U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

26–068 PDF 2017

THE FEDERAL INFORMATION TECHNOLOGY 

REFORM ACT SCORECARD 2.0 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

AND THE

SUBCOMMITTEE ON 

GOVERNMENT OPERATIONS 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FOURTEENTH CONGRESS 

SECOND SESSION 

MAY 18, 2016 

Serial No. 114–159 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://www.house.gov/reform 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

JASON CHAFFETZ, Utah, Chairman 

JOHN L. MICA, Florida 

MICHAEL R. TURNER, Ohio 

JOHN J. DUNCAN, JR., Tennessee 

JIM JORDAN, Ohio 

TIM WALBERG, Michigan 

JUSTIN AMASH, Michigan 

PAUL A. GOSAR, Arizona 

SCOTT DESJARLAIS, Tennessee 

TREY GOWDY, South Carolina 

BLAKE FARENTHOLD, Texas 

CYNTHIA M. LUMMIS, Wyoming 

THOMAS MASSIE, Kentucky 

MARK MEADOWS, North Carolina 

RON DESANTIS, Florida 

MICK, MULVANEY, South Carolina 

KEN BUCK, Colorado 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

JODY B. HICE, Georgia 

STEVE RUSSELL, Oklahoma 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GLENN GROTHMAN, Wisconsin 

WILL HURD, Texas 

GARY J. PALMER, Alabama 

ELIJAH E. CUMMINGS, Maryland, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STEPHEN F. LYNCH, Massachusetts 

JIM COOPER, Tennessee 

GERALD E. CONNOLLY, Virginia 

MATT CARTWRIGHT, Pennsylvania 

TAMMY DUCKWORTH, Illinois 

ROBIN L. KELLY, Illinois 

BRENDA L. LAWRENCE, Michigan 

TED LIEU, California 

BONNIE WATSON COLEMAN, New Jersey 

STACEY E. PLASKETT, Virgin Islands 

MARK DESAULNIER, California 

BRENDAN F. BOYLE, Pennsylvania 

PETER WELCH, Vermont 

MICHELLE LUJAN GRISHAM, New Mexico 

JENNIFER HEMINGWAY, Staff Director 

JULIE DUNNE, Senior Counsel 

WILLIAM MARX, Clerk 

DAVID RAPALLO, Minority Staff Director 


KING-6430 with DISTILLER
(III) 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

WILL HURD, Texas, Chairman 

BLAKE FARENTHOLD, Texas, Vice Chair 

MARK WALKER, North Carolina 

ROD BLUM, Iowa 

PAUL A. GOSAR, Arizona 

ROBIN L. KELLY, Illinois, Ranking Minority 

Member 

GERALD E. CONNOLLY, Virginia 

TAMMY DUCKWORTH, Illinois 

TED LIEU, California 

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

MARK MEADOWS, North Carolina, Chairman 

JIM JORDAN, Ohio 

TIM WALBERG, Michigan, Vice Chair 

TREY GOWDY, South Carolina 

THOMAS MASSIE, Kentucky 

MICK MULVANEY, South Carolina 

KEN BUCK, Colorado 

EARL L. ‘‘BUDDY’’ CARTER, Georgia 

GLENN GROTHMAN, Wisconsin 

GERALD E. CONNOLLY, Virginia, Ranking 

Minority Member 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STACEY E. PLASKETT, Virgin Islands 

STEPHEN F. LYNCH, Massachusetts 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(V) 

C O N T E N T S 

Page 

Hearing held on May 18, 2016 ............................................................................... 1 

WITNESSES 

Mr. Steven I. Cooper, Chief Infomation Officer, U.S. Department of Commerce 

Oral Statement ................................................................................................. 6 

Written Statement ............................................................................................ 9 

Ms. Dawn Leaf, Chief Information Officer, U.S. Department of Labor 

Oral Statement ................................................................................................. 13 

Written Statement ............................................................................................ 15 

Mr. Michael M. Johnson, Chief Information Officer, U.S. Department of Energy 

Oral Statement ................................................................................................. 20 

Written Statement ............................................................................................ 22 

Ms. Renee P. Wynn, Chief Information Officer, National Aeronautics and 

Space Administration 

Oral Statement ................................................................................................. 26 

Written Statement ............................................................................................ 28 

Mr. David A. Powner, Director, IT Management Issues, U.S. Government 

Accountability Office 

Oral Statement ................................................................................................. 35 

Written Statement ............................................................................................ 38 

APPENDIX 

Opening Statement of Mr. Meadows ...................................................................... 82 

FITARA Scorecard documents for the record ........................................................ 85 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

THE FEDERAL INFORMATION TECHNOLOGY 

REFORM ACT SCORECARD 2.0 

Wednesday, May 18, 2016 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY, JOINT

WITH THE SUBCOMMITTEE ON GOVERNMENT OPERATIONS, 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, 

Washington, D.C. 

The subcommittees met, pursuant to call, at 2:04 p.m., in Room 

2154, Rayburn House Office Building, Hon. William Hurd [chairman of the Subcommittee on Information Technology] presiding. 

Present from Subcommittee on Information Technology: Representatives Hurd, Walker, Blum, Kelly, and Lieu. 

Present from Subcommittee on Government Operations: Representatives Meadows, Jordan, Walberg, Buck, Carter, Connolly, 

and Plaskett. 

Mr. HURD. The Subcommittee on Information Technology and the 

Subcommittee on Government Operations will come to order. Without objection, the chair is authorized to declare a recess at any 

time. 

We believe votes are probably going to be called around 2:20, so 

we are going to try to get through as many of the opening statements as we can before we have to take a break and come back 

for the questioning. 

So thank you for being here and good afternoon. 

Earlier in this Congress, the Subcommittee on Information Technology and the Subcommittee on Government Operations began a 

joint effort to hold agencies accountable for implementation of 

FITARA. Our oversight on this issue is part of an ongoing effort 

to reform the state of IT in the Federal Government. 

FITARA can play a key role in ensuring broader authorities for 

agency CIOs and a reduction of waste, fraud, and abuse. I think 

it is important to keep that broader goal in mind as we discuss today’s grades. 

The intent of grading agencies is to provide an objective measurement of progress and challenges. Some agencies continue to do 

better than others. Today, I am pleased to see moderate improvement in the grades from the first scorecard. 

The overarching goal is for Federal agencies to transition to deploying modern technology rather than spending funds on outdated 

systems. Technology is a wonderful thing. It should reduce errors, 

save taxpayer money, and be a tool to help agencies accomplish 

their missions. It should not be a burden. 


KING-6430 with DISTILLER
2 

To agency CIOs looking to improve your score, I would say, three 

things. 

First, understand that the grade is a snapshot in time. The committee realizes, in many cases, the situations CIOs find themselves 

in developed long before they got there and are the result of decisions made by people who are long gone. 

Second, the risk assessment transparency metric is entirely within the CIO’s control. GAO reports validate the common-sense conclusion that major IT projects carry much more risk than agency 

CIOs are currently acknowledging to Congress and the American 

people. I would encourage CIOs to take a good look at the risk ratings they are assigning to projects on the dashboard. 

And third, there are millions of dollars’ worth of savings still on 

the table for data center consolidation. GAO has reported that 

agencies have closed over 3,000 of about 10,500 data centers and 

achieved $2.8 billion in cost savings rate. Most of these savings are 

attributed to just four agencies, including Commerce, who I believe 

is going to talk about that today. So there is much more in terms 

of savings left available. GAO calculates plan savings of around 

$1.5 billion per year from consolidating data centers. 

For those advocating for billions of additional funding to help 

modernize IT, I would suggest that savings from data center consolidation might be a better place to look than a new appropriation. 

Under FITARA, CIOs now have a proper seat at the table. No 

longer are technology and cyber issues confined to tech geeks in 

some backroom. In the digital age, IT issues are front and center. 

They are central to what government does and how it does it. 

This committee intends to focus on ensuring the men and women 

in these CIO positions are qualified, accountable, and empowered 

to make decisions and lead within their agencies. The American 

taxpayers deserve agency CIOs who understand the value proposition of the cloud rather than CIOs who believe their agencies are 

so special that a proprietary mainframe database is needed. 

Congress requires accurate and complete data, and answers from 

agencies, rather than conflicting numbers and obfuscation. Ultimately, taxpayers deserve a government that leverages technology 

to serve them rather than one that deploys unsecured, decades-old 

technology and keeps sensitive information in nonencrypted databases. 

We are not there yet, and we have a long way to go, but I am 

cautiously optimistic that we are moving the needle in the right direction. 

I thank the witnesses for being here today, and I look forward 

to their testimony. 

Now, I would like to recognize Ms. Kelly, the ranking member of 

the Subcommittee on Information Technology from the great State 

of Illinois, and my friend, for her opening statement. 

Ms. KELLY. Thank you, Mr. Chairman. 

And thank you, Chairman Meadows and Ranking Member 

Connolly. I know they will be joining us shortly. 

Today’s hearing is the third in a series that our subcommittees 

have held to learn how agencies are implementing the requirements of the Federal Information Technology Acquisition Reform 

Act. As was noted, during November’s hearing, these hearings help 


KING-6430 with DISTILLER
3 

us ensure that agencies are hitting the required benchmarks as we 

move toward a more efficient, modern, and secure Federal Government. 

At the last hearing, we released a FITARA scorecard assessing 

agencies’ implementation of four of the seven initiatives required 

by the act. Today, we release an updated FITARA scorecard measuring agencies progress in the areas of data center consolidation, 

IT portfolio review savings, incremental project development, and 

risk assessment transparency. 

I am looking forward to discussing the grades received by the 

four agencies here today. 

Since the last scorecard, I am encouraged to see that out of the 

24 agencies that are covered by FITARA, seven have shown improvement in their overall grade, and others have improved in individual categories. 

Looking beyond the grades, let me say that I have been encouraged by the responsiveness of most agencies and the progress in 

FITARA implementation to date. I especially want to recognize, as 

the chairman said, the Department of Commerce’s work in exceeding their goal of saving $222 million through fiscal year 2016 in 

data center consolidations. I hope to see this effort to continued. 

Government-wide data center consolidations alone have realized 

$1.3 billion in savings, and we are expecting to save an additional 

$8.2 billion by 2019. These are good first steps, but it is clear that 

there are obstacles to overcome in implementation. 

This new scorecard shows that numerous agencies have hit roadblocks and others have fallen behind in implementation. I look forward to addressing these challenges today, also. 

I’m especially interested in hearing how agencies plan to stick to 

their FITARA implementation plans as a new presidential administration takes charge next year. No transition is seamless, so I look 

forward to learning what steps your agencies are taking to ensure 

a transition that will continue the progress we have made so far. 

We all know what is at stake here. The Federal Government’s IT 

acquisition process isn’t just an inefficient use of taxpayer money. 

It is also a security risk. Too many agencies are still reliant on outdated legacy systems. With each passing year, these systems cost 

more and more to secure and maintain. 

FITARA not only helps Federal agencies save money in IT procurement, it also helps them make smarter IT investments. Quite 

frankly, FITARA implementation is a change that the Federal Government has sorely needed. 

I want to thank the witnesses for testifying today. I know that 

an overhaul of your IT acquisition and management is not an easy 

task, so I look forward to hearing how your agencies are handling 

the challenges in implementing FITARA. 

Thank you, Mr. Chairman. I yield back. 

Mr. HURD. Thank you, Ms. Kelly. 

I would like to now recognize the chairman of the Subcommittee 

on Government Operations, Mr. Meadows, for his opening statement. 

Mr. MEADOWS. Thank you, Mr. Chairman. Thank you for your 

leadership on this particular issue. 


KING-6430 with DISTILLER
4 

I’m going to keep my remarks very brief. They are about to call 

votes here shortly. 

So in doing that, I think it is more important that we emphasize 

the fact that FITARA is not a law that was passed with no expectation of implementation. We are going to continue to follow up and 

continue to have these types of hearings. 

We are hearing news that two of our witnesses hopefully have 

plans that are either on their way or very close to being done, so 

I applaud you for those efforts. 

Really, this is more about accountability. For us, we want to see 

progress. We are going to work with the GAO on a number of 

fronts. 

As we look at that, it is going to be a critical component of what 

we look at. I have already been talking to appropriators on a number of fronts. I’m willing that, if you are willing to do a good job, 

I am willing to be your advocate. So I want to just stress that. 

But thank you. I will submit a written statement for the record, 

Mr. Chairman. 

With that, I will yield back. 

Mr. HURD. Thank you, sir. 

I now would like to recognize Mr. Connolly, the ranking member 

of the Subcommittee on Government Operations, and the architect 

of FITARA, or, as most people like to call it, the Connolly-Issa bill. 

Mr. CONNOLLY. You are my very favorite chairman. 

[Laughter.] 

Mr. CONNOLLY. I’ve always thought that, except for Mr. Meadows. It is kind of a tie. Both wonderful human beings. 

Thank you, Chairman Hurd, Chairman Meadows, and my friend 

Ranking Member Kelly. 

I welcome this latest joint subcommittee hearing to examine the 

implementation of FITARA. I’m particularly grateful to my two colleagues on the other side of the aisle. 

They made a promise we weren’t going to let this go. Unlike 

Clinger-Cohen, we were going to stick with this, and we were going 

to provide oversight. And they have kept their word. And the four 

of us operate seamlessly. I think that is good for the United States 

Government. 

I think, in partnership with the executive branch, we can make 

a big difference on something that may seem deceptively 

uninteresting, but that actually can help transform agencies and 

how they do business and save lots of dollars for our taxpayers. 

Today, we release our second scorecard on FITARA. As I stated 

at our last hearing, the scorecard is not intended to be a scarlet 

letter on some agency’s back. It is meant to incentivize agencies to 

improve management of Federal IT investments and to create 

metrics so that we can look at progress. 

On the initial scorecard issued prior to December 31, for all agencies to have FITARA implementation plans, it was understandable 

that we some grades on the lower end of the scale. We were just 

beginning. Ds and Fs outnumbered As, Bs, and Cs more than 2- 

to-1. Today, we are pleased to see a very marked improvement in 

the latest scorecard with higher marks now out numbering lower 

ones. 


KING-6430 with DISTILLER
5 

Seven agencies improved their overall grades, including the Department of Energy, one of today’s witnesses, which jumped two 

letter grades. 

I also want to commend the Department of Commerce for its 

work on data center consolidation, a very critical part of FITARA. 

It originally set the goal of saving $222 million and actually reported $260 million in savings, an example to which other agencies 

ought to inspire. 

While the Department of Energy and the Department of Labor 

are performing well on some aspects of the scorecard, I would note 

both agencies only recently received OMB approval—recently, I 

think it’s in the last 24 hours, but all right, good—for the initial 

implementation plan. Obviously, we expect to hear more from those 

agencies today about why their plans were delayed and what actions they are taking to advance those important IT management 

and acquisition reforms. 

It is also encouraging to see the Department of Energy reporting 

all three of its major IT projects meeting the incremental development benchmark for delivering functionality every 6 months. 

Similarly, I want to applaud the Labor Department for its realistic evaluation of the risks present in its IT projects. The department rated nearly three-fourths of its projects as high-risk, earning 

it high marks for risk assessment transparency. I know Dave 

Powner and GAO are looking for realistic assessment of project 

risks and what they entail. 

Accurately calculating and reporting project risk is a continuing 

challenge. Agencies currently report two-thirds of their IT investments pose low risk. Based on GAO’s more thorough reviews of 

those projects, that risk, we believe, is understated. 

Accurately capturing the risk so we can respond to it and anticipate problems is one of the pillars of FITARA. It is a management 

concept, so we look forward to hearing more from GAO on how to 

address that challenge as we move forward. 

I also want to hear from today’s witnesses about whether we are 

accurately defining IT investments and how that may affect implementation of reforms. 

For example, neither the Commerce Department nor NASA includes spacecraft or satellites in their reporting. Surely, those systems fall under the IT umbrella, so we would like to hear their 

thoughts about that. 

It is also puzzling that the government agency with arguably the 

most innovative and technologically demanding mission continues 

to receive the lowest marks on the scorecard, NASA. NASA has not 

reported anything under incremental development and received 

failing grades for the other three metrics. For example, it says that 

it plans to spend $731 million on major IT investments this year, 

but reports none of those projects are high-risk. That stretches credulity, and we want to talk about that today. 

Mr. Chairman, before closing, let me share an example of one 

agency doing the right thing, though it might not have been reflected in its initial grades. As my colleagues will recall, the Department of Transportation scored at the lower end in certain 

areas, but CIO Rich McKinney actually demonstrated that he gets 

what we are trying to deal when we put a freeze on IT acquisitions 


KING-6430 with DISTILLER
6 

for 90 days at the end of last year because he discovered component agency CIOs did not have a good handle on what their agencies were spending. 

We want more CIOs exercising that kind of new authority under 

FITARA. 

Today’s hearing is just the latest in what we all hope will be an 

ongoing series as we continue to push agencies to adopt these reforms. 

Again, I thank my three colleagues for their willingness to collaborate as one to try to make the government function better and 

to save money for our hardworking taxpayers. Thank you very 

much. 

Mr. HURD. Thank you, Mr. Connolly. 

I would like to hold the record open for 5 legislative days for any 

members who would like to submit a written statement. 

We will now recognize our panel of witnesses. I am pleased to 

welcome Mr. Steven Cooper, chief information officer at the U.S. 

Department of Commerce; Ms. Dawn Leaf, CIO at the U.S. Department of Labor; Mr. Michael Johnson, CIO at the U.S. Department 

of Energy; Ms. Renee Wynn, chief information officer at NASA; and 

Mr. David Powner, director of IT management issues at the U.S. 

Government Accountability Office. 

It is always a pleasure to have you here, David. 

Welcome to you all. Pursuant to committee rules, all witnesses 

will be sworn in before they testify, so please rise and raise your 

right hands. 

Do you solemnly swear or affirm that the testimony you are 

about to give will be the truth, the whole truth, and nothing but 

the truth? 

Thank you. Please be seated. 

Let the record reflect that the witnesses answered in the affirmative. 

In order to allow time for discussion, we would appreciate if you 

would implement your testimony to 5 minutes. Your entire written 

statements will be made part of the record. If the bells go off while 

you are talking, just keep going. We will conclude at your statement. 

Now, I would like to thank Mr. Cooper at the Department of 

Commerce. You got a B, the highest grade that we gave. Mr. Cooper, you get to kick us off today, starting with your 5 minutes. 

WITNESS STATEMENTS 

STATEMENT OF STEVEN I. COOPER 

Mr. COOPER. Thank you very much. Chairman Hurd, Ranking 

Member Kelly, Chairman Meadows, Ranking Member Connolly, 

and members of the subcommittees, thank you for the opportunity 

to appear before you today to discuss Commerce’s work on the implementation of the Federal Information Technology Acquisition 

Reform Act, and thank you for your resolute bipartisan efforts to 

ensure that this critical law is implemented successfully. 

To begin, I believe FITARA is one of the strongest and most helpful pieces of legislation to improve CIO involvement with the decision processes and policies related to managing information techVerDate Nov 24 2008 09:59 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00012 Fmt 6633 Sfmt 6633 H:\26068.TXT APRIL

KING-6430 with DISTILLER
7 

nology resources and increased government efficiency and effectiveness. I am committed to its success. 

Secretary Pritzker and Deputy Secretary Andrews strongly support FITARA and have made FITARA one of their and my key priorities. They have made it clear to DOC’s executive leadership that 

FITARA is the responsibility not only of the CIO, but all their senior staff. 

Since October 2015, the department’s FITARA team, representing my office and the department’s budget, acquisition, personnel, and legal offices, has been meeting weekly to ensure the 

full implementation of our FITARA plan and FITARA across the 

Department of Commerce. 

FITARA implementation is one of my top goals, and I have 

named one of my senior staff, Ms. Erin Cavanaugh, who is with me 

today, our full-time program manager for FITARA implementation, 

making the department one of only a few departments to create a 

full-time FITARA program official. 

Let me now highlight progress we have collaboratively made in 

three specific areas, and why I believe we are on a path to achieve 

full implementation in the budget, personnel, and acquisition areas 

required by FITARA. 

First, budget. My office is working closely with the department’s 

offices of budget to ensure that I am fully engaged in the budget 

formulation and review process to enable me to review and approve 

the overall DOC IT budget. Leveraging FITARA has allowed me as 

the DOC CIO to have full visibility into each bureau’s IT budget, 

which enhances my understanding of our full ask and spend, and 

helps me identify opportunities for strategic and operational collaboration all across all 12 of our bureaus in areas like 

cybersecurity, enterprise licensing agreements, cost savings, and 

contract consolidation. I am particularly pleased that the NOAA 

and Census CIOs and their budget offices have worked closely with 

my office and the DOC budget office to introduce greater involvement in budget formulation and visibility. 

Second, acquisition. Our Office of Acquisition Management has 

revised the Commerce acquisition manual, so that the CIO now 

participates in the review and approval of all acquisitions above 

$10 million, whether or not a program was initially determined to 

be IT. This is a significant change. Previous acquisition policy only 

required my office participation on acquisition over $75 million. 

Third, personnel. Our chief human capital officer and I drafted 

and reviewed and signed a new department bulletin, which gives 

me direct involvement in the selection responsibility over all SES 

IT and all CIO-titled positions across the department. That said, 

our IT work force planning is not complete, but I expect to see considerable progress in the next 6 months in addressing the hiring 

and retention of critical IT resources for cyber and IT risk management, data analytics, agile development, and Web services. 

Another notable goal of FITARA and of every CIO is cost savings 

in the IT environment. While my particular driver is not the cost 

savings per se, I fully expect implementing FITARA will help me 

drive the unit cost of every IT service we deliver down. This will 

result from opportunities identified through greater oversight, visiVerDate Nov 24 2008 09:59 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00013 Fmt 6633 Sfmt 6633 H:\26068.TXT APRIL

KING-6430 with DISTILLER
8 

bility, and collaboration across IT acquisition and budget formulation. 

In closing, for our DOC FITARA implementation to fully succeed, 

we need more than just law or policy. We need to institutionalize 

best IT practices and processes across the department. My staff is 

working with their counterparts in each bureau CIO office and in 

our H.R., finance, and acquisition offices to improve visibility and 

participation in all IT budget and acquisition processes. I expect to 

have initial process improvements and reviews in place by the end 

of this fiscal year, and to operate more efficiently in the future. 

I thank the subcommittees for holding this hearing and for your 

commitment to ensuring successful implementation of FITARA. I 

would be pleased to answer any questions you may have. 

[Prepared statement of Mr. Cooper follows:] 


KING-6430 with DISTILLER
9 


KING-6430 with DISTILLERInsert offset folio 1 here 26068.001

TESTIMONY OF STEVE COOPER 

DEPARTMENT OF COMMERCE CHIEF INFORMATION OFFICER 

BEFORE THE SUBCOMMITTEES ON 

INFORMATION TECHNOLOGY AND ON GOVERNMENT OPERATIONS OF THE 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

UNITED STATES HOUSE OF REPRESENTATIVES 

May 18,2016 

Chairman Hurd, Ranking Member Kelly, Chairman Meadows, Ranking Member Connolly, and Members of the 

Subcommittees, thank you for the opportunity to appear before you today to discuss Commerce's work on the 

implementation of the Federal Information Technology Acquisition Reform Act (FITARA), and thank you for your 

resolute, bipartisan efforts to ensure that this critical law is implemented successfully. 

To begin, I believe FITARA is one of the strongest and most helpful pieces of legislation to improve CIO involvement with 

the decision processes and policies related to information technology {IT) resources and increased government 

efficiency and effectiveness. I am committed to its success. 

Secretary Pritzker and Deputy Secretary Andrews strongly support FITARA and have made FITARA one of their, and my, 

key priorities. They have made it clear to the Department of Commerce's executive leadership that FITARA is the 

responsibility not only of the CIO but all their senior staff. Since October 2015, the Department's FITARA Team, 

representing my office and the Department's Budget, Acquisition, Personnel, and Legal offices, has been meeting weekly 

to ensure the full implementation of FITARA across Commerce. I have identified FITARA implementation as one of my 

top programmatic goals. Moreover, I have named one of my senior staff, Ms. Erin Cavanaugh, former Acting Director of 

IT Policy and Planning, as our full time Program Manager for FITARA implementation, making the Department of 

Commerce (DOC) one of only a few departments to create a full-time FITARA position. I have reinforced the importance 

of FITARA with my DOC CIO Council by adding FITARA as a standing agenda item in each CIO council meeting. The DOC 

C!O council includes the CIO from each of the Department's 12 bureaus. We meet every two weeks to make the tough 

decisions, collaborate, and shape the actions necessary to bring all Commerce IT into the 21st century in support of the 

varied DOC missions. 

Page 1 of 4 
10 


KING-6430 with DISTILLERInsert offset folio 2 here 26068.002

Let me now turn to the progress we have collaborative!y made in several areas, and why I believe we are on the path to 

achieve full implementation in the budget, personnel, and acquisition areas required by F!TARA. 

Budget 

My office is working closely with the Department's Office of Budget to ensure I am fully engaged in the budget 

formulation and review process to enable me to review and approve the overall DOC IT budget. Leveraging FITARA has 

allowed me, as the DOC CIO, to have full visibility into each Bureau's IT budget to enable me enhance my understanding 

of our IT "ask" and "spend" and to help me identify opportunities for strategic and operational collaboration across 

bureaus (e.g. cyber security}, strategic sourcing (e.g., enterprise licensing agreements}, cost-savings, and contract 

consolidation and improvement. I am particularly pleased that the NOAA and Census CIOs and their budget offices have 

taken some earlier initiative in this area, and I expect to leverage their work going forward with the other bureau C!Os. 

understand that the new A-ll guidance from OMB will incorporate much of the policy and process changes needed in 

this area, and I and our DOC Budget Director are fully prepared to work across the Department to comply with that 

guidance. 

Acquisition 

The DOC Office of Acquisition Management has revised the Commerce Acquisition Manual so that my office now 

participates in the review and approval process for all acquisitions above $10 million, whether or not a program was 

initially determined to be IT procurement. This is a significant improvement, as our previous acquisition policy only 

required my office's participation on acquisitions over $75 million. We are leveraging FJTARA to revise our acquisition 

policies to ensure Bureau C!Os will see virtually all acquisitions involving IT. In some bureaus, the Bureau CIO does not 

have authority to review a !liT acquisitions, and therefore is not able to identify opportunities for cost savings or 

collaboration in a fully optimized manner. In other bureaus, notably Census and the Bureau of Economic Analysis, their 

C!Os see and review all major acquisitions involving IT, and we are moving in this direction across all Commerce Bureaus. 

Personnel 

Our Chief Human Capital Officer and I drafted, reviewed, and signed Department HR Bulletin 206, which gives me direct 

involvement in selection responsibility over SES IT and all CIO-titled positions across the Department. That said, our IT 

workforce planning is not complete but I expect to see considerable progress in the next six months in addressing the 

hiring and retention of critical IT resources (e.g., Cyber and IT Risk Management; data analytics; agile development; web 

services). 

Page 2 of4 
11 


KING-6430 with DISTILLERInsert offset folio 3 here 26068.003

Data Center Consolidation Initiative 

An important part of FITARA is data center consolidation. GAO and Congress have recognized our progress on the Data 

Center Consolidation Initiative. We look forward to continuing that progress when OMB issues new guidance on the 

Data Center Optimization Initiative. We have already begun supporting the Incremental Development Initiative and the 

Workforce Initiative as well. 

Federal IT Dashboard 

We continue to keep our reporting on the IT Dashboard transparent and accurate. I review our IT portfolio of all major 

investments monthly with my Capital Program Investment and Control (CPIC) team prior to posting our monthly 

scorecard. This review, with input from DOC CPIC Committee, results in timely and comprehensive reporting of 

identified risks and progress for our major IT projects and investments. Under FITARA, I have expanded our CIO reviews 

to include projects and information systems which introduce new technology; are public facing; are deemed high risk; or 

were not developed within DOC but are required to be used by DOC employees. Our goal is to review all major IT 

systems in the IT Portfolio Report at least once every year and all IT projects which meet our new FITARA driven criteria 

at least once every three years. 

IT Governance 

Each bureau, via our DOC CIO Council has been sharing best practices across the Department on IT operations, cyber 

security and risk management, acquisition, and methods for attracting and retaining key IT personnel. This sharing has 

helped us identify opportunities for collaboration among bureaus, opportunities to consolidate contract actions, solve 

tough technical problems, and increase the morale and esprit-de-corp of our IT communities of practice. 

Strategic Sourcing 

Finally, I want to note our successful history with strategic sourcing. Recently, the American Council for Technology and 

the Industry Advisory Council (ACT-lAC) identified the Department's strategic sourcing efforts as an example of a Level3 

"Best Practice," which is the highest level an agency can attain. 

Opportunities 

One of the major challenges facing every federal CIO is "shadow IT." Shadow IT refers to systems and solutions built and 

used inside bureaus and offices without direct CIO review or approval or deployed and operated outside of the 

respective IT department. These systems are frequently not aligned with the Department's enterprise architecture, nor 

reviewed for compliance with requirements for control, documentation, security, and reliability. These systems 

represent a greater risk of exposing government data to privacy and security breaches. FITARA, with its emphasis on 

Page 3 of 4 
12 


KING-6430 with DISTILLERInsert offset folio 4 here 26068.004

transparency and collaboration/ gives every CIO an excellent opportunity to identify these systems, and to bring them 

into alignment with appropriate rules and CIO oversight. By working with our Privacy Officer, our CIO Council, and our 

cybersecurity team we will move shadow IT from being a higher risk and potential liability to a value added asset. 

COST SAVINGS 

Another notable goal of FITARA, and of every CIO, is cost savings in the IT environment. While my driver is not cost 

savings per se, I fully expect implementing FITARAwill help drive the unit cost of every IT service down. This will result 

from opportunities identified through greater oversight, visibility, and collaboration across IT acquisition and budget 

formulation. 

CLOSING 

For our DOC FITARA implementation to fully succeed, we need more than just law or policy. We need to institutionalize 

best IT practices and processes across the Department. My staff is working with their counterparts in each bureau CIO 

office to improve visibility and participation in all IT budget and acquisition processes. I expect to have initial process 

improvements and reviews in place by the end of this fiscal year, and to operate more efficiently in the future. 

FITARA is providing me, as the Commerce CIO, and each Bureau CIO, significantly enhanced oversight into all things 'IT'. 

With this oversight, and the accompanying individual and shared responsibility/ I expect that our IT environment will be 

more cohesive, more collaborative, and more effective in the years to come. !strongly believe FITARA will help the 

Secretary and I achieve our agreed goals, thus serving the many and varied customers of the Department of Commerce 

and the American Public. 

I thank the Subcommittees for holding this hearing, and for your commitment to ensuring successful implementation of 

FITARA. I would be pleased to answer any questions you may have. 

Page 4 of 4 
13 

Mr. HURD. Thank you, Mr. Cooper. 

I now would like to recognize Ms. Dawn Leaf, CIO at the Department of Labor, who had a grade of C, which is one step better than 

you were the last time we issued these grades. 

So, Ms. Leaf, over to you for 5 minutes. 

STATEMENT OF DAWN LEAF 

Ms. LEAF. Chairman Hurd, Ranking Member Kelly, Chairman 

Meadows, Ranking Member Connolly, and members of the subcommittees, good afternoon and thank you for the opportunity to 

brief you on the Department of Labor’s FITARA implementation. 

I would like to focus on some challenges, highlight some 

progress, and provide you a working-level perspective on how 

FITARA can help the department to improve its IT services. 

First, let me state that, historically, the Department of Labor has 

had decentralized IT organizations and resources, that these have 

been fragmented and siloed at the department bureau level. We 

have experienced the same inefficiencies and issues that I know 

this committee has heard described in other hearings by other 

agencies. 

Another relevant factor that I would like to emphasize is that 

decades of information technology underinvestment and the fragile 

state of our IT infrastructure and our application systems make it 

challenging for the department to improve its performance in some 

of the FITARA metrics. 

Specifically, it is difficult for the Department of Labor to achieve 

high scores and cost savings because we are on a bare-bones IT 

budget to start with. There is not much to cut. 

On the positive side, we have a great opportunity with cost 

avoidance, to leverage enterprise investments in IT, to add technology capabilities and services, and to do so more efficiently. 

Turning to progress, the department has improved and strengthened its IT governance processes, and that has helped us to improve transparency, to improve our risk management, and to improve our incremental delivery and development. 

In 2012, the department launched an initiative to consolidate 

nine separate agency infrastructures. We have made some 

progress, and we have proven that we can deliver modern IT services on time and within budget. 

By the end of 2016, we will have closed 38 of our 90 data centers. 

We will have achieved or met our 40 percent data center consolidation target. 

In 2014, the department migrated 17,000 employees from nine 

separate legacy email systems to a commercial Federal community 

cloud service. For the same cost, we are able to give our employees 

400 times as much storage, which gives them back 2 hours per 

month per employee, because now they are able to just work instead of spending 2 hours a month archiving email so that they 

have enough space to work, so they can send and receive emails. 

In 2015 and 2016, the department improved our cybersecurity 

posture, including a 95 percent reduction in security vulnerabilities 

by implementing an aggressive security patch in our patch management process. 


KING-6430 with DISTILLER
14 

We are planning a 2017 through 2019 unified communications 

project to redesign, modernize, and consolidate nine decades-old 

networks in over 600 locations throughout the U.S. This is not only 

critical for security, it also allows us to reduce costs. We will be 

able to reduce 85 percent of our voice circuits and 50 percent of our 

phone management costs. 

In closing, I would like to just touch on two ways that FITARA 

can help the Department of Labor with its IT challenges. 

FITARA is especially important to an agency that is starting in 

an underfunded position, because it encourages the department to 

make IT investments that are not only effective for agency missions, but efficient. FITARA also provides structure to help us manage change, organization change and technology change. 

While the Department of Labor is moving forward, we realize 

that we have a long road ahead. Thank you for the opportunity to 

share my thoughts, and I am happy to answer any questions. 

[Prepared statement of Ms. Leaf follows:] 


KING-6430 with DISTILLER
15 


KING-6430 with DISTILLERInsert offset folio 5 here 26068.005

STATEMENT 

OF 

DAWN MARIE LEAF 

CHIEF INFORMATION OFFICER 

U.S. DEPARTMENT OF LABOR 

BEFORE THE 

SUBCOMMITTEES ON INFORMATION TECHNOLOGY 

AND GOVERNMENT OPERATIONS 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

UNITED STATES HOUSE OF REPRESENTATIVES 

May 18,2016 

Introduction 

Chairman Hurd, Ranking Member Kelly, Chairman Meadows, Ranking Member Connolly, and 

Members of the Subcommittees, thank you for the invitation to appear today to discuss the 

Department of Labor's (DOL) implementation of the Federal Information Technology 

Acquisition Reform Act (FITARA). I would like to highlight the progress that DOL has made in 

the key and related areas of Information Technology (IT) Portfolio Review and Risk 

Management, and Incremental Development. I will also highlight our IT Modernization 

progress, including Data Center Consolidation, and the Department's improvements to its IT 

Security posture. Finally, I offer an "in the trenches" perspective on the role ofFITARA in 

helping DOL to meet these and other IT challenges. 

One factor that I would like to emphasize is that the Department's level of IT funding and the 

state of the Department's IT Legacy infrastructure and mission application systems directly 

affect the ability of, and speed with which, DOL can complete some of the requirements that are 

needed to improve the Department's performance in the FITARA Report Card metrics. As 

summarized in the Department's April 21, 20 !6, response to an oversight inquiry from this 

Committee and the Senate Committee on Homeland Security and Governmental Affairs, DOL 

has "' ... significant IT challenges, including that some of our systems have become unreliable 

because we have for many years lacked the funds to maintain and update them." To be clearer, it 

is difficult for DOL to achieve high scores in cost savings because the Department is on a bare 

bones IT budget to begin with. On the positive side, my message to you today is that there is a 

silver lining. Every IT governance process that we improve and every IT dollar that we invest 

results in a large return to the taxpayer in terms of improved services and cost avoidance each 

dollar spent goes a long way. DOL's greatest opportunity is the ability to leverage Departmentwide investments for new IT services, and eliminate the additional expenses we would incur 

from making duplicative investments at the individual component agency level. FIT ARA is 

helping the Department to accomplish our IT improvements more efficiently. 
16 


KING-6430 with DISTILLERInsert offset folio 6 here 26068.006

IT Governance Process Improvements 

Portfolio Review 

In 2013, DOL established an annual Office of the Chieflnformation Officer (OCIO) review of 

component agency level IT investments as part of the annual budget formulation process. This 

review identifies opportunities for DOL to plan strategically, avoid duplication, and leverage our 

investments. For example, to improve customer service, the majority of DOL agencies want to 

move from brick and mortar desktop systems to mobile computing and expand use of data 

analytic tools. DOL estimated that providing these capabilities at the Departmental level would 

cost less than 50% of the sum total of what the components were seeking to undertake through 

separate, agency-specific projects. 

While this was a good first step, DOL's FITARA plan recognizes the need for enhanced 

coordination between the Chief Financial Officer (CFO), the Departmental Budget Center 

(DBC), and the Chief Acquisition Officer (CAO) to reinforce the CIO's role in Department IT 

planning and execution by requiring earlier and more detailed review of agency IT budget 

requests and IT acquisitions. In Fiscal Year (FY) 2016, DOL is strengthening the OCIO review 

and approval process. For example, DOL component agencies are required to confirm that they 

have allocated the portion of their discretionary IT funding necessary to ensure that mission 

critical systems are up to date with security patches, prior to obtaining annual IT Spend Plan and 

IT acquisitions' approval. 

Program Planning and Execution 

In 2013, DOL also established a Departmental IT Program Review Board (PRB) for OCIO-led 

infrastructure and enterprise applications. Every project that has gone through this process, such 

as the DOL Cloud Email implementation, has been completed within budget and on schedule, 

and has successfully delivered the results and IT services as planned. In FY 2016, DOL is 

expanding the use of the IT Program Review Board process to include not only Enterprise 

projects managed by the OCIO, but all agency projects for new mission applications and major 

upgrades to legacy systems. This process increases transparency not only in the upfront 

investment and project planning, but also in the project execution. The IT PRB members include 

key Department stakeholders, such as the Chief Information Security Officer and Chief Financial 

Officer, and designated business and IT managers from across DOL agencies. Expanding the 

scope and role of the IT PRB will help us assess and reduce risk for DOL's IT projects by 

ensuring that they are well planned and executed, and completed successfully on time and within 

budget. With respect to incremental development, DOL plans all projects in stages, including 

infrastructure and acquisition of commercial and shared services. DOL also uses agile 

development methodology for new applications development. The expectation is that this IT 

Governance improvement will allow DOL to improve Risk Assessment Transparency and 

Incremental Development metrics. 

2 
17 


KING-6430 with DISTILLERInsert offset folio 7 here 26068.007

IT Organization and Workforce Governance 

There is, and has always been, only one "CIO" at the Department of Labor. However, each DOL 

component agency has a senior IT manager that reports within that particular agency or office. 

In 2015, DOL formally posted the DOL Bureau IT Leadership Directory with the names and 

titles of these agency IT leaders, and implemented a management policy requiring Agency heads 

to obtain the CIO's approval to announce and fill vacancies for these positions. We also 

established a working group, comprised of agency representatives, the CIO, CAO, and the Chief 

Human Capital Officer (CHCO) to define performance plan elements that support 

Administration and Department objectives. 

Since FITARA's enactment, the improved IT governance processes, increased transparency, and 

program checkpoints we have introduced are enabling the Department to make more informed 

decisions, reduce risk, improve IT services, and achieve greater efficiencies. 

IT Modernization 

I would like to highlight examples of initiatives that are helping DOL to make progress toward 

some of the key FIT ARA objectives. The DOL IT Modernization effort, launched in 2012, has 

an objective to consolidate nine separate and disparate agency IT infrastructures into one unified 

infrastructure under the management authority of the CIO. While the technical consolidation 

timeline is funding dependent, DOL has made significant progress, and has proven that it can 

deliver modern IT services on time and within budget. 

Data Center Consolidation 

During the 2013 Memorial Day holiday weekend, DOL opened its Department-wide 

commercially-hosted consolidated data center. This immediately reduced the risk of a service 

outage by increasing available emergency power uptime from 2 hours to over 24 hours. In 2014, 

DOL closed 20 of its non-core data centers, and made improvements to prepare DOL for its 

connection and migration to cloud e-mail and virtualized servers. In April20 16, DOL leveraged 

an existing data center to stand up a new Department Failover and Disaster recovery capability. 

To date, DOL has closed 28 data centers to bring the original total down from 90 to 62. DOL is 

on track to close an additional I 0 data centers in 2016, achieving its 40% target. 

Unified Communications Project 

Another keystone IT Modernization effort is our Unified Communications project, which 

includes a redesign of the decades old DOL network and security infrastructure. The 

Department's nine separate legacy networks have inherent security vulnerabilities by virtue of 

their age and design. A more secure and well-performing network, with greater capacity, is 

needed for DOL to expand mission support, reduce costs, and expand the use of cloud and 

Federal shared services. Because most of our workforce of approximately 17,000 employees is 

distributed in office locations throughout the U.S., DOL has over 600 voice and 600 data 

telecommunications circuits. Many organizations moved to Voice over Internet Protocol (VOIP) 

shared voice and data lines in the early 2000's. DOL did not. When fully funded, the Unified 

Communications project will leverage VOIP to allow DOL to reduce costs and improve 

3 
18 


KING-6430 with DISTILLERInsert offset folio 8 here 26068.008

efficiency. We estimate that as much as 85% of the annual voice circuits, and as much as 50% 

of phone management service costs, can be reduced when DOL moves away from duplicate 

voice and data lines and separate phone and data network management. This project is also a 

critical element of DOL's efforts to fully integrate its nine separate agency infrastructures and to 

fully complete the Data Center Consolidation initiative. 

IT Security 

Despite the Cybersecurity dependencies on the network infrastructure and Data Center 

Consolidation projects, DOL has improved its security posture while these projects are in 

progress. In support of Cyber Sprint, DOL accelerated the timeline for implementing identity 

access management two-factor authentication. DOL is an early adopter of free Department of 

Homeland Security (DHS) Continuous Monitoring (CM) tools to identify vulnerabilities on DOL 

computing devices. As a result, DOL has reduced its unpatched security vulnerabilities across 

the Department by approximately 95%. In 2016, DOL implemented a Mobile Device 

Management technical security policy to reduce the risk of DOL data loss. 

Cloud Email and Collaboration 

Perhaps the most visible Department level IT Modernization project that DOL has completed is 

Cloud Email and Collaboration. In FY 2014, DOL successfully migrated 17,000 DOL 

employees from nine separate legacy email systems to a commercial federal community cloud 

email service. This satisfied the number one request from DOL staff surveyed in 2011- to 

increase email working space. For the same monthly cost per employee as the old legacy email 

systems, DOL is providing each employee with 400 times the amount of storage that he or she 

had before, as well as unlimited archive space. In 2014, DOL estimated that the migration to 

cloud email saved each DOL employee approximately 2 hours per month in time spent deleting 

email because of storage constraints. 

Through the Department IT Governance Process improvements referenced earlier, DOL is 

encouraging DOL agencies to prioritize the replacement of decades old legacy application 

systems. The legacy systems aren't productive for our staff or the public, cost relatively more to 

support, and increase security and reliability risks. 

Costs and Benefits of IT Modernization 

To date, DOL's IT modernization efforts have resulted in more cost avoidance than cost savings. 

We do not have a large IT Budget with excess resources that can be reduced. The benefits 

accruing from cost avoidance are improved DOL staff productivity and cases where a specific IT 

capability or capacity is added, improved or increased for the same cost that DOL paid 

previously. For example, in the case of the cloud email implementation, the replacement of an 

existing service allowed the Department to avoid the cost it would have incurred to provide 

employees with four hundred times as much storage capacity. The cost savings and avoidance 

associated with having more reliable IT services is harder to quantify, but we know from 

experience that outages caused by antiquated systems are costly-- to productivity, service to the 

public, the Department's reputation, and employee morale. 

4 
19 


KING-6430 with DISTILLERInsert offset folio 9 here 26068.009

Conclusion 

In closing, I'd like to touch on two challenges the Department continues to face. While these are 

obvious, I think it is important, from a working ground level perspective, to emphasize the role 

that FIT ARA has in helping DOL to meet these challenges. 

Earlier in my statement, I referenced the DOL IT funding challenge and its impact in terms of 

Legacy IT application and infrastructure systems. FIT ARA is particularly important to an 

agency that is starting from an underfunded position because it encourages the Department to 

leverage the scarce resources it does have not only effectively, but efficiently. 

While not unique to our discipline or organization, the other challenge we must confront is that 

the Department is absorbing a great deal of change, at a very rapid pace. We are introducing 

new technology to the IT staff and to the DOL workforce. We are making changes to strategic, 

tactical and operational plans while we are executing them. We are introducing organizational 

change that affects the entire Department, including significant governance and process changes. 

There is also a natural tension created as we shift from optimization at the individual component 

agency level to a broader Departmental level, and from a Departmental level to the Federal level. 

FIT ARA provides added structure and consistency to help the Department absorb these changes 

and accomplish the overarching goals of Federal IT transformation. 

While the Department has moved, and continues in the right direction, we recognize that there is 

still a long road ahead to achieve full implementation ofFITARA and the goals it was intended 

to support. Thank you again for this opportunity to share my thoughts with the Subcommittees. I 

will be pleased to answer any questions you may have. 

5 
20 

Mr. HURD. Thank you, Ms. Leaf. 

Mr. Johnson, you are now recognized for 5 minutes, and the Department of Energy has moved the most in their grades to a C, I 

believe from an F, the last score. So thank you for that, Mr. Johnson. You are now recognized for 5 minutes. 

STATEMENT OF MICHAEL M. JOHNSON 

Mr. JOHNSON. Good afternoon, Chairman Hurd, Ranking Member Kelly, Chairman Meadows, Ranking Member Connolly, and distinguished members of the committee. On behalf of the Department 

of Energy, I appreciate the opportunity to appear before you to discuss the department’s implementation of the Federal Information 

Technology Acquisition Reform Act. 

The department has been working closely with OMB to implement FITARA and cyber best practices across the complex ecosystem that is the Department of Energy as we meet our diverse 

mission. We are pleased that the committees’ just-release May 

2016 FITARA implementation scorecard 2.0 acknowledges that the 

department is making progress. 

Just this last Friday, DOE submitted to OMB the third major revision to our initial FITARA implementation plan submission. I am 

pleased to say that yesterday OMB approved DOE’s FITARA implementation plan, and we will post it to our public Web site within 

the next 30 days. 

DOE’s FITARA implementation plan is transformational for the 

department, and it results in unprecedented CIO engagement and 

DOE enterprise-wide transparency into IT budget formulation and 

review, acquisition review and approval, and IT work force planning. In addition, the plan provides for the collection of detailed IT 

and cyber performance metrics across all DOE IT investments. 

At the request of the Secretary, I joined DOE a little over a year 

ago to develop and implement an effective cyber strategy for the 

DOE enterprise. The complex DOE enterprise comprises 97 entities 

across 27 States, to include 19 staff offices, 10 program offices, 19 

field sites, 17 National Laboratories, four technology centers, and 

the four Power Marketing Administrations. 

Each entity is structured to perform its area of our diverse mission that spans nuclear security, scientific research, energy, and 

environmental management. All but one of our National Laboratories are government-owned, contractor-operated facilities managed through the management and operating, or M&O, contracts 

designed to enable innovation and management efficiencies. 

Our cyber governance is both transparent and responsive, and 

includes close collaboration involvement with all entities across 

DOE, notably the National Laboratories. 

The Deputy Secretary chairs the DOE cyber council. As CIO, I 

chair the DOE Information Management Governance Board. We 

use these entities to oversee development, coordination, and implementation of DOE’s cyber- and IT-related policies. 

The information technology portion of DOE’s budget is approximately $1.7 billion, which often is integrated into the larger nonIT investments. We have expanded our processes to ensure CIO involvement in all phases of annual and multiyear IT planning, programming, budgeting, and decision-making. The department has 


KING-6430 with DISTILLER
21 

also developed an enterprise plan for review and approval of IT acquisitions that covers acquisition plans, statements of work, evaluation, and selection criteria. 

DOE understands the need to leverage human capital for success. Accordingly, we are focusing on the development of a DOE 

cyber work force strategy that will increase the CIO’s involvement 

in DOE’s human capital selection practices with a focus on developing performance goals with results-driven critical elements and 

enhanced recruitment and retention of vital IT personnel. 

The DOE continues to consolidate and optimize its data centers 

to include advanced metering facility upgrades to improve power 

utilization effectiveness. 

From 2010 to present, for our updated and expanded inventory 

of 217 enterprise computing data centers, including both Federal 

and M&O, we closed 75, increasing cost savings to the department 

of just over $17 million. 

We developed a unified DOE cyber strategy and implementation 

plan that consolidates and prioritizes the excellent cyber enterprise 

information resources management initiatives ongoing at the DOE 

into five key areas: information resources management best practices, to include reliability and enhanced efficiencies; modernization, to quickly move from legacy to transformative solutions; 

strengthen cybersecurity fundamentals, to reduce risk and enhance 

defense in-depth capabilities; seamless integration of operations in 

cyberdefense, to combine situational awareness and threat operational status in enterprise-wide, real-time indicator-sharing; and 

cyber research and development intended to out-innovate our adversaries and stay ahead of advanced persistent threats. 

In conclusion, DOE is actively engaged in FITARA implementation and related transformational reforms, which will result in significant insights into and enhanced oversight of DOE information 

and IT. Through a department-wide collaborative and inclusive 

process, we have made major strides toward the goal, although further work is needed. 

I thank the subcommittees for their commitment to ensuring successful implementation of FITARA. Your support is vital to our success. 

It has been my honor to provide this testimony, and I will be 

pleased to address any questions you may have. Thank you. 

[Prepared statement of Mr. Johnson follows:] 


KING-6430 with DISTILLER
22 


KING-6430 with DISTILLERInsert offset folio 10 here 26068.010

STATEMENT 

OF 

MICHAEL JOHNSON 

CHIEF INFORMATION OFFICER 

U.S. DEPARTMENT OF ENERGY 

BEFORE THE 

SUBCOMMITTEES ON INFORMATION TECHNOLOGY 

AND GOVERNMENT OPERATIONS 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

UNITED STATES HOUSE OF REPRESENTATIVES 

May 18,2016 

Introduction 

Good afternoon, Chairman Hurd, Ranking Member Kelly, Chairman Meadows, Ranking 

Member Connolly, and distinguished Members of the Committee. On behalf of the Department 

of Energy (DOE), I thank you for the opportunity to appear before you to discuss the 

Department's implementation of the Jssa-Connolly Federal Information Technology Acquisition 

Reform Act (FIT ARA), and thank you for your efforts in ensuring that this critical law is 

implemented successfully. DOE welcomes the authority that FITARA provides to accomplish 

greater transparency and fiscal accountability over its Information Technology (IT) and cyber 

investments. 

During my tenure at DOE, I have been working to implement FIT ARA and cybersecurity best 

practices across numerous and diverse DOE components. This work has enabled the 

development of strategic partnerships among departmental Program Offices and senior leaders 

that will allow DOE FITARA implementation to strengthen key reform initiatives, including 

PortfolioStat, Tech Stat, CyberStat, and data center optimization. 

The DOE Enterprise 

I joined DOE a little over a year ago to develop and implement an effective, efficient, and 

inclusive cyber strategy for the DOE enterprise. The enterprise comprises 97 entities-spread 

across 27 states-divided among 10 Program Offices, 19 Staff Offices, 4 Power Marketing 

Administrations. 19 Field Sites, 17 National Laboratories, and 4 Technology Centers-each 

uniquely structured to perform our distinct mission. This mission spans an incredibly diverse 

range of portfolios from nuclear security, open science research, power administration, to 

environmental management. 

Of the 17 National Laboratories, all but one are government-owned, contractor-operated 

facilities, managed through Management and Operating (M&O) contracts. The IT portion of 

DOE's overall budget is approximately $1.78 ($1.18 of which is spent through M&O contracts). 

At DOE, IT is often an integrated component of much larger non-IT investments. 
23 


KING-6430 with DISTILLERInsert offset folio 11 here 26068.011

The DOE enterprise is a critical factor relevant to FIT ARA implementation. Wherever possible, 

DOE leverages its existing management and acquisition processes, including National Nuclear 

Security Administration (NNSA). DOE's efforts to implement FITARA reflect the input of 

stakeholders from across the enterprise; for over a year the DOE enterprise has applied 

knowledge and expertise to collaboratively identify and resolve FIT ARA implementation issues. 

Governance 

The Department's IT and cyber governance is fully inclusive, transparent, responsive, and 

supportive of the DOE mission. The DOE Cyber Council, chaired by the Deputy Secretary, and 

Information Management Governance Board (IMGB), which I chair, are our executive policy 

and implementation fora. The Cyber Council is chartered to, among other things, reinforce 

strategic and tactical information sharing and information safeguarding initiatives to ensure 

enterprise-wide compliance with legislative requirements, executive orders, Federal policies and 

rules, and Federal cybersecurity and risk management standards. The Cyber Council reviews 

and vets significant enterprise information resources management and cyber-related policy issues 

prior to a decision by the Secretary and the Deputy Secretary. The IMGB consists of senior 

officials from the DOE enterprise with responsibility for IT systems and cybersecurity, and 

serves as the forum for collaboration, development, coordination, and implementation of 

enterprise information resources management activities. The lMGB is structured to conduct 

detailed program reviews for IT investments, to include performance issues in project execution, 

cost, schedule, technical metrics, and risks. This supports DOE's development of accurate risk 

ratings for its submission to the Federal IT Dashboard. The IMGB and the Cyber Council are 

mature, functioning bodies, with invested and engaged stakeholders from across the DOE 

enterprise that meet on a regular basis. 

Budget & Acquisition 

Working closely with the Department's senior leadership team. I have significant involvement in 

IT-based budget, procurement, and workforce decision-making. Crucial to effective DOE 

implementation of FIT ARA, is ensuring that the CIO is able to provide strategic input at the 

early stages of DOE's budgeting and acquisition processes. DOE is adjusting its internal budget 

development procedures and guidance to ensure CIO involvement in all necessary phases of its 

annual and multi-year planning, programming, budgeting, and decision-making. Further, DOE is 

working to reengineer current acquisition strategy processes to include the CIO (or 

representative) in all IT -related acquisition and execution decisions. The Chief Acquisition 

Officer (CAO), Chief Financial Officer (CFO), and I, along with DOE elements, worked 

collaboratively to develop an enterprise plan for the review and approval of IT acquisitions that 

covers acquisition plans, statements of work, and evaluation and selection criteria. The end 

goals are expedited final review and approval that incorporates factors such as strategic planning 

and sourcing, enterprise goals, licensing, and mission needs prior to spending on IT assets. 

2 
24 


KING-6430 with DISTILLERInsert offset folio 12 here 26068.012

Transparency 

Greater transparency for DOE leadership into enterprise IT spending is foundational to FIT ARA 

implementation. DOE understands that improving acquisition, investment governance, and IT 

portfolio transparency are critical elements towards achieving mission objectives and greater 

savings, all while reducing cyber risk. 

Data-driven decision-making is a key activity for the Department. We are currently refining the 

IT Portfolio reporting processes to ensure alignment with substantive processes and categories 

across the Department. This will provide the DOE CIO, DOE Element CIOs, and the broader 

DOE enterprise transparency into the enterprise IT spend across both mission and support IT, 

and in both major and non-major investments. Based on this, we are developing additional 

improvements to increase the transparency of our IT portfolio on the Federal IT Dashboard. 

Workforce & Organization 

With strong leadership endorsement, the Chief Human Capital Officer (CHCO) and I are 

working together to develop and implement the DOE Cyber Workforce Strategy, that will define 

and implement a process to increase the CIO's involvement in DOE's human capital selection 

practices, develop performance goals with results-driven critical elements for identified 

positions, and enhance recruitment and retention of vital IT personnel. Our goal is to ensure that 

DOE's information management and cyber workforce is both well-trained and equipped to 

respond rapidly to evolving mission needs. We are simplifying and expediting the hiring 

process, and are examining workforce requirements to develop rules and practices that will 

sustain this critical workforce. 

In accordance with Office of Management and Budget (OMB) policy, DOE is requiring all 

program and project managers assigned to major acquisitions to obtain the necessary 

certifications that meet government-wide standards for knowledge. skill, and experience. This 

includes mandatory training in the areas of Advanced Risk Management, Program Management 

and Portfolio Analysis, Agile Methodologies, and Advanced Earned Value Management 

Techniques. In 2015, DOE implemented a program to increase the number of Level I. 2, and 3, 

Federal Acquisition Certification for Program and Project Managers (FAC-P/PM) across 

the enterprise. The DOE F AC-P/PM is one step toward increasing certifications on all levels. 

All Elements must report project management qualifications and ensure that project managers 

are equipped to successfully manage major IT investments, ensuring compliance with both 

external and internal regulations and guidance. On a quarterly basis, DOE CIO reviews all major 

IT investments to ensure that the project managers assigned to those investments are FAC-P/PM 

certified at the appropriate level. 

Data Center Optimization 

Data Center Optimization and Consolidation is central to DOE's strategy to increase 

effectiveness across the enterprise, reduce IT and energy costs and gain efficiencies, and reduce 

cyber risk associated with legacy systems. We have proactively taken steps to capture a broader 

enterprise-wide inventory of data centers, expanding our previous reporting by including the 

3 
25 


KING-6430 with DISTILLERInsert offset folio 13 here 26068.013

breadth of our enterprise, noting that several of our mission-specific data centers are not suitable 

for consolidation because of the nature of their respective mission requirement, to include data 

processing and storage needs. 

DOE continues optimization of its data centers through advanced metering and facility upgrades 

to improve power utilization effectiveness. DOE will continue to refine its data center 

optimization initiative strategy, modernize its IT infrastructure, migrate workloads to the Cloud, 

and optimize its data centers for greater operational and energy efficiency. To that end, DOE 

established an enterprise-wide Data Center Working Group, chartered to identify best practices 

in data center metering, optimization, consolidation, and cloud migration. 

From 20 I 0 to present, DOE reported a total of217 enterprise computing data centers. During 

this timeframe, 75 data centers have been closed, leaving a total of 142 open enterprise data 

centers. The closures have resulted in a savings to the Department of just over $17M. 

Cybersecurity 

The DOE approach to cybersecurity addresses dynamic and evolving cyber threats. To achieve 

our cyber security mission objectives, we consolidated cyber initiatives into a unified and 

prioritized DOE plan that collects them into several areas including: (I) Information Resources 

Management best practices (to improve effectiveness, reliability, and efficiency); 

(2) modernization (to move quickly from legacy to transformative solutions); (3) strengthened 

cybersecurity fundamentals (to reduce risk and defense-in-depth capabilities); and (4) seamless 

integration of lnfonnation Resources Management operations and cyber defense (to combine 

situational awareness of threat, operational status and events, and cyber incidents). 

DOE has made significant contributions to the real-time dissemination of actionable cyber threat 

infonnation, both inside and outside the Department. Our intent is to leverage the full 

complement of enterprise capabilities and protect the DOE enterprise. 

Conclusion 

DOE is committed to greater transparency and fiscal accountability over its IT and cyber 

investments. The Department is actively working to implement FIT ARA in a manner that is 

best-suited to the structure and functioning of DOE's complex enterprise. Through a 

department-wide inclusive, and collaborative process, we have made major strides towards that 

goal, although further work is needed. Your interest and support are vital to our success. It has 

been my honor to provide this testimony to you. I would be pleased to address any questions 

that you may have for me. 

4 
26 

Mr. HURD. Thank you, Mr. Johnson. 

Votes have been called. It is a six-vote series, so we are going to 

stand adjourned until the end of the final vote. 

[Recess.] 

Mr. HURD. The Subcommittees on Information Technology and 

Government Operations will reconvene. 

I think we left off with you, Ms. Wynn, for your opening statement of 5 minutes. Since I have called out the grades for everyone 

else, NASA had the lowest grade of the folks reviewed with an F. 

Ms. Wynn, over to you for 5 minutes. 

STATEMENT OF RENEE P. WYNN 

Ms. WYNN. Thank you, Chairman Hurd, Chairman Meadows, 

and other members of the Information Technology and Government 

Operations Subcommittees for allowing me to appear before you 

today to update you on NASA’s implementation of the Federal Information Technology Acquisition Reform Act. 

Unfortunately, NASA is at the bottom of the FITARA scorecard. 

That is not something we are proud of. NASA is fully committed 

to implementing the FITARA law. We know we have a lot of work 

to do, and I am here today to assure you that significant changes 

are already underway at NASA to improve our management of IT. 

But before I get into more detail about our implementation plans, 

I would like to introduce myself. My name is Renee Wynn, and I 

have more than 26 years of Federal service, spending most of those 

years at the Environmental Protection Agency. I joined NASA 10 

months ago as the deputy CIO, and, 2 months later, I was promoted to be the agency CIO. 

Since then, I have initiated listening meetings to learn the needs 

of my IT customers and how they can inform our joint path forward. I have visited each center, meeting with the CIOs and the 

center directors, and I’ve been meeting with each mission office at 

headquarters. 

Everywhere I go, people are frank with me about IT needs, about 

governance, and operational changes they are believe are needed, 

or changes they fear are coming. So I am listening and taking action as quickly as I can. 

The ball is now in my court to manage and secure the agency’s 

IT resources, so that is what I and my amazing team are going to 

do. 

To its credit, over the last several years, NASA has transformed 

its IT governance structure to empower the CIO with greater authority, and thus, today, I am the beneficiary of these many 

changes. 

For example, I now report directly to the Administrator and can 

talk to him whenever I want. The CIO now sits on all key NASA 

decision-making councils, and the CIO has direct authority and 

oversight over the center CIOs, including their IT decisions and acquisitions. 

Better yet, NASA recently completed an internal business services assessment of NASA’s IT program. In this BSA outlined a series of steps the agency should take and plans to take to optimize 

and protect our IT assets. 


KING-6430 with DISTILLER
27 

In my personal opinion, this review has been a gift to current 

and future NASA CIOs in that it says NASA supports you as the 

CIO and we do want you to transform the way NASA manages IT. 

Like FITARA, the BSA results will ensure that IT is seen as a strategic agency resource establishing clear direction for the NASA CIO 

to approve the agency’s IT spend for non-highly specialized and 

highly specialized IT. 

Additionally, NASA is strengthening its alignment of IT resources against mission goals. My office will be held accountable for 

additional agency IT costs, schedule, and performance through a 

new portfolio review process. NASA is providing me with greater 

visibility into the overall budget planning cycle, allowing me to spot 

IT resource problems at a mission level earlier on. 

These are big steps forward for NASA, and NASA should be commended for starting this process even before FITARA became law. 

It is important to remember that NASA’s scientific and technical 

mission is unique. For example, cooperation with other nations, the 

public, and scientists around the world is one of NASA’s founding 

principles. Therefore, NASA has always sought the widest practical 

and appropriate distribution of information about our missions. But 

in doing so, we must also safeguard our IT assets against wellresourced and highly motivated individuals who wish to harm us. 

Malicious threats to our network are constantly evolving, which 

means our work is never done. Thus, I want to reassure you today 

that IT is a top priority at NASA. While the number of attempted 

cyber instances against NASA continues to increase, I am confident 

that NASA continues to appropriately address them. 

For example, NASA did not experience any major incidents in 

fiscal year 2015, as defined by the Office of Management and Budget. NASA has successfully met all capability targets established in 

the 2015 cyber sprint activity. And the DHS cyber hygiene report 

for NASA currently shows that there are a zero critical 

vulnerabilities older than 30 days. 

In conclusion, I appreciate the opportunity to appear before you 

today to reassure you that NASA has a strong foundation upon 

which to successfully implement FITARA and that we are committed to fully implementing FITARA. We remain ever vigilant 

with protecting our information assets as well. 

I would be happy to answer any questions that you may have. 

[Prepared statement of Ms. Wynn follows:] 


KING-6430 with DISTILLER
28 


KING-6430 with DISTILLERInsert offset folio 14 here 26068.014

Statement of 

Renee Wynn 

Chief Information Officer 

National Aeronautics and Space Administration 

before the 

HOLD FOR RELEASE 

UNTIL PRESENTED 

BY WITNESS 

May 18,2016 

Subcommittees on Information Technology and Government Operations 

Committee on Oversight and Government Reform 

U.S. House of Representatives 

Chairman Hurd and Chairman Meadows, Ranking Member Kelly and Ranking Member Connolly, and 

members of the Subcommittees, thank you for the opportunity to testify before you today about NASA's 

implementation of the Federal Information Technology Acquisition Reform Act (FIT ARA) and its impact 

on information technology (IT) acquisition and security at NASA. 

As the world leader in space exploration and cutting-edge science missions, NASA's work contributes 

directly to the economic vitality of our great Nation. In doing so, each day, hundreds of thousands of 

NASA personnel, contractors, academics and members of the public access some part of NASA's IT 

infrastructure- a complex array of more than 500 information systems with over 140,000 components 

geographically dispersed around the globe. This infrastructure plays a critical role in every aspect of 

NASA's mission, from controlling spacecraft to processing scientific data. 

Last year, for example, the entire world watched as New Horizons sent back the first close-up images of 

Pluto, and we continued to make new discoveries about Mars that will help inform human missions there. 

This year, the world watched as American Astronaut Scott Kelly returned home from the International 

Space Station after I2 months of working off the Earth for the Earth. Additionally, this year in space will 

pay scientific and medical dividends for years to come, helping pave the way for future astronauts to 

travel to Mars and beyond. The Orion spacecraft and the Space Launch System rocket that will carry us 

again to deep space continued to reach new milestones. In cooperation with our industry partners, Boeing 

and SpaceX, we moved closer to commercial launches of astronauts from American soil. We are 

formulating missions to study dark energy, perform galactic and extragalactic surveys and to explore 

exoplanets. We learned more about our home planet and our challenging climate as newer Earth science 

missions began to return their data. Technology continues to drive exploration in space and in the airand we made advances toward a future in which we make air travel safer, cleaner and more efficient. 

As NASA's Chieflnfonnation Officer (CIO), my office provides IT products and services, including 

policy and procedure for all ofNASA. Currently about 17,100 civil servants and 40,000 contractors work 

at nine NASA Centers and one Federally Funded Research Center, as well as several smaller satellite 

facilities. 

Every day NASA faces dynamic and continuing challenges defending our IT systems and networks from 

intrusion originating from individuals and organizations with malicious intent. Therefore, NASA 
29 


KING-6430 with DISTILLERInsert offset folio 15 here 26068.015

continues to improve its technical and procedural capabilities employed to: attain situational awareness of 

our information-security vulnerabilities and threats; and proactively defend the IT assets supporting our 

enterprise. Recently, NASA hired its first Senior Cybersecurity Advisor who reports directly to me, as 

the CIO. In this role, Rob Powell serves as my senior technical expert on IT security, staying abreast of 

the threat environment not only at NASA but at other Federal and non-Government networks. He 

actively engages with our Federal partners, thus ensuring that best security practices are implemented at 

NASA, and that NASA remains coordinated on and protected against threats and threat mitigations. 

The collective actions of NASA's Office of the Chief Information Officer (OCIO), as well as information 

sharing with the Department of Homeland Security and other Federal agencies involved in cybersecurity, 

are contributing to an improved security posture. For example, the Department of Homeland Security's 

Cyber Hygiene report for NASA currently shows that there are zero critical vulnerabilities older than 30 

days. Additionally, NASA did not experience any ·'major" cybersecurity incidents in FY 2015, as defined 

by the Office of Management and Budget'. Additionally in FY 2015, the NASA Security Operations 

Center, which is responsible for cyber incident response at NASA, transitioned its incident management 

process to adhere to the Department of Homeland Security's U.S. Computer Emergency Readiness 

Team's (US-CERT) new Federal Incident Notification Guidelines2. This new incident notification 

process took effect on Oct. I, 2015. NASA now categorizes all incidents and reports the information at 

the Federal-level to the US-CERT in near-real-time. 

It is also important to point out that NASA is extremely proactive in our approach to handling breaches 

caused by human error through awareness and education. NASA reaches out to every employee and 

guest with network accounts to notify them of best practices, both within the industry and within NASA. 

Employees must take mandatory training in order to retain access to our networks. They are encouraged 

to engage in discussions with professionals during activities such as webinars, road shows, and IT 

security technical expos featuring guest speakers, and related activities. The Administrator and other 

senior leaders also have repeatedly stressed to all NASA employees that they will be held accountable for 

failing to adhere to our established procedures and policies. Additionally. employees are warned before 

they take any NASA online training, for example, that any misuse of assigned accounts may constitute 

grounds for termination of access privileges, administrative action, and/or civil or criminal prosecution. 

Admittedly, NASA's scores on the FIT ARA scorecard are unacceptable. We have work to do, and 

challenges to overcome. But at the same time, I believe it is also important to reflect on the major strides 

NASA has already taken in improving the management of and protection of the Agency's IT 

infrastructure. Thus, the remainder of my testimony today will provide a brief summary of our 

achievements to date, and other work in progress directed at becoming the best stewards of the Agency's 

IT resources. 

NASA's Implementation of FIT ARA 

NASA is fully committed to implementing the FITARA requirements by aligning our IT services and 

capabilities against those requirements. Following passage of FITARA, NASA immediately began 

working toward implementing the law's requirements while also building upon internal changes 

previously made at NASA. In summary, this work has included: 

1 OMB Memorandum 16-03, '·Definition 

2 OMB Memorandum 15-01, "Updated DHS US-CERT Incident Notification Guidelines'', pg. 12-13. October 3. 

2014: bJill:i~www. \\'hllct!ousc.gov /sitc~/dcfai,ilt/i1lcs/omb/t}temqrl!.niillL£QJ..ilm~ Jj-0 l.pdf 
30 


KING-6430 with DISTILLERInsert offset folio 16 here 26068.016

Initiating a Business Services Assessment (BSA) review of how IT is delivered at the Agency; 

Increasing the responsibility, accountability and authority of the NASA CIO in order to drive 

efficiencies and cost-savings through the acquisition, deployment and management of IT across 

NASA; 

Using a tool known as Solutions for Enterprise-wide Procurement which will help NASA 

manage a suite of government-wide IT products to meet the requirements of FIT ARA; and 

• Aligning IT and mission strategy in order to achieve goals and measure performance while 

ensuring stakeholders are informed including: 

o Strengthening Agency ability to align IT resources with Agency missions, goals, 

programmatic priorities and statutory requirements; 

o ClarifYing the scope of the Agency CIO's role with respect to program IT and mission IT 

decisions, as well as allowing the CIO to participate in major Agency decision making 

processes for Agency missions; 

o Holding the CIO accountable for Agency IT cost, schedule and performance through a 

new portfolio review process. The CIO will also have new authority and greater 

visibility into the overall budget planning cycle, allowing me to spot IT resource 

problems at a mission level earlier on; 

o Increasing transparency of!T resources across the entire Agency; and 

o Ensuring that the IT security policies and procedures are implemented at the Centers. 

The BSA for IT 

NASA has recently realigned the reporting structure so that I, as the NASA ClO, have 

direct authority and oversight over the Center CIOs. 

NASA established the BSA evaluation process in 2015 to strategically assess Agency mission support 

services, evaluate the health of current mission support capabilities, and identify opportunities to further 

optimize performance. The BSA supports the Agency's objective of establishing a more effective and 

efficient operating model to meet current and future mission objectives. 

For each BSA activity, NASA establishes a core team, comprised of diverse professions from across 

NASA, to evaluate mission support activities. The core teams collect data from across NASA, conduct 

surveys and interviews with internal stakeholders, review recent audits and regulations. benchmark 

external organizations, and perform a detailed assessment of existing operations. As part of the BSA 

process, the Agency employs several feedback mechanisms to collect input from NASA Centers, Mission 

Directorates and other key organizations about potential options to enhance the specific mission support 

activities. Based on the results of the BSA and input collected from across NASA, the Agency makes 

decisions to strategically re-shape operations in an attempt to optimize mission support services to meet 

current and future Agency mission needs. 

The IT assessment was the pilot activity for the NASA BSA. The IT BSA "deep dive" included 

assessments of!T roles and responsibilities, governance, data centers, communications and end-user 

services and security. Many elements of NASA's implementation ofF!TARA lie within the 

aforementioned BSA Implementation Plan, specifically, (I) Agency Chief Information Officer Authority 

Enhancements; (2) Portfolio Review; and (3) Data Center Consolidation. 
31 


KING-6430 with DISTILLERInsert offset folio 17 here 26068.017

On March 31, 2016, the BSA IT Implementation Plan, which includes an exhaustive methodology on 

influencing budget formulation and execution, increasing involvement in IT acquisitions, and building a 

competent IT workforce while aligning our workforce to execute these strategies and approaches was 

approved by NASA. Like FIT ARA, the BSA was designed to ensure that IT is seen as a strategic Agency 

resource. One of the most important objectives of the BSA process was to establish clear objectives for 

the NASA CIO to approve the Agency's IT spend plan for non-highly specialized and highly specialized 

IT. 

As the Agency CIO, I am now responsible for implementing the NASA BSA IT decisions outlined in 

Enclosure 1. 

Improving NASA's IT Governance Structure 

In November 20 II, NASA adopted a phased approach to implement IT governance across all areas of IT. 

Phase 1 successfully focused on Enterprise IT services directly managed by the NASA CIO. Phase II was 

formally initiated in December 2013 and focused on Center IT services. 

Currently, the NASA CIO has visibility into and oversight of all NASA IT through IT authority. The 

CIO also has direct control over CJO managed services through IT program authority. Additionally, to 

ensure that the IT security policies and procedures are implemented at the Centers, several years ago, 

NASA realigned the reporting structure so the NASA CIO has direct authority and oversight over the 

Center CIO. Specifically, the NASA CIO "[ d)irects, manages, and provides policy guidance and 

oversight of the Agency's Center [CIO] activities, and operations, including in concurrence with Center 

Directors, the approval of the assignment, promotion, discipline, and relief of the principal CIO at each 

Center, and assesses their performance." 

Next, as a result of the lessons learned from Phase II of NASA IT governance implementation, the release 

of FITARA legislation, and NASA's technical and business optimization efforts, the BSA for IT was 

initiated. Results from the aforementioned BSA activity highlighted enhancements to IT roles and 

responsibilities, as well as IT governance, were necessary to clearly distinguish IT authority from IT 

program authority, even though existing policy provided the NASA CIO clear authority for visibility and 

oversight of all NASA IT. The plan to execute these related enhancements was approved March 31, 

2016. 

Many elements of NASA's FITARA implementation plan are enabled through the implementation of the 

Agency's transformed IT governance structure and clarilied roles and responsibilities. NASA is 

streamlining the Agency's IT governance structure while simultaneously broadening council membership 

to promote integrated, efficient Agency-wide decision-making. 

One of the key findings of the BSA is that the existing governance and operating model for IT across 

NASA needed to better align with the changing business of IT management and FIT ARA to ensure 

compliance with applicable policies, laws and directives as part of the OC!O's responsibility. 

The BSA identified key roles, including the position of the CIO, which required more visibility and 

authority in order to exercise greater influence in optimizing NASA's IT. This new govemance structure 

will be in place for NASA's FY 2018 budget planning cycle, thus allowing the CIO to have visibility into 

Agency budget decision-making processes across the Agency. This is the first step in improving 

visibility into decision-making information. The portfolio review will be conducted in partnership with 

the NASA Chief Financial Oflicer (CFO), Deputy Center Directors, and key mission leadership and 

includes a comprehensive review of institutional and mission IT and related acquisition strategies. The 
32 


KING-6430 with DISTILLERInsert offset folio 18 here 26068.018

decisions made during this review will include joint recommendations for IT optimization that are carried 

out under the authority of the NASA CIO. In addition, the budget review will validate the CIO has direct 

accountability tor IT, and increase this new authority in the budget cycle. Moreover, the review is the 

formal venue for uncovering mission IT details ranging from acquisitions to execution, an area the NASA 

C!O has previously lacked insight. In addition, by gaining awareness into mission IT acquisitions, the 

C!O will have more insight into and influence over the security of mission assets. 

The good news is that we have already seen positive evidence of the expansion of the CIO's role in 

monitoring Agency IT program performance through the elimination of duplicative and ineffective IT 

boards. Additionally, I have made an effort as the Agency's new CIO to more proactively engage the 

Center CIOs, visiting each Center during my first six months as C!O. I also have reached out to mission 

stakeholders within the Agency so as to better understand their work and how my job intersects with their 

mission. I also am engaged with our other Federal partners who share the FITARA responsibility. 

Additionally, I have engaged with the CIOs of our international partner agencies so as to share best 

practices with them. 

Portfolio Review 

In order to achieve FITARA-based objectives, NASA leadership and the NASA CIO established a new 

budget review aligned with the Agency's annual budget cycle deliverables. This new budget review is 

part of the Agency's implementation ofFITARA. which mandates that NASA's CIO have approval 

authority over the entire IT budget, and increases the CIO's responsibility. The scope of the review 

includes IT and program-funded IT and related acquisition strategies. In this model, the NASA C!O is 

responsible for ensuring that IT investments align with NASA's mission, goals, and programmatic 

priorities while strengthening accountability for IT cost, schedule, and performance. The budget review 

enables the NASA CIO to be more directly accountable through increased authority in the budget cycle. 

The strategy of this inaugural review process is driven by input from all IT stakeholders, including Center 

ClOs, Center CFOs. and Mission Program Managers. 

Data Center Consolidation 

In 20I 0, at the beginning of the Office of Management and Budget's (OMB) Federal Data Center 

Consolidation Initiative (FDCCI), NASA had 79 data centers. The FDCCI promotes the use of Green IT 

by reducing the overall energy and real estate footprint of Government data centers, reducing the cost of 

data center operations, and shifting IT investment to more efficient computing platforms and 

technologies. Since that time, NASA has closed 50 data centers freeing more than 39,000 square feet of 

space for re-purposing. The target is to reduce to 22 data centers by the end of FY 2018. 

Additionally, NASA OCIO recently embarked on the development of an integrated Agency-wide data 

center architecture to guide future investments and further consolidation, including on-site, outsourced, 

and cloud-based data center services. 

Conclusion 

While NASA has a strong foundation upon which to successfully implement FIT ARA, we recot,rnize 

there is still much work to do. As evidenced by my testimony today, NASA is fully committed to 

implementing FlTARA, and we are actively taking steps to complete that implementation as quickly as 

possible. We look forward to working with Congress, the Government Accountability Office, and other 

Federal stakeholders, including OMB and other Federal agency CIOs in effectively implementing 

F!TARA to reduce costs and increase the value of our IT acquisitions. In conclusion, thank you for the 

opportunity to testifY before you today, and I would be happy to answer any questions that you may have. 
33 


KING-6430 with DISTILLERInsert offset folio 19 here 26068.019

Background 

National Aeronautics and Space Administration (NASA) 

Business Services Assessment (BSA) Decision Summary 

Information Technology (IT) Pilot Deep Dive 

Enclosure l 

In 2015, NASA established the Business Services Assessment (BSA) to strategically assess mission 

support services, evaluate the health of current mission support capabilities, and identify opportunities to 

further optimize performance. The NASA BSA supports the Agency's objective of establishing a more 

effective and efficient operating model to meet current and future mission requirements. 

Process 

For each BSA activity, NASA establishes a core team, comprised of diverse professionals from across 

NASA organizations, to evaluate mission support activities. The core teams collect data from across 

NASA, conduct surveys and interviews with internal stakeholders, review recent audits and regulations, 

benchmark external organizations. and perform a detailed assessment of existing operations. As part of 

the BSA process, the Agency employs several feedback mechanisms to collect input from NASA Centers, 

Mission Directorates, and other key organizations on potential options to enhance the specific mission 

support activities. Based on the results of the BSA and input collected from across NASA, the Agency 

makes decisions to strategically re-shape operations in an attempt to optimize mission support services to 

meet current and future Agency mission needs. 

Topic 

The Information Technology (IT) assessment was the pilot activity for the NASA BSA. The IT BSA 

deep dive included assessments of!T roles and responsibilities, governance, data centers, 

communications, end-user services and security. The findings and decisions below provide a summary of 

the IT BSA. The Agency Chieflnformation Officer (CIO) is responsible for oversight of NASA's IT 

activities, as well as implementing NASA BSA IT decisions. 

Findings and Decisions 

L IT Roles & Responsibilities and Governance 

Finding: The IT BSA found the existing governance and operating model for IT across the Agency 

needed to better align with the changing business of IT management and the Federal Information 

Technology Acquisition Reform Act (FITARA) to ensure compliance with applicable policies, laws and 

directives as part of the ocro·s responsibility. 

Decisions: The OCIO will create a multi-tier (level 0 through level3) management structure and appoint 

Program Executives for each IT domain; develop a plan to enable IT management improvements; 

restructure and streamline existing duplicative IT boards; conduct a formal annual capital investment 

review as part of the budget process; work with procurement and formalize guidance on strategic sourcing 

for IT contract activities; and conduct functional reviews of all Centers on a 3-year rotating basis. 

2. Data Centers 

Finding: The BSA found insufficient strategic direction, consistent coordination and oversight of NASA 

data center and computing investments. 

Decision: The OCIO will implement a federated/hybrid data center operational model by developing an 

integrated, Agency-wide data center architecture to guide future investments and further consolidation, 
34 


KING-6430 with DISTILLERInsert offset folio 20 here 26068.020

including on-site, outsourced, and cloud-based data center services as well as enabling strategic 

sourcing/contract optimization. 

3. Communications 

Findings: Multiple NASA Centers were found to have outdated communication services for phones, 

voicemail and Land Mobile Radios (LMR). In addition, the deep dive found that some mission areas 

were unable to effectively and securely collaborate using existing IT infrastructure. 

Decision: The Agency will realign NASA Integrated Communications Services (NICS)-provided voice 

services, network operations and transformation funding from Centers to the Agency OCIO to enable an 

enterprise funded and managed approach for communications. 

4. End-User Services (Workstations and Collaboration & Content Management Tools) 

Findings: The Agency Consolidated End-User Services contract (ACES) was not being used as 

extensively as intended, which led to less than optimal IT operations. The deep dive also found multiple 

contracts and methods were being used to procure and administer workstations; and numerous 

independent platforms and tools were being used across NASA for collaboration. 

Decisions: The OCIO will consolidate Non-ACES workstations administration and support, where 

feasible and appropriate. A target was established for each NASA Center to obtain at least 80% of their 

desktop, laptop, and workstation computing services through ACES. Further, the Agency decided that 

using non-ACES systems would require waiver approval from the Center CIO. Compliance with these 

objectives will be evaluated as part of the annual Center functional reviews. Finally, the OCIO will 

develop a core suite of collaboration tools and standards to meet the majority of NASA requirements. 

5. IT Security 

Finding: The absence of an enterprise-wide risk management framework created gaps managing 

NASA's cybersecurity risks, implementing the Agency's cybersecurity program, and effectively 

managing cybersecurity resources and tools. 

Decisions: The OCIO will sponsor a zero-based review of IT Security spending and ensure alignment to 

the NASA IT security strategy. The OCIO will also establish an Agency IT Security risk management 

framework and IT security architecture that aligns with NASA's business risks. 
35 

Mr. HURD. Thank you, Ms. Wynn. 

Now someone who has testified many times before this committee, Mr. Powner, you are recognized for your 5-minute opening 

statement. 

STATEMENT OF DAVID A. POWNER 

Mr. POWNER. Chairmen Hurd and Meadows, Ranking Members 

Kelly and Connolly, and members of the subcommittees, I would 

like to thank you and your staff for your continued oversight of the 

implementation of FITARA with the second set of grades. 

We recently completed, at your request, detailed work on three 

of the four scorecard areas to support your grading efforts. This 

afternoon, I would like to briefly discuss the grades overall in each 

of the three areas we performed our work. Those are data centers, 

dashboard accuracy, and incremental development, all major areas 

of emphasis with FITARA. 

Starting with the grades, overall, there has been some progress 

with seven agencies having higher grades, one lower, and 16 having no change. We view the 6-month progress as quite positive, 

since implementing FITARA and receiving higher grades will take 

time to address long-standing, systemic weaknesses in IT management. 

To comprehensively implement this law to better invest our Nation’s IT dollars, CIO authorities need to be strengthened. Critical 

to that are the FITARA implementation plans that are to provide 

an assessment of gaps in CIO authorities and agency efforts to improve those authorities. We are pleased to hear that both Labor 

and Energy now have approved plans, so they are all in, and we 

will actually be looking at the next round of iterations on those 

plans. 

Now turning to data center consolidation, of the roughly 10,500 

data centers, 3,121 have been closed to date and another 2,100 are 

planned. Interestingly, 84 percent of the closures to date have come 

from four agencies, Ag, DOD, Treasury, and Interior. Your uptick 

of the data center grades is quite appropriate. 

We want consolidation, and we want savings. This next slide 

shows savings to date with data center consolidation. I know it is 

hard to read. There are the closures, if you look at 3,100, if we go 

back to that prior one, the prior slide, please. The 3,100, that is 

what has been closed to date. 

I want to emphasize there are four agencies that are accountable 

for 84 percent of those 3,100 closures. Your uptick in their grades 

is appropriate. 

If we flip to the next slide, this is savings. That gray shaded area 

there from 2011 through 2015, there has been collectively about 

$2.8 billion in savings to date. There is another $5.4 billion remaining. When you look at out-years, over $1 billion each year. 

This is why FITARA is so important, because without FITARA, 

we would not have this focus and attention on data center consolidation. 

A couple points on this chart. Four agencies account for 86 percent of the $2.8 billion in savings. Those are Commerce, Defense, 

DHS, and Treasury. Again, rewarding these departments with 

higher grades for their substantial savings is an excellent idea. 


KING-6430 with DISTILLER
36 

The other point I would like to make is that out-years savings 

of $5.4 billion, we actually have a lot more than $5.4 billion on the 

table. There were 10 agencies that had planned closures that did 

not have out-year estimates that were called for by OMB. We made 

recommendations to those 10 agencies. 

And your downgrading those 10 agencies to emphasize the importance of these out-year projections is really the right way to go. 

So what we want to do is we want to reward closures and savings, 

and we want to make sure there are not out-year projections that 

we have to down tick in their grade. So that is going to be really 

helpful in ensuring we get the appropriate savings here. 

Next, I would like to turn to dashboard transparency. FITARA 

codified the IT dashboard and CIO risk ratings for approximately 

750 major IT investments across the departments. These ratings 

indicate whether each investment is low, moderate, or high risk. 

The dashboard currently tells us there are about 200 investments 

totaling about $12 billion that are moderate or high risk, and that 

72 percent of IT dollars the government invests is low risk. 

Although CIOs are acknowledging a bit more risk from your last 

hearing, these IT dashboard CIO ratings still greatly underestimate risk. 

This next chart shows the results of our latest review on CIO 

ratings. We looked at approximately 100 investments on the IT 

dashboard and performed our own risk assessments compared to 

the CIO ratings. So, for instance, that green bar on the top, there 

were 61 CIO ratings that were rated as low risk or green. Our assessment concluded that only 10 of those were green, 28 should 

have been yellow, and 23 should have been red. So that is an indication of where we need to get better transparency and accuracy 

so that we can better manage these major IT investments. 

Your grading scheme, Mr. Chairman, which equates higher 

grades with acknowledging more risk is definitely the way to go 

until CIOs start acknowledging more risk with their ratings. 

Turning to incremental development, FITARA requires that CIOs 

certify that IT investments deliver in increments consistent with 

OMB policy, which requires that major investments deliver in 6 

months. Agencies collectively report that 65 percent of their IT 

projects government-wide plan to deliver in 6 months. 

Our review found some agencies were accurately reporting this, 

like DHS and Transportation. However, others, like Commerce and 

Treasury, were not, and your grades adjustments to those two 

agencies were appropriate. 

I would like to conclude by thanking your subcommittees for your 

aggressive oversight of FITARA implementation with your scorecard and your many other actions. With the upcoming change in 

administration, it will be very important not to lose the positive 

momentum we have. Our team at GAO will be working very hard 

through this transition, addressing several requests from you to 

keep the focus on CIO authorities, delivering transformational IT 

solutions, and replacing antiquated, inefficient, and, in many cases, 

insecure systems and infrastructure. 

Chairmen Hurd and Meadows, Ranking Member Kelly, I thank 

you for your leadership. Our team at GAO looks forward to conVerDate Nov 24 2008 09:59 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00042 Fmt 6633 Sfmt 6633 H:\26068.TXT APRIL

KING-6430 with DISTILLER
37 

tinuing to work supporting your efforts on FITARA implementation. 

[Prepared statement of Mr. Powner follows:] 


KING-6430 with DISTILLER
38 


KING-6430 with DISTILLERInsert offset folio 21 here 26068.021

For Release on Delivery 

Expected at 2:00p.m. ET Wednesday, May 18, 2016 

GA0-16-672T 

United States Government Accountability Office 

Testimony 

Before the Subcommittees on Government 

Operations and Information Technology, 

Committee on Oversight and Government 

Reform, House of Representatives 

INFORMATION 

TECHNOLOGY 

OMB and Agencies Need 

to Focus Continued 

Attention on Implementing 

Reform Law 

Statement of David A. Powner, Director 

Information Technology Management Issues 
39 


KING-6430 with DISTILLERInsert offset folio 22 here 26068.022

Why GAO Did This Study 

What GAO Recommends 

INFORMATION TECHNOLOGY 

OMB and Agencies Need to Focus Continued 

Attention on Implementing Reform Law 

What GAO Found 

The Office of Management and Budget (OMS) and agencies have taken steps to 

improve federal information technology (IT) through a series of initiatives; 

however, additional actions are needed. 

Consolidating data centers. In an effort to reduce the growing number of 

data centers, OMB launched a consolidation initiative in 2010. GAO recently 

reported that agencies had closed 3,125 of the 10,584 total data centers and 

achieved $2.8 billion in cost savings and avoidances through fiscal year 

2015. Agencies are planning a total of about $8.2 billion in savings and 

avoidances through fiscal year 2019. However, these planned savings may 

be higher because 10 agencies had not fully developed their planned savings 

goals. In addition, agencies made limited progress against OMS's fiscal year 

2015 data center optimization performance targets, such as the utilization of 

data center facilities. GAO recommended that the agencies take action to 

complete their cost savings targets and improve optimization progress. Most 

agencies agreed with the recommendations or had no comment 

Enhancing transparency. OMS's IT Dashboard provides detailed 

information on major investments at federal agencies, including ratings from 

Chief Information Officers (CIO) that should reflect the level of risk facing an 

investment In a draft report, GAO's assessments of the risk ratings showed 

more risk than the associated CIO ratings. In particular, of the 95 

investments reviewed, GAO's assessments matched the CIO ratings 22 

times, showed more risk 60 times, and showed less risk 13 times. Several 

issues contributed to these differences, such as ratings not being updated 

frequently. In its draft report, GAO is recommending that agencies improve 

the quality and frequency of their CIO ratings. 

Implementing incremental development. An additional key reform initiated 

by OMB has emphasized the need to deliver investments in smaller parts, or 

increments, in order to reduce risk and deliver capabilities more quickly. 

Since 2012, OMB has required investments to deliver functionality every 6 

months. In a draft report, GAO determined that 22 agencies reported that 64 

percent of 469 active software development projects had plans to deliver 

usable functionality every 6 months for fiscal year 2016. Further, for seven 

selected agencies, GAO identified significant differences in the percentage of 

software projects delivering every 6 months reported to GAO compared to 

what was reported on the IT Dashboard. For example, the percentage of 

software projects reported to GAO by the Department of Commerce 

decreased by about 42 percentage points from what was reported on the IT 

Dashboard. These differences were due, in part, to agencies having different 

interpretations of OMS's guidance on reporting software development 

projects. In its draft report, GAO is recommending that OMB and agencies 

improve the use of incremental development 

-------------United States Government Accountability Office 
40 


KING-6430 with DISTILLERInsert offset folio 23 here 26068.023

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, 

and Members of the Subcommittees: 

I am pleased to be here today to discuss our recent work related to the 

December 2014 information technology (IT) reform law (commonly 

referred to as the Federal Information Technology Acquisition Reform Act 

or FITARA). 1 As you know, the effective and efficient acquisition and 

management of IT investments has been a long-standing challenge in the 

federal government In particular, the federal government has spent 

billions of dollars on failed and poorly performing IT investments, which 

often suffered from ineffective management Moreover, spending on IT 

operations has been inefficient In light of these ongoing challenges, in 

February 2015, we added improving the management of IT acquisitions 

and operations to our list of high-risk areas for the federal government. 2 

My statement today will primarily discuss our recently published work on 

data center consolidation and our draft reports with recommendations, 

which are currently with applicable agencies for comment, on the ( 1) risk 

of major investments as reported on the Office of Management and 

Budget's (OMB) IT Dashboard and (2) implementation of incremental 

development practices. A more detailed discussion of the objectives, 

scope, and methodology of this work is included in each of the reports 

that are cited throughout this statement 3 

We conducted the work on which this statement is based in accordance 

with generally accepted government auditing standards. Those standards 

require that we plan and perform the audit to obtain sufficient, appropriate 

evidence to provide a reasonable basis for our findings and conclusions 

based on our audit objectives. We believe that the evidence obtained 

Information Technology Acquisition Reform provisions of the Carl Levin and 

Howard 'Buck' McKeon National Defense Authorization Act for Fisca! Year 2015, Pub 

L. No. 113-291, div. A. title VIII, subtitleD, 128 Stat. 3292. 3438-3450 (Dec. 19, 2014) 

2

GAO, High-Risk Sefies: An Update, GA0-15-290 (Washington, D.C.: Feb. 11. 2015). 

GAO maintains a high-risk program to focus attention on government operations that it 

identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, and 

mismanagement or the need for transformation to address economy, efficiency, or effectiveness challenges, 

3

See the related GAO products page at the end of this statement for a list of the reports 

on which this testimony is based. 

Page 1 GA0-16-672T 
41 


KING-6430 with DISTILLERInsert offset folio 24 here 26068.024

Background 

provides a reasonable basis for our findings and conclusions based on 

our audit objectives. 

The federal government plans to invest more than $89 billion on IT in 

fiscal year 2017. However, as we have previously reported, investments 

in federal IT too often result in failed projects that incur cost overruns and 

schedule slippages while contributing little to the mission-related 

outcome. For example: 

The Department of Defense's Expeditionary Combat Support System 

was canceled in December 2012 after spending more than a billion 

dollars and failing to deploy within 5 years of initially obligating funds. 4 

The Department of Homeland Security's Secure Border Initiative 

Network program was ended in January 2011, after the department 

obligated more than $1 billion to the program, because it did not meet 

cost-effectiveness and viability standards. 5 

The Department of Veterans Affairs' Financial and Logistics 

Integrated Technology Enterprise program was intended to be 

delivered by 2014 at a total estimated cost of $609 million, but was 

terminated in October 2011 due to challenges in managing the 

program• 

The Office of Personnel Management's Retirement Systems 

Modernization program was canceled in February 2011, after 

DOD Financial Management: Implementation Weaknesses in Army and Air Force 

Business Systems Could Jeopardize DOD's Auditability Goals, GA0-12~134 (Washington, 

D.C.: Feb. 28, 2012) and DOD Business Transformation: Improved Management 

Oversight of Business System Modernization Efforls Needed, GA0-11-53 {Washington, 

D.C .. Oct. 7, 2010). 

5See, for example, GAO, Secure Border Initiative: DHS Needs to Strengthen Management 

and Oversight of Its Prime Contractor, GA0-11-6 {Washington, D.C.: Oct 18, 2010); 

Secure Border Initiative: DHS Needs to Reconsider Its Proposed Investment in Key 

Technology Program, GA0-10-340 (Washington, D.C .. May 5. 2010): and Secure Border 

Initiative: DHS Needs to Address Testing and Performance Limitations That Place Key 

Technology Program at Risk. GA0-10-158 (Washington, D.C. Jan. 29, 2010). 

6

GAO, Information Technology· Actions Needed to Fully Establish Program Management 

Capability for VA's Financial and Logistics Initiative, GA0-10-40 (Washlngton, O.C Oct 

26, 2009) 

Page 2 GA0-16-672T 
42 


KING-6430 with DISTILLERInsert offset folio 25 here 26068.025

spending approximately $231 million on the agency's third attempt to 

automate the processing of federal employee retirement claims. 7 

The tri-agency8 National Polar-orbiting Operational Environmental 

Satellite System was stopped in February 2010 by the White House's 

Office of Science and Technology Policy after the program spent 16 

years and almost $5 billion. 9 

The Department of Veterans Affairs' Scheduling Replacement Project 

was terminated in September 2009 after spending an estimated $127 

million over 9 years. 10 

These and other failed IT projects often suffered from a lack of disciplined 

and effective management, such as project planning, requirements 

definition, and program oversight and governance. In many instances, 

agencies had not consistently applied best practices that are critical to 

successfully acquiring IT investments. 

Federal IT projects have also failed due to a lack of oversight and 

governance. Executive-level governance and oversight across the 

government has often been ineffective, specifically from chief information 

officers (CIO). For example, we have reported that not all CIOs had the 

7See, for example, GAO, Office of Personnel Management: Retirement Modernization 

Planning and Management Shortcomings Need to Be Addressed, GA0-09-529 

(Washington, D.C .. Apr. 21, 2009) and Office of Personnel Management: Improvements 

Needed to Ensure Successful Retirement Systems Modernization, GA0-08-345 

(Washington. D.C. Jan. 31, 2008) 

8The weather satellite program was managed by the National Oceanic and Atmospheric 

Administration, the Department of Defense, and the National Aeronautics and Space 

Administration. 

9See, for example. GAO, Polar-Orbiting Environmental Satellites: With Costs Increasing 

and Data Continuity at Risk, Improvements Needed in Tri-agency Decision Making, 

GA0-09-564 (Washington, D.C.: June 17, 2009) and Environmental Satellites: PolarOrbiting Satellite Acquisition Faces Delays; Decisions Needed on Whether and How to 

Ensure Climate Data Continuity, GA0-08-518 (Washington, D.C.: May 16, 2008) 

10GAO, Information Technology: Management Improvements Are Essential to VA's 

Second Effort to Replace Its Outpatient Scheduling System, GA0-10-579 (Washington. 

O.C. May 27, 2010). 

Page 3 
43 


KING-6430 with DISTILLERInsert offset folio 26 here 26068.026

Recent Law Can Improve 

Agencies' Management of 

IT 

authority to review and approve the entire agency IT portfolio and that 

CIOs' authority was limited.'' 

Recognizing the severity of issues related to government-wide 

management of IT, FITARA was enacted in December 2014. The law 

holds promise for improving agencies' acquisition of IT and enabling 

Congress to monitor agencies' progress and hold them accountable for 

reducing duplication and achieving cost savings. FITARA includes 

specific requirements related to seven areas. 

Federal data center consolidation initiative (FDCCI). Agencies are 

required to provide OMB with a data center inventory, a strategy for 

consolidating and optimizing the data centers (to include planned cost 

savings), and quarterly updates on progress made. The law also 

requires OMB to develop a goal for how much is to be saved through 

this initiative, and provide annual reports on cost savings achieved. 

Enhanced transparency and improved risk management. OMB 

and agencies are to make detailed information on federal IT 

investments publicly available, and agency CIOs are to categorize 

their IT investments by risk. Additionally, in the case of major IT 

investments rated as high risk for 4 consecutive quarters, the law 

requires that the agency CIO and the investment's program manager 

conduct a review aimed at identifying and addressing the causes of 

the risk. 

Agency CIO authority enhancements." Agency CIOs are required 

to (1) approve the IT budget requests of their respective agencies, (2) 

certify that IT investments are adequately implementing OMB's 

incremental development guidance, (3) review and approve contracts 

for IT, and (4) approve the appointment of other agency employees 

with the title of CIO. 

Federal Chief Information Officers: Opportunities Exist to Improve Role in 

Technology Management, GA0-11-634 (Washington, D.C .. Sept 15, 2011) 

12The provisions apply to the agencies covered by the Chief Financial Officers Act of 1990 

31 U.S.C. § 901(b), except that the Department of Defense is exempted from this and 

other activities 

Page4 GA0-16-672T 
44 


KING-6430 with DISTILLERInsert offset folio 27 here 26068.027

Portfolio review. Agencies are to annually review IT investment 

portfolios in order to, among other things, increase efficiency and 

effectiveness, and identify potential waste and duplication. In 

developing the associated process, the law requires OMB to develop 

standardized performance metrics, to include cost savings, and to 

submit quarterly reports to Congress on cost savings. 

Expansion of training and use of IT acquisition cadres. Agencies 

are to update their acquisition human capital plans to address 

supporting the timely and effective acquisition of IT. In doing so, the 

law calls for agencies to consider, among other things, establishing IT 

acquisition cadres or developing agreements with other agencies that 

have such cadres. 

Government-wide software purchasing program. The General 

Services Administration is to develop a strategic sourcing initiative to 

enhance government-wide acquisition and management of software. 

In doing so, the law requires that, to the maximum extent practicable, 

the General Services Administration should allow for the purchase of 

a software license agreement that is available for use by all Executive 

Branch agencies as a single user. 

Maximizing the benefit of the federal strategic sourcing initiative. 

Federal agencies are required to compare their purchases of services 

and supplies to what is offered under the Federal Strategic Sourcing 

initiative. OMB is also required to issue related regulations. 

In June 2015, OMB released guidance describing how agencies are to 

implement the law. 13 OMB's guidance states that it is intended to, among 

other things: 

assist agencies in aligning their IT resources to statutory 

requirements; 

establish government-wide IT management controls that will meet the 

law's requirements, while providing agencies with flexibility to adapt to 

unique agency processes and requirements; 

Management and Oversight of Information Technology, Memorandum M~ 15-14 

tvv;asnma·ranD.C, June 10, 2015). 

Page 5 GA0-16-672T 
45 


KING-6430 with DISTILLERInsert offset folio 28 here 26068.028

clarify the CIO's role and strengthen the relationship between agency 

CIOs and bureau CIOs; and 

strengthen CIO accountability for IT cost, schedule, performance, and 

security. 

The guidance includes several actions agencies are to take to establish a 

basic set of roles and responsibilities (referred to as the "common 

baseline") for CIOs and other senior agency officials that are needed to 

implement the authorities described in the law. For example, agencies 

were required to conduct a self-assessment and submit a plan describing 

the changes they will make to ensure that common baseline 

responsibilities are implemented. Agencies were to submit their plans to 

OMS's Office of E-Government and Information Technology by August 

15, 2015, and make portions of the plans publicly available on agency 

websites no later than 30 days after OMB approval. As of May 2016, 22 

of the 24 Chief Financial Officers Act agencies had made their plans 

publicly available. 

In addition, OMB recently released proposed guidance for public 

comment on the optimization of federal data centers and implementation 

of FITARA's data center consolidation and optimization provisions. 14 

Among other things, the proposed guidance instructs agencies to 

maintain complete inventories of all data center facilities owned, 

operated, or maintained by or on behalf of the agency; develop cost 

savings targets due to consolidation and optimization for fiscal years 2016 

through 2018 and report any actual realized cost savings; and measure 

progress toward defined performance metrics (including server utilization) 

on a quarterly basis as part of their data center inventory submissions. 

The proposed guidance also directs agencies to develop a data center 

consolidation and optimization strategic plan that defines the agency's 

data center strategy for the subsequent 3 years. This strategy is to 

include a limeline for agency consolidation and optimization activities with 

an emphasis on cost savings and optimization performance benchmarks 

the agency can achieve between fiscal years 2016 and 2018. Finally, the 

proposed guidance indicates that OMB will maintain a public dashboard 

140MB, Data Center Optimization Initiative (DCOI), accessed Apri128, 2016, 

https.'//datacenters.cio.gov. OMB sought feedback and suggestions on the proposed 

guidance through April 1, 2016. 

PageS GA0·16-672T 
46 


KING-6430 with DISTILLERInsert offset folio 29 here 26068.029

IT Acquisitions and 

Operations Identified by 

GAO as a High Risk Area 

that will display consolidation-related costs savings and optimization 

performance information for the agencies. 

In February 2015, we introduced a new government-wide high-risk area, 

Improving the Management of IT Acquisitions and Operations. 15 This area 

highlights several critical IT initiatives in need of additional congressional 

oversight, including reviews of troubled projects, an emphasis on 

incremental development, a key transparency website, reviews of 

agencies' operational investments, data center consolidation, and efforts 

to streamline agencies' portfolios of IT investments. We noted that 

implementation of these initiatives has been inconsistent and more work 

remains to demonstrate progress in achieving IT acquisition outcomes. 

Further, in our February 2015 high-risk report, we identified actions that 

OMB and the agencies need to take to make progress in this area. These 

include implementing FIT ARA, as well as implementing our previous 

recommendations, such as developing comprehensive inventories of 

federal agencies' software licenses. As noted in that report, we have 

made multiple recommendations to improve agencies' management of IT 

acquisitions and operations, many of which are discussed later in this 

statement Between fiscal years 2010 and 2015, we made approximately 

800 such recommendations to OMB and federal agencies. As of May 

2016, about33 percent of these recommendations had been 

implemented. 

Also in our high risk report, we stated that OMB and agencies will need to 

demonstrate measurable government-wide progress in the following key 

areas: 

implement atleast80 percent of GAO's recommendations related to 

the management of IT acquisitions and operations within 4 years, 

ensure that a minimum of 80 percent of the government's major 

acquisitions deliver functionality every 12 months, and 

Page 7 
47 


KING-6430 with DISTILLERInsert offset folio 30 here 26068.030

Implementation of IT 

Reform Law Needed 

to Improve 

Performance of Key 

Initiatives 

achieve no less than 80 percent of the planned PortfolioStat16 savings 

and 80 percent of the planned savings for data center consolidation. 

One of the key initiatives to implement FIT ARA is data center 

consolidation. OMB established FDCCI in February 2010 to improve the 

efficiency, performance, and environmental footprint of federal data 

center activities. In a series of reports over the past 5 years, we 

determined that while data center consolidation could potentially save the 

federal government billions of dollars, weaknesses existed in several 

areas including agencies' data center consolidation plans and OMB's 

tracking and reporting on cost savings. 17 In total, we have made 111 

recommendations to OMB and agencies to improve the execution and 

oversight of the initiative. Most agencies agreed with our 

recommendations or had no comment. 

Most recently, in March 2016, we reported18 that the 24 departments and 

agencies 19 participating in FDCCI collectively made progress on their data 

16Launched by OMS in March 2012, PortfoHoStat requires agencies to conduct an annual 

agency-wide IT portfolio review to, among other things, reduce commodity IT spending 

and demonstrate how its IT investments align with the agency's mission and business 

functions. For more information, see OMB, Implementing PorlfolioStat, Memorandum M12-10 (Washington D.C .. Mar. 30. 2012) 

17 GAO, Data Center Consolidation: Reporting Can Be Improved to Reflect Substantial 

Planned Savings, GA0-14-713 (Washington, D.C .. Sept 25, 2014); Data Center 

Consolidation: Strengthened Oversight Needed to Achieve Cost Savings Goal, 

GA0-13-378 (Washtngton, O,C.: Apr. 23, 2013); Data Center Consolidation: Agencies 

Making Progress on Efforts, but Inventories and Plans Need to Be Completed, 

GA0-12-742 (Washington, D.C.: July 19, 2012); and Data Center Consolidation: Agencies 

Need to Complete Inventories and Plans to Achteve Expected Savmgs, GA0-11-565 

(Washington, D.C .. July 19, 2011). 

18GAO, Data Center Consolidation: Agencies Making Progress, but Planned Savings 

Goats Need to Be Established [Reissued on March 4, 2016}, GA0-16-323 (Washington, 

D.C .. Mar. 3, 2016) 

1

9-rhe 24 agencies that F!TARA requires to participate in FDCCI are the Departments of 

Agriculture, Commerce. Defense, Education, Energy, Health and Human Services, 

Homeland Security, Housing and Urban Development. the Interior, Justice, Labor, State. 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency, 

General Services Administration, National Aeronautics and Space Administration, National 

Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management 

Small Business Administration, Social Security Administration, and U.S. Agency for 

International Development. 

Page 8 GA0-16-672T 
48 


KING-6430 with DISTILLERInsert offset folio 31 here 26068.031

center closure efforts. Specifically, as of November 2015, agencies had 

identified a total of 10,584 data centers, of which they reported closing 

3,125 through fiscal year 2015. Notably, the Departments of Agriculture, 

Defense, the Interior, and the Treasury accounted for 84 percent of these 

total closures. Agencies are also planning to close an additional 2,078 

data centers-for a total of 5,203-by the end of fiscal year 2019. See 

figure 1 for a summary of agencies' total data centers and reported and 

planned closures. 

Figure 1: Agencies' Total Data Centers and Completed and Planned Closures (fiscal 

years 2010 through 2019), as of November 2015 

\ Additional data 1 centers planned 

; for closure 

, / ~;:~~gt:ca! 

In addition, we reported that 19 of the 24 agencies reported achieving an 

estimated $2.8 billion in cost savings and avoidances from their data 

center consolidation and optimization efforts from fiscal years 2011 to 

2015. Notably, the Departments of Commerce, Defense, Homeland 

Security, and the Treasury accounted for about $2.4 billion (or about 86 

percent) of the total. Further, 21 agencies collectively reported planning 

an additional $5.4 billion in cost savings and avoidances, for a total of 

approximately $8.2 billion, through fiscal year 2019. See figure 2 for a 

summary of agencies' reported achieved and planned cost savings and 

avoidances from fiscal years 2011 through 2019. 

Page 9 GA0-16-672T 
49 


KING-6430 with DISTILLERInsert offset folio 32 here 26068.032

Figure 2: Agency¥reported Data Center Consolidation Cost Savings and Avoidances (dollars in billions) 

Do.Uars In billions 

2.0 ~--~A~~~W~~~d~--,,----------------------~p~~~M~e~d-----------------------, 

1.5 

1.0 

0.5 

2011 2015 

Fiscal years 

Sou!"ce:GAOanalystllofagencydata. I GA0-16-672T 

$1.6 

Total savmgs and avotdances $8 2 btlhon 

2016 2017 2018 2019 

However, we noted that planned savings may be higher because 10 of 

the 21 agencies that reported planned closures from fiscal years 2016 

through 2018 have not fully developed their cost savings and avoidance 

goals for these fiscal years. 20 Agencies provided varied reasons for not 

having this information, including that they were in the process of reevaluating their data center consolidation strategies, as well as facing 

other challenges in determining such information. We noted that the 

reporting of planned savings goals is increasingly important considering 

the enactment of FITARA, which requires agencies to develop yearly 

calculations of cost savings as part of their multi-year strategies to 

consolidate and optimize their data centers. We concluded that, until 

agencies address their challenges and complete and report such 

information, the $8.2 billion in total savings and avoidances may be 

10 agencies are the Departments of the Interior, State, Transportation. and the 

Treasury: the Environmental Protection Agency; National Aeronautics and Space 

Administration; National Science Foundation; Nuclear Regulatory Commission; Office of 

Personnel Management; and Small Business Administration. 

Page 10 GA0-16-672T 
50 


KING-6430 with DISTILLERInsert offset folio 33 here 26068.033

understated and agencies will not be able to satisfy the data center 

consolidation strategy provisions of FITARA. 

Finally, we reported that agencies made limited progress against OMB's 

fiscal year 2015 core data center optimization performance metrics. 21 In 

total, 22 of the 24 agencies reported data center optimization information 

to OMB. 22 However, of the nine metrics with targets, only one-full-time 

equivalent ratio (a measure of data center labor efficiency)-was met by 

half of the 24 agencies, while the remaining eight were each met by less 

than half of the agencies. See figure 3 for a summary of agencies' 

progress against OMB's data center optimization metric targets. 

Figure 3: Agencies' Progress against OMS Data Center Optimization Metric Targets 

Number of agencies 

20 

15 

10 

Core to non· 

core operating 

system ratio 

Core to 

non.core 

physical 

server ratio 

Facility 

utilization 

Office of Management and Budget (OMB) metrlcs 

12 

Full-time 

equivalent 

ratio 

Power usage 

effectiveness 

Storage: 

utiliZation 

VIrtual hosts Virtuallzatlon density 

Vlrtuallted 

operating 

systems 

- Agencies meeting or exceeding metric target 

$our<;e·GAOanalysnof~ncyandOMBdata. I GA0-16-SnT 

May 2014, OMS issued a set of metrics to measure the extent to wh1ch agencies 

data centers are optimized in areas such as data center energy, labor, and storage. For 

more information, see OMS, Fiscal Year 2014 PortfolioStat, Memorandum M~14-08 

(Washington, D.C.: May 7. 2014). 

22Two agencies-the National Science Foundation and the Small Business 

Administration-do not have any reported core data centers in their inventories and, 

therefore, do not have a basis to measure and report optimization progress 

Page 11 GA0-16-672T 
51 


KING-6430 with DISTILLERInsert offset folio 34 here 26068.034

Risks Need to Be Fully 

Considered When 

Agencies Rate Their Major 

Investments on OMB's IT 

Dashboard 

Agencies reported a variety of challenges in meeting OMS's data center 

optimization targets, such as the decentralized nature of their agencies 

making consolidation and optimization efforts more difficult We noted that 

addressing this challenge and others is increasingly important in light of 

the enactment of FITARA, which requires agencies to measure and report 

progress in meeting data center optimization performance metrics< We 

concluded that, until agencies take action to improve progress against 

OMS's data center optimization metrics, including addressing any 

challenges identified, they could be hindered in the implementation of the 

data center consolidation provisions of FITARA and in making initiativewide progress against OMS's optimization targets< 

To better ensure that federal data center consolidation and optimization 

efforts improve governmental efficiency and achieve cost savings, we 

recommended that 10 agencies23 take action to complete their planned 

data center cost savings and avoidance targets for fiscal years 2016 

through 2018< We also recommended that 22 agencies" take action to 

improve optimization progress, including addressing any identified 

challenges< Fourteen agencies agreed with our recommendations, 4 did 

not state whether they agreed or disagreed, and 6 stated that they had no 

comments< 

To facilitate transparency across the government in acquiring and 

managing IT investments, OMS established a public website-the IT 

Dashboard-to provide detailed information on major investments at 26 

agencies, including ratings of their performance against cost and 

schedule targets< Among other things, agencies are to submit ratings 

from their CIOs, which, according to OMS's instructions, should reflect the 

level of risk facing an investment relative to that investment's ability to 

23These 10 agencies are the Departments of the Interior, State, Transportation, and the 

Treasury; the Environmental Protection Agency, National Aeronautics and Space 

Administration. National Science Foundation, Nuclear Regulatory Commission, Office of 

Personnel Management, and Small Business Administration. 

24These 22 agencies are the Departments of Agriculture, Commerce, Defense, Education, 

Energy, Health and Human Services. Homeland Security, Housing and Urban 

Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and 

Veterans Affairs; the Environmental Protection Agency, General Services Administration, 

National Aeronautics and Space Administration, Nuclear Regulatory Commission, Office 

of Personnel Management, Social Security Administration, and U.S. Agency for 

International Development 

Page 12 GA0-16~672T 
52 


KING-6430 with DISTILLERInsert offset folio 35 here 26068.035

accomplish its goals. In this regard, FITARA includes a requirement for 

CIO's to categorize their major IT investment risks in accordance with 

OMB guidance. 25 

Over the past 6 years, we have issued a series of reports about the IT 

Dashboard that noted both significant steps OMB has taken to enhance 

the oversight, transparency, and accountability of federal IT investments 

by creating its IT Dashboard, as well as issues with the accuracy and 

reliability of data. 26 In total, we have made 22 recommendations to OMB 

and federal agencies to help improve the accuracy and reliability of the 

information on the IT Dashboard and to increase its availability. Most 

agencies agreed with our recommendations or had no comment. 

Most recently, as part of our ongoing work, we determined that agencies 

had not fully considered risks when rating their major investments on the 

IT Dashboard. Specifically, our assessment of 95 investments at 15 

agencies27 matched the CIO ratings posted on the Dashboard 22 times, 

showed more risk 60 times, and showed less risk 13 times. Figure 4 

summarizes how our assessments compared to the select investments' 

CIO ratings. 

2540 U.S.C. § 11302(c)(3)(C). 

26GAO, IT Dashboard: Agencies Are Managing Investment Risk. but Related Ratings 

Need to Be More Accurate and Available. GA0-14-64 (Washington. DC.: Dec. 12. 2013): 

Information Technology Dashboard: Opportunities Exist to Improve Transparency and 

Oversight of Investment Risk at Select Agencies, GA0~13-98 {Washington, D.C .. Oct 16, 

2012); IT Dashboard: Accuracy Has Improved. and Additional Efforts Are Under Way to 

Better Inform Decision Making, GA0-12-210 (Washington, D.C.: Nov. 7, 2011 ); 

Information Technology: OMB Has Made Improvements to Its Dashboard, but Further 

Work Is Needed by Agencies and OMB to Ensure Data Accuracy, GA0-11-262 

(Washington, o_c __ Mar. 15, 2011); and Information Technology: OMB's Dashboard Has 

Increased Transparency and Oversight, but Improvements Needed, GA0-10-701 

(Washington, D.C .. July 16, 2010). 

27The 15 selected agencies were the Departments of Agriculture, Commerce, Defense, 

Education, Energy, Health and Human Services, Homeland Security, the Interior, Labor, 

State, Transportation, the Treasury, and Veterans Affairs; the Environmental Protection 

Agency: General Services Administration: Social Security Administration; and Office of 

Personnel Management 

Page 13 GA0-1G-G72T 
53 


KING-6430 with DISTILLERInsert offset folio 36 here 26068.036

Figure 4: Comparison of Selected Investments' April 2015 CIO Rating to GAO's Assessments 

Chief Information Officer 

ratings for selected 

Investments 

GAO's assessment of 

selected Investments' risk 

-Lowrisk 

20 40 

Medium risk - High risk 

•• •• , .. 

Source- GAO's tiS$<'!$$1ll!lnt of data from the Office of Managem!lllt and Budget's lnformatiOfl Technology Dashboard, I GA0-16-672T 

Aside from the inherently judgmental nature of risk ratings, we identified 

three factors which contributed to differences between our assessments 

and CIO ratings: 

Forty-one of the 95 CIO ratings were not updated during the month 

we reviewed, which led to more differences between our assessments 

and the CIOs' ratings. This underscores the importance of frequent 

rating updates, which help to ensure that the information on the 

Dashboard is timely and accurately reflects recent changes to 

investment status. 

Three agencies' rating processes span longer than 1 month. Longer 

processes mean that CIO ratings are based upon older data. and may 

not reflect the current level of investment risk. 

Seven agencies' rating processes did not focus on active risks. 

According to OMB's guidance, CIO ratings should reflect the CIO's 

assessment of the risk and the investment's ability to accomplish its 

goals. CIO ratings that do no incorporate active risks increase the 

chance that ratings overstate the likelihood of investment success. 

As a result, we concluded that the associated risk rating processes used 

by the agencies were generally understating the level of an investment's 

risk, raising the likelihood that critical federal investments in IT are not 

receiving the appropriate levels of oversight. To better ensure that the 

Dashboard ratings more accurately reflect risk, we are recommending in 

our draft report, which is with the applicable agencies for comment, that 

Page 14 GA0-16~672T 
54 


KING-6430 with DISTILLERInsert offset folio 37 here 26068.037

Agencies Need to 

Increase Their Use of 

Incremental Development 

Practices 

15 agencies" take actions to improve the quality and frequency of their 

CIO ratings. 

OMB has emphasized the need to deliver investments in smaller parts, or 

increments, in order to reduce risk, deliver capabilities more quickly, and 

facilitate the adoption of emerging technologies. In 2010, it called for 

agencies' major investments to deliver functionality every 12 months and, 

since 2012, every 6 months. Subsequently, FITARA codified a 

requirement that agency CIO's certify that IT investments are adequately 

implementing OMS's incremental development guidance. 29 

In May 2014, we reported30 that almost three-quarters of selected 

investments at five major agencies" did not plan to deliver capabilities in 

6-month cycles, and less than half planned to deliver functionality in 12-

month cycles. We also reported that most of the five agencies reviewed 

had incomplete incremental development policies. Accordingly, we 

recommended that OMB develop and issue clearer guidance on 

incremental development and that selected agencies update and 

implement their associated policies. Most agencies agreed with our 

recommendations or had no comment. 

More recently, as part of our ongoing work, we determined that agencies 

had not fully implemented incremental development practices for their 

software development projects. Specifically, as of August 31, 2015, on 

15 agencies are the Departments of Agriculture, Commerce, Defense, Education, 

Energy, Health and Human Services, Homeland Security, the Interior, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency, 

Office of Personnel Management; and Social Security Administration. 

2940 U.S.C. § 11319(b)(1)(B)(ii). 

30GAO, Information Technology: Agencies Need to Establish and Implement Incremental 

Development Policies, GA0-14-361 (Washington, D.C .. May 1, 2014) 

31These five agencies are the Departments of Defense, Health and Human Services, 

Homeland Security. Transportation, and Veterans Affairs. 

Page 15 GA0-16-672T 
55 


KING-6430 with DISTILLERInsert offset folio 38 here 26068.038

the IT Dashboard, 22 federal reported that 300 of 469 active 

software development projects (approximately 64 percent) were planning 

to deliver usable functionality every 6 months for fiscal year 2016, as 

required by OMB guidance. Regarding the remaining 169 projects (or 36 

percent) that were reported as not planning to deliver functionality every 6 

months, agencies provided a variety of explanations for not achieving that 

goal, including project complexity, the lack of an established project 

release schedule, or that the project was not a software development 

project Table 1 lists the total number and percent of software 

development projects that agencies reported plans to deliver functionality, 

from highest to lowest 

agencies are the Departments of Agriculture, Commerce, Defense, Education, 

Energy, Health and Human Services, Homeland Security, Housing and Urban 

Development, the Interior, Justice, Labor, State, Transportation. the Treasury, and 

Veterans Affairs: the Environmental Protection Agency, Genera! Services Administration, 

National Archives and Records Administration, Office of Personnel Management, Small 

Business Administration, Social Security Administration. and U.S. Agency for International 

Development 

Page 16 GA0-16-672T 
56 


KING-6430 with DISTILLERInsert offset folio 39 here 26068.039

Table 1: Federal Agency Software Development Projects' Plans to Deliver Functionality Every 6 Months for Fiscal Year 2016, 

as Reported on the IT Dashboard 

"Thirteen additional departments and agencies had at !east one major !T investment and a total of 20 

or fewer projects. These agencies have been totaled together because calculating a percent of 

functionality delivered for a small number of projects does not provide a reliable figure. 

In reviewing seven selected agencies'" software development projects, 

we determined that the percentage delivering functionality every 6 months 

was reported at 45 percent for fiscal year 2015 and planned for 54 

percent in fiscal year 2016. However, significant differences existed 

between the delivery rates that the agencies reported to us and what they 

reported on the IT Dashboard. For example, the percentage of software 

projects delivering every 6 months that was reported to us by the 

Department of Commerce decreased by about 42 percentage points from 

what was reported on the IT Dashboard. In contrast, the Department of 

Defense reported a 55 percentage point increase from what was reported 

on the IT Dashboard. Figure 5 compares what the seven agencies 

reported on the IT Dashboard and the numbers they reported to us. 

seven agencies are the Departments of Commerce, Defense, Education, Health 

and Human Serv1ces, Homeland Security, Transportation. and the Treasury 

Page 17 
57 


KING-6430 with DISTILLERInsert offset folio 40 here 26068.040

Figure 5: Comparison of Software Development Projects' Percentage of Planned Delivery Every 6 Months Reported on the IT 

Dashboard and to GAO for Fiscal Year 2016 

Percentage of software development projects planning to deliver a release every 6 months in fiscal year 2016 

100 93 

80 

60 

40 

20 

Department of 

Commerce 

Department of 

Health and 

Human Services 

Information Technology Dashboard 

GAO 

Source·GAOaoalyslsofagencydata. I GA0-16-672T 

Department of 

Education 

Department of 

the Treasury 

Department of 

Homeland 

Security 

Department of 

Transportation 

Department of 

Defense• 

aThe Department of Defense did not provide requested information in time to verify the information 

reported for a sample of projects 

We determined that the significant differences in delivery rates were due, 

in part, to agencies having different interpretations of OMS's guidance on 

reporting software development projects and because the information 

reported to us was generally more current than the information reported 

on the IT Dashboard. We concluded that, until the inconsistences in the 

information reported to us versus the information provided on the IT 

Dashboard are addressed, the seven agencies we reviewed are at risk 

that OMS and key stakeholders may make decisions regarding agency 

investments without the most current and accurate information. 

Finally, nearly all of the seven agencies we reviewed had not yet 

implemented the FITARA requirement related to certifying that major IT 

investments are adequately implementing OMS's incremental 

development guidance. Specifically, only one agency-the Department of 

Homeland Security-had processes and policies to ensure that the CIO 

Page 18 GA0-16~672T 
58 


KING-6430 with DISTILLERInsert offset folio 41 here 26068.041

will certify that major IT investments are adequately implementing 

incremental development, while the remaining six agencies had not 

established such processes and policies. Officials from most of these six 

agencies reported they were in the process of updating their existing 

incremental development policies to address certification. 

To improve the use of incremental development, we are recommending in 

our draft report, which is with the applicable agencies for comment, that 

agencies take action to update their policies for incremental development 

and IT Dashboard project information. 34 We are also recommending that 

OMB provide clarifying guidance on what IT investments are required to 

use incremental development and for reporting on projects that are not 

subject to these requirements. 

In summary, with the recent enactment of FITARA, the federal 

government has an opportunity to improve the transparency and 

management of IT acquisition and operations, and strengthen the 

authority of CIOs to provide needed direction and oversight However, 

improvements are needed in several critical IT initiatives, including data 

center consolidation, efforts to increase transparency via OMS's IT 

Dashboard, and incremental development-all of which are related to 

provisions of FITARA Accordingly, OMB and federal agencies should 

expeditiously implement the requirements of the new IT reform law and 

continue to implement our previous recommendations. To help ensure 

that these improvements are achieved, continued congressional oversight 

of OMB's and agencies' implementation efforts is essentiaL 

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, 

and Members of the Subcommittees, this completes my prepared 

statement I would be pleased to respond to any questions that you may 

have at this time. 

we recommended that the Departments of Commerce, Defense, 

Education, and Human Services, Transportation, and the Treasury update their 

policies. We also recommended that in addition to those agencies, the Department of 

Homeland Security update IT Dashboard project information 

Page 19 GA0-16-672T 
59 


KING-6430 with DISTILLERInsert offset folio 42 here 26068.042

GAO Contacts and 

Staff 

Acknowledgments 

If you or your staffs have any questions about this testimony, please 

contact me at (202) 512-9286 or at pownerd@gao.gov. Individuals who 

made key contributions to this testimony are Dave Hinchman (Assistant 

Director), Justin Booth, Chris Businsky, Rebecca Eyler, linda 

Kochersberger, and Jon Ticehurst. 

Page 20 GA0·16·672T 
60 


KING-6430 with DISTILLERInsert offset folio 43 here 26068.043

Related GAO Products 

Data Center Consolidation: Agencies Making Progress, but Planned 

Savings Goals Need to Be Established {Reissued on March 4, 2016]. 

GA0-16-323. Washington, D.C.: March 3, 2016. 

High-Risk Series: An Update. GA0-15-290. Washington, D.C.: February 

11,2015. 

Data Center Consolidation: Reporting Can Be Improved to Reflect 

Substantial Planned Savings. GA0-14-713. Washington, D.C.: 

September 25, 2014. 

Information Technology: Agencies Need to Establish and Implement 

Incremental Development Policies. GA0-14-361. Washington, D.C.: May 

1, 2014. 

IT Dashboard: Agencies Are Managing Investment Risk, but Related 

Ratings Need to Be More Accurate and Available. GA0-14-64 

Washington, D.C.: December 12,2013. 

Data Center Consolidation: Strengthened Oversight Needed to Achieve 

Cost Savings Goal. GA0-13-378. Washington, D.C .. April23, 2013. 

Information Technology Dashboard: Opportunities Exist to Improve 

Transparency and Oversight of Investment Risk at Select Agencies. 

GA0-13-98. Washington, D.C.: October 16, 2012. 

Data Center Consolidation: Agencies Making Progress on Efforts, but 

Inventories and Plans Need to Be Completed. GA0-12-742. Washington, 

D.C.: July 19, 2012. 

IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under 

Way to Better Inform Decision Making. GA0-12-21 0. Washington, D.C.: 

November7, 2011. 

Data Center Consolidation: Agencies Need to Complete Inventories and 

Plans to Achieve Expected Savings. GA0-11-565. Washington, D.C.: July 

19,2011. 

Federal Chief Information Officers: Opportunities Exist to Improve Role in 

Information Technology Management. GA0-11-634. Washington, D.C.: 

September 15, 2011. 

Page 21 GA0-16-672T 
61 


KING-6430 with DISTILLERInsert offset folio 44 here 26068.044

(100855) 

Related GAO Products 

Information Technology: OMB Has Made Improvements to Its Dashboard, 

but Further Work Is Needed by Agencies and OMB to Ensure Data 

Accuracy GA0-11-262. Washington, D.C.: March 15, 2011. 

Information Technology: OMB's Dashboard Has Increased Transparency 

and Oversight, but Improvements Needed. GA0-1 0-701. Washington, 

D.C.: July 16, 2010. 

Page 22 GA0-16-672T 
62 


KING-6430 with DISTILLERInsert offset folio 45 here 26068.045

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further pennission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 
63 


KING-6430 with DISTILLERInsert offset folio 46 here 26068.046

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO's commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO's website (http:l/www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http:liwww.gao.gov and select "E-mail Updates." 

The price of each GAO publication reflects GAO's actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO's website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information. 

Connect with GAO on Facebook, Flickr, Twitter, and You Tube. 

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog. 

Visit GAO on the web at www.gao.gov. 

Contact: 

Website: http://www.gao.gov/fraudnetffraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548 

1.} Please Print on Recycled Paper. 

Insert offset folio 47 here 26068.047KING-6430 with DISTILLER

GAO 

Dollars in billions 

1 Achieved 11 Planned 

2.0 $1.6 

1.5 

1.0 

~0 

~~~$"fj77lf:!f: 

::;;::; ;;;::;:/~ $6:% w 

$.? ~$3~~ii -w~~~- 0; #!i w• • 

0.5 

0.0 

2011 2015 

Fiscal years 

Source: GA0-16-672T 

- $1

Total savings and avoidances: $8.2 bil

2016 2017 2018 20

Insert offset folio 48 here 26068.048KING-6430 with DISTILLER

GAO 

Total number of federal data centers 

Total data centers planned for closure 

Data centers closed through fiscal year 

/;""' ... 

----

..... 

' 2,078 \ Additional data centers 

: planned for closure thro

/ fiscal year 2019 

' ,/ 

--

Source: GA0-16-672T 

Insert offset folio 49 here 26068.049KING-6430 with DISTILLER

GAO 

Chief Information Officer ratings for selected investments 

0 20 40 60 80 

Low risk Medium risk - High risk 

Source: GA0-16-672T 
67 

Mr. HURD. Thank you, Mr. Powner. 

I will now recognize myself for 5 minutes for opening questioning. 

Mr. Cooper, I want to start with you. Commerce is one of the 

four agencies that is responsible for 86 percent, 87 percent of the 

savings in closing down the data centers. How are you able to use 

that money that you save? 

Mr. COOPER. We have an internal process that is set up. As we 

realize savings, we have a prioritized bureau-specific list of priorities. The bureaus bring forward, through our investment review 

process, their savings dollars redirected against that prioritized 

list. 

So it comes through the bureau investment review process up to 

the department review process. That way we have —— 

Mr. HURD. Mr. Cooper, I’m going to interrupt there. 

Mr. COOPER. Please. 

Mr. HURD. If you realize savings in your operations, you should 

be able to use that savings also to go after some of the other 

projects of legacy systems that you have already identified. Are you 

able to do that? 

Mr. COOPER. Yes. I was going into a little bit of detail on how 

we do that. The answer is yes. We have a process. We actually do, 

both at the department level and at the bureau level, redirect that 

savings. It is redirected based upon the priorities of new investments or risk-based issues that need to be addressed at the bureau 

level and the department level. 

Mr. HURD. Thank you, Mr. Cooper. 

Ms. Wynn, 10 months at NASA, correct? Two months in the CIO 

job? 

Ms. WYNN. I was 2 months as the deputy CIO and then promoted to the CIO the last 8 months. 

Mr. HURD. So are we going to be able to get to Mars if we are 

still using Fortran? 

Ms. WYNN. Thank you for your question, Chairman. At this 

point, I am not an expert on what it is going to take to get to Mars, 

but I’m happy to take the question for the record, and add the 

question about programming language as well. 

Mr. HURD. Please do. 

My question for you is, so you have come in and inherited a situation, and we recognize that. What additional responsibilities or 

authorities would you like to have in order to right this ship? 

Ms. WYNN. Chairman, thank you for the recognition to the newness. It is much appreciated. 

On March 31, the agency approved our transformation plan. It 

is about 219 pages. That gives me a lot of authority that is aligned 

with the FITARA law, as well as some things that NASA saw that 

needed to change. So at this juncture, we are changing our governance structure, changing the way we take a look at the budget, as 

well as taking a look at how we do portfolio review. 

At this juncture, that feels like it is going to be an excellent start 

for me at NASA. 

Mr. HURD. When did the CIO report directly to the Administrator, when did that change happen? 


KING-6430 with DISTILLER
68 

Ms. WYNN. It is my understanding that that started about 2 

years ago. 

Mr. HURD. When it comes to incremental developments, on your 

scorecard, there is no data on this. Is that because there are no IT 

projects in the works? Or is it because we don’t know which IT 

projects are in the works? 

Ms. WYNN. Chairman, the lack of incremental spending is due to, 

I believe, a couple things. One is, in my opening statement testimony, I emphasized the ability of the CIO to look at specialized 

and nonspecialized IT. The nonspecialized IT is our mission IT 

where a lot of development work is in our regular, ongoing basis. 

I recently have been given the authority to begin to look to make 

more transparent what goes on there. That is where a lot of our 

development happens, and that is where I am expecting to be able 

to say to you, yes, we are doing incremental. 

Mr. HURD. In the next review cycle, what should we expect from 

NASA? 

Ms. WYNN. At this juncture, in discovering this in preparation for 

the hearing, this is what I expect to be able to deliver to you. One 

is information on how much we have actually saved in closing our 

data centers, to be able to say to you that we have a good plan for 

a modified portfolio review process that includes the infrastructure 

IT as well as our mission IT, and then finally be able to report to 

you where we have actually driven a lot of savings in our software 

management. 

Mr. HURD. I think that would be pretty successful. 

Mr. Johnson, the 14 or 17 National Labs, why do they need an 

exemption from FITARA? 

Mr. JOHNSON. Thank you for the question, Chairman. 

So, as you know, DOE does not have a position on the legislation, 

which exempted the National Labs from FITARA implementation. 

However, we have been working closely with the National Labs 

just over 1 year that I have been the CIO within DOE. Through 

a collaborative process, which included not only the program offices 

and the National Labs, we have been putting in place a number 

of what we call transparency reforms that get to an effective management of our IT and cyber work force and information across our 

entire enterprise to include our National Labs. 

Mr. HURD. In my opinion, the National Labs are probably some 

of the most important things to protect, and they are probably the 

biggest target when you look at nation sponsors that are looking 

at cutting-edge technology. 

Not adhering to some of what I would consider some very basic 

standards for good digital hygiene to me does not make sense. This 

is an area where my expectation is that these National Labs have 

some greater transparency on what they are doing, how they are 

doing it, and ensuring they are not using Fortran and systems that 

are super old and outdated. 

I think as we go forward and have new laws and go through appropriations, some of those things may change. 

Ms. Leaf, what took so long to get the implementation plan approved? 

Ms. LEAF. Thank you for the question. 


KING-6430 with DISTILLER
69 

The department leadership felt that it was very important that 

we complete due diligence in understanding the relationship of 

FITARA with the Confidential Information Protection and Statistical Efficiency Act, or CIPSEA. 

So the department reviewed that internally. They requested 

guidance from OMB, which we received. When we received it, we 

incorporated it and finished our plan. 

Mr. HURD. Ms. Leaf, thank you very much. 

I now would like to recognize my colleague, Ms. Kelly, for 5 minutes of questioning. 

Ms. KELLY. Thank you, Mr. Chair. 

Last November, the committee received a briefing on GAO’s review of how the 24 agencies identified in the Chief Financial Officers Act of 1990 had begun implementation of FITARA. At the committee’s request, four key areas of FITARA were scored, enhancement to agency chief information officer authorities, transparency 

and risk management, portfolio review, and Federal data center 

consolidations. 

Mr. Powner, this question is for you. Can you explain why those 

areas were selected and how the scores were calculated? 

Mr. POWNER. First of all, in working with your staff, I think we 

all collectively decided, and it was a great bipartisan effort, that 

these were areas directly tied to FITARA. They were areas that 

where needed reform needed to occur. They were also areas where 

agencies had data. 

So if you look at incremental development, scores on the dashboard, and savings, there is publicly reported data on the dashboard, on the CIO ratings, and incremental development, and then 

also, too, there is savings information that goes to the Appropriations Committees for both portfolios stats and data centers. 

So it is the agency’s data, and I thought it was a great idea on 

your part to use the agency’s data to score them initially on those 

initial grades back in November. Now this go-around, there were 

some tweaks to the data, because it was all self-reported initially, 

but there were some tweaks. Like on incremental development, we 

didn’t think it was quite accurate with a couple agencies. 

Mr. Cooper, one of them was Commerce. So there was a downgrade on that score for incremental development. 

But it was also great that these committees, that you decided to 

uptick agencies who saved a lot and closed a lot, because that is 

really what we want to do. So I think there has been a nice little 

initial evolution of the grades where it evolved from more just selfreporting and had some of our GAO reports validate the self-reporting, and to reward what you really want, closures and savings. 

Ms. KELLY. Thank you. 

Mr. JOHNSON AND MS. Leaf, you represent two agencies that 

showed improvement. Can you quickly review what steps you took 

to improve? 

Mr. JOHNSON. Ranking Member, thank you for the question. 

Let’s see, as I mentioned, I have been at the department just 

over a year. One of the things we prioritized was streamlining governance so that we can make sure that we have a common view 

on what issues we face as a department, both from an IT informaVerDate Nov 24 2008 09:59 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00075 Fmt 6633 Sfmt 6633 H:\26068.TXT APRIL

KING-6430 with DISTILLER
70 

tion resource management point of view, and also from a cyber 

point of view. 

As part of that process, we have an integrated team now that includes management all the way to the top of the department. It includes all the elements of our department, including our field and 

the previously mentioned National Labs. 

What we have attempted to do is focus all of those great minds 

and all of that great effort on focusing where we can make improvements. Two places where DOE did improve, as you can see 

from the scorecard, one, in particular, was in data centers, something that we are focusing on specifically to try to gain efficiencies 

that we can, as mentioned earlier, provide funds back into mission 

to try to address the other issues we have. 

So I would account most of the success to opening up the aperture of the governance and making sure that everyone is on the 

same page, but, in addition, having a focused plan on what we need 

to do. 

Ms. KELLY. Thank you. 

Ms. LEAF. So at the Department of Labor, what we have primarily done is strengthened our IT governance processes. 

The two areas that we have really improved are more detailed 

review of agency IT spend plans and acquisitions, so that we really 

do understand what the agencies are buying and how that fits with 

the overall strategic department objectives. We also, for the first 

time, expanded our IT program review board to include agency 

projects and programs. Before it was just for enterprise-level 

projects. 

So those are our two governance areas that we have improved 

and I think what has contributed to our improvement. 

Ms. KELLY. I am happy to see that all 24 agencies’ plans have 

been approved or submitted. That is one thing. But, of course, they 

have to be implemented. 

Can you guys quickly go down the line and talk about what are 

your plans for the transition? Because we know, one way or another, there will be a new administration. 

Mr. COOPER. I’m happy to start. Thank you for the question. At 

Commerce, we have already taken steps that actually even preceded my coming into the role at the Department of Commerce as 

the CIO. 

We have already institutionalized in a memo actually signed by 

our Acting Secretary back in 2012 a significant amount of the authorities granted to the CIO and then reinforced by FITARA. That 

has allowed Commerce to kind of have a bit of a head start, if you 

want to think of it that way. 

But in addition, we have implemented, through our governance 

process for IT, some additional reviews that did not exist until we 

had FITARA to leverage, two specific ones that are now part of the 

CIO oversight review. 

First, programmatic reviews that my office or I or any bureau 

CIO can request. That is a formal review. You can think of them 

as being analogous or the equivalent of TechStat. But we launched 

those. We invite OMB to join us and, in some cases, GAO, depending upon what is under review. 


KING-6430 with DISTILLER
71 

The second is, and this is brand new, it is kind of unique to Commerce that we have implemented, is what we call a CIO review. 

That is a review that didn’t previously exist. I leveraged FITARA, 

the authorities granted to the CIOs, to be able to call a CIO review. 

We are using it specifically to take a look at programs that fall 

below our investment thresholds. 

We are focused on the following three major types of programs: 

one, any public-facing type of initiative that reaches to our constituents, stakeholders, citizens; second, any introduction of new 

technologies that could be state of the market, but they have not 

been used within the department before; and third, anything that 

we believe constitutes not abnormal risk but risk of a different nature than we are used to addressing. 

An example, moving into the cloud requires new IT skill sets. We 

consider that a high risk. So even though you might have an initiative in a bureau that might represent less than $10 million for a 

lifecycle investment, we can now conduct a CIO review on that program. 

Ms. KELLY. Briefly. My time is up. 

Ms. LEAF. Okay, so quickly, we are really focusing on process improvements that will be in place and are institutionalized, irrespective of the individuals that are in place. 

There are two areas for that. One is our actual FITARA plan has 

quarterly milestones, so we have committed to those. The other is 

that we are actually implementing the processes in the department 

through directives. So those should stand regardless of who is in 

place. 

Ms. KELLY. Thank you. 

Mr. JOHNSON. So within the Department of Energy, three main 

changes. 

One, as it relates to, as mentioned earlier, our implementation 

plan also has quarterly deadlines that we are following. 

We are also modifying our program review process to include 

modifying the charters by which those are run, including our Information Management Governance Board, which will be used as our 

internal investment review board for the department. That charter 

is being modified, and it will be signed out by the Deputy Secretary. 

And finally, for the first time within the department, I, as CIO, 

am going to be included on an Energy systems advisory board that 

analyzes all major investments to include $400 million and above, 

to include facilities that might include IT major investments like 

high-performance computing, et cetera, which is hugely transformational for the department. 

Ms. KELLY. Thank you. 

Ms. WYNN. For NASA, and thank you for the question, Congresswoman, that is, we basically have one thing and that is implement 

our business services assessment, which covers such things, but not 

just these things. It would be our governance, our roles and responsibilities, as well as our security, the way we focus on security. And 

there are policies and procedures that go underneath that. And a 

huge element of this one is a culture change element. 

So as long as we stay the course on what we have committed to 

do, we should be in good stead. 


KING-6430 with DISTILLER
72 

Ms. KELLY. I don’t know if you have a comment? 

Mr. POWNER. I would just add that I think the improvements in 

governance is really needed across the Federal Government, not 

only on the large acquisitions, but where that governance also 

looks at the legacy spend. 

I know, next week, we are going to look more closely at these old 

legacy systems and the challenges in maintaining and the security 

vulnerabilities. 

But that governance perspective really needs to look at everything, so it is encouraging that these processes are being approved. 

Ms. KELLY. Thank you. 

Thank you, Mr. Chair. 

Mr. HURD. Thank you, Ms. Kelly. 

I now would like to recognize Chairman Meadows for 5 minutes. 

Mr. MEADOWS. Thank you, Mr. Chairman. I thank each of you 

for your testimony. I will try to be brief as we work through this 

issue. 

Ms. Leaf, I want to come to you. Your particular position, do you 

think it is an impediment to accomplishing your overall goal with 

where you are in the reporting status to the very top of your agency? 

Ms. LEAF. So let me just address what the department is going 

to do in the FITARA plan to strengthen the role of the CIO. We 

have two items. We are adding the CIO, and I am currently in that 

position, to the department management meeting, which is where 

they agency heads meet regularly. We have an action item to reassess this in 2017, with respect to the reporting structure. 

My honest answer to you is that I report to an Assistant Secretary, who is a strong champion of IT. I participate with him in 

meetings with the Deputy Secretary and with the Secretary. So in 

this particular instance, the reporting structure is not an impediment, because of the individuals who are in the positions. 

I do think that it is appropriate for the department to reconsider 

it, however, with the transition. 

Mr. MEADOWS. I would concur with your last statement. I guess 

what I would say is, knowing that the reporting is a critical component after you are gone, or perhaps after those you report to are 

gone, I would encourage, while you have a cooperative mood, to express the sense of Congress that that reporting relationship is 

being looked at. How about that? 

Ms. Wynn, I want to come to you. Obviously, your grade was not 

one that I jumped up and down about, nor do you, I can tell. I even 

questioned GAO. The gentleman to your left will admit that when 

I saw it I said that this has to be wrong, because I visited NASA, 

and I know the commitment to the mission at NASA, so certainly 

it has to be wrong. 

So I guess my question to you is twofold. Do you know what it 

would take to get from an F to a C? 

Ms. WYNN. Chairman, thank you. 

We are not proud of our —— 

Mr. MEADOWS. I am not here to beat you up. 

Ms. WYNN. I’m glad GAO said yes, we did not make a mistake 

in our reporting, so great on that one. 


KING-6430 with DISTILLER
73 

So I think with our business services assessment, we are on 

track to head toward a C. As long as we stay on that particular 

plan that the agency approved—and, as you know, in order for us 

to make the changes in the CIO world, we have to have the support 

of senior leadership, and we have to have that because of the culture change. I have that in place now, so it is time for me and my 

team to capture that moment and get through the implementation 

process. 

Mr. MEADOWS. So in a roundabout way, I guess the answer was 

yes, you know how to get to a C. 

So the question becomes, at the next briefing, will we see you at 

a C? 

Ms. WYNN. Chairman Meadows, yes, your summary is right. We 

are to do that. 

As far as guaranteeing a C, as long as the grading stays precisely 

as it is right now, we know how to make those changes. But I 

would say that there are a couple areas where there are bigger 

changes. That is on the incremental side, taking a look at some of 

our projects. We are headed toward getting that insight. I just can’t 

guarantee what day I’m going to get that one. 

Mr. MEADOWS. I am not asking for that. I knew many of your 

teammates in other areas, and we expect the culture to be one that 

would embrace—just to be frank, they will not be satisfied with 

being an F, so you have big shoes to fill. 

But I guess my question is, do you have the tools and the insight 

and the commitment to improve? 

Ms. WYNN. Chairman Meadows, I do. 

Mr. MEADOWS. Okay, all right. 

So let me go to the GAO very quickly, because one of the graphs 

that you put up there had to do with what you identified as I guess 

low risk, that was identified by the agencies as low risk, but it 

looked like most of that was either medium or high risk, according 

to your analysis of where it should be. 

So is there a disadvantage for agencies to self-report now that 

the scorecard is already out, to say, ‘‘Okay, we made a mistake. 

They are, indeed, medium risk, high risk, or whatever.’’ By self-reporting to you at this point, do they get adversely affected by getting a different dashboard quicker? Or is there an incentive to go 

ahead and have all the agencies call you tomorrow and say, ‘‘Gosh, 

we agree with your assessment. Put us at high risk, low risk, 

here.’’ 

Mr. POWNER. So I think, if they had more red than yellow investments, they would have a higher grade. Right now, we need to still 

move in that direction. 

Right now, the dashboard shows 72 percent of our dollars, this 

is both major investments in acquisition or operations, are low risk. 

There is no one in this room that believes 72 percent of our major 

investments are low risk. They are just not. 

Mr. MEADOWS. So what you are saying, your testimony here 

today, and it needs to be a clear message to all of the agencies, is 

they can get a higher score— am I understanding you right?—just 

by reporting it correctly? 

Mr. POWNER. Correct. So Commerce and Labor both have As. 

They acknowledge a fair amount of yellows. And Labor has one red, 


KING-6430 with DISTILLER
74 

but there is a fair amount of yellows in their assessments. It is not 

all green. NASA is all green, so they get an F on dashboard. 

So that is kind of how it works right now. We have seen changes. 

There is more acknowledgment of risk since your last hearing, but 

that review we did for you shows that we still have a long way to 

go. 

Even Commerce, there were a couple assessments that Steve has 

that we weren’t in full agreement. We think he could still acknowledge some more risk on certain ones. 

Our point on this is you cannot manage these IT investments appropriately unless you acknowledge the risk. If you say it is green, 

you are not going to get reviewed when we all know that there are 

a lot of yellows and reds. 

We need that governance that every one of these CIOs talk 

about. And collectively, these four CIOs spend $5 billion collectively 

on IT in a given year. That is a lot of money that we need to manage more appropriately, and it starts with acknowledging risk. 

Mr. MEADOWS. All right. So that message needs to be clear. 

Let me finish up with two very small points. 

One, Mr. Cooper, congratulations on moving forward. Do you 

have a full-time CIO in place for Census yet? 

Mr. COOPER. We have made the selection. That individual will be 

moving into that office. I apologize. I do not know the specific timing, but very shortly. 

Mr. MEADOWS. Without getting into the weeds here, we really 

have some to-do items as it relates to Census. I won’t beat you up 

in public, so let’s just follow up on that. 

Ms. Leaf, is it true that you had to buy replacement parts on 

eBay for some of your system? 

Ms. LEAF. Yes, sir, it is. But I’m happy to say that those servers 

have been upgraded and replaced. 

Mr. MEADOWS. All right, so here is my last admonishment to all 

of you, and the chairman talked about it with Ms. Wynn with regards to Fortran. We have legacy systems that must—not maybe, 

must—must be changed. So the message that needs to go from you 

to those who work in IT is that we will no longer accept that this 

is the way that we have always done it, whether it is COBOL, 

Fortran, or any other language that is grayer than I am. 

It is imperative, without mentioning it in a public forum, we 

have agencies who are taking IT dollars to prop up legacy systems 

and stealing from the future of our IT systems to prop it up. 

Mr. CONNOLLY AND MR. Hurd are much better versed at this 

than I am. I will dig from an investigative standpoint, and then let 

them weigh in from a technical standpoint, but let this day be the 

day that we start to address that. 

I will yield back, Mr. Chairman. 

Mr. HURD. Thank you, Chairman Meadows. 

I would like to recognize Mr. Connolly for 5 minutes. 

Mr. CONNOLLY. Thank you, Mr. Chairman. I echo everything my 

friend from North Carolina and my friend from Texas have said. 

Picking up on a very interesting line of questioning Mr. Hurd 

had, Mr. Johnson, I want to state for the record that the carveout 

for the National Labs was an outrageous thing to do. 


KING-6430 with DISTILLER
75 

They used their influence here on the Hill. They used an appropriations vehicle to get around this committee and this bill. The 

ink was barely dry on the bill. We didn’t have implementation evaluation, and those labs got an exception. 

Who could be hurt by that? Well, anybody depending on the National Lab. 

The whole point here isn’t another pain in the neck set of requirements and compliances. It is to transform how we do business. 

It is to get at legacy systems. It is to make sure things are 

encrypted and secure. It is to try to streamline management. It is 

to save resources and plow them back into the enterprise. 

If there is anyone who could have benefited from FITARA, it is 

the National Labs. 

So I hope you will go home to the Department of Energy with 

this message: We are not going to stand for it. We will revisit this 

issue. 

I do not presume to speak for my colleagues on the other side 

of the aisle, but I think this will be a broad bipartisan assault on 

the National Labs if they try it again. And if we have to go toeto-toe with Appropriations Committee, we will do so, because it has 

been evident that others are benefiting from this effort. 

It would be one thing if we were many years into the process and 

it was onerous and it was hard and it was bureaucratic and it was 

costing money and the promise wasn’t being realized. I still might 

not like it, but I could understand why you might pursue your 

other options—not you, but the National Labs, did not wait. 

I hope you will go back and warn them. This time, there will be 

a fight. And I think it will be bipartisan. 

At any rate, other than that, Mr. Cooper, you were talking in 

your testimony about cost savings. This really isn’t about cost savings. I take that point very well. But on the other hand, as Ms. 

Leaf pointed out, there are cost savings. She specifically cited one 

that makes my heart go pitty-pat, data center consolidation. 

How are we doing at DOC on that? And do you have some kind 

of number you can ascribe to it? 

Mr. COOPER. Yes, we are doing very well, and we continue to do 

well. 

We have realized about—I think the number, and I will verify 

this to make sure I’m giving you an accurate number, so I will 

come back with a follow-up. But I think we now stand at about 

$308 million that we have actually realized. We are on track to 

continue our very solid record of adding to that savings figure. 

If I may, I want to clarify very quickly what my remark was. It 

was to differentiate between a focus on absolute cost savings in IT. 

One of the things that is misunderstood in my executive leadership 

team that we are working to clarify is the difference between absolute cost of IT—for example, for capacity expansion or newer demand, new capability. That will drive the total cost of IT up. But 

some folks are misunderstanding that if the total cost of IT is going 

up, then I as the CIO and other CIOs must be doing something incorrect. They believe that the total cost should be moving down or 

stay flat. 

What we are doing is we are trying to educate our entire work 

force in Commerce that the correct metric to use around cost savVerDate Nov 24 2008 09:59 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00081 Fmt 6633 Sfmt 6633 H:\26068.TXT APRIL

KING-6430 with DISTILLER
76 

ings is to ensure that the unit cost of any IT service that we deliver, we are constantly driving the unit cost down. That way, both 

can be true. We can reflect true efficiency, true cost savings, even 

when the total amount of spend may, in fact, be going up. 

Mr. CONNOLLY. A good point, and that is why I wanted you to 

have the opportunity to clarify. I will give you a political note on 

that. 

But all of what you said takes a little time to institutionalize, to 

get everybody right with the program, to have a plan, to make sure 

the National Labs—we have this moment in time where the leadership here is completely united. We have GAO and GSA and OMB 

all on that script. That ain’t going to last forever. There are not always going to be people appear who go, ‘‘Yes, I get that, no problem, as long as trajectories are right.’’ As you heard Mr. Hurd ask, 

I hope you are able to reinvest the savings, not everyone is going 

to have that point of view. 

That is why one of the things we are keen on here is taking advantage of this moment while you can. 

Mr. Powner, what changes might be made as we look down the 

road to the scorecard, to make it even more useful and hopefully 

more accurate? 

By the way, I like the fact that we are using some subjective 

judgment. When we see all green, you get an F. You are not rewarded for that. That is terrific. That is a very non-bureaucratic 

approach to a very important subject. I mean, one could just absolve oneself and go check, it’s all green, how wonderful. We know 

that is not true. We know that we have lost billions of dollars 

sometimes in waste and mistaken investments. So trying to catch 

them early is a good thing. Exercising that judgment, to me, is also 

a very welcoming, good thing. 

But what might we add to the scorecard that would round it out 

and give us a better picture of DOE and NASA and others? 

Mr. POWNER. A couple key examples. I think, one, fixing the CIO 

authority issue, you need to find some way to score that, because 

if you do not fix the CIO authority issue in the cultures and bureaucracies at all these departments and agencies, you are not 

going to be able to accomplish FITARA in all of these areas as well 

as you possibly could. So looking at those plans and measuring 

whether the CIO authorities are truly being tackled is, as I think 

Ms. Leaf clearly pointed out that they are doing at the Department 

of Labor, that is what we need to find a way to look into. That is 

critical. 

The other thing, if you look at data center consolidation, over 

time, it is not going to be about closures and savings, although we 

are always going to have savings, but it is about optimization 

metrics, too, because there are some agencies that I still think are 

low-balling their estimates. It looks like they are done, but their 

optimization metrics are nowhere utilizing the equipment and the 

facilities at those departments and agencies. So that means they 

probably still have more savings. 

I think when we mature this in the future, looking at optimization metrics, but clearly, the CIO authority needs to be tackled aggressively. 


KING-6430 with DISTILLER
77 

Mr. CONNOLLY. By the way, just for the record, now every Federal agency has submitted a FITARA implementation plan, right? 

Mr. POWNER. Yes. 

Mr. CONNOLLY. Okay. The last two came in recently. 

Mr. POWNER. Yes. You can take your C- off the scorecards and 

make them C. 

Mr. CONNOLLY. Ms. Wynn, two points, and then my time is up. 

One following up on what the chairman asked you, which I think 

is a brilliant question, are we going to get to Mars using Fortran? 

I think you said, well, I have to get back to you for the record. That 

is one I want to read. 

But I think he was getting at, with legacy systems, with antiquated systems, what could go wrong with that, in terms of Mars? 

Of all Federal agencies, yours in some ways is the most critically 

dependent on technology and technology working. 

I guess I would just ask you, for the record, would you not concede the point I think implied in the chairman’s question, which is 

that technology, the IT piece, is really important to really all of 

your missions at NASA, and, therefore, getting them right and 

making sure we have them sort of updated and upgraded is pretty 

important? 

Ms. WYNN. Congressman Connolly, you are absolutely right. IT 

is important for NASA’s mission. 

Mr. CONNOLLY. One final point with you, Ms. Wynn, as you are 

relatively new, as you are working through the FITARA plan, I 

think you said you have a 219-page plan, setting metrics in advance, to me, is really important. If you do not have metrics, it is 

all interesting but—so, for example, on data center consolidation, 

I think it is really important, a priori, to say we have X number 

and we are going to reduce it by this much by this date. 

And it has to be a stretch. It has to push the organization a little 

bit, not an impossible goal, but if you don’t have stretch goals, we 

are not really meeting our mission. 

So I would commend to you as you work through that plan set 

some of those metrics for the organization and your other colleagues, because that is the only way we are going to achieve 

progress. And it is the only way we are going to use FITARA as 

it was intended, which is a useful management tool for you and ultimately for the head of NASA itself. 

All right, I want to thank all of you for being here. I really benefited a lot. 

And my concern about the National Labs ought not to color, Mr. 

Johnson, the progress DOE is making. I thank you, but I wanted 

you to go back, because I think the chairman is absolutely right to 

ask that question, and it did not go unnoticed up here. Thank you. 

Mr. HURD. Thank you, Mr. Connolly. 

Mr. Meadows? 

Mr. MEADOWS. Thank you, Mr. Chairman. 

A very brief follow-up, since we are talking about legacy systems, 

and since most of the people working on those legacy systems I 

would surmise are closer to retirement than not, what I would like 

from each one of you is the cost estimate of really not waiting for 

2 or 3 or 5 years for us to fall off the cliff, the cost estimate of getVerDate Nov 24 2008 09:59 Jul 13, 2017 Jkt 000000 PO 00000 Frm 00083 Fmt 6633 Sfmt 6633 H:\26068.TXT APRIL

KING-6430 with DISTILLER
78 

ting rid of those legacy systems for your agencies, if you would do 

that. 

Then, Mr. Cooper, let me come back to the CIO. It is obvious that 

you get this here, and we have the Census coming up and we cannot afford to fail. Has it been contemplated that the CIO role for 

Census would be incorporated as part of your responsibility, or that 

you take that on, since you obviously get it and are willing to 

work? Because I need to get the Census side with the GAO counterpart because we have GAO and we all stakeholders, to be frank, 

that are very, very concerned that we are not getting it. And we 

have a great relationship, but we are reaching a point of ‘‘go, no 

go’’ on a lot of decisions that are creeping up. 

You get it. I’m not so sure the new CIO would get it, so have you 

looked at that? 

Mr. COOPER. Yes, and, Chairman Meadows, may I offer this, 

would this be acceptable, I will carry back—I know the planned 

timing. As I mentioned, we selected the individual. I know the 

planned timing. Would you allow me to go back, work with Director 

Thompson, and speed that up and allow us to put that individual 

in place? 

My commitment to you and this committee is that I will then 

commit to working directly with that individual to ensure that we 

help that individual come up to speed as rapidly as possible, but 

leveraging myself and my office to ensure that we honor the commitments that I previously made to this committee and that director Thompson has previously made to this committee? 

Mr. MEADOWS. That sounds fair, because what we cannot have 

is someone in the job 8 months later, and we get an F on the Census. So I appreciate that. 

I yield back. 

Mr. HURD. Mr. Powner, the issue of the CIO responsibility still 

perplexes me. Of the 24 CFO agencies, how many of the CIOs report directly to the agency head? 

Mr. POWNER. I do not have that exact number, but I think very 

few of them do. Even if they do—we looked at this years ago and 

did some work on this. It is dated, but even those that on paper 

report to the agency head typically report to the DepSec. We found 

that reporting to the DepSec actually gives most CIOs the right 

visibility and a seat at the table at most of the agencies. That is 

what we concluded. 

Mr. HURD. So how many report directly to the Deputy Secretary 

or the Secretary? 

Mr. POWNER. I don’t have an exact number on that. But I can 

tell you not enough. 

Mr. HURD. So in your opinion, would an appropriate grade when 

it comes to CIO authorities be whether they report directly to the 

Secretary or the Deputy Secretary, and do all of the CIOs within 

the agency report to them? 

Mr. POWNER. Yes, that is a good way to measure. That is the intent of FITARA, where you have the CIOs reporting to the department or agency —— 

Mr. HURD. Would you agree that this metric is disproportionately 

more influential in the overall grading of an agency over all the 

other areas that FITARA looks at? 


KING-6430 with DISTILLER
79 

Mr. POWNER. Yes, if you don’t fix those CIO authorities, I think 

you’re going to continually struggle. 

The other thing I think to keep in mind is the relationship with 

the other CFOs. We have heard many agencies, when CIOs have 

a solid relationship with the chief financial officers, things work 

out a lot better. 

Mr. HURD. Mr. Powner, you are reading my mind. 

How are CFOs responding to the implementation of FITARA? 

Mr. POWNER. Mixed bag. I don’t have GAO reports that say this, 

but we have enough anecdotes, and you have heard it. Some CFOs 

are worried about losing power. Some CFOs are working closely 

with CIOs. We are seeing some progress, but we need to see more 

progress so we have equal footing there. 

I think a true measure, too, is going to be trying to get your arms 

around the IT budget. I don’t think CIOs can do that without 

CFOs’ help. So you have to partner with CFOs to get your arms 

around the IT budget. That is a clear position in FITARA. There 

was a reason FITARA was written that way, starting with this 

committee. 

Mr. HURD. At FITARA 3.0, I think it would be interesting to 

have some of the CFOs sitting alongside their CIO colleagues, having these conversations. 

Mr. CONNOLLY. Mr. Chairman? 

Mr. HURD. Yes? 

Mr. CONNOLLY. You have asked a very, very important question, 

and I would just say, when we wrote FITARA, we decided to make 

it less prescriptive and more expansive. We took cognizance of the 

fact that we had multiple CIOs, and rather than by fiat say there 

shall be one, we kind of encouraged the system to evolve, so that 

there would be a primus inter pares, first among equals, in the 

CIO constellation, because there were 240 or 250 CIOs. And your 

question is absolutely apt. 

So will that sort of flexible legislative framework work, or do we 

have to resort to codifying and deciding by fiat? And that is why 

I think your question is so irrelevant, and I hope the CFOs understand that. 

Thank you, Mr. Chairman, for the question. 

Mr. HURD. My last question goes to Mr. Cooper. 

I appreciate everyone being here today, and for the delay for 

votes. 

Commerce got the highest grade, yet Commerce has 114 million 

lines of Fortran code, which they have 525 employees supporting 

that. There are 37 systems that are using operating systems that 

are no longer supported by the vendor. Por que? Why? 

Mr. COOPER. In most cases, those support operations that cannot 

easily be replaced by commercial, off-the-shelf software. 

Mr. HURD. You are talking about the Fortran code? 

Mr. COOPER. The Fortran code is, in most cases that I am aware 

of—I accept what you’re telling me as far as the numbers of systems and lines of code. 

What we are doing is working with those bureaus directly where 

we have a legacy system exactly like you described. It is no longer 

vendor-supported. 


KING-6430 with DISTILLER
80 

Now, what we are doing in a lot of cases is we actually are 

backporting, meaning we are getting patches through the public domain, and we are applying those patches on a very regular basis, 

much as we would do if we received a vendor patch. We are doing 

that in every situation that we can. 

We are also doing the following. In a situation where we cannot 

take that approach, we are doing everything we can to basically 

quarantine that legacy system. We are doing that specifically to 

prevent cyber risk in the spread of something coming in through 

a vulnerability in those legacy systems. We are trying to quarantine it so that we can shut it off and it won’t then propagate 

across our networks or across other applications. 

Lastly, we are working as rapidly and effectively as we can, quality with speed, to replace those legacy systems. But because, in 

most cases, we can’t find readily available commercial, off-the-shelf 

software, we still have to build it. We are taking advantage of savings we are realizing through our data center consolidation initiative and optimization efforts to redirect that savings into new development and replacement of some of, but not all, some of those 

legacy systems. 

Mr. HURD. Thank you, Mr. Cooper. 

I would like to thank the rest of the witnesses for taking the 

time to appear before us today. If there is no further business, 

without objection, the subcommittees stand adjourned. 

[Whereupon, at 4:29 p.m., the subcommittees were adjourned.] 


KING-6430 with DISTILLER
(81) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
82 


KING-6430 with DISTILLERInsert offset folio 50 here 26068.050

Statement by Mr. Meadows 

"The Federal Information Technology Reform 

Act (FIT ARA) Scorecard 2.0" 

Wednesday, May 18, 2016, 2:00p.m. in 2154 

Rayburn House Office Building 

• In Fiscal Year 2017, the federal government 

plans to invest more than $89 billion on IT. 

This is a significant area of federal spending that 

requires Congress' attention. 

• This hearing continues this Committee's 

oversight of agencies' implementation of 

FIT ARA. In fact, this is the third hearing that 

we've had on FITARA and the second FITARA 

Scorecard hearing - or as we like to call it 

FIT ARA Scorecard 2. 0. 

• We have focused so much attention to Federal 

IT acquisition and management because it is 

important to everything agencies do- and 

because IT acquisition remains on the GAO 

High Risk List. 
83 


KING-6430 with DISTILLERInsert offset folio 51 here 26068.051

• We welcome the agency CIOs (Commerce, 

NASA, Energy, and Labor) here today to talk 

about their efforts to implement FIT ARA and of 

course the Scorecard 2.0 grades. 

• The Scorecard, which the Committee developed 

with assistance from GAO, continues to use the 

same key areas (Data Center Consolidation, IT 

Portfolio Review Savings, Risk Assessment 

Transparency and Incremental Development) for 

purposes of measuring agencies' FIT ARA 

implementation. 

• And again the data is data that agencies have 

reported to GAO or Congress- so it's selfreported data. For Scorecard 2.0, we have had 

another six months to collect data and GAO has 

done some work to validate some of these 

numbers. 

• So what's different in terms of overall grades? 

Seven agency grades improved (including 

Energy "C" and Labor "C"). 16 agency grades 
84 


KING-6430 with DISTILLERInsert offset folio 52 here 26068.052

stayed the same (NASA "F" and Commerce 

"B ") and one agency grade declined. 

• We've also taken note that two agenciesEnergy and Labor - that are here today do not 

yet have in place an approved FIT ARA 

Implementation Plan. Consequently, we 

assigned a "C-" instead of a "C" grade. 

• FIT ARA and in particular the Scorecard 

provides a tool to help agencies improve the 

buying, management, and hopefully retirement 

of outdated IT. 

• We look forward to continuing our FIT ARA 

oversight and ultimately helping agencies 

achieve better outcomes in how they spend over 

$89 billion on federal IT. 
85 


KING-6430 with DISTILLERInsert offset folio 53 here 26068.053

1. Data Center Consolidation 

Savings 

Savings Savings Reported 

Goal Reported to 

Agency (millions) to GAO % Congress % Combined Grade 

Commerce 222 258 116% 260 117% 100% A 

Energy 4 10 227% 2 39% 70% c 

Labor 6 0% 0 0% 0% F 

Background: 

FITARA requires agencies (with a few caveats) to provide the Office of Management and 

Budget (OMB) with a data center inventory, a strategy for consolidating and optimizing the data 

centers (to include planned cost savings), and quarterly updates on progress made.' The law also 

requires OMB to develop a goal of how much is to be saved through this initiative, and provide 

annual updates on cost savings achieved. 

Calculation: 

Agencies are graded based on the percentage of planned savings related to data center 

consolidation that they have reportedly realized. Since agencies report differing figures to OMB 

and the Government Accountability Office (GAO), the two percentages are averaged (note: a 

maximum of I 00 percent is used in the average). 

Data Source: 

OMB's April2016 IT Oversight and Reform (!TOR) report to Congress and the GAO's tracking 

of agencies' implementation.2 

1 Federal Information Technology Reform provisions of the Carl Levin and Howard P. ·Buck' McKeon National 

Defense Authorization Act for Fiscal Year 2015. Pub. L. No. 113-291, div. A. title VIII. subtitleD§ 834. 128 Stat. 

3292,3444-3448 (Dec. 19, 2014). 2 Sec. e.g., GAO. Data Center Consolidation: Reporting Can be Improved to Reflect Substantial Planned Savings. 

GA0-14-713. (Washington, D.C.: Sept. 25. 2014). 
86 


KING-6430 with DISTILLERInsert offset folio 54 here 26068.054

2. IT Portfolio Review Savings 

Budgets Reported savings %of %of 

Agency (millions) (millions) Budgets Max Grade 

Commerce 6,684 320 4.8% 66% D 

Energy 4,912 30 .6% 8% F 

Labor 2,140 5 .2% 3% F 

NASA 4.123 131 3.2% 44% F 

Background: 

FIT ARA requires the Office of Management and Budget to develop and most agencies to 

implement a process to review agency IT investment portfolios in order to, among other things, 

increase efficiency and effectiveness, and identify potential waste and duplication. 3 

Calculation: 

Each agency's total PortfolioS tat savings divided by its total IT budget for the most recent 3 

fiscal years. The resulting ratio is then compared to the leading agency's ratio (in this case, SSA 

-5.7% of budget) and scored. 

Data Source: 

OMB's April2016 IT Oversight and Refonn (!TOR) report to Congress and the President's 

annual budget.< 

3 Federal Information Technology Reform provisions of the Carl Levin and Howard P. ·Buck' McKeon National 

Defense Authorization Act lor Fiscal Year 2015. Pub. L. No. 113-291, div. A, title VIII. subtitleD§ 833:40 U.S.C. 

§ 11319(c)(sccondsubsecs.(c)). 4 Each agency·s budget submissions include a report on its IT portfolio and a business case for each major IT 

investment. These data are available at https://itdashboard.gov/data_leeds. 
87 


KING-6430 with DISTILLERInsert offset folio 55 here 26068.055

3. Incremental Development 

Projects 

Major Associated delivering Incremental 

Agency Investments Projects every 6 months (%) Grade 

Commerce 10 ll5 95 83% cs 

Energy 3 3 3 100% A 

Labor 2 4 3 75% c 

Background: 

Poor-performing projects have often used a "big bang" approach-that is, projects that are 

broadly scoped and aim to deliver functionality several years after initiation. Consequently 

OMB has called for agencies' major IT investments to deliver functionality every 12 months and 

since 2012, has required investments to deliver functionality every 6 months.6 

Calculation: 

The percentage of an agency's IT projects associated with major IT investments in developmene 

that delivered functionality every six months. Additionally, the Committee adjusted Commerce 

and Treasury's grades down based on a forthcoming GAO report. 

Data Source: 

Monthly Data feeds on OMB's IT Dashboard as of May 2016.8 

5 The Committee adjusted Commerce and Treasury's grades in this category down based on a fo11hcoming GAO 

report. 

6 OMB. FY 2017 IT Budget- Capital Planning Guidance (2015): FY 2016/T Budget- Capital Planning Guidance 

(2014): Guidance on F.xhibits 53 and 300--!nformation Technology and £-Government (2013): Guidance on 

Exhibits 53 and 300--Information Technology and E.-Government (2012). 7 Investments in development arc those spending at least 50% of their planned spending in development (per the 

Office of Management and Budget, Fiscal Year 2016 Budget of the U.S. Government). NASA, NSF, and NRC do 

not currently have any projects that meet this dciinition and thus do not have letter grades in this area. 8 https:i/itdashboard.gov/data feeds 
88 


KING-6430 with DISTILLERInsert offset folio 56 here 26068.056

4. Risk Assessment Transparency 

Major 

Projects 

rated 

Major high %Rated Grade 

Agency Projects9 risk high risk 

Commerce 1,643 1,301 79% A 

Energy 

NASA 731 0% F 

Background: 

For each major investment, FITARA requires the responsible agency Chief Information Officer 

(CIO) to submit an assessment of risk and the investment's ability to accomplish its goals. 10 

Additionally, for major IT investments that rate as high risk for four consecutive quarters, the 

law requires that the agency CIO conduct a review aimed at identifying and addressing the 

causes of the risk. 11 

Calculation: 

The five agencies with the most reported risk (lowest portion of investments rated "green" 

(low/moderately-low risk), by dollar) are given an "A", the next five a ·'B", the next five a "C", 

the next five a "D" and the last 4 are given an "F" (24 agencies were evaluated). 

Data Source: Monthly Data feeds on OMB 's IT Dashboard as of May 2016. 12 

9 In Millions 10 Federal Information Technology Reform provisions of the Carl Levin and Howard P. 'Buck' McKeon National 

Defense Authorization Act for Fiscal Year 2015. Pub. L. No. 113-291, div. A, title Vlll, subtitleD§ 832:40 U.S.C. 

§ 11302 (c)(3)(C). 

"Pub. L. No. 113-291. div. A. title VIII. subtillc D § 832:40 U.S.C. § 11302 (c)(4). 12 https:llitdashboard.gov/data feeds 
89 


KING-6430 with DISTILLERInsert offset folio 57 here 26068.057

Honse Oversight and Government Reform !mplemenlation Scorecard 

In December 2014. the Federallnfonnation Technology Acquisition Reform Act (FITARA) was enacted. fhe Committee is grading 

agency implementation of the following 4 key areas ofFITARA. Based on available data, collected by GAO at the request of 

Committee. each agency vvas scored in the four areas. which were combined to yield an overall '·A" through T' grade. 

l. Data Center Consolidation 

2. IT Portfolio ReYiew SaYings 

3. Incremental Development 

4. Risk Assessment Transparency 

) The Commmee downgraded The Departments of Energy and Labor's overall grades from aCto a c. because ne1ther of them have an approved F!TARA 

1mplementat10n plan 
90 

Æ 


KING-6430 with DISTILLERInsert offset folio 58 here 26068.058

House Oversight and Government Reform Committee 

May 2016 

Grades: 

FIT ARA Scorecard 

Risk IT Portfolio 

1 This area measures agencies 'major' investments- defined as those that are spending at least 50% of their planned 

spending in development (per the Office of Management and Budget, Fiscal Year 2016 Budget qfthe U.S. 

Government). NASA, NSF, and NRC did not have any projects that met this definition. 2 Three agencies-BUD, SBA and USAID-did not report any planned data center consolidation cost savings goals; 

therefore, no grade has been determined for these agencies.