolidation and Cloud Computing.--
          (1) In general.--In implementing a data center 
        consolidation and optimization strategy under this 
        section, a covered agency shall do so in a manner that 
        is consistent with Federal guidelines on cloud 
        computing security, including--
                  (A) applicable provisions found within the 
                Federal Risk and Authorization Management 
                Program (FedRAMP); and
                  (B) guidance published by the National 
                Institute of Standards and Technology.
          (2) Rule of construction.--Nothing in this section 
        shall be construed to limit the ability of the Director 
        of the Office of Management and Budget to update or 
        modify the Federal guidelines on cloud computing 
        security.
  (d) Waiver of Requirements.--The Director of National 
Intelligence and the Secretary of Defense, or their respective 
designee, may waive the applicability to any national security 
system, as defined in section 3542 of title 44, United States 
Code, of any provision of this section if the Director of 
National Intelligence or the Secretary of Defense, or their 
respective designee, determines that such waiver is in the 
interest of national security. Not later than 30 days after 
making a waiver under this subsection, the Director of National 
Intelligence or the Secretary of Defense, or their respective 
designee, shall submit to the Committee on Homeland Security 
and Governmental Affairs and the Select Committee on 
Intelligence of the Senate and the Committee on Oversight and 
Government Reform and the Permanent Select Committee on 
Intelligence of the House of Representatives a statement 
describing the waiver and the reasons for the waiver.
  (e) Sunset.--This section is repealed effective on October 1, 
[2018] 2020.

           *       *       *       *       *       *       *

                                  [all]
```