a

GAO

United States Government Accountability Office

Report to Congressional Committees

September 2005 INFORMATION 

TECHNOLOGY

Management 

Improvements Needed 

on Immigration and 

Customs 

Enforcement’s 

Infrastructure 

Modernization 

Program

GAO-05-805
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

www.gao.gov/cgi-bin/getrpt?GAO-05-805.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Randy Hite, 

(202) 512-3439, HiteR@gao.gov. 

Highlights of GAO-05-805, a report to 

congressional committees 

September 2005

INFORMATION TECHNOLOGY 

Management Improvements Needed on 

Immigration and Customs Enforcement's 

Infrastructure Modernization Program 

DHS’s fiscal year 2004 Atlas expenditure plan, related documentation, and 

program officials’ statements satisfied all conditions imposed by Congress, 

including (1) meeting the capital planning and investment control review 

requirements established by the Office of Management and Budget (OMB); 

(2) complying with the DHS enterprise architecture; (3) complying with the 

acquisition rules, requirements, guidelines, and systems acquisition 

management practices of the federal government; and (4) being reviewed 

and approved by ICE’s Investment Review Board, DHS, and OMB. However, 

this satisfaction is based more on plans and commitments that provide for 

meeting these conditions than on completed actions. As such, much remains 

to be accomplished for Atlas planning and management efforts to be 

considered effective and thereby minimize the risks associated with the 

program’s capacity to deliver promised IT infrastructure capabilities and 

benefits on time and within budget. 

GAO developed a number of observations about the expenditure plan and 

DHS’s management of the program. The observations address the need for 

economic justification of Atlas, rigorous and disciplined program 

management practices, performance measurements that are linked to goals 

and benefits, and an expenditure plan that provides sufficient information on 

program commitments for it to be a useful accountability tool. For example, 

Atlas’s existing economic justification does not reflect recent and planned 

changes in the program’s scope and purpose, including plans to expand the 

program beyond IT infrastructure upgrades. In addition, program 

management controls and capabilities have yet to be established. While ICE 

has begun to establish an Atlas program office, this office is not yet 

operational and is not adequately staffed. For example, while ICE has 

assigned a program manager and three contracting staff, it has not yet 

determined how many staff will be needed on the Atlas projects. In addition, 

while the program manager recently assessed staffing needs for program 

support positions, and identified several, none have been filled (see graphic).

Proposed Program Management Office 

Business

Analyst

Financial

Analyst

Risk

Analyst

Documentation

Specialist

Common

Computing

Enterprise

Information Integration Information

Assurance

Infrastructure

Engineering

Transformation

Planning

Program Manager

Project Manager

EA

Analyst

Staffing in place Staffing need assessed Staffing need not assessed

Source: GAO analysis of DHS data.

Senior Infrastructure

Officer

The Department of Homeland 

Security’s (DHS) Atlas program is 

intended to modernize Immigration 

and Customs Enforcement’s (ICE) 

information technology (IT) 

infrastructure. By congressional 

mandate, DHS is to develop and 

submit for approval an expenditure 

plan for Atlas that satisfies certain 

legislative conditions, including a 

review by GAO. GAO was asked to 

determine whether the plan 

satisfied certain legislative 

conditions and to provide 

observations on the plan and 

management of the program. 

What GAO Recommends

To strengthen Atlas planning and 

management, GAO recommends 

that the Secretary of DHS ensure 

that ICE follows through on 

commitments to implement 

effective management controls and 

capabilities by, among other things, 

revising and updating the costbenefit analysis; making the 

program office operational; 

developing and implementing 

rigorous performance program 

management practices; and 

ensuring that future expenditure 

plans fully disclose the system 

capabilities, schedule, cost, and 

benefits to be delivered. In its 

written comments on this report, 

DHS concurred with GAO’s 

recommendations and 

stated actions that it was taking to 

implement them. 
Page i GAO-05-805 Information Technology

Contents

Letter 1

Compliance with Legislative Conditions 2

Other Observations on the Expenditure Plan and Management of 

Atlas 3

Conclusions 5

Recommendations for Executive Action 6

Agency Comments 7

Appendixes

Appendix I: Briefing to the Staffs of the Subcommittees on Homeland 

Security, Senate and House Committees on Appropriations 8

Appendix II: Comments from the U.S. Department of Homeland 

Security 60

Appendix III: GAO Contact and Staff Acknowledgments 63

Abbreviations

DHS Department of Homeland Security

ICE Immigration and Customs Enforcement

IT information technology

OMB Office of Management and Budget

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately.
Page 1 GAO-05-805 Information Technology

United States Government Accountability Office

Washington, D.C. 20548

A

September 7, 2005 Letr

The Honorable Judd Gregg

Chairman

The Honorable Robert C. Byrd

Ranking Member

Subcommittee on Homeland Security

Committee on Appropriations

United States Senate

The Honorable Harold Rogers

Chairman

The Honorable Martin Olav Sabo

Ranking Member

Subcommittee on Homeland Security

Committee on Appropriations

House of Representatives

The 2004 Department of Homeland Security Appropriations Act1

 provided 

$40 million for Immigration and Customs Enforcement’s (ICE) program to 

modernize its information technology (IT) infrastructure.2

 The goals of the 

program—which ICE refers to as “Atlas”—are to, among other things, 

improve information sharing, strengthen information security, and improve 

workforce productivity. The act provided that the Department of Homeland 

Security (DHS) was prohibited from obligating the $40 million until it 

developed a plan for how the funds are to be spent that satisfied certain 

legislative conditions, including having the plan reviewed by us. On March 

16, 2005, DHS submitted its fiscal year 2004 expenditure plan to the Senate 

and House Appropriations Subcommittees on Homeland Security. Pursuant 

to the act, we reviewed the plan; our objectives were to (1) determine 

whether the plan satisfies legislative conditions specified in the act and (2) 

provide any other observations about the plan and management of the 

program.

On May 10 and 24, 2005, we briefed the Senate and House Homeland 

Security Subcommittee staffs, respectively, on the results of our review. 

1

Pub. L. No. 108-90 (Oct. 1, 2003).

2

During fiscal year 2004, the Department of Homeland Security reprogrammed about $30.2 

million of the $40 million to address other ICE priorities, thereby leaving $9.8 million for the 

program.
Page 2 GAO-05-805 Information Technology

This report transmits the results of that work. The full briefing, including 

our scope and methodology, is reprinted in appendix I. 

Compliance with 

Legislative Conditions

DHS satisfied each of the applicable legislative conditions specified in the 

act. In particular, the plan, including related program documentation and 

program officials’ statements, satisfied or provided for satisfying all key 

aspects of (1) meeting the capital planning and investment control review 

requirements of the Office of Management and Budget (OMB);3

 (2) 

complying with the DHS enterprise architecture;4

 (3) complying with 

acquisition rules, requirements, guidelines, and systems acquisition 

management practices of the federal government; and (4) having the plan 

reviewed and approved by ICE’s Investment Review Board, DHS, and OMB.

However, satisfaction of these legislative conditions is based in large part 

on plans and oral commitments by program officials that provide for 

meeting the conditions. To illustrate, OMB capital planning requirements 

direct agencies planning to make a major IT investment, like Atlas, to 

among other things (1) summarize the investment’s life-cycle costs; (2) 

analyze costs and benefits, including return on investment; (3) establish 

performance goals and measures; and (4) develop security and privacy 

plans. The Atlas program does not have a current life-cycle cost estimate 

nor a current cost-benefit analysis showing return on investment. It also 

does not have a complete set of performance measures. Further, the 

program does not have an up-to-date security plan that includes Atlas, and 

officials have yet to develop a privacy impact assessment for the program. 

The program manager acknowledged these shortfalls and either planned or 

orally committed to fully satisfy the requirements when expenditure plan 

funds become available.

3

OMB Circular A-11 establishes policy for planning, budgeting, acquiring, and managing 

federal capital assets. Capital investment and control requirements are now found in OMB 

Circular A-11, part 7, rather than in part 3.

4

An enterprise architecture provides a clear and comprehensive picture of an organization’s 

operations and its supporting systems and infrastructure. It is an essential tool for 

effectively and efficiently engineering business processes and for implementing and 

evolving supporting systems in a manner that maximizes interoperability, minimizes overlap 

and duplication, and optimizes performance. 
Page 3 GAO-05-805 Information Technology

Other Observations on 

the Expenditure Plan 

and Management of 

Atlas

Our observations address the need for economic justification of Atlas, 

rigorous and disciplined program management practices, performance 

measurements that are linked to goals and benefits, and an expenditure 

plan that provides sufficient information on program commitments to 

make the plan a useful accountability tool. An overview of specific 

observations follows:

• Economic justification (i.e., analysis of costs and benefits) does not 

reflect recent and planned changes in the program’s scope and 

purpose. The existing cost-benefit analysis—which was developed in 

2002—has not yet been revised to reflect changes in the program’s scope 

and purpose. Since ICE became responsible for Atlas in 2003 (inherited 

from the Immigration and Naturalization Service) it has materially 

changed the program’s scope, purpose, and priorities. Specifically, Atlas 

was expanded to (1) support additional law enforcement units5

 (and 

their business requirements) that were merged into ICE and (2) provide 

the flexibility to support new ICE priorities, such as integrating future 

antiterrorism programs and projects and facilitating information sharing 

with domestic and international law enforcement organizations. In 

addition, the program is also being expanded beyond infrastructure 

upgrades to include efforts to streamline and reengineer core business 

functions with the application of IT. According to the fiscal year 2004 

expenditure plan and program manager, revising the analysis is a “next 

step” to be taken and the goal is to have a contractor complete an 

updated cost-benefit analysis on or about September 30, 2005. 

• Program management controls and capabilities have yet to be 

established. ICE has begun to establish an Atlas program office; 

however, the program office is not yet operational. Specifically, the 

bureau has drafted a management structure and plan, which includes 

staff roles and responsibilities. However, the structure and plan are 

currently being reviewed by ICE management and have not been made 

final. Moreover, of the $63.52 million that ICE reported was obligated for

Atlas in fiscal years 2002 and 2003, only about $900,000 (or about 1.4

percent of the total amount) was obligated for program management 

capabilities. In contrast, our work on other IT modernization programs 

(including two in DHS) show that 19 percent was invested in such 

5

The units include the Federal Air Marshals Service, Federal Protective Service, Customs 

investigations, and Customs intelligence.
Page 4 GAO-05-805 Information Technology

management capabilities. In addition, while key acquisition 

management processes have been defined in ICE’s System Development 

Life Cycle methodology, the program office has yet to implement these 

processes. 

Further, the program office is not adequately staffed.6

 Currently, the 

office has staffed the program manager position, and it has three 

contracting staff performing functions such as developing staffing 

needs assessments and other program management-related activities. 

While the program manager recently assessed staffing needs for 

program support positions (e.g., financial management, contracting, and 

enterprise architecture), he has not yet performed a needs assessment 

to determine the staffing needs for the five of the six projects that 

comprise the Atlas program. Moreover, of the seven program support 

positions that the program manager has determined are needed, none 

have been filled, according to program officials. The program manager 

stated that ICE plans to strengthen program management controls and 

capabilities once funds provided for in the expenditure plan are 

available. 

• Program goals, expected benefits, and reported achievements are not 

fully aligned. The Atlas expenditure plan and documentation show that 

the program has defined goals and expected benefits and has reported 

actual achievements accomplished during fiscal years 2002 and 2003. 

However, the relationships among goals, benefits, and achievements 

have not been defined and are not apparent in all cases. Moreover, the 

reported achievements are not expressed in terms of measurable 

outcomes or results, but rather as activities completed. The program 

manager stated that the 2002 and 2003 achievements were not analyzed 

and aligned to program goals and benefits, and that outcome-based 

measures were not developed in part because the emphasis at the time 

was on buying and deploying long overdue infrastructure upgrades as 

quickly as possible. He stated that in the future, the program intends to 

define, ensure, and disclose the linkage among program goals, benefits, 

and results. 

6

According to the program manager, Atlas staffs were transferred to the US-Visitor and 

Immigrant Status Indicator Technology program in 2003, which is managed by the DHS 

Under Secretary for Border and Transportation Security.
Page 5 GAO-05-805 Information Technology

• Fiscal year 2004 expenditure plan does not provide sufficient 

information on program commitments to permit effective 

congressional oversight. The Atlas expenditure plan does not show the 

level of detail and scope of the program needed for Congress to 

understand its plans and commitments relative to system capabilities, 

cost, benefits, and schedule. Further, it does not sufficiently describe 

progress made against program commitments (e.g., expected benefits). 

According to the program manager, the state of the plan reflects the 

program’s uncertainty about the appropriate level of detail in 

expenditure plans. He stated that future plans will include missing 

content. 

Conclusions The fiscal year 2004 Atlas expenditure plan, in combination with related 

program documentation and program officials’ statements, satisfies the 

legislative conditions set forth by Congress. However, this satisfaction is 

based more on plans and commitments that provide for meeting these 

conditions than on completed actions. As such, much remains to be 

accomplished for Atlas planning and management efforts to be considered 

effective and thereby minimize the risks associated with the program’s 

capacity to deliver promised IT infrastructure capabilities and benefits on 

time and within budget.

The current state of planning and management puts the program at risk. 

While this is partially due to events beyond the program’s control, such as 

the department’s decision to reprogram Atlas funding and to redeploy Atlas 

staff to competing DHS priorities, as well as to change the program’s scope 

and purpose when it transitioned from the Immigration and Naturalization 

Service to ICE, it is also due to the program’s decision not to use fiscal 

years 2002 and 2003 funds to invest in program management capabilities. 

Given that more than $60 million has reportedly been obligated to date on 

the program, resources have been available to strengthen planning and 

management capabilities in key areas, but investment in these areas has 

been deferred. Deferral of establishing such program planning and 

management controls and capabilities—such as having reliable and current 

economic justification for the program; a capable program office; and 

clearly aligned program goals, benefits, and performance measures— 

introduce unnecessary risk to the program.

Moreover, not providing congressional decision makers with the 

information that they need about program commitments to be met with the 
Page 6 GAO-05-805 Information Technology

expenditure plan funds—including the benefits to be produced, the 

capabilities to be delivered, and the cost and schedule estimates to be 

met—impedes congressional oversight. 

Recommendations for 

Executive Action

To minimize risks to the Atlas program, we recommend that the Secretary 

of Homeland Security, through the Under Secretary for Border and 

Transportation Security, direct the Assistant Secretary for Immigration and 

Customs Enforcement to ensure that ICE follows through on commitments 

to implement effective management controls and capabilities by taking the 

following five steps:

• Revising and updating the cost-benefit analysis, to identify current 

mission requirements; how they will be met; and an estimate of the 

program’s incremental and life-cycle costs, benefit, schedule, and return 

on investment. This should also include establishing plans, associated 

tasks, and milestones for accomplishing this effort. 

• Making the Atlas program office operational by (1) developing a staffing 

needs assessment to determine the positions and the level of staffing 

needed for all projects to adequately manage the program, including a 

human capital strategy and timetable for acquiring the staff and bringing 

them on board; (2) finalizing the roles and responsibilities for the 

positions identified in the staffing assessment and for the projects; and 

(3) implementing and institutionalizing key acquisition management 

controls, including risk management processes where relevant 

responsibilities are assigned and key risks and their status are reported 

to an executive body.

• Developing and implementing an updated Atlas security plan and 

privacy impact assessment. This should also include establishing plans, 

associated tasks, and milestones for accomplishing this effort. 

• Developing and implementing rigorous performance management 

practices for the Atlas program that include properly aligned goals, 

benefits, achievements, and anticipated achievements that are defined 

in measurable terms. This should also include establishing plans, 

associated tasks, and milestones for accomplishing this effort. 

• Ensuring that future expenditure plans fully disclose the system 

capabilities, schedule, cost, and benefits to be delivered, as well as the 

acquisition strategy for Atlas.
Page 7 GAO-05-805 Information Technology

Agency Comments In the department’s written comments on a draft of this report, which were 

contained in a letter signed by the director, DHS Departmental GAO/Office 

of Inspector General Liaison, DHS concurred with all of our 

recommendations and stated actions it was taking to implement them. 

DHS’s comments are reprinted in appendix II.

We are sending copies of this report to the Chairmen and Ranking Members 

of other Senate and House committees and subcommittees that have 

authorization and oversight responsibilities for homeland security. We are 

also sending copies to the Secretary of Homeland Security and the Director 

of OMB. Copies of this report will also be available at no charge on our Web 

site at www.gao.gov.

Should you or your offices have any questions on matters discussed in this 

report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may be 

found on the last page of this report. Key contributors to this report are 

listed in appendix III.

Randolph C. Hite

Director, Information Technology Architecture

and Systems Issues
Page 8 GAO-05-805 Information Technology

Appendix I

Briefing to the Staffs of the Subcommittees on Apendxies

Homeland Security, Senate and House 

Committees on Appropriations ApendxiI

Appendix I

Information Technology: Management Improvements

Needed on Immigration and Customs Enforcement’s 

Infrastructure Modernization Program

Briefing to the Staffs of the

Subcommittees on Homeland Security,

Senate and House Committees on Appropriations

May 10 and May 24, 2005
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 9 GAO-05-805 Information Technology

2

Briefing Overview

• Introduction

• Objectives

• Results in Brief

• Background

• Results

• Legislative Conditions

• Observations

• Conclusions

• Recommendations

• Agency Comments

• Attachment I: Scope and Methodology
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 10 GAO-05-805 Information Technology

3

Introduction

The Department of Homeland Security’s (DHS) Bureau of Immigration and

Customs Enforcement (ICE)1 is responsible for enforcing border security, trade, 

and other laws by, for example, investigating and collecting intelligence on 

individuals and groups who act to violate these laws. ICE is also responsible for 

detecting and deterring hostile acts on U.S. commercial aviation and protecting

federal facilities.

Atlas is an ICE program to modernize the bureau’s information technology (IT)

infrastructure. IT infrastructure includes the hardware (e.g., servers, routers,

storage devices, communication lines) and system software (e.g., database

management and operating systems and network management) that provide an 

environment for operating and maintaining software applications.

According to ICE, the goals of Atlas include improving information sharing,

strengthening information security, and improving workforce productivity.

1ICE was formed from the former Immigration and Naturalization Service, U.S. Customs Service, and other entities. Atlas began in 2002 under

the former INS.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 11 GAO-05-805 Information Technology

4

Introduction

The fiscal year 2004 Department of Homeland Security Appropriations Act2

appropriated $40 million for Atlas and provided that DHS was prohibited from

obligating these funds until the department submitted a plan for how the funds were

to be spent that satisfied the following legislative conditions:

• meets the capital planning and investment control review requirements

established by the Office of Management and Budget (OMB), including OMB 

Circular A-11, part 3,3

• complies with DHS’s enterprise architecture,4

• complies with the acquisition rules, requirements, guidelines, and systems 

acquisition management practices of the federal government,

2Pub.L. No. 108-90 (Oct. 1, 2003).

3OMB Circular A-11 establishes policy for planning, budgeting, acquisition, and management of federal capital assets. Capital investment and 

control requirements are now found in OMB Circular A-11, part 7, rather than part 3.

4As agreed with the staffs of the appropriations subcommittees, we assessed compliance with the DHS enterprise architecture in lieu of the ICE 

enterprise architecture.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 12 GAO-05-805 Information Technology

5

Introduction

• is reviewed and approved by ICE’s Investment Review Board (IRB),5 DHS, and 

OMB, and 

• is reviewed by GAO.

During fiscal year 2004, DHS reprogrammed about $30.2 million of the Atlas funds 

to cover other ICE priorities, leaving $9.8 million for the program.

DHS submitted its fiscal year 2004 expenditure plan for $9.8 million on March 16, 

2005, to its Senate and House Appropriations Subcommittees on Homeland

Security.

5The purpose of the IRB is to integrate capital planning and investment control, budgeting, and acquisition. It is also to ensure that spending on 

investments directly supports and furthers the mission and that this spending provides optimal benefits and capabilities to stakeholders and

customers.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 13 GAO-05-805 Information Technology

6

Objectives

As agreed, our objectives were to

1. determine whether the Atlas fiscal year 2004 expenditure plan satisfies the

legislative conditions, and

2. provide any other observations about the expenditure plan and DHS’s

management of the Atlas program.

We conducted our work at DHS and ICE headquarters in Washington, D.C. from 

March 2005 through May 2005 in accordance with generally accepted government

auditing standards. Details of our scope and methodology are provided in 

attachment I.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 14 GAO-05-805 Information Technology

7

Results in Brief

Objective 1: Satisfaction of Legislative Conditions

Legislative conditions

1. Meets the capital planning and investment control review 

requirements established by OMB, including OMB Circular A-11,

part 7.6

2. Complies with the DHS enterprise architecture.

3. Complies with the acquisition rules, requirements, guidelines,

and systems acquisition management practices of the federal

government.

4. Is reviewed and approved by ICE IRB, DHS, and OMB.

5. Is reviewed by GAO.

Satisfied

Satisfied

Satisfied7

Satisfied

Satisfied

Status

6Capital investment and control requirements are now found in OMB Circular A-11, part 7, rather than part 3.

7Satisfied: Satisfied or provides for satisfying every aspect of the condition that we reviewed.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 15 GAO-05-805 Information Technology

8

Results in Brief

Objective 2: Other Observations

• Economic justification does not reflect recent and planned changes in the 

program’s scope and purpose.

• Program management controls and capabilities have yet to be established.

• Program goals, expected benefits, and reported achievements are not fully

aligned.

• Fiscal year 2004 expenditure plan does not provide sufficient information on

program commitments to permit effective congressional oversight.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 16 GAO-05-805 Information Technology

9

Results in Brief

Recommendations

We are making recommendations to the Secretary of DHS to improve Atlas

expenditure planning and program management.

In commenting on a draft of this briefing, ICE’s chief information officer and the 

Atlas program manager agreed with our findings and conclusions and stated that 

our recommendations were reasonable.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 17 GAO-05-805 Information Technology

10

Background

ICE

ICE was formed as a component agency of DHS in 2003 when the law

enforcement functions of the Justice Department’s former Immigration and 

Naturalization Service (INS) and the Treasury Department’s former Customs 

Service, among other agencies, were merged into DHS. 

The ICE mission is to ensure the security of the American people and homeland by

investigating violators of, and thereby, enforcing the nation's immigration and

customs laws; protecting U.S. commercial air carriers, airports, passengers, and 

crews; policing and securing federal buildings and other facilities; and collecting,

analyzing, and disseminating intelligence to assist it in these endeavors.

Headed by the Assistant Secretary of Immigration and Customs Enforcement, ICE 

has approximately 15,000 employees in over 400 offices domestically and in other 

countries.

The Atlas program was started by INS in 2002. Responsibility for the program was 

transferred to ICE in 2003 as part of the establishment of DHS.

The figure on the following page shows ICE and Atlas organizational placement

within the department.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 18 GAO-05-805 Information Technology

11

Background

ICE and Atlas Organizational Placement

Simplified DHS organizational chart showing ICE and Atlas program
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 19 GAO-05-805 Information Technology

12

Background

Impetus for Atlas 

According to ICE officials, Atlas was initiated to address information sharing and 

security limitations within the former INS caused by, for example, 

• obsolete hardware/software that needed refreshing;

• incompatible, non-interoperable information systems; and

• uneven system security capabilities.

These officials stated that these challenges were exacerbated by the formation of 

ICE because the organizations that merged into ICE had different

hardware/software environments (e.g., multiple e-mail systems) and different

mission and customer needs.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 20 GAO-05-805 Information Technology

13

Background

Goals of Atlas

The stated goals of Atlas are, among other things, to: 

• enhance workforce productivity,

• strengthen integrity, security, and privacy of information and data assets, and

• promote information sharing and collaboration.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 21 GAO-05-805 Information Technology

14

Background

Atlas Projects

The fiscal year 2004 expenditure plan states that Atlas consists of seven 

interrelated projects, which are briefly described below.

According to the program manager, Electronic Access and E-Government has

recently been merged with the Enterprise Information project, which is described on

the next slide.

Electronic Access

and E-Government

•Connect new bureau organizations (e.g., Federal Protective Service, Federal Air 

Marshal Service) to ICE’s communications network to, among other things, provide

investigators and other staff quicker access to information used to accomplish

mission duties.

•Identify a solution for optimizing the integration and performance of these

connections and develop a plan to implement it. 

Integration

(Connectivity)

•Acquire and deploy a common e-mail application (MS Exchange) to replace

multiple and disparate e-mail applications currently in use across ICE organizations.

•Implement hardware and software (i.e., Active Directory) that enables the common

e-mail application to operate on multiple local area networks.

•Install new desktop computers.

Common Computing

Environment

Project Description

Source: DHS data.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 22 GAO-05-805 Information Technology

15

Background

Atlas Projects

Continued.

•Strengthen security of ICE’s information, network, and systems by expanding the

capabilities of the bureau’s Security Operations Center in the following areas: audit

log management, intrusion detection, firewall management, cryptographic services,

computer forensics, vulnerability scanning, and penetration testing.

Information

Assurance

•Develop and prototype an approach to integrate systems and information across

ICE, including developing a central data repository with the capabilities to access,

navigate, and search information across multiple sources (referred to as Enterprise

Query) and share information across existing systems on a real time basis (referred

to as Enterprise Interoperability).

•Establish infrastructure to support implementation of Web-based applications (i.e.,

electronic government).

Enterprise

Information

•Provide engineering facilities (e.g., interoperability laboratory) and automated tools

and procedures to manage and operate ICE’s IT infrastructure and evaluate and

test new technologies before deploying them in the operational environment.

Infrastructure

Engineering

Project Description

Source: DHS data.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 23 GAO-05-805 Information Technology

16

Background

Atlas Projects

Continued.

•Implement program management structures, policies, and processes to stand up

the program office.

•Provide adequate program office staffing.

•Centralize and streamline procurement planning and procedures to enable more

efficient purchasing of hardware and software products and services.

•Manage and oversee Atlas projects and contractors, including developing tools to 

help in these endeavors.

•Ensure compliance with DHS’s enterprise architecture.

•Monitor adherence to cost, schedule, and performance goals.

Transformation

Planning

Project Description

Source: DHS data.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 24 GAO-05-805 Information Technology

17

Background

Atlas Funding

Since fiscal year 2002, Atlas has been provided $143.17 million in appropriated

funds.

• $39.1 million from INS counterterrorism funding in fiscal year 2002.8

• $24.47 million from INS investment and operations and maintenance

funding in fiscal year 2003.

• $40 million from DHS appropriations in fiscal year 2004,9 of which $30.2

million was reprogrammed by DHS to cover other ICE priorities, leaving

$9.8 million.

• $39.6 million from DHS appropriations in fiscal year 2005.10

8Counterterrorism funding came from the Department of Defense and Emergency Supplemental Appropriations for Recovery from and Response

to Terrorist Attacks on the United States Act, 2002. Pub. L. No. 107-117 (Jan. 10, 2002); H.R. Report 107-350 (Dec. 19, 2001). 

9Pub.L. No. 108-90 (Oct. 1, 2003).

10Pub.L.. No. 108-334 (Oct. 18, 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 25 GAO-05-805 Information Technology

18

Background

Atlas Expenditures

As shown in the table below, ICE reports that it has obligated $63.5211 million in 

fiscal years 2002 and 2003 appropriated funds on various Atlas projects. 

0 0 0 Electronic Access and EGovernment

Infrastructure Engineering 0 0 0

$0 $10.51 $10.51 Common Computing

Environment

Transformation Planning 0 .89 .89

$17.63

10.20

1.34

6.09

Expenditures in

fiscal year 2002

(in millions)

$45.89

9.52

4.56

20.41

Expenditures in

fiscal year 2003

(in millions)

Total $63.52

Information Assurance 19.72

Enterprise Information 5.90

Integration (Connectivity) 26.50

Total

(in millions)

Project

Source: DHS data.

11According to the program manager, of the $63.57 million that Congress appropriated in fiscal years 2002 and 2003, $63.52 million was

obligated to Atlas projects and the remainder ($.05 million) was reprogrammed to other ICE priorities.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 26 GAO-05-805 Information Technology

19

Background

Planned Use of Fiscal Year 2004 Funding

According to the fiscal year 2004 expenditure plan, the $9.8 million will be spent on five

projects that are immediate needs of the program.

0 • None. Electronic Access and EGovernment12

Information Assurance 0 • None.

Total $9.82

1.92

.25

.75

3.4

$3.5

FY 04 Funds (in millions)

• Acquire program office support staff.

• Acquire automated tool to help manage and oversee projects,

including cost, schedule, and performance.

• Study how to streamline procurement processes.

Transformation Planning

• Begin developing data repository and Enterprise Query

capability.

• Convert selected existing administrative applications (e.g., time 

and attendance) to Web-based environment.

Enterprise Information

• Develop laboratory to test and evaluate to-be-acquired desktop

computers and other equipment. Infrastructure Engineering

• Connect new ICE organizations’ systems to bureau’s

communications network.

• Develop solution and implementation plan for optimizing

performance of connections.

Integration (Connectivity)

• Acquire and deploy e-mail application to ICE organizations.

• Implement Active Directory.

• Develop plan for acquiring desktop computers.

Common Computing Environment

Project Planned Use

Source: DHS data.

12According to the program manager, the project Electronic Access and E-Government was recently merged with Enterprise Information.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 27 GAO-05-805 Information Technology

20

Objective 1 Results

Legislative Conditions

The Atlas expenditure plan satisfies each of the legislative conditions.

Condition 1 Satisfied. The expenditure plan, including related program

documentation and statements from the program manager, either satisfies or

provides for satisfying the capital planning and investment control review

requirements established by OMB, including Circular A-11, part 3,13 which

establishes policy for planning, budgeting, acquisition, and management of federal 

capital assets.

Examples of our analysis are in the following table. As the table shows, not all OMB 

requirements have been satisfied, but oral commitments have been made for doing

so. Given that ICE has reportedly already invested $63.52 million on Atlas projects 

and plans to invest another $9.8 million this year, it is important for ICE to follow

through on these commitments.

13Capital investment and control requirements are now found in OMB Circular A-11, part 7, rather than part 3.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 28 GAO-05-805 Information Technology

21

Objective 1 Results

Legislative Conditions

Examples of OMB Circular A-11

requirements Results of our findings

Indicate whether the investment was

approved by an investment review committee.

The plan was approved on November 16, 2004, by the ICE IRB chair and 

on January 12, 2005, by the chief information officer, who chairs the DHS

Enterprise Architecture Board.

Provide justification and describe acquisition

strategy.

The plan and supporting documentation justify the program on the basis

of current capability deficiencies and mission needs. However, neither

includes an analysis of costs and benefits or return on investment. These

documents also provide some aspects of a high-level acquisition

strategy, such as identifying the five contracts that have been, and are to 

be used to acquire hardware and software products and program support

services. The program manager stated that a current cost-benefit

analysis and a more detailed acquisition strategy will be developed once 

expenditure plan funds become available.

Summarize life cycle costs and cost-benefit

analysis, including the return on investment.

The program does not have a current life-cycle cost estimate nor a

current cost-benefit analysis showing return on investment. Program

officials stated they intend to revise and update by September 2005

Atlas’s cost-benefit and other analyses (dated 2002). However, the

officials did not have documentation defining how this was to be

accomplished. The program manager stated that a current cost and

benefit analysis will be developed once expenditure plan funds become

available.14

Provide performance goals and measures. The plan and supporting documentation identify one preliminary

performance metric for each of Atlas’s planned projects. According to the

program manager, these are the program’s initial performance measures

and additional measures, linked to program goals, will be developed once

expenditure plan funds become available. Performance goals and

measures were not used to track the $63 million invested in Atlas during

fiscal years 2002 and 2003.14

14These areas are more fully discussed in the observation sections of the briefing.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 29 GAO-05-805 Information Technology

22

Objective 1 Results

Legislative Conditions

Examples of OMB Circular A-11

requirements Results of our findings

Address security and privacy. The plan and supporting documentation state the importance of security

and privacy and provide high-level information on intended security

measures, including one proposed project—Information Assurance—that

is intended to implement a bureauwide security program. In addition, ICE

has a December 2003 bureau-wide security plan. However, plans for the 

Information Assurance project have not been developed, and the

expenditure plan does not allocate any fiscal year 2004 funding to the

project. Further, ICE’s December 2003 bureauwide security plan does not

mention Atlas or the Information Assurance project. Moreover, ICE has 

not developed an Atlas privacy impact assessment. According to the

program manager, ICE intends to update the security plan and prepare a 

privacy impact assessment, but existing plans do not provide for how and

when this will be accomplished.

Provide risk inventory and assessment. Assessments performed on risks were via ad hoc meetings. A draft risk

management plan was developed from these meetings and the plan

contains an inventory of risks. It does not, however, identify, among other

things, how the risks will be monitored. The Atlas program manager

stated that the program office is in the process of developing more

effective risk management and oversight processes and intends to add a

risk analyst position when Atlas funding is received.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 30 GAO-05-805 Information Technology

23

Objective 1 Results

Legislative Conditions

Condition 2 Satisfied. The plan, including related program documentation and 

DHS officials’ statements, either satisfies or provides for satisfying the condition

that the department ensure Atlas is compliant with DHS’s enterprise architecture

(EA).

An EA provides a clear and comprehensive picture of an organization’s

operations and its supporting systems and infrastructure. It is an essential tool for 

effectively and efficiently engineering business processes and for implementing

and evolving supporting systems in a manner that maximizes interoperability,

minimizes overlap and duplication, and optimizes performance. We have worked 

with the Congress, OMB, and the federal Chief Information Officers Council to 

highlight the importance of architectures for both organizational transformation

and IT management. An important element of EA management is ensuring that IT 

investments are compliant with EA, including basing such assessments on

documented analysis.

On August 6, 2004, we reported on version 1.0 of DHS’s EA, stating that DHS’s

initial EA provides a partial foundation but was missing key elements expected to 

be found in a well-defined architecture.15 DHS has since developed version 2.0 of 

its EA. We have not reviewed this version of DHS’s EA.

15GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: 

August 6, 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 31 GAO-05-805 Information Technology

24

Objective 1 Results

Legislative Conditions

DHS’s Enterprise Architecture Board and Enterprise Architecture Center of

Excellence16 are responsible for determining whether programs comply with the

EA. On December 8, 2004, Atlas’s program manager requested the center to 

assess the program’s compliance with the EA. On January 10, 2005, the center

reported the results of its assessment to the board, stating that Atlas was in 

compliance. On January 12, 2005, the board approved this compliance

determination.

The center based its determination on documentation submitted by the program 

manager and discussions among center staff, including officials from DHS’s

Infrastructure Transformation Office and IT Security Office. However, the 

determination was not based on documented analysis mapping Atlas’s

infrastructure architecture to the EA. Such analysis is necessary to make 

informed alignment determinations. According to the center’s chair, who also

serves as DHS’s chief architect, because Atlas is in the early stages of its lifecycle and therefore is not very well defined, such an analysis was not required,

and when Atlas is more defined, a thorough and documented analysis will be 

performed.

16A review group made of subject manner experts that recommends EA compliance to the DHS Enterprise Architecture Board and ultimately to the 

DHS IRB.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 32 GAO-05-805 Information Technology

25

Objective 1 Results

Legislative Conditions

Given the critical role that Atlas is to play in contributing to DHS’s strategic

information sharing and interoperability goals, it is important for ICE and DHS to 

follow through on the stated provision to base future Atlas compliance

determinations on documented and verifiable analysis.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 33 GAO-05-805 Information Technology

26

Objective 1 Results

Legislative Conditions

Condition 3 Satisfied. The plan, including related program documentation and 

statements from the Atlas program manager, either satisfies or provides for

satisfying the condition to comply with the acquisition rules, requirements,

guidelines, and systems acquisition management practices of the federal 

government. These practices provide a management framework based on the use 

of rigorous and disciplined processes for planning, managing, and controlling the 

acquisition of IT resources, including:

• acquisition planning, which ensures, among other things, that reasonable

plans, milestones, and schedules are developed and that all aspects of the 

acquisition effort are included in these plans;

• solicitation, which involves making sure that a request for proposal that 

delineates a project’s requirements is prepared and, consistent with 

relevant solicitation laws and regulations, that a contractor is selected that

can most cost-effectively satisfy these requirements;

• requirements development and management, which includes establishing

and maintaining a common and unambiguous definition of requirements

among the acquisition team, the system users, and the development

contractor;
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 34 GAO-05-805 Information Technology

27

Objective 1 Results

Legislative Conditions

• project management, provides for management of the activities within the 

project office and supporting contractors to ensure a timely, efficient, and 

cost-effective acquisition;

• contract tracking and oversight, which ensures that the development

contractor performs according to the terms of the contract; needed contract

changes are identified, negotiated, and incorporated into the contract; and

contractor performance issues are identified early, when they are easier to 

address; and

• evaluation, which determines whether the acquired products and services 

satisfy contract requirements before acceptance.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 35 GAO-05-805 Information Technology

28

Objective 1 Results

Legislative Conditions

These acquisition management processes are also embodied in published best 

practices models, such as the Software Engineering Institute (SEI)’s Software 

Acquisition Capability Maturity Model®.

17 Examples of our analysis of ICE 

performance of these processes and practices are shown on the following table. 

They show that not all aspects of the processes and practices have been

implemented, but that oral commitments have been made for doing so. Given that 

ICE has already invested $63.52 million on Atlas projects and plans to invest

another $9.8 million this year, it is important for ICE to follow through on these

commitments.

17Developed by Carnegie Mellon Software Engineering Institute (SEI), Software Acquisition Capability Maturity Model (SA-CMM®), Version

1.03 (March 2002).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 36 GAO-05-805 Information Technology

29

Objective 1 Results

Legislative Conditions

Examples of practices Results of our analysis

Acquisition planning18

Ensures that reasonable

planning for the acquisition

is conducted including,

among other things,

developing an acquisition

strategy and plan,

determining the cost and

schedule, and identifying

risks, and defining

requirements.

The expenditure plan and supporting documents (e.g., the fiscal year 2005 Atlas budget

submission to OMB known as an Exhibit 300) provide aspects of a high-level acquisition

strategy, such as identifying the five contracts that have been, and are to be used, to acquire

products and program support services. According to the program manager, a detailed

acquisition strategy will be developed when expenditure plan funds become available and

current program life cycle cost and schedule estimates will be developed by September 2005.

A draft risk management plan for the program has been developed that contains an inventory

of risks, and according to the fiscal year 2004 expenditure plan and the Atlas program

manager, the program will follow the bureau’s 2002 System Development Life Cycle, which we

have previously reported addresses key system acquisition planning and requirements

definition activities. 19

Project management20

Provides for the

management of activities

within the project office

and supporting contractors

to ensure a timely,

efficient, and cost-effective

acquisition.

ICE has begun to establish a program office with responsibility for managing the acquisition,

deployment, operation, and sustainment of Atlas. However, current staffing consists of a 

program manager and three contractor support staff, leaving key program office positions not

staffed (e.g., project managers, EA analyst, business analyst, risk analyst). The expenditure

plan states that the program office will comply with the bureau’s 2002 System Development

Life Cycle, which includes activities to promote a timely, efficient, and cost-effective

acquisition, such as implementing key acquisition management processes advocated by 

Software Engineering Institute’s acquisition model, and monitoring progress through monthly

reports on project cost, schedule, and performance.

18For example see, Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model (SA-CMM®), Version 1.03

(March 2002).

19For example see, GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-

563 (Washington, D.C.: June 9, 2003).

20For example see, Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model (SA-CMM®), Version 1.03 

(March 2002).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 37 GAO-05-805 Information Technology

30

Objective 1 Results

Legislative Conditions

Condition 4 Satisfied. DHS and OMB satisfied the legislative condition requiring

that the plan be reviewed and approved by the ICE IRB, DHS, and OMB. 

• The ICE IRB chair approved the fiscal year 2004 expenditure plan on

November 16, 2004.

• The DHS chief information officer, who also chairs the Enterprise Architecture

Board, approved the plan on January 12, 2005.

• OMB approved the plan on January 4, 2005.

Condition 5 Satisfied. GAO satisfied the condition that it review the plan.

Our review was completed on May 5, 2005.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 38 GAO-05-805 Information Technology

31

Objective 2 Results

Observations: Economic Justification

Observation 1: Economic justification does not reflect recent and planned changes 

in the program’s scope and purpose.

Cost-benefit analyses are essential tools for making informed program investment

selection and control decisions and for establishing the return on investment

benchmark against which to measure whether investments are delivering intended

business value. Accordingly, the Clinger-Cohen Act, OMB guidance,21 and

investment management best practices recognize the importance of having reliable

and current cost-benefit analyses.

INS developed an analysis of Atlas’s costs and benefits in 2002. The analysis

estimated that the program would cost about $800 million to implement over a 6-

year period and would provide benefits of approximately $1.1 billion dollars,

primarily through better system response times and reduced operations and

maintenance costs, as shown in the following figure.

21Clinger-Cohen Act of 1996, 40 U.S.C. 11101-11704; and Office of Management and Budget (OMB) Circular A-130, Management of 

Federal Information Resources (November 30, 2000).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 39 GAO-05-805 Information Technology

32

Objective 2 Results

Observations: Economic Justification

Sources of Atlas program benefits

As we have previously reported,22 it is important for cost-benefit analyses to be 

updated to reflect material changes to a program’s scope, purpose, cost, 

timeframes, etc., so that agency officials will have a reliable basis for program

investment decisions.

22For example, see GAO, Information Technology: Greater Use of Best Practices Can Reduce Risks in Acquiring Defense Health Care 

System, GAO-02-345 (Washington, D.C.: September 26, 2002).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 40 GAO-05-805 Information Technology

33

Objective 2 Results

Observations: Economic Justification

Observation 1: Cont.

Since ICE became responsible for Atlas in 2003, the bureau has materially

changed the program’s scope, purpose, and priorities. Specifically, Atlas was

expanded to

• support additional law enforcement units (and their business requirements)

that were merged into ICE (e.g., Federal Air Marshals Service, Federal 

Protective Service, Customs investigations, Customs intelligence); and

• provide the flexibility to support new ICE priorities (e.g., integrating future 

anti-terrorism programs and projects, facilitating information sharing with 

domestic and international law enforcement organizations).

In addition, the program manager said that the program is to include efforts to 

streamline and reengineer core business functions with the application of 

information technology. According to this official, details of these efforts are to be 

defined in the fiscal year 2005 Atlas expenditure plan.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 41 GAO-05-805 Information Technology

34

Objective 2 Results

Observations: Economic Justification

Observation 1: Cont.

According to the Atlas program manager, the cost benefit analysis has not yet been 

revised to reflect changes to the program’s scope and purpose because doing so 

has not been a priority. According to the fiscal year 2004 expenditure plan, revising 

the analysis is a “next step” to be taken. However, existing plans do not identify a 

date for doing so. The program manager stated that a current cost-benefit analysis

will be developed once funds provided for in the expenditure plan become

available. He also stated that the goal is to have a contractor complete an updated

cost benefit analysis on or about September 30, 2005. 

Until the cost benefit analysis is revised to reflect recent and planned changes to 

the program, DHS will not have a reliable basis for making informed Atlas 

investment decisions.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 42 GAO-05-805 Information Technology

35

Objective 2 Results

Observations: Program Management Controls and Capabilities

Observation 2: Program management controls and capabilities have yet to be 

established.

As we have previously reported,23 the success of major modernization programs

such as Atlas depends on having an operational program office that has, among 

other things, effectively implemented rigorous and disciplined program

management process controls and adequately filled key human capital positions.

Two activities key to strategically managing human capital are performing staffing 

needs assessments and defining staff roles and responsibilities.

The SEI’s Software Acquisition Capability Maturity Model (SA-CMM®)24 has defined

a suite of key acquisition process areas that are necessary to manage the system

acquisition program in a rigorous and disciplined fashion. As described earlier in 

the briefing, these process areas include:

• acquisition planning,

• solicitation,

• requirements development and management,

• project management, 

• contract tracking and oversight, and

• evaluation. 23 For example, see GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563

(Washington, D.C.: June 9, 2003).

24 Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model (SA-CMM®), Version 1.03 (March 2002).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 43 GAO-05-805 Information Technology

36

Objective 2 Results

Observations: Program Management Controls and Capabilities

Observation 2: Cont.

ICE has begun to establish an Atlas program office. For example, the bureau has 

drafted a management structure and plan, which includes staff roles and 

responsibilities. However, the structure and plan are currently being reviewed by 

ICE management and the program office is not yet operational. Moreover, while

key acquisition management processes have been defined in the System 

Development Life Cycle methodology, which our previous work25 has shown

adequately defines the critical management processes needed to successfully 

acquire systems, the program office has yet to implement these processes.

25 For example, see GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563

(Washington, D.C.: June 9, 2003).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 44 GAO-05-805 Information Technology

37

Objective 2 Results

Observations: Program Management Controls and Capabilities

Observation 2: Cont.

In addition, the program office is not adequately staffed.26 Currently, the office has 

staffed the program manager position and it has three contracting staff performing 

such functions as developing staffing needs assessments and other program

management related activities. Further, while the program manager recently

assessed staffing needs for program support positions (e.g., financial management,

contracting, EA), he has not yet determined the staffing needs for five Atlas 

projects. Specifically, the program manager recently asked, and the project

managers provided estimates of, staffing needed, but these estimates were not 

based on an estimating methodology or staffing needs assessment. Instead, the 

project managers provided estimates of the staff that could be obtained given the 

funding provided in the plan. Moreover, of the seven program support positions that 

the program has determined it needs, none have been filled. (The figure on the

next slide shows the proposed office structure, along with the organizational areas

where staffing needs have and have not been assessed, and where staffing needs 

have and have not been filled.)

26According to the program manager, Atlas staff were transferred to the US-Visitor and Immigrant Status Indicator Technology program in 2003, 

which is managed by the DHS Under Secretary for Border and Transportation Security.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 45 GAO-05-805 Information Technology

38

Objective 2 Results

Observations: Program Management Controls and Capabilities

Observation 2: Cont. Proposed Program Management Office

27Government full-time employees

28Contracting full-time employees

29According to the program manager, the staff for the Transformation Planning project also serve as the staff for the program office.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 46 GAO-05-805 Information Technology

39

Objective 2 Results

Observations: Program Management Controls and Capabilities

Observation 2: Cont.

The program manager attributes the state of the program office, including controls 

and capabilities, to competing DHS priorities. He stated that ICE plans to 

strengthen program management controls and capabilities once funds provided for 

in the expenditure plan are available. In particular, he cited two projects

(Transformation Planning and Infrastructure Engineering) in the expenditure plan 

that have this goal. However, existing program documentation does not describe

how and when these projects are to achieve this goal. Moreover, it should be noted 

that of the $63.52 million obligated for Atlas in fiscal years 2002 and 2003,

$900,000 (or about 1.4 percent of the total) was obligated for these two projects.

While the current expenditure plan proposes investing $2.17 of the $9.8 million on 

these two projects, this still represents but 4 percent of the $73.37 million Atlas

funding to date going to improving program management. By contrast, our work on 

other IT modernization programs, such as US-VISIT, shows that roughly 19 percent

was invested in program management.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 47 GAO-05-805 Information Technology

40

Objective 2 Results

Observations: Program Management Controls and Capabilities

Observation 2: Cont.

Until the above program management controls and capabilities are in place and

functioning, ICE faces the increased likelihood that Atlas will not meet its objectives 

on schedule and within budget.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 48 GAO-05-805 Information Technology

41

Objective 2 Results

Observations: Performance Goals and Measures

Observation 3: Program goals, expected benefits, and reported achievements are 

not fully aligned.

The Clinger-Cohen Act30 requires the use of effective IT management practices,

including measuring the contributions of IT investments to achieving agency

mission outcomes. To this end, OMB states31 that agencies should, among other 

things

• establish program performance goals and expected benefits,

• develop outcome-based measures to assess actual program performance (i.e., 

achievements) against expected benefits, and

• ensure that goals, expected benefits, and achievements are properly aligned.

30Clinger-Cohen Act of 1996, Public Law 104-106; and Office of Management and Budget (OMB)

Circular A-130, Management of Federal Information Resources (November 30, 2000).

31OMB Circular No. A-11, Part 7 (revised July 2004).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 49 GAO-05-805 Information Technology

42

Objective 2 Results

Observations: Performance Goals and Measures

Observation 3: Cont.

The Atlas expenditure plan and documentation show that the program has defined

goals and expected benefits and has reported actual achievements accomplished

during 2002 and 2003. The stated goals include:

• enhancing productivity, and

• assuring integrity, security, and privacy of information and data assets, and

• promoting information sharing and collaboration.

The stated benefits include:

• better response time,

• reduced operations/maintenance costs,

• improved reliability, and

• enhanced help desk operations.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 50 GAO-05-805 Information Technology

43

Objective 2 Results

Observations: Performance Goals and Measures

Observation 3: Cont.

In addition, examples of stated achievements are

• purchased Active Directory hardware and software for the e-mail system, 

• initiated an interim Security Operations Center, and 

• developed a data encryption approach for the network.

However, the relationships among goals, benefits, and achievements have not 

been defined, and are not otherwise apparent in all cases. For example, it is not 

clear how the following reported achievements relate to Atlas goals. 

• improving the capacity of the network,

• implementing tools to monitor network performance, and 

• completing an Enterprise Information Concept of Operations document. 

Moreover, the reported achievements are not expressed in terms of measurable

outcomes or results, but rather as activities completed.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 51 GAO-05-805 Information Technology

44

Objective 2 Results

Observations: Performance Goals and Measures

Observation 3: Cont.

The program manager stated that the 2002 and 2003 achievements were not 

analyzed and aligned to program goals and benefits and outcome-based measures

were not developed because the emphasis at the time was on buying and

deploying long-overdue infrastructure upgrades as quickly as possible. However,

he also stated that the program intends to define, ensure, and disclose the linkage

among program goals, benefits, and results in the future. To this end, the program 

manager stated that one performance measure for each project has been defined

as a starting point and that other outcome-based performance measures will be

defined and used to assess program progress. However, existing program plans

and documentation do not specify how and when this will be done.

The program manager also told us that the state of Atlas’s performance practices

are due to competing DHS priorities limiting the resources that have been devoted

to the program. Until the program aligns its goals, benefits, and performance

measures, it will not have the necessary means for measuring progress, ensuring

accountability, and making well-informed investment decisions.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 52 GAO-05-805 Information Technology

45

Objective 2 Results

Observations: Expenditure Plan Lacks Detail

Observation 4: Fiscal year 2004 expenditure plan does not provide sufficient

information on program commitments to permit effective congressional oversight.

As we have previously reported,32 the legislative requirement to submit expenditure

plans for major IT modernization programs, like Atlas, to the Appropriations

Committees is intended to provide lawmakers with a sufficient understanding of the 

programs to permit informed decision-making about the use of the appropriated

funds and provide a mechanism for holding the agency accountable for results. Our 

prior experience in working with Congress and other agencies on developing and 

implementing expenditure plans shows that these plans need to disclose a 

sufficient level and scope of information for Congress to understand what the 

system capabilities and benefits are to be delivered, by when, at what cost, and 

what progress is being made against the commitments.

The Atlas expenditure plan does not show the level of detail and scope of the 

program for Congress to understand its plans and commitments relative to system

capabilities, cost, benefits, and schedule. Further, it does not sufficiently describe

progress made against program commitments (e.g., expected benefits).

32For example, see GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563

(Washington, D.C.: June 9, 2003).
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 53 GAO-05-805 Information Technology

46

Objective 2 Results

Observations: Expenditure Plan Lacks Detail

Observation 4: Cont.

Instead, the expenditure plan and supporting documentation describe, for example,

high-level system capabilities to be delivered under each project, planned

expenditure aggregated by project (not linked to system capabilities). It does not 

link planned expenditures to system capabilities, set milestones for delivery of 

system capabilities, or discuss benefits to be realized as a result of planned system 

investments.

According to the Atlas program manager, the state of the plan reflects the 

program’s uncertainty about the appropriate level of detail in expenditure plans.

This official also stated that future plans will reflect GAO’s published work on the 

content of program expenditure plans. If it does not, the Congress will not have

essential information needed to make informed decisions about expenditure plan

approval and to oversee progress.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 54 GAO-05-805 Information Technology

47

Conclusions

The fiscal year 2004 Atlas expenditure plan, in combination with related program

documentation and program officials’ statements, satisfies the legislative conditions

set forth by Congress. However, this satisfaction is based on plans and

commitments that provide for meeting these conditions, rather than on completed

actions to satisfy the conditions. As such, much remains to be accomplished before 

Atlas planning and management efforts can be considered effective and thereby

minimize the risks associated with the program’s capacity to deliver promised IT 

infrastructure capabilities and benefits on time and within budget.

The current state of planning and management puts the program at risk. While this 

is partially due to events beyond the program’s control, such as the department’s

decision to reprogram Atlas funding and to redeploy Atlas staff to competing DHS 

priorities, as well as changes to the program’s scope and purpose when it 

transitioned from INS to ICE, it is also due to the program’s decision to not use 

fiscal year 2002 and 2003 funds to invest in program management capabilities.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 55 GAO-05-805 Information Technology

48

Conclusions

Given that more than $60 million has been reportedly obligated to date on the 

program, resources have been available to strengthen planning and management

capabilities in key areas, but investment in these areas has been deferred. Deferral

of establishing such program planning and management controls and capabilities,

such as having reliable and current economic justification for the program, a

capable program office, and clearly aligned program goals, benefits, and 

performance measures, introduce unnecessary risk to the program.

Moreover, not providing congressional decision-makers with the information that 

they need about program commitments to be met with the expenditure plan funds, 

including the benefits to be produced, the capabilities to be delivered, and the cost 

and schedule estimates to be met, impedes congressional oversight.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 56 GAO-05-805 Information Technology

49

Recommendations for Executive Action

To minimize risks to the Atlas program, we recommend that the Secretary of

Homeland Security, through the Under Secretary for Border and Transportation

Security, direct the Assistant Secretary for Immigration and Customs Enforcement 

to ensure that ICE follows through on commitments to implement effective 

management controls and capabilities by

• Revising and updating the cost-benefit analysis to identify current mission 

requirements, how they will be met, and an estimate of the program’s 

incremental and life-cycle costs, benefit, schedule, and return on investment.

This should also include establishing plans, associated tasks, and milestones

for accomplishing this effort. 

• Making the Atlas program office operational by (1) developing a staffing needs

assessment to determine the positions and the level of staffing needed for all 

projects to adequately manage the program, including a human capital

strategy for acquiring the staff and a timetable for bringing them on board; (2) 

finalizing the roles and responsibilities for the positions identified in the staffing 

assessment and for the projects; and (3) implementing and institutionalizing

key acquisition management controls, including risk management processes

where relevant responsibilities are assigned and key risks and their status are 

reported to an executive body.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 57 GAO-05-805 Information Technology

50

Recommendations for Executive Action

• Developing and implementing an updated Atlas security plan and privacy

impact assessment. This should also include establishing plans, associated

tasks, and milestones for accomplishing this effort.

• Developing and implementing rigorous performance management practices for 

the Atlas program that include properly aligned goals, benefits, and

achievements, and anticipated achievements that are defined in measurable

terms. This should also include establishing plans, associated tasks, and 

milestones for accomplishing this effort.

• Ensuring that future expenditure plans fully disclose the system capabilities,

schedule, cost-benefits to be delivered, as well as the acquisition strategy for 

Atlas.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 58 GAO-05-805 Information Technology

51

Agency Comments

In providing oral comments on a draft of this briefing, ICE’s chief information officer 

and the Atlas program manager agreed with our findings and conclusions and

stated that our recommendations were reasonable. They also provided technical

comments, which we incorporated in the briefing as appropriate.
Appendix I

Briefing to the Staffs of the Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations

Page 59 GAO-05-805 Information Technology

52

Attachment I

Scope and Methodology

To accomplish our objectives, we

• analyzed the fiscal year 2004 Atlas expenditure plan and supporting documents against

legislative conditions and other relevant federal requirements, guidance, and best

practices to determine whether the conditions were met, and in doing so, considered the 

conditions met when the expenditure plan, including supporting program documentation

and program officials’ representations, either satisfied or provided for satisfying the

conditions, and 

• assessed supporting documentation and interviewed program and other involved ICE

and DHS officials to determine capabilities in key program management areas, such as 

• acquisition planning,

• enterprise architecture,

• project management,

• human capital planning, and 

• risk management.

For DHS data that we did not substantiate, we have made appropriate attribution indicating

that data’s source.

We conducted our work at ICE and DHS headquarters in Washington, D.C. from March 2005 

through May 2005 in accordance with generally accepted government auditing standards.
Page 60 GAO-05-805 Information Technology

Appendix II

Comments from the U.S. Department of 

Homeland Security ApendxiI
Appendix II

Comments from the U.S. Department of 

Homeland Security

Page 61 GAO-05-805 Information Technology
Appendix II

Comments from the U.S. Department of 

Homeland Security

Page 62 GAO-05-805 Information Technology
Page 63 GAO-05-805 Information Technology

Appendix III

GAO Contact and Staff Acknowledgments ApendxiI

GAO Contact Randolph C. Hite, (202) 512-3439

Staff 

Acknowledgments

In addition to the individual named above, Gary Mountjoy, Assistant 

Director; Nancy Glover; James Houtz; and Tammi Nguyen made key 

contributions to this report.

(310605)
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

Obtaining Copies of 

GAO Reports and 

Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go to 

www.gao.gov and select “Subscribe to Updates.”

Order by Mail or Phone The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to:

U.S. Government Accountability Office

441 G Street NW, Room LM

Washington, D.C. 20548

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Contact:

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Congressional 

Relations

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548

Public Affairs Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548