U.S. GOVERNMENT PUBLISHING OFFICE

37–281 PDF WASHINGTON : 2019

FITARA 8.0 

HEARING 

BEFORE THE

SUBCOMMITTEE ON GOVERNMENT OPERATIONS 

OF THE

COMMITTEE ON OVERSIGHT 

AND REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED SIXTEENTH CONGRESS 

FIRST SESSION 

JUNE 26, 2019 

Serial No. 116–40 

Printed for the use of the Committee on Oversight and Reform 

( 

Available on: http://www.govinfo.gov 

http://www.oversight.house.gov or 

http://www.docs.house.gov 
(II) 

COMMITTEE ON OVERSIGHT AND REFORM 

ELIJAH E. CUMMINGS, Maryland, Chairman 

CAROLYN B. MALONEY, New York 

ELEANOR HOLMES NORTON, District of 

Columbia 

WM. LACY CLAY, Missouri 

STEPHEN F. LYNCH, Massachusetts 

JIM COOPER, Tennessee 

GERALD E. CONNOLLY, Virginia 

RAJA KRISHNAMOORTHI, Illinois 

JAMIE RASKIN, Maryland 

HARLEY ROUDA, California 

KATIE HILL, California 

DEBBIE WASSERMAN SCHULTZ, Florida 

JOHN P. SARBANES, Maryland 

PETER WELCH, Vermont 

JACKIE SPEIER, California 

ROBIN L. KELLY, Illinois 

MARK DESAULNIER, California 

BRENDA L. LAWRENCE, Michigan 

STACEY E. PLASKETT, Virgin Islands 

RO KHANNA, California 

JIMMY GOMEZ, California 

ALEXANDRIA OCASIO-CORTEZ, New York 

AYANNA PRESSLEY, Massachusetts 

RASHIDA TLAIB, Michigan 

JIM JORDAN, Ohio, Ranking Minority Member 

JUSTIN AMASH, Michigan 

PAUL A. GOSAR, Arizona 

VIRGINIA FOXX, North Carolina 

THOMAS MASSIE, Kentucky 

MARK MEADOWS, North Carolina 

JODY B. HICE, Georgia 

GLENN GROTHMAN, Wisconsin 

JAMES COMER, Kentucky 

MICHAEL CLOUD, Texas 

BOB GIBBS, Ohio 

RALPH NORMAN, South Carolina 

CLAY HIGGINS, Louisiana 

CHIP ROY, Texas 

CAROL D. MILLER, West Virginia 

MARK E. GREEN, Tennessee 

KELLY ARMSTRONG, North Dakota 

W. GREGORY STEUBE, Florida 

DAVID RAPALLO, Staff Director 

WENDY GINSBERG, Subcommittee Staff Director 

YVETTE BADU-NIMAKO, Director of Policy and Counsel 

JOSHUA ZUCKER, Assistant Clerk 

CHRISTOPHER HIXON, Minority Staff Director 

CONTACT NUMBER: 202-225-5051 

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

Gerald E. Connolly, Virginia, Chairman 

Eleanor Holmes Norton, District of Columbia, 

JOHN SARBANES, Maryland 

JACKIE SPEIER, California 

BRENDA LAWRENCE, Michigan 

STACEY PLASKETT, Virgin Islands 

RO KHANNA, California 

STEPHEN LYNCH, Massachsetts 

JAMIE RASKIN, Maryland 

Mark Meadows, North Carolina, Ranking 

Minority Member 

THOMAS MASSIE, Kentucky 

JODY HICE, Georgia 

GLENN GROTHMAN, Wisconsin 

JAMES COMER, Kentucky 

RALPH NORMAN, South Carolina 

W. STEUBE, Florida 
(III) 

C O N T E N T S 

Page 

Hearing held on June 26, 2019 ............................................................................... 1 

WITNESSES

Ms. Suzette Kent, Federal Chief Information Officer, Office of Management 

and Budget 

Oral Statement ........................................................................................................ 3 

Ms. Carol Harris, Director, IT Management Issues, Government Accountability Office 

Oral Statement ........................................................................................................ 4 

Mr. Gary Washington, Chief Information Officer, U.S. Department of Agriculture 

Oral Statement ........................................................................................................ 18 

Mr. Jason Gray, Chief Information Officer, U.S. Department of Education 

Oral Statement ........................................................................................................ 20 

Mr. Eric Olson, Chief Information Officer, U.S. Department of the Treasury 

Oral Statement ........................................................................................................ 21 

Written opening statements and statements for the witnesses are available 

on the U.S. House of Representatives Document Repository at: https:// 

docs.house.gov. 

No additional documents were entered into the record during this hearing. 

(1) 

FITARA 8.0 

Wednesday, June 26, 2019 

HOUSE OF REPRESENTATIVES

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

COMMITTEE ON OVERSIGHT AND REFORM

Washington, D.C. 

The subcommittee met, pursuant to notice, at 4:07 p.m., in room 

2154, Rayburn House Office Building, Hon. Gerald E. Connolly 

(chairman of the subcommittee) presiding. 

Present: Representatives Connolly, Norton, Khanna, Meadows, 

Massie, Grothman, and Jordan. 

Mr. CONNOLLY. The subcommittee will come to order. And without objection, the chair is authorized to declare a recess of the committee at any time. 

This subcommittee is convening our eighth biannual hearing to 

assess FITARA, the Federal Information Technology Acquisition 

Reform Act, and other information technology laws. 

I want to recognize our two witnesses on the first panel. Very 

brief—I’m going to recognize myself very briefly for an opening 

statement. 

FITARA, from our point of view, is a tool that can be used for 

change agents within Federal agencies to come into the 21st century to make ourselves more efficient, to achieve economies, to improve productivity and morale while also better serving the American people. Not doing that has huge costs including compromising 

data, big data bases that we are charged as the Federal Government with protecting. And so after we passed FITARA, we wanted 

to make sure that what happened to FITARA was not what happened with Clinger-Cohen, its predecessor law, where both authors 

of the legislation left Congress, and there was really nobody who 

felt they were vested in making sure that law did what it was intended to do. We wanted to make sure that did not happen. 

And so I think by now it’s pretty clear that our committee is as 

committed as ever to insisting on implementation of the law. We 

create a scorecard working with GAO that’s designed to incentivize 

that cooperation and that reform so that we can achieve all of the 

valued goal, as I just enunciated. It’s not designed to burn a scarlet 

letter on an agency’s back or a CIO’s back. It is designed to be a 

tool to incentivize change for the good. And that’s the spirit in 

which we are going to have today’s hearing. 

We are glad that there are agencies that are showing steady 

progress. And we believe that there are some agencies that would 

show even more progress had they not fallen back on the CIO reporting sequence in the organization chart or if they had, in fact, 
2 

adopted that as a reform. We want to see a reporting sequence that 

makes sure that the chief CIO is reporting to the boss. And that’s 

our goal. And you get scored on that if you’re not doing it. 

So anyway, we’re going to get on with the hearing. I want to 

thank everyone for their patience with the House schedule, both 

this subcommittee and the floor votes. Sorry to keep everybody 

waiting, but that was beyond my control or Mr. Meadows’ control. 

And it now gives me great pleasure to recognize my friend, the 

distinguished ranking member and the former chairman of this 

subcommittee, and my partner in crime, Mr. Meadows. 

Mr. MEADOWS. Thank you, Mr. Chairman. Thank you for your 

leadership. I’m going to be extremely brief because of the lateness 

of the hour. 

Thank you both for being here. Some of you have made recommendations in terms of direct reports on CIOs. I can tell you 

that, having a conversation with NASA, I think they’re going to address that. And so the bottom line, we’re paying very close attention to it. We’re working in a bipartisan fashion. We want everybody to understand the score cards are meaningful to us, and eventually they’re going to be meaningful to the agencies because we’re 

working to attach dollars both as penalties and rewards to that, because I believe that if you’re getting good responses, you ought to 

be rewarded. 

I can tell you that I took a visit over to OPM the other day. And 

the way that we’re doing Federal benefits is archaic. We have got 

to change that. And I am willing—you know, this fiscally conservative Republican is willing to spend money to get it done. So this 

is a critical piece. 

And with that, thank you both for coming to testify. Thank all 

the staff. Listen, I know the work gets done, many times without 

a lot of applause. But I want to applaud everybody who’s trying to 

make this work. And I thank the gentleman for his leadership on 

the Connolly Issa bill. 

Mr. CONNOLLY. My friend is too kind, and I thank him. 

So for our first two witnesses, we have Suzette Kent, who is the 

Federal chief information officer from the Office of Management 

and Budget. I think this is your first time before us, Ms. Kent; is 

that correct. 

Ms. KENT. This is my second. 

Mr. CONNOLLY. Second. Okay. Well, welcome back. 

And Carol Harris, who, of course, is the director of IT management issues at the Government Accountability Office. 

If you would both rise, please. We swear all of our witnesses in 

here at the committee. 

And if you’d raise your right hands, do you swear or affirm that 

the testimony you’re about to give is the truth, the whole truth, 

and nothing but the truth, so help you God. 

Let the record show that both of our witnesses answered in the 

affirmative. Thank you. 

Mr. CONNOLLY. The microphones are sensitive, so please speak 

directly into them. Without objection, your full written testimony 

will be made part of the record, so I would ask you to verbally summarize your testimony as best you can within the five-minute window. With that, Ms. Kent, over to you. 
3 

STATEMENT OF SUZETTE KENT, FEDERAL CHIEF INFORMATION OFFICER, OFFICE OF MANAGEMENT AND BUDGET 

Ms. KENT. Thank you, Chairman Connolly, Ranking Member 

Meadows, and members of the committee, thank you for having me 

here today. I’m honored to be here to discuss FITARA and technology topics that are of vital importance to empowering agencies 

to achieve their missions. As you open, FITARA is more than just 

a law and a scorecard; it serves as a vehicle for how we communicate involving priorities and a measure to demonstrate progress. 

This administration continues to emphasize the FITARA goals 

through the IT modernization goal in the President’s management 

agenda and in the executive order on CIO authorities. Our government’s ID policies must be as nimble and iterative as the global 

technology industry and the changing nature of the threat landscape we’re addressing. This intent drove our policy updates in 

2018 and 2019. 

Some of those policies had not been updated in almost a decade. 

We also sought to update how we measure success, so the council 

provided recommendations to GAO and to this Oversight Committee around how we continue to enhance the FITARA scorecard 

and continue to make it meaningful in driving progress. 

Additionally, we are focused on making metrics and measures 

data driven, publicly available, and continuous through the 

websites. We made great strides in IT modernization in the last 

two years. I’ll highlight a couple of quick examples. Increasing 

adoption of commercial cloud email from 45 percent to 72 percent. 

That’s 1.8 million mailboxes now. We closed 150 enterprise 

datacenters. 

All 23 civilian CFO act agencies have hit defined targets for data 

ex-filtration detection and 21 have met targets on mobile device security, and our technology modernization fund projects have yielded playbooks and working strategies that can be easy—easily replicated to accelerate agency systems migrations. 

We’ve updated policy on high value assets, identity and credential and access management, cloud smart, datacenter, and delivered for the first time a Federal data strategy with a one-year action plan. And in May, various agency CIOs, OMB policy leaders, 

and I met with congressional staff members of this and other committees to walk through all of those policy updates and how those 

actually drive progress forward for enhancements. The recently released cloud smart strategy is a great example of how we remove 

barriers. 

Three key areas prevented adoption of cloud and technologies 

that were addressed in the update. Security. How we move from a 

perimeter-based model to a data-centric model. Procurement. Agencies had to adjust to these new consumption-based models, and 

most important, how we address and develop the Federal work 

force to operate effectively in these new paradigms. 

It also includes a directive for agencies to develop an application 

rationalization road map. This road map is critical and it defines 

what can move to the cloud and helps inform the datacenter needs 

and helps us define those targets for what will be closed. 

The CIO Council has recently released the application rationalization playbook to help agencies achieve this task. Since 
4 

datacenter optimization is also important to this committee, I’ll 

briefly comment on a couple of pieces of division in the new policy. 

We closely studied the data collected under the original memo and 

working with agencies, we identified ways to streamline the closure 

process and clearly identify facility types that will continue to be 

needed for agency mission specific reasons. We included these 

learnings in the updated policy, which does focus on enabling aggressive closure with specific targets by agency and ensuring efficient operations where datacenters deemed to be a key mission facility that’s part of that agency’s mission. 

Last year when I testified to this committee, I highlighted work 

force challenges and any technology transformation the people that 

are charged with acquiring, deploying, and operating in that new 

environment are ultimately the key to the transformation success 

and we must invest in providing the experiences that our work 

force needs to keep their skills relevant. 

Next month we will be celebrating the graduation of our first 

Federal cyber rescaling academy and we will have kicked off our 

second cohort. These initiatives are a way that we’re investing in 

our current, dedicated, and qualified Federal employees to both enhance their careers, but simultaneously address our work force 

gaps in the technology area. 

As the reskilling model proves itself, we hope to replicate it for 

other skill areas and we endeavor to make this approach a standard operating procedure, not just a onetime special project. 

So in closing, our continued coordination with Congress is key to 

making government modern, secure, and mission ready. We know 

that the American people expect our Nation to be a world leader 

on every front including technology and cybersecurity. 

In this discussion today, we know that agencies are making 

progress, but modernization and battling cybersecurity threats are 

a continuous journey and there’s much more to do. With the support of Congress, we will continue to raise the bar in agency performance, and overall empower agencies to leverage technology to 

enable their mission, to improve the citizen services and be effective stewards of taxpayer money. 

Thank you for the opportunity today, and I look forward to answering your questions. 

Mr. CONNOLLY. Thank you, Ms. Kent. And when you go back to 

OMB, you’re going to be able to say, I’m the one person in this 

White House who went to a hearing on impeachment and subpoenas and nothing like that was discussed at all. 

Ms. KENT. Yes, sir. 

Mr. CONNOLLY. Ms. Harris? 

STATEMENT OF CAROL HARRIS, IT MANAGEMENT ISSUES, 

GOVERNMENT ACCOUNTABILITY OFFICE 

Ms. HARRIS. Chairman Connolly, Ranking Member Meadows, 

and members of the subcommittee. I’d like to thank you and your 

staff for your continued oversight on IT management and cybersecurity with this eighth set of grades. 

Overall, five agencies’ grades went up, four went down, and 11 

remained the same. HHS and NASA’s overall grades were lowered 

because their CIOs no longer report to the head or deputy of the 
5 

agency. This is also the first time in which four agencies received 

two grades, which we prepared at your request in response to 

changes to OMB’s datacenter initiative. 

I’d like to briefly comment on this and other selected areas of 

your scorecard. I’ll first start with the dashboard portfolio stat 

areas. Thirteen agencies’ grades were increased by this committee 

as a way to recognize a significant progress made in these areas 

governmentwide since scorecard 1.0 4 years ago. This progress 

would not have happened to this extent without your scorecard in 

oversight. 

I’ll turn to FISMA next, which is now included in the scorecard 

methodology. It’s inclusion had a generally negative effect as there 

were 12 agencies with either a D or an F. Only one agency, NSF, 

received an A and four received a B. 

Next, Incremental Development. This area now captures projects 

that are not primarily software development in nature such as a 

non-IT acquisition with the tech component. This change, which 

was previewed in scorecard 7.0 was suggested by the CIO Council 

and makes this area more comprehensive. As a result, we saw ten 

agencies grades in this area decrease while three agencies went up. 

And last, with respect to datacenters, you asked us to show a set 

of overall grades that use the datacenter grades from 7.0 as well 

as another set that excluded these grades entirely. If datacenter 

grades were included, HUD and EPA’s overall grades would increase and VA and SSA’s grades would decrease. The reason for 

the two sets of grades relates to OMB’s changes to its datacenter 

optimization initiative. 

Among other things, OMB’s guidance revises the classification of 

datacenters and datacenter optimization metrics. For example, 

OMB will no longer require agencies to maintain inventories of 

their smaller nontiered datacenters which make up about 80 percent of the government’s facilities. If these changes are implemented as is, the committee will lose the ability to track and measure progress in this area since the initial scorecard because the 

baseline for comparison will have changed. 

Moreover, the changes will likely slow down or even halt important progress agencies should be making to consolidate, optimize, 

and secure their datacenters. 

Mr. Chairman, this concludes my comments on the overall scorecard. I look forward to your questions. 

Mr. CONNOLLY. Thank you so much. Let me begin. Ms. Harris, 

we’re here to talk about the implementation of a law, correct? 

Ms. HARRIS. Correct. 

Mr. CONNOLLY. When it comes to datacenters, what is the language of the law? 

Ms. HARRIS. The language says that agencies should have a comprehensive datacenter inventory. 

Mr. CONNOLLY. And what’s the goal besides an inventory? 

Ms. HARRIS. The goal is to consolidate. 

Mr. CONNOLLY. Correct. That’s the verb. We say I believe in the 

law, consolidation, and optimization, but consolidation goes first 

and it means something presumably other than optimization, 

would you agree—— 

Ms. HARRIS. Yes. 
6 

Mr. CONNOLLY [continuing]. since we use both words? 

Ms. HARRIS. Yes. 

Mr. CONNOLLY. Ms. Kent, one of the concerns we have, although 

your memo delivered to us on June 25 adds some clarity that may 

be reassuring, but since we got a hearing, our concern is that when 

OMB gives guidance on optimization and exempts 80 percent of the 

datacenters from specific inventory plans, you are—you’re skirting 

the intent of the law. 

The intent of the law was always to identify how many 

datacenters we had, which was a struggle, and then cut them in 

half and then cut them in half again. That was the goal. It was 

set by your predecessor in the early years of the Obama Administration, actually. In those days I think we thought we had 1600, 

and so the goal was initially by the administration cut it to 800 

and my bill said, no, we’re going to do that again, cut it to 400. 

And that’s what we put—we didn’t put that number, but that’s— 

that was what we incorporated into FITARA. 

What we discovered was that, of course, what we got really good 

at was identifying more. And so we didn’t have 1600, we had whatever it was, Ms. Harris, 12,000, 14,000, and so at some point we 

thought, well, good that you’re getting better at counting, but the 

goal here is to be more efficient, move to the cloud, don’t have all 

these little stovepipes all over the place, and I know you share that 

goal. 

So I want to give you the opportunity to talk about, well, what 

is it that OMB is doing in emphasizing optimization and exempting 

from, sort of, our audit here 80 percent of the datacenters that 

exist because we’re afraid that whatever your intent, the consequence is we won’t capture that and we will not effectuate the 

savings the law was intended to encourage. 

Ms. KENT. Thank you for your question, sir, and the opportunity 

to talk about it. And first statement of intent is to comply with the 

law. 

Mr. CONNOLLY. We are relieved. 

Ms. KENT. You referenced changing various numbers over points 

and time, and that was one of the components of the analysis was 

that there were things that had been included that included rate 

things for printers and weather stations and things that weren’t 

necessary—MRI machines weren’t actually classified as a 

datacenter, so some of the things are trying to address what actually operates as a datacenter and we intend to close. And that is 

very specific in the new guidance. 

But we also understand and very clearly from talking with agencies, there are some reasons where we will continue to operate a 

datacenter, a super computer site, something that is needed for resiliency, special needs of agencies that we believe are very important and we want to ensure those are being operated efficiently and 

securely with the intent of this committee. 

But we also found out something else that’s included in the cloud 

strategy. One of the barriers to making progress from closing those 

remaining datacenters and the IT dashboard has the target, by Fiscal Year for each of the agencies that was developed at the agency 

level, but in some cases, the application rationalization work is not 

complete. So they don’t have an identified target for whether it’s 
7 

moving to the cloud or what we’re going to do with it, so that’s the 

part of the application rationalization playbook that’s included in 

cloud and you will hear some agencies, they’ve met their target, 

they’ve done a fantastic job, but other agencies have more work to 

do. 

Mr. CONNOLLY. How long have you worked in government? 

Ms. KENT. Sixteen months today. 

Mr. CONNOLLY. All right. So sometimes with the best of intentions and trying to be flexible, we send signals we did not intend 

to send and that’s our concern. We don’t want a rigid, mindless 

mentality, and you’ve—everything you said I can agree with and I 

know Mr. Meadows could too, but both of us come from private sector backgrounds and I also come from a public sector management 

background and I’m a big believer and I think—I know Mr. Meadows is too, in setting metrics because that’s goal setting. 

So at the end of the day, yes, we want to be flexible, but what 

we felt—and I still do feel, we’ve got to set metrics. So Agency X, 

we all agree you’ve got 340 and after some consultation and all 

that, the goal is to reduce a hundred of them because the others 

you need or cut it in half. 

Once we do that, let’s set that and hold people to that metric and 

we’re willing to work with you on that. What we obviously don’t 

want is a circumvention and a dilution of the goal and we’re nervous optimization gives a lot of wiggle room. 

And it’s easy for somebody to say I have 3,420 of them and I 

need every one of them. Every one is precious, and we’re not going 

to change a thing. Or wait you out because, after-all, you’ve used 

this weaker word optimization, which doesn’t really require me to 

do something specific and so I know that’s not your intent, but you 

hear my concern and my experience is, sometimes you’ve got to 

give very clear direction and set very explicit metrics in order to 

accomplish something. 

Ms. KENT. I hear your concern. I look forward to continuing to 

talk with the committee because I think we are being extremely explicit and actually in the opening of the guidance, it specifically 

says, any plans to open new or expand have to be approved by 

OMB as well as the closure intent is part of their strategic planning and reporting in the capital planning process. 

Mr. CONNOLLY. And as I said at the beginning, I’d be more worried but I think your memo of June 25 does, I agree, it’s reassuring 

in some ways. 

Ms. KENT. Thank you, sir. 

Mr. CONNOLLY. Not 100 percent, but maybe we’re all on the 

same page. So all right. I saw you shake your head in agreement 

about the CIO reporting to the boss and I want to give you an opportunity given your title and your position to maybe talk about 

that. I think, again, both Mr. Meadows and I know Mr. Hurd if he 

were here and Ms. Kelly if she were here, our experiences, especially in bureaucracies—and I don’t mean that in a pejorative way, 

but big, large organizations who you report to matters a lot. 

Ms. KENT. Yes, sir. 

Mr. CONNOLLY. If you report to the deputy assistant under widget manager in the bowels of the basement, everyone can figure that 

out and it’s how fascinating you’ve got an opinion about what I 
8 

should do with my IT, but I’m going to listen to him because he’s 

the assistant secretary or the secretary or whatever he is. 

When you report to the boss and everyone knows you report to 

the boss, that carries weight and we want to empower a CIO to 

have that relationship and to carry that kind of weight and make 

those kinds of decisions. I think Ms. Harris indicated that in the 

case of two agencies had they done that, they would have had A 

scores. Is that correct? 

Ms. HARRIS. Yep. That’s correct. 

Mr. CONNOLLY. Yes. So we’re missing an opportunity here. How 

can we better encourage that org chart and that hierarchy of efficient responsibility so that we’re all doing better? 

Ms. KENT. Thank you for the opportunity to comment on that. 

We do share that concern and are very focused on not just the reporting relationship from the perspective of reporting to the boss, 

but ensuring that we have technology as a mission enabler and 

they are absolutely clear with the direction from the top about 

what the priorities are and what set out to be accomplished by that 

agency. 

We shared your concerns with the agencies that moved backward, we had direct conversations with them as well, and appreciate your continued support in emphasizing that both through law, 

through guidance, and through an executive order, directives have 

been issued. We’re going to continue those conversations and I do 

believe, though, that in—it’s a conversation with GAO and some of 

the scorecard reporting relationships, there are agencies who have 

made recent changes. They recognize the intent. I’ve had opportunity to be with at least three of those agencies in conversations 

with the Secretary and the CIO with clarity around priorities, 

budget, and resource needs. So we will continue to focus on it, your 

support in those that moved backward is much appreciated. 

Mr. CONNOLLY. Thank you, and I have overstayed my welcome. 

So I know my friend, Mr. Meadows, has, in fact, directly engaged 

in one of these questions to good effect. Mr. Meadows? 

Mr. MEADOWS. Mr. Chairman, thank you for continuing to make 

this a priority. I know this is not our first, second, or third FITARA 

hearing. It won’t be our last and for both of you, thank you for your 

testimony. 

Obviously Ms. Harris, thank you for continuing with your fine 

folks at GAO to guide us through on what we believe is—will ultimately be a good tool. I don’t know that we’re there yet. I think 

my perspective is that it’s a work in progress and even with the 

way that we changed the grading just recently to make sure that 

some of the unintended consequences are not there. 

So Ms. Kent, one of the areas that we’ve got to be aware of is, 

as we start to see how agencies game the system, and I say game 

the system in that, you know, it’s basically figuring out how the 

scorecard works and how you can either underreport or overreport 

to create a better grade and so we’re trying to address that. 

Getting back to the point that the chairman made just a few 

minutes ago as it relates to datacenters, so I’ll give you the cheat 

sheet. There is nothing more important to him than getting rid of 

datacenters and he can look at all the scores on this FITARA scorecard and if you’re messing up on datacenters, you’re going to have 
9 

a problem. All right? So I just—Ms. Harris, would you agree with 

that? 

Ms. HARRIS. I would absolutely agree with that. 

Mr. MEADOWS. And so in doing that, here’s what I would ask for 

greater clarification than what we have. The word ‘‘optimization’’ 

when we look at that, you know, you can optimize this and it 

doesn’t necessarily mean that we’re changing anything and so 

here’s what I would ask is, if you could provide this committee with 

some—and GAO with guidance on what optimization actually 

means. I mean, are we looking at 70 percent capacity on servers? 

Are we looking at redundancy of X percentage? What does it mean 

because what it means to one agency will be very different than— 

and, actually, probably, should be different for some agencies. 

You certainly want redundancy in some areas of the government 

with greater—with the need for greater reliability than others. 

That being said, we need to define that and make sure that Ms. 

Harris and her team has the proper input. 

One of the concerns is that the quality of the data that we continue to get is a hodge podge, and so I need to make sure that that 

gets prioritized, if you can, and if you’re running into a problem, 

here’s, I think, the chairman and I would agree, you just call us, 

we’ll be glad to raise it to the very highest levels within those agencies. 

I know when Ms. Harris the other day mentioned the direct report for the NASA administrator, I’m one of the few that have had 

the privilege of knowing the previous NASA administrator under 

the previous administration and thinking incredibly highly of him 

and what he was able to accomplish. 

I also have a personal relationship with the new NASA administrator and so I sent him a text and just said, listen, this is not 

good. You’re getting dinged on the scorecard. He responded back 

promptly, we’re going to take care of it and those are the kind of 

things that I think all of us just want to see, is just that willingness to say, golly, we didn’t know it was a problem, especially when 

you have a transition from administration to administration, but 

that’s the other key point, I guess. 

And what I would love to see from you, Ms. Kent, is the processes in place that when we change an administration, we don’t go 

backward. I think there’s a real—and it’s not a ding on this administration or the prior administration that have, you know, been 

able to deal with FITARA, but it’s a real problem that we are going 

to have going forward is the minute you get a new political appointee in there, if they don’t realize that it’s a big deal, then we’re 

going to have the same thing with somebody that’s here for 16 

months saying, golly gee, I didn’t know it was a problem. 

So is that something that you can work with the committee in 

terms of establishing those for us? 

Ms. KENT. Yes, it certainly is. And I appreciate our ongoing discussions. The phone call from Members of Congress certainly seems 

to assist in getting action and we would very much like to talk 

through the details on the guidance on what we are holding agencies accountable when we say optimization. It’s some of the things 

that have been part of the baseline and been defined, and I would 

add one more point on the CIOs. We’re at a point today as reflected 
10 

in the scorecard for the first time where we have 22 of 24 that are 

actually permanent and not acting, and that is—as you look over 

the history of the scorecard, that’s an important accomplishment. 

Mr. MEADOWS. And that’s to be applauded. It truly is. 

Ms. KENT. And it let’s us move forward as you have said and 

have some consistency as we go forward, so I do look forward to 

taking those followups back to this committee. 

Mr. MEADOWS. I yield back. 

Mr. CONNOLLY. I thank my friend and I reiterate his offer. Another way of putting it as, he and I are Alphonse Gaston and I’m 

not going to say which is which, but it’s all good. 

The gentlelady from the District of Columbia, our friend, Eleanor 

Holmes-Norton. 

Ms. NORTON. Thank you very much, Mr. Chairman. I think this 

is a timely hearing given what we learn was the state of IT, of 

technology in the Federal Government, how behind the Government of the United States was, so I’m interested in how we’re 

doing in catching up. 

Now it looks like we made a decent start, 90 million in funds allocated during that first year, so the first thing I’d want to know 

since this is so new is, examples of modernization projects that 

have been done. What have you done with the money particularly 

given reductions in appropriations which perhaps we could help get 

if we could have some examples, good examples that speak to the 

public and speak to the Congress about what you’ve done with the 

pretty good start. You had $90 million in the fund I’m interested 

in is the technology modernization fund. 

Ms. KENT. I’d be very excited to share some of those successes 

with you and I’ll frame a couple of things. Just in the time since 

the board has started, so a little over a year, we looked at over 

50—or approximately 50 proposals that would have totaled almost 

$600 million. Now, as you pointed out, we only funded a very small 

set of approximately—that represented $90 million and those were 

projects that had not only agency benefit, but all of government 

benefit and I’d like to tell you the—share the success stories of a 

couple. 

You will hear later from USDA, one of the initiatives that they 

undertook was consolidation of multiple portals for farmers.gov to 

provide an enhanced services for things that had been spread out 

and created an environment that was not only the most effective 

from customer service, but from—or farmer facing, but from a 

maintenance perspective, more costly and less efficient. 

In the case of HUD, they have eight applications that are cobalt 

applications that are core applications to their mission and they 

brought forward two of those as a pilot to learn both the tools, the 

process, and the playbooks to convert that from cobalt to java and 

not disrupt the business. And that’s a really exciting part of what 

they are achieving is, they’ve been able to take 1.2 million lines of 

code and convert it and not disrupt the business. 

Ms. NORTON. Is this a competitive process? Is this based on who 

will cost you less while saving you some money in this fund? How 

do you judge? 

Ms. KENT. That’s a great question. 

Ms. NORTON. They compete against one another, or how? 
11 

Ms. KENT. So in what was actually laid out in the law, there 

were specific intents—modernization, implementation of shared 

services, work force transformation, large broad scale transformation. There was also a very important component that the 

benefits from the initiative could pay back the funds that they received, so not every project actually has—and they have to pay it 

back in a very specified timeframe under a definition of—— 

Ms. NORTON. Are they doing that, by the way? 

Ms. KENT. They are doing that. They are doing that. As I said, 

we started a year ago and this is the first time we will have money 

coming back on schedule as planned—— 

Ms. NORTON. Your appropriations—— 

Ms. KENT. I’m sorry? 

Ms. NORTON [continuing]. fail, though, tremendously from that 

healthy $100 million in that first year to only $25 million in 2019, 

so giving—excuse me? 

Ms. KENT. Yes, ma’am. It certainly has moved. 

Ms. NORTON. That’s a huge reduction. I’m not sure why, but I’d 

like, since this was supposed to be a full cost recovery fund, how 

does that work and are you concerned about the funds’ ability to 

remain solvent? 

Ms. KENT. It is full cost recovery and I appreciate Congressman—Chairman Connolly’s support for the technology modernization fund. We did request additional funds because we saw the 

worthiness of all these projects coming forward and in many cases 

with the agencies and I would invite you to speak with our team 

at USDA in the next panel. The agencies were able to accelerate 

things that they would not be able to do in normal course of business and they have a payback plan. 

And one of the other very large benefits that we saw and I know 

that Department of Energy, USDA, HUD, and GSA have shared is 

that it brought the CIO and CFO communities very close together 

because they had to reconcile the spend and the payback plan and 

what the benefits look like in a way that they have never been 

tasked to do before to ensure that it is cost recoverable, so we’ve 

very much appreciate—— 

Ms. NORTON. Do you think you can remain solvent? 

Ms. KENT. Yes, we can remain solvent with that amount. It limits what we can do—— 

Ms. NORTON. I see. 

Ms. KENT [continuing]. and the projects we can—we absolutely 

have the plan for solvency, but it limits the number of projects and 

the acceleration of modernization that we can do going forward. 

Ms. NORTON. That’s my concern, Mr. Chairman. Thank you very 

much. 

Mr. CONNOLLY. Thank you. 

And if I could, just before I call on you, Mr. Grothman, if I may, 

just quick, Ms. Harris, the fund that Ms. Kent and Ms. Norton 

were just talking about Congress created. Originally we had pretty 

large amounts of money in mind. That got whittled down and whittled down and whittled down in order to be able to sell the idea 

of the authorization. 

Do you believe that we have critical mass that this fund as currently funded is viable or, put differently, can actually make a dif-
12 

ference, be the catalyst we intended it to be for people to retire legacy systems? 

Ms. HARRIS. I don’t believe so, Mr. Chairman. With fewer funds 

to award, the TMF cannot recover as much in their administrative 

fees. So when Ms. Norton is asking about solvency, we have preliminary analysis that shows that the office’s operating cost 

through Fiscal Year 2020 will exceed the administrative fees to be 

collected from these awarded projects. So our suggestion and—is 

for the TMF fund to be fully funded at that $438 million level to 

continue the good work that Ms. Kent is elaborating on. 

Mr. CONNOLLY. I think that this is something we can find some 

common ground on, and we need to work in the next budget cycle 

hopefully together so we have a number we can all agree on that 

is meaningful, gives us the criticality we need, and that can 

incentivize agencies to do the very thing you were describing, Ms. 

Kent. 

And finally, just both of you, on—I know this is on behalf of Mr. 

Hurd as well as all of us, but one of the things we encountered was 

agencies saying, well, we’re creating a fund within our agency to 

be able to capture the savings effectuated in FITARA, but our lawyers are telling us we can’t use them, we can’t put money in them 

because that’s an appropriations function. 

Now, some agencies I don’t think seem to have that problem but 

others do. Just real quickly, do you both believe that we need to 

fix that legislatively, or can that be done administratively with 

guidance from OMB? 

Ms. KENT. We believe in some of the cases it has to be fixed legislatively and there is wording proposed at the committee level. We 

had proposed some blanket language that would apply to all agencies. That has been turned down multiple times. So we have gone 

very specifically to individual agencies, and in some cases, through 

those committees, that has been approved. 

We have some requests and education is one of those directly at 

the committee level for various technical enablement of those funds 

for agencies who don’t have a similar vehicle or need to fund or operate out of that working capital account. 

Mr. CONNOLLY. Ms. Harris. 

Ms. HARRIS. Mr. Chairman, I think—— 

Mr. CONNOLLY. Could you speak up? 

Ms. HARRIS. Yes. Mr. Chairman, when MGT was passed, I mean, 

the intent was that that transfer authority would be there. So 

while I’m not a lawyer, it kind of boggles the mind that you would 

need additional legislation in order to offer that transfer authority 

so that MGT could be—— 

Mr. CONNOLLY. I know Mr. Hurd would share your view and so 

do I. And I don’t speak for Mr. Meadows, but he’s here. He can 

speak for himself. But our view is the law is the law. We passed 

the law. It’s quite clear what the intent is. And to have a sudden 

hurdle from inside agency attorneys saying, well, no, you can’t do 

that, certainly thwarts the intent of the law, that that may not be 

their purpose but that’s the effect. And so we will do what we have 

to do, but we would share, I think, your initial reaction, Ms. Harris. 

Mr. Meadows, did you want to comment on that? 
13 

Mr. MEADOWS. Well, I just agree. And What I’d like to do—— 

Mr. CONNOLLY. You do agree? 

Mr. MEADOWS. I do agree. 

Mr. CONNOLLY. Yes. 

Mr. MEADOWS. And, Ms. Kent, what I would like to do—I think 

congressional intent was clear. I think general counsels in different 

agencies maybe are a little unclear in what we believe we were 

clear about. And so in doing that some guidance I think would go 

a long way, and if we need to do a little research and a little push 

on our end to support that, I’m willing to do that. 

Ms. KENT. I’d be happy to share the specific examples with you 

and appreciate your support. 

Mr. CONNOLLY. Yep. That would be very helpful. I thank my 

friend. 

Mr. Khanna, the gentleman from California. 

Mr. KHANNA. Thank you. Well, first, Chairman Connolly, I want 

to recognize your leadership for having the FITARA guidelines become law and really bring some accountability to technology in government. And I want to recognize our ranking member, Representative Meadows, for also his understanding on technology. 

You know, I represent Silicon Valley, and probably the biggest 

thing that surprised me when I got to Congress is some of the technological illiteracy in this place. There was one hearing, I’m not 

going to mention the Member, who held his up his iPhone and 

started berating the Google CEO telling him how he couldn’t track 

the iPhone. And the Google CEO was patiently explaining that 

Apple made the iPhone. 

I appreciate, Ms. Kent, your leadership coming from a technology 

background. When I’m pressed to say what part of the administration I liked, I often cite you and Matt Lira. And I appreciated your 

work on the IDEA Act, which coincides with FITARA and was bipartisan legislation that we all passed. And I would like to know 

what is the status of the implementation guidelines for that legislation? 

Ms. KENT. Thank you for your question, sir, and thank you for 

your kind comments. I’d very much like to tell you about where we 

are with the IDEA Act, and I was honored to be there with you 

when that was signed at the end of the year. 

Our immediate action with all of the agencies was to take the 

specific items that were laid out in the IDEA Act and determine 

both the timeline and what things needed to be done centrally and 

what things needed to be done by the agency specifically. 

We met with the agencies and outlined those pieces. Some components were actually part of work that was already underway, 

things like the inventory that you required and the definition or 

the intent for a plan for how those would be handled. I know that 

the report for digital signature acceptance has just come in. 

So we aligned those things with what was already in place. We 

also had some items that you will see in some of the budget requests that are coming forward that has to do with those forward 

implementation plans. And we look to do those in the future. 

I would share one really interesting outcome of the IDEA Act. In 

inventorying the websites and determining a plan forward, it was 

very enlightening because many of the agencies said we need to 
14 

consolidate this set of websites. So we actually looked at them from 

priority and a user-centered approach of what was highly used, 

what was highly valued. And then those things that didn’t have the 

user traffic, wasn’t delivering specific services, other reasons, we’re 

actually pursuing a plan to consolidate and close those. 

So we are moving forward with many aspects of the implementation, they are included in the activities going on now. And there 

are some pieces for which agencies needed additional resources, 

and you’ll see those reflected in their 2020 budgets. 

Mr. KHANNA. Great. Let me ask you one final open-ended question. I don’t think anyone on the committee would disagree that the 

U.S. Government is the most powerful institution created in 

human history. And it was the U.S. Government actually that 

helped fund a lot of Silicon Valley. And so it’s mind boggling me 

that this incredibly powerful institution has technology platforms 

or acquisition platforms that aren’t up to now what many companies do in Silicon Valley. 

What do you think Congress can do in supporting FITARA and 

the IDEA Act to help continue to get us to a place where the U.S. 

Government should be the model for innovation? 

Ms. KENT. Your question actually aligns with part of the reason 

that I’m here and actually believing that same thing, that we 

should have the capabilities in the Federal Government that are 

available across many other industries and set the basis of expectations for our citizens. 

So when we talk about particularly modernization and cybersecurity as part of the FITARA Act those are the key components of 

how we actually make this transformation. Elements of the IDEA 

Act give us a prioritization to be able to actually take action and 

shut down and close the websites and rethink how we deliver services. 

The connected government and delivering mobile and digital 

services help make those things a priority. Those signals both 

through the FITARA scorecard and specific legislation are helpful. 

I would also say though when you look across at the agency activity for IT budgets we do—and it’s—this committee has talked about 

it frequently—we spend quite a bit on maintenance of those legacy 

systems. 

So tools like the Technology Modernization Fund and modernization initiatives that are outside of that basic maintenance helps us 

drive faster and gives us a way—otherwise agencies are moving in 

small increments for what they can divert out of that maintenance 

path, and that’s not a good solution either. 

Mr. KHANNA. Thank you. 

Mr. CONNOLLY. I thank the gentleman. 

And now the gentleman from Wisconsin, Mr. Grothman. 

Mr. GROTHMAN. Thank you. 

And I’d like to thank both of you for coming over here. I know 

you have such a busy day, but I know it’s something Congress has 

been waiting for, so thanks for coming over. 

Health and Human Services and NASA changed their reporting 

structures, right, so that the CIOs no longer report directly to the 

head or even the deputy head of the agency. Can you comment as 

to why that was done and what your general opinion of it is? 
15 

Ms. KENT. I can comment from my conversations regarding that. 

I would direct you specifically to the agency heads as to why they 

made that decision. You know, what NASA shared had decisions 

that were not necessarily related to the activities of the CIO. I 

think that’s in conflict with what we expected. And as you may 

have seen in the HHS side they had lots of different moves going 

on at the time. I am continuing my conversation with them regarding that approach. 

Mr. GROTHMAN. It just seems odd. 

Ms. KENT. And we agree, and that is not the intent. So we will 

continue the conversations until we are back in a place that is reflective of what is expected. 

Mr. GROTHMAN. Okay. Ms. Harris? 

Ms. HARRIS. I mean, the only thing I would add, sir, is in the 

case of HHS that reporting relationship was not codified in their 

policy. So at the time the acting CIO also was dual hatted as the 

acting chief or the chief technology officer, and so in that role as 

a chief technology officer he had that direct reporting relationship 

to the Secretary. And so when he put on the hat of CIO he also 

had that relationship to the Secretary. 

But since he has now vacated that CIO position because that relationship wasn’t codified in policy it went away, and so that really 

drives the important point that this relationship needs to be set in 

stone in policy so that we can maintain that continuity regardless 

of who is in the office. 

Mr. GROTHMAN. Okay. Let me give you kind of a broad-based 

question here. From your perspective—first of all, how long have 

you both had your positions? I should know that and I don’t. 

Ms. KENT. Sorry. Could you repeat the question? 

Mr. GROTHMAN. How long have you had your position? 

Ms. KENT. Sixteen months. 

Ms. HARRIS. Since 2012. 

Mr. GROTHMAN. Okay. From your perspective what worries you 

the most about IT management, say the last six months? 

Anything? 

Maybe nothing. It runs like a clock. 

Ms. HARRIS. I think from my perspective when you take a look at the spend of the $90 billion each year on IT, 80 percent of that 

spend is on legacy IT. We need to focus on decreasing that number 

and reinvesting that money into modernizing our aging systems. 

Mr. GROTHMAN. It’s kind of a shocking number, isn’t it? 

Ms. HARRIS. Yes. 

Mr. GROTHMAN. If it was done right, how much do you think you 

could save? 

Ms. KENT. It is. And I think I just commented on modernization 

that reflects a similar view. I would also state that when you look 

at our entire set of modernization goals, both transformation of the 

legacy systems and the ability to sustain current environment 

while you’re making that transformation and then continued focus, 

you said, you know, what are the priorities, it is always cyber, and 

ensuring that we are prioritizing our activities there based on the 

changing nature of the threat environment and where we see that 

volume and where we see those types of threats and ensuring that 

we are prioritizing that. 
16 

So when the majority of an agency budget goes to maintaining 

status quo that means that agency CIOs have to be incredibly crystal clear on the priority for those funds and their internal resources 

that are focused on the transformation in cybersecurity. 

Mr. GROTHMAN. When we talk about legacy systems what percent of the systems that you’re familiar with—I mean, you said 

how much more money we’re spending on the legacy systems, but 

what percent of this—even compared to the private sector, and you 

must deal with that somewhat, what percent do you think we have 

in the government you’d call up to date or the same type of systems 

you’d find in a modern American corporation? 

Ms. HARRIS. Sir, we don’t have that information. We have not 

done work to look at the percentage of what’s legacy and what’s development in the private sector. So I wish I could answer it, but 

I don’t have that information. 

Mr. GROTHMAN. You guys, can I ask one more question? 

Mr. CONNOLLY. Of course. 

Mr. GROTHMAN. That’s a surprising answer. I feel I’ve got to ask 

another question. Do you ever look into and see, you know, compare like where you are compared to major American corporations, 

you’d have people begin to work with you and say, holy cow, I can’t 

believe you still have this stuff sitting around here? Does that 

thing ever go on? Or do you have people leave your organization 

to the private sector and say, hey, wow, you want—you can’t believe what I found out here? There’s no comparison or no looking 

around or no comparing? You don’t do that? 

Ms. KENT. I would comment, I don’t know that there’s an exact 

number, a comparison per se to a single sector, but I would mention two things that we are looking at. One of the policies that 

we’ve used as a driver and a filter for how we prioritize legacy system transformation as well as website transformation has been 

high-value assets and looking at those things that are of critical 

importance to agencies and insider infrastructure and ensuring 

that we put resources there first. 

The other thing that we’ve done is from a customer experience 

perspective actually looked at the citizens that we’re serving and 

had dialogs around what they expect. And that actually does give 

a comparison in many cases across industry because their expectations are set on what they experience in their normal lives, whether it’s from their financial institution or a retail business that 

they’re shopping with. 

So we have used that user-centered design and customer expectations to drive back into the way that we are looking at delivering 

services, both from a digital and mobile capability standpoint. 

Mr. GROTHMAN. Okay. Well, again, thanks. Thanks for coming 

over here. I appreciate the chair letting me take so much of other 

people’s time. 

Mr. CONNOLLY. Not at all. Thank you, Mr. Grothman. 

And, Mr. Grothman, if I may followup on your question, I think 

we could afford, Ms. Harris, to be a little more forthright. I think 

you’re letting yourself off the hook a little bit by saying, I don’t 

know, I mean, I’m not in the private sector. I mean, there are 

things we do know. 
17 

For example, I always ask—and you probably do too, Mr. Meadows—when I speak to a private sector group, it’s a trick question. 

I go, well, how many CIOs do you have? And they always look at 

you no matter how big they are like what a trick—well, what do 

you mean? We have one. Well, how many does the Federal Government have? 

When we began FITARA with 24 agencies we had 250 people 

with the title CIO, and that means no one is in charge, no one can 

be held accountable, nobody is exactly responsible. And that’s a big 

difference, I would say, Mr. Grothman, between the private sector 

and the public sector where we can learn from the private sector. 

Likewise, we were celebrating a little while ago the transition 

from COBOL. I can’t think of a private sector company that still 

has COBOL, let alone would be celebrating in 2019 the transition 

from it to something else. So I think there are some things that we 

clearly can observe and learn from and benefit from in the private 

sector. Moving to the cloud is another one. 

So it is instructive, and hopefully we cannot necessarily entirely 

mimic the private sector, but there’s a lot of management practices 

we could learn from. And having the CIO report directly to the Secretary of the agency is also something quite common in the private 

sector. The CIO is not buried in the bowels of the organization, 

somebody who is a key part of the management team, because everyone understands the key role of IT in the enterprise. 

Ms. HARRIS. Yes. 

Mr. CONNOLLY. Well, I want to thank you both so much for coming. We’re going to continue this dialog. I am pleased, Ms. Harris, 

that MeriTalk did a study—a survey rather of 200 CIOs mostly in 

the public sector, and they found that 70 percent said that FITARA 

was, in fact, from their point of view, a useful kind of nudge for 

change within the agencies, and that’s kind of good to hear. And 

I see you shaking your head. Would you confirm that yourself 

or—— 

Ms. HARRIS. Well, I think that’s very encouraging because I will 

say that the progress that has been made since the inception of the 

score—well, the FITARA but then also with your continued oversight with the scorecard 1.0 now to 8.0 how it has evolved and how 

it has kind of raised the level of improvements across the board 

has been tremendous from transparency in the dashboard to portfolio stats in the savings. It’s all, you know, because of the tremendous oversight from your committee. 

Mr. CONNOLLY. Well, we want to thank GAO also for always 

being innovative in looking at how best we can make that scorecard 

a useful tool. So thank you and to your colleagues. 

Mr. Meadows. 

Mr. MEADOWS. I just want to make one point. The staff just let 

me know when we look at the transition fund, you know, it passed 

the House today with only 35 million. And when we look at this 

it’s—you know, we may represent two different District 11s, but we 

are together on this particular issue, and so what we need to do 

is work in a bipartisan way to get that up to a number that actually is meaningful. Thirty-five million sadly is a rounding error 

when it comes to addressing this problem. 
18 

Mr. CONNOLLY. I’m so glad you brought that up, Mr. Meadows, because I had an amendment to add $15 million to that $35 million 

to just get a respectable number. And unfortunately that was not 

ruled in order. It was subject to a point of order up in Rules, so 

we were not able to do it. 

Mr. MEADOWS. You have better connections with the Speaker 

than I do. 

Mr. CONNOLLY. But we will work on it together. 

Thank you both so much for being here today. And, Ms. Harris, 

I promised you’d make your plane. You’re going to make your 

plane. 

Thank you. 

Ms. HARRIS. Thank you. 

Ms. KENT. Thank you. 

Mr. CONNOLLY. And now we’re ready for our second panel: Gary 

Washington, Chief Information Officer of the United States Department of Agriculture; Jason Gray, Chief Information Officer of the 

United States Department of Education; and Eric Olson, Chief Information Officer from the Department of Treasury. 

If you would stand and raise your right hand, we’ll be sworn in. 

Thank you. Do you swear or affirm that the testimony you’re about 

to give is the truth, the whole truth, and nothing but the truth, so 

help you God? 

I thank you. And let the record show that our witnesses answered in the affirmative. 

The microphones, as I said, are sensitive, so if you can speak directly into them like I’m doing, you can be heard. Everybody has 

five minutes to summarize their testimony. Your full statement 

will be entered the into the record as submitted. 

And, Mr. Washington, why don’t we begin with you and your 

five-minute statement. Welcome. 

STATEMENT OF GARY WASHINGTON, CHIEF INFORMATION 

OFFICER, U.S. DEPARTMENT OF AGRICULTURE 

Mr. WASHINGTON. Thank you, Chairman Connolly, Ranking 

Member Meadows, and the members of the subcommittee for the 

opportunity to update you today on the United States Department 

of Agriculture’s progress on implementation of FITARA. I am Gary 

Washington, the Chief Information Officer of USDA. I would also 

like to thank you for your ongoing support and commitment to improve information technology management across the Federal Government. 

Secretary Perdue’s vision is to make USDA the most efficient, effective, customer focused, and best managed department in the 

Federal Government. Central to that goal is focusing on enterprisebased approaches to management and decision-making. We have 

taken many steps to achieve that goal including the implementation of the FITARA Information Technology Management Maturity 

Model, and we continue to make progress. 

As evidenced by the latest FITARA scorecard and the progress 

we have made over the past year, I am pleased that USDA have 

moved up an entire letter grade on the scorecard, and I hope that 

we will be doing as well or better than our friends here at Department of Education next year. 
19 

I know we have a lot further to go, but every day I am seeing 

the positive impact that FITARA has on our Department, and I 

would like to discuss some of that progress today. Since my last appearance before the subcommittee, USDA partnered with the 

White House Office of American Innovation and the General Services Administration Center of Excellence to improve the management of information technology at USDA. 

This effort accelerated IT modernization across the Department, 

improving leadership alignment, quality, and efficiency of IT, including decreasing the number of chief information officers, CIOs, 

from 22 to one, closing 28 to 39 data centers resulting in a cost savings and avoidance of $42.1 million and closing 2,255 data centers 

overall. 

We have enrolled 13 agencies into USDA cloud program resulting in a net cost avoidance of $12.1 million, improving our megabytes 

score from an F to an A on the 7.0 scorecard by implementing a 

number of effective processes and procedures to improve software 

management. 

We’ve also petitioned our existing working capital fund to receive 

technology modernization funding and making significant improvements in cybersecurity with 96 percent of USDA systems having 

authorities to operate as opposed to 74 percent in Fiscal Year 2017. 

Additionally, end-user equipment and hardware will be centrally 

managed by the Office of Chief Information Officer using an IT 

service management system with asset management as a core function. We will onboard the inventory for all the USDA mission areas 

and offices as part of an enterprise end-user consolidation initiative 

scheduled to be completed by the end of Fiscal Year 2020. 

And our Digital Infrastructure Services Center will be responsible for the central inventory and management of all infrastructure components of USDA, which includes network and system 

hosting. The system hosting would be accomplished by the end of 

Fiscal Year 2020 through the data Center Optimization Initiative 

and Cloud Adoption Centers of Excellence. 

The network transition to the new General Services Administration enterprise infrastructure solutions contract will ensure accurate inventory of our network infrastructure. I would like to emphasize the strong engagement and support for those efforts from 

our USDA leadership, namely the secretary and deputy secretary 

who I report directly to on IT matters. I believe we have an effective reporting structure and involvement in IT management and 

modernization issues at the highest level. 

In closing, USDA has consistently proven itself as a leader in 

embracing FITARA. We want to continue to implement FITARA 

across USDA and integrate it into our daily processes and IT modernization activities even further than we have today. We recognize 

there is more work to be done, and we continue to tackle those 

challenges. 

I truly appreciate the attention the committee has brought to 

this issue and your ongoing support of our efforts to change the 

way the Federal Government thinks about and manages IT. 

I look forward to answering any questions you may have. Thank 

you. 

Mr. CONNOLLY. Thank you, Mr. Washington. 
20 

Mr. Gray. 

STATEMENT OF JASON GRAY 

Mr. GRAY. Thank you, Chairman Connolly, Ranking Member 

Meadows, and members of the subcommittee for this opportunity to 

talk about the progress the U.S. Department of Education has 

made in implementing the Federal Information Technology Acquisition Reform Act. 

I recognize the great privilege and honor of being invited to appear here today. Never in my life could I have imagined having opportunities I’ve had to speak before the U.S. Congress. Thank you. 

I’d also like to thank you for your continued commitment to improving information technology management. My responsibility is 

to ensure the availability of IT with appropriate controls and to ensure the integrity in how we use it under the leadership of Secretary DeVos and in collaboration with the Office of Federal Student Aid and my office we have achieved a number of improvements in recent years. 

Mr. GRAY. There are two areas that I would like to highlight 

today, cybersecurity is one focus area of FITARA, which encourages 

agencies to proactively address cybersecurity risk and compliance 

with Federal Information Security Modernization Act. 

To address the cybersecurity challenge, OCIO developed our own 

cybersecurity risk scorecard based on the National Institute’s of 

Standards and Technical cybersecurity framework. The implementation of a scorecard improved our focus and alignment with OMB 

requirements for sound risk management practices for protecting 

our systems and networks. 

The scorecard also provided a specific path for the Department 

system owners and security officers to identify, prioritize, and mitigate risks. From September 2018 to June 2019, the Department 

has mitigated and closed over 2,300 plans of actions and milestones 

representing a 72 percent reduction in vulnerabilities than the Department systems. 

We use the scorecard to provide monthly briefings to the secretary, deputy secretary, and senior leaders. With their support 

and with the hard work off our system and security personnel, we 

were able to raise our FITARA security score two letter grades to 

a C in December 2018. The Department, along with the majority 

of its peers, started with a FITARA cybersecurity score of F in 

2018. 

Another area of focus is IT modernization, which is in line with 

the Department’s focus on creating and managing a more modern 

and secure IT environment and is consistent with the themes and 

principles outlined in the cross-agency priority goal on IT modernization found in the President’s management agenda. 

In 2017, we began an exhaustive review of our IT portfolio to ensure that IT systems, applications, and services are secure, appropriately governed, and modernized to meet the needs of today’s 

economy with an eye toward tomorrow opportunities. 

To this end, OCIO worked with key stakeholders across the 

agency and industry experts to complete a comprehensive analysis 

of our business missions and the IT assets supporting them. As a 
21 

result of those efforts, we developed a detailed visualization or map 

of the Department’s IT inventory, which we analyzed to determine 

the Department’s needs and to build our five-year IT modernization 

plan and strategic road map. 

The effort provides greater transparency across the Department 

enabling us to work with business owners, to identify opportunities, to leverage shared and cloud services, automate manual business processes, reduce cybersecurity risk, and consolidated cloud 

service providers. We are working with the Office of Management 

and Budget and Congress to obtain appropriations language that 

would allow us to transfer funds to a working capital fund, which 

would support the Department’s future modernization initiatives 

and accomplish the goals and objectives of the Modernizing Government Technology Act. 

We requested this transfer authority in the Fiscal Year 2020 

budget, and the Treasury Department has committed to activating 

an account for the Department once the transfer authority has 

been granted by Congress. 

I recognize our areas for improvement, we must continually monitor and assess our IT management and service delivery practices 

and policies. We are taking actions in areas where we are not fully 

meeting our milestones. 

One such area is CIO and CAO collaboration on the review and 

approval acquisition strategies and plans. OCIO is partnering with 

contracts and acquisition management to establish touch points between the IT life cycle management process and the acquisitions 

process to ensure the CIO has the opportunity to review all approve all acquisition strategies and plans that contain IT. 

Secretary DeVos and the Department take FITARA implementation seriously, we believe our progress demonstrates that. Thank 

you for your time today, and I look forward to responding to your 

questions. 

Mr. CONNOLLY. Thank you so much, Mr. Gray. 

Mr. OLSON. 

STATEMENT OF ERIC OLSON, CHIEF INFORMATION OFFICER, 

U.S. DEPARTMENT OF THE TREASURY 

Mr. OLSON. Thank you, Chairman Connolly, Ranking Member 

Meadows, and members of the subcommittee for the opportunity to 

testify on Treasury’s implementation of FITARA. My name is Eric 

Olson and it is my honor and privilege to serve as the chief information officer for the U.S. Department of the Treasury. 

Information technology is at the core of what Treasury does. We 

represent the third largest civilian agency in terms of overall IT 

budget, and plan to spend approximately 4.8 billion on IT in Fiscal 

Year 2019. 

Managing a large IT portfolio with the scale in complexity of 

Treasury is a very challenging endeavor, and we are grateful for 

the financial and human resources we have been provided to accomplish our mission. We recognize our responsibility for the stewardship of these resources, and we take this responsibility very seriously. We appreciate that FITARA was enacted to assist us to 

perform this responsibility. 
22 

Our key guiding principle for modernization is to drive the greatest amount of resources toward mission enablement and digital 

transformation. This requires pursuing enterprise initiatives and 

shared services so that we can reduce duplication and leverage 

economies of scale. At the same time, we encourage our bureaus to 

focus on transforming mission outcomes by adopting practices from 

the private sector that have proven successful in delivering digital 

transformation, such as cloud-based services, agile development, 

and low code platforms. 

I would like to briefly summarize some of our recent accomplishments and how they fit into the larger approach for Treasury IT 

modernization. On the heels of Congress’ enactment of the Tax Cut 

and Jobs Act, the IRS recently completed a successful tax filing 

season that was annealed in large part by the successful delivery 

of one of the largest and most complex IT implementations every 

undertaken by the Treasury Department. 

Implementation of tax form required the modification of hundreds of applications across the IRS and the Bureau of Fiscal Service. This recent accomplishment demonstrates Treasury’s ability to 

deliver change at scale on an accelerated timeframe. Treasury continues its pursuit of enterprise-wide services. Recently Treasury delivered an expansive upgrade to its enterprise H.R. system, an enterprise-wide service that supports the nearly 100,000 Treasury 

employees. 

Treasury is also in the process of implementing a cloud-based talent management system that will deliver a common platform for 

employee training, performance management, and succession planning. These initiatives demonstrate Treasury’s ability to use its 

franchise fund to achieve some of the benefits of what an IT working capital fund might achieve. 

In addition to the successes I mentioned earlier, I would like to 

report on how Treasury is implementing FITARA. In some areas 

of the FITARA scorecard Treasury has scored well, for example, 

data center consolation and portfolio review. We have worked hard 

in these areas and we are proud of our results. In other areas, although we have worked hard, we recognized there is room for improvement. 

FITARA recognizes the importance of agency CIOs having a substantial role in agency IT decisions. I meet regularly with Secretary 

Mnuchin on major IT investments, cybersecurity risk, and opportunities to pursue Treasury-wide initiatives. I believe this increased 

engagement with Treasury senior leadership has produced notable 

results in the delivery of the IRS modernization plan and the delivery of technology to support tax reform, among other things. 

On cybersecurity, we fully appreciate the threat posed by wellresourced and highly motivated adversaries and are committed to 

mitigating risk posed by such actors. While we cannot completely 

eliminate risk, we acknowledge our supreme responsibility to 

proactively address cybersecurity risk to the greatest degree possible. Toward that end, we operate a comprehensive cybersecurity 

program focused on risk mitigation. Our strategy is to make investments and capabilities that materially reduce our risk and reduce 

the cost of our compliance. 
23 

We are grateful to Congress for the support of our cybersecurity 

enhancement account, which is focused on identifying and funding 

projects that have the greatest Treasury-Wide impact in these and 

other important areas. 

In closing, we recognize and embrace our responsibility to be a 

good steward of IT resources. We understand and embrace the language intended in FITARA. We share the common goal of Treasury 

IT modernization. And we value the collaboration with Congress to 

jointly achieve these goals. 

Thank you, once again, for the opportunity to testify today. 

Mr. CONNOLLY. Thank you, Mr. Olson. 

Ms. Harris, did you want to comment? And I’m sorry if I led you 

astray, I was simply reassuring you, you’re going to make your 

flight at 10 o’clock. 

Ms. HARRIS. I see. I apologize for—— 

Mr. CONNOLLY. No, forgive me if I misled. 

Ms. HARRIS. Mr. Chairman, Ranking Member Meadows, I’ll now 

turn my comments to the Departments of Agriculture, Education, 

and Treasury. These agencies collectively plan to spend $7.5 billion 

on IT this year, for each of them, roughly 80 percent of their IT 

spend is on operational systems. Both USDA and Treasury have an 

overall C-grade on this scorecard, while Education is at a B+. Education has also sustained this overall B+ grade over the last four 

scorecards. 

Some positive areas to highlight for all three, the vast majority 

of their IT projects use an incremental approach. They also have 

comprehensive software license inventories and use them to make 

decisions and save money. USDA and Treasury have also closed 

more than 50 percent of their total data centers and exceeded their 

savings goals. Education closed all of their data centers and moved 

to the cloud years ago. 

For all three agencies, the progress to improve their IG assessments of cybersecurity is rather low. In the case of USDA and 

Treasury, they also self-reported low numbers in meeting OMB’s 10 

cyber metrics. The combination of the two is a reason for their low 

grades in this area. Education, on the other hand, self-reported 

meeting all 10 of OMB’s cyber metrics, and as a result, raised their 

grade in this area to a C. I’d also like to note that if USDA and 

Treasury CIOs reported to the head of their agencies, their overall 

grade would increase to a B. 

Mr. Chairman, this concludes my comments on the results of 

these three agencies. 

Mr. CONNOLLY. I thank you. Thank you so much. And it is heartening to hear the progress. I would just say, and you can confirm 

this, Mr. Gray. As I understand it, you now have zero data centers? 

Mr. GRAY. That is correct. 

Mr. CONNOLLY. And that you went from paying $12 per gigabyte 

of storage to a few cents? 

Mr. GRAY. Actually, sir, we are currently focused on transition— 

or doing cloud consolidation, and we recently within the last three 

months transitioned from $1.43 per gigabyte to $0.12 a gigabyte. 

Mr. CONNOLLY. So there are savings to be had in data center 

consolation and moving to the cloud? 
24 

Mr. GRAY. Yes. Yes, Mr. Chairman. I think you’re a poster child 

for doing that, and I thank you. 

Mr. CONNOLLY. Let me ask, Ms. Harris, GAO looked at best practices, and you identified FITARA requirements, one of which was— 

in order to get to best practices, obtains support from senior leadership. 

Would it be fair to say that all three of the agencies in front of 

us have achieved that? 

Ms. HARRIS. Well sir, I think in the case of Education that’s 

clearly the case because of Mr. Gray’s direct reporting to the Secretary. In the case of USDA and Treasury, that direct reporting is 

not as clear-cut. So I would say that in those two cases that senior 

leadership support may not be as clear as Education’s. 

Mr. CONNOLLY. And I think that’s really particularly important 

in your case, Mr. Washington, because Secretary Purdue has offered himself up as the pilot for the innovation agenda that Mr. 

Kushner and Chris Little are organizing at the White House. And 

if you’re going to do that, the model here is the CIO has got to report to the boss. There’s kind of no getting around that, and it is 

the desiring goal and objective of FITARA, it’s in our scorecard, 

and it is part of best practices GAO established. 

The second is—and you can comment on that if you wish. I’m 

sorry, I didn’t mean to not let you comment. 

Mr. WASHINGTON. Thank you, Mr. Chairman. I have all the access—I have extreme amount of access to the Secretary and the 

deputy secretary, and I frequently meet with the deputy secretary 

and speak with him about matters—— 

Mr. CONNOLLY. But if I may, Mr. Washington. That’s good, but 

that could be personal. 

Mr. WASHINGTON. Yes, sir. 

Mr. CONNOLLY. We’re talking about an organizational chart 

where you have the right to go in that office because you report to 

him or her. And if the bureaucracy doesn’t see that, it diminishes 

your power or your successor’s power. Power, influence, the ability 

to make change get enforced because everyone understands you’ve 

got the ear’s boss—I mean, the boss’s ear. You know, that works 

in the private sector. 

If I know, in the private sector, somebody has the ear of the 

CEO, so when he or she calls me, I know who that is, believe me, 

I’m paying attention and following up on that as a priority. And so 

I think that’s really what we’re getting at. It has to show on the 

organizational chart. It’s great you have access, but your successor 

may not. And we want to institutionalize this in the formal structure of the organization. 

And, Mr. Olson, you indicated that you have access to Mr. 

Mnuchin, but again, the same thing, is it not that we haven’t institutionalized this, though, so that your successors and his successors will have the same kind of relationship? 

Mr. OLSON. Sir if I could elaborate a little bit on the arrangement. So by Treasury policy, I do have a direct reporting relationship to Secretary Mnuchin on all CIO matters. I do also have an 

operational relationship to the secretary for management, and I 

think that is sort of the element that is causing some confusion or 

some concern here. 
25 

This is what I would offer up. I think Treasury has a very robust, I’ll say performance management structure. That structure, 

which has existed for many years, is the purview and the responsibility of the assistant secretary for management. It has served actually as enhancer to my authorities as a CIO to be plugged into 

that and not try to recreate, for example, my own sort of set of 

oversight, if you will, with all the Treasury bureau heads and 

Treasury IT leaders. 

So it enables me actually to have very good interaction and influence with bureau heads routinely. I have the opportunity to meet 

with them and talk with them on technology matters. 

It also brings me to the table when, for example, we’re talking 

about a particular bureau’s budget or work force issues with the 

bureau head, because IT doesn’t live in a vacuum, there are work 

force issues, there are budget issues, there are procurement issues, 

and all those folks need to be at the table. So, you know, I do feel 

like I have that. 

The other thing I’ll say, and I mentioned this in my opening comments, is that we successfully delivered a tax filing season, it was 

a very complicated heavy lift. Back a year or so ago when we were 

sort of still interpreting the law and creating specific requirements, 

I started to have some concerns about our ability to deliver that on 

time, and I expressed those to the Secretary. 

The engagement with the Secretary led to the ability, for, me to 

meet with IRS leadership weekly for the following year, and I’m 

talking about the commissioner, the deputy commissioners, the 

CIO, and we sat down and we reviewed the progress of tax reform 

implementation weekly so that we would get there. I don’t believe 

that would have happened if the rest of the organization didn’t understand my reporting relationship to the Secretary. 

Mr. CONNOLLY. Good feedback. And it’s also heartening that finally IRS is getting the attention it has long deserved. It has been 

on a starvation diet for all too long, and especially when it comes 

to technology, some of those legacy systems are particularly characteristic of IRS. I mean, as a Democrat, I’m sorry it took the tax 

bill to be the incentive to do it, but I’ll take it. 

In any event, thank you. 

Mr. MEADOWS. Mr. MEADOWS. I’m going to be real brief. Obviously we’re looking 

at this. We’re looking at detail. We’re looking at what is being said 

and then what is actually being done, and I think there’s a big difference between what is said and what is done, and sometimes 

what is said here as witnesses is not what we’re hearing is being 

actually done at the agencies. So I guess what I would encourage 

all of you to do is look at your FITARA scorecard. 

And, Mr. Gray, I want to say thank you. Obviously, recognizing 

success is one of the things that we don’t do a good job of doing 

sometimes. And I know I’ve been to—I haven’t been to your agency, 

I’ve been to the other two agencies, and many times it’s the first 

time Members of Congress ever come to say thank you, and shame 

on us. And so I just want to say thank you for your work. 

Thank you for truly the impact that you’re making. And yet, we 

will not spend any more money on any one item than we do IT. 

I mean, Ms. Harris was talking about $90 billion, you know, when 
26 

you add all the factors in there, it’s probably up to 110, 120 billion 

when you count in some of the agencies we can’t talk about. When 

you look at what all of those components—I’m amazed at how archaic our IT system is. I mean, we’re spending more than any Fortune 500 company would spend on IT, and yet, obviously—and, listen, I’m preaching to the choir, all of you get this. 

And I guess what I’m saying, the big thing for me—the big thing 

for the chairman is data centers and making sure those are consolidated. The big thing for me is if we continue to spend operational 

money for COBOL and FORTRAN programmers and legacy systems that—it’s just mind-boggling that we would do it and we continue to do it, not just in some of your agencies, but in other agencies across this. 

And so, for me, it is, you know, really critical, Mr. Olson. I think 

about the IRS and the amount of data that you have, and what I 

would call the big mainframe IBM systems that are really programmed in such archaic language that we’re having to pay a premium for the programmers because nobody programs in that language anymore. 

So in terms of action items, for me, if you would get back to this 

committee on what is your plan to get rid of legacy systems, and 

what is the cost of doing it? And for some of you, you know, you’ve 

got to make sure that you’re up and running, and you may even 

have to have a parallel system that gets built so that you can do 

the transfer. 

I realize there are logistical problems, Ms. Harris has said sometimes it’s like trying to change a tire while you’re driving 55 miles 

an hour. For some of you it’s like your driving 100 miles an hour 

trying to fix that flat tire, but I need a plan. 

And I guess the only frustration you will find is that at the next 

FITARA hearing, if there is not a plan, not just from the three of 

you, but anybody that is listening, on how we’re going to get rid 

of that, there’s going to be a problem. I’m tired of talking about it. 

And I’m saying that in the nicest way that I can. 

But thank you all for your work. We are making great progress. 

Even the Cs and the C+s and D+s and all of that, do not take the 

generosity of a modified scoring as oly oly oxen free. It’s time that 

we get serious about trying to get those to at least the next level 

up. And I’ll yield back. 

Mr. CONNOLLY. I thank the gentleman. The gentlelady from the 

District of Columbia, Ms. Eleanor Holmes Norton. 

Ms. NORTON. Thank you very much, Mr. Chairman, I appreciate 

your calling specific agencies so that we could look beneath the surface and see how this is doing. So I’m interested in the scorecard 

that evaluates agencies for implementation of what is called the 

Federal Information Security Modernization Act, that’s what we 

mean when we say FISMA. 

And I think that this metric is particularly important to the Congress because it will enable us to evaluate agencies who have a 

metric of their own and then to ask the agencies to explain themselves, and that’s what I’d like to begin with now. 

I’m going to ask the Department of Education who received a C, 

the Department of Treasury who received a D, and the USDA who 
27 

received an F, to explain why and what actions you can take or 

have taken to improve these scores? 

Mr. GRAY. Thank you for the question. Specifically, as was mentioned earlier, the Risk and Management Assessment, the RMA 

piece, is where agencies are assessing against metrics. We meet 

regularly to discuss cybersecurity as a whole. As I alluded to in my 

opening remarks and my written testimony, we use a cybersecurity 

risk scorecard that was developed that is aligned with the new cybersecurity framework, and what that does is it enables me to have 

near real time visibility into the cybersecurity posture of each of 

our systems. It reaches back to the Department of Justice in this 

case to pull information about my systems and I use that as—— 

Ms. NORTON. So did you know that—this is Mr. Gray from the 

Department of Education—did you know that at the time that your 

Department received a C? Is that what it would get today—will 

continue to get? 

Mr. GRAY. We are striving to improve our cybersecurity scorecard 

and have made significant improvements. To your question about 

what have we done or what are we going to do? 

Ms. NORTON. Yes. 

Mr. GRAY. Within the last three months we have made a massive 

IT transition to everything entirely new. When I got to the Department about three years ago, a little over three years ago now, we 

inherited a 10-year-old IT service contract. There was a lot of legacy and old things. We have re-competed and awarded, and within 

the last three months have transitioned to entirely new—new 

equipment, new hardware, new software, new systems, everything. 

Ms. NORTON. So if you were evaluated today, you think you 

would do better than a C? If you were evaluated today, given the 

improvements you just indicated? 

Mr. GRAY. We are currently stabilizing within the next two 

months, but absolutely. Once the stabilization is done, I absolutely 

expect for our scores to improve. 

Ms. NORTON. The Department of Treasury, that would be Mr. 

Olson. 

Mr. OLSON. That’s correct. 

Ms. NORTON. The Department of Treasury got a D. How do you 

explain that, and what actions have you taken to improve that 

score metric? 

Mr. OLSON. Sure. So let’s talk about the metric itself. Part of it 

is based on an IG audit—— 

Ms. NORTON. Based on what? 

Mr. OLSON. IG audit that’s done of our FISMA system, so we 

scored three out of five. 

Ms. NORTON. Is that why you got a D? 

Mr. OLSON. So three out of five equates to a D, and that’s 50 percent of our grade. And I would the first to tell you that that’s not 

where we need to be. It’s a maturity model and, you know, part of 

what we’ve been trying to do and part of what we’ve been using, 

the cyber enhancement account, has been to make investments 

where we get the biggest bang for the buck to improve these kinds 

of things. 

I actually sat down with Secretary Mnuchin to talk about our 

scores in this area, and he said, Eric, what’s it going to take to get 
28 

to four? So, four, we have 430 systems, it’s a random selection of 

systems in any given year. So it’s like, gosh, it’s an extremely 

heavy lift, but how can we get to four on the highest value assets. 

So he’s asked me to put together a plan, how can we get to four 

if we were to be audited on our highest value assets. 

The other half of the grade, which is the risk management score, 

as you know, this is sort of like 10 individual items, it’s passed 

down. And some of these scores, if you don’t get 100 percent, you 

fail. So I’m not at all quibbling with the scorecard, but I mean to 

say that 9 out of 10 of them are well into the high 90’s, and we 

have a one or two percent delta, which—you know, we have got to 

put it over the line and we would get, you know, a much better 

grade. 

The one area where we’re doing the worst and is actually a new 

element that was added to the scorecard in Q–3 of 2018, and we 

have a lot of work to do. That has to do with bringing strong 

encryption to legacy—well, to high value assets, many of which in 

the Department of the Treasury, are legacy systems which don’t 

lend themselves sort of architecturally elegant ways of doing that. 

But nonetheless, we understand the ask, we’ll figure it out. But 

that’s how I look at raising my scores. 

Ms. NORTON. So it seems that you are aware. 

Mr. OLSON. Very aware. 

Ms. NORTON. And are taking action. And, finally, to round this 

out, Mr. Chairman, could I ask the Representative of USDA, Mr. 

Washington, about what was the lowest score among the three of 

you here, the F score. How do you explain that? Why that score? 

And what actions have you taken to improve that score since you 

got that score—that low score? 

Mr. WASHINGTON. Well, ma’am, we were in an environment 

where we had many different tools that weren’t speaking the same 

language in terms of configuration management and patching. 

That’s where we fell short on the—— 

Ms. NORTON. Do you have a variety of tools, did you say? 

Mr. WASHINGTON. Yes, we had a variety of tools that weren’t 

feeding the same information, that’s where we fell short on a 

FISMA metric because it wasn’t feeding the metric data properly. 

So what we’ve done since last year, we’ve organized the end user 

consolidation that’s very important to us across USDA, and we’re 

going to get down to one common tool. And all of the end user support activities will be managed by the Department. So they will 

have common images and patching will be done the same way and 

standardized across the Department of Agriculture. And we intend 

to have that completed before the end of Fiscal Year 2020. 

Ms. NORTON. Thank you very much. 

Thank you, Mr. Chairman. That’s all. 

Mr. CONNOLLY. Thank you. And thank you for that line of questioning because I think that really is something we got to work on. 

Mr. Olson, I just want to add, with respect to your answer. Surely—I know you do—understand the part of our intention was, if it 

can’t be encrypted, it needs to be replaced and we’re trying to 

incentivize the replacement of legacy systems. 

Mr. OLSON. Yes. 

Mr. CONNOLLY. And that’s another nudge. 
29 

Mr. OLSON. Absolutely. And I think you’re aware of a large modernization plan we have put in for most of that portfolio. 

Mr. CONNOLLY. I would just say to all three of you, you represent 

agencies that maintain very large data bases. And I can recall, Mr. 

Gray, not to cite Education, but we had a hearing on this subcommittee a number of years ago focusing on different Federal 

agencies, and one of them was on yours. And what really was striking was, you wouldn’t think of Department of Education being a 

particular target for bad guys in the cyber world, but you have a 

data base of over 40 million Americans. Because if I applied for a 

student loan, you got my data. You got my financial data, my banking information, my credit cards, my credit history, my mortgage, 

on and on. And what could go wrong with that if that got breached? 

So your being up to snuff in terms of cybersecurity is actually 

pretty important to the American people, and that would certainly 

be true—IRS has data on everybody. And USDA has all kinds of 

data base, of course, as well. So, you know, this cyber question is 

not an academic one, I know not for you, but it isn’t for us either. 

We’re very cognizant of what can go wrong if we don’t accelerate 

this move toward updated systems. 

Oh, I’m sorry, Mr. Grothman, the gentleman from Wisconsin. 

Mr. GROTHMAN. Thank you very much. I’d like to thank the other 

three of you for coming over here, I know it’s very busy for you and 

we’re keeping you here a little late. So appreciate the extra effort. 

We talked before about the huge amount of cost that goes into 

what—I think it was Ms. Harris described as legacy systems. And 

I wondered for each of your three agencies, if we can start with Mr. 

Washington, could you let us know how many of the systems in 

your agencies you would describe as legacy systems? 

Mr. WASHINGTON. Sir, in terms of legacy systems, is it classified 

and is obsolete using outdate technology? 

Mr. GROTHMAN. Correct. 

Mr. WASHINGTON. We have less than five systems that are actually classified as old legacy systems. But we do spend about 77 percent of our portfolio in terms of O&M. 

Mr. GROTHMAN. Seventy-seven percent of your money you spend 

on the legacy systems? You said you have five legacy systems left, 

of that, five of how many? 

Mr. WASHINGTON. Oh, how many systems? We have—I’d have to 

get back to you on the exact number of systems, sir. 

Mr. GROTHMAN. About. 

Mr. WASHINGTON. We have about 129 systems in USDA. 

Mr. GROTHMAN. So you spend 77 percent of the money on five 

out of like 150 systems? 

Mr. WASHINGTON. On operation and maintenance. Of what we 

spend on our IT portfolio. 

Mr. GROTHMAN. That’s almost unbelievable. Could you give me 

the dollar numbers that go with those fantastic figures? 

Mr. WASHINGTON. Say again, sir. 

Mr. GROTHMAN. Like how many dollars are we talking about 

here. 

Mr. WASHINGTON. We have approximately a $2.3 billion IT portfolio at USDA. 

Mr. GROTHMAN. Two point three billion. 
30 

Mr. WASHINGTON. Yes sir. 

Mr. GROTHMAN. And you spend like 72 percent of that on five out 

of a 150 systems. 

Mr. WASHINGTON. No not on five—that’s on O&M. On the five 

systems we don’t spend that much money, sir. 

Mr. GROTHMAN. Okay. But you said you spent over 70 percent 

on five legacy systems. Is that right. 

Mr. WASHINGTON. I said for operations and maintenance. On the 

five legacy systems, we plan to retire those this year—those this 

year. And I don’t have the exact numbers right now, but it’s not— 

it’s a small amount of money. 

Mr. GROTHMAN. Okay. Well, it sounds kind of amazing numbers. 

Mr. Gray, I’ll give you the same question. 

Mr. GRAY. We have one legacy system at the Department, which 

is currently planned to be modernized through the next gen initiative that Federal Student Aid is leading. 

Mr. GROTHMAN. And when will that be done? 

Mr. GRAY. Excuse me. 

Mr. GROTHMAN. When will that be done? When will it be modernized? 

Mr. GRAY. That is a wonderful question. We currently have contracts that are under a protest, and as soon as those contract protests are resolved, we will be proceeding forward. 

Mr. GROTHMAN. What’s the nature of the protests? 

Mr. GRAY. There’s quite a number of that. I’d be happy to followup after. 

Mr. GROTHMAN. Okay. We’ll give Mr. Olson the same question. 

Mr. OLSON. Sure. So I’m happy to sort of comment. Within 

Treasury we have eight or so major bureaus, and I would probably 

answer that question a little bit for each one. But at the end of the 

day, the biggest rock in the Treasury Department is the IRS. So 

let’s sort of talk about that one, because I think that one. It’s 

roughly sort of an 80/20 split, maybe 85/15, depending on the year. 

Mr. GROTHMAN. What is the 85? 

Mr. OLSON. Eighty-five is O&M versus what we call development, maintenance, and enhancement DM&E, which is the build 

piece. I would offer this—there’s been a lot of discussion earlier 

in—in the early panel about private sector companies. 

I spent a lot of time talking to private sector companies, and in 

particular, financial services companies, and asked them this question a lot about how much do they spend on O&M, which is in the 

private sector they call run, and DM&E, which in the private sector they call grow. And they have another—sort of another category 

of spend that they call transform. 

It’s not necessarily bad in and of itself to have a big number in 

run. But you have to have strategy for making the business case 

to invest as much as you can in grow and transform. And I will 

just say, as far as the IRS goes, and the big banks that I’ve talked 

to, this particular fraction, if you will, percentage, if you will, is not 

unlike what the biggest banks in the countries see as far as the 

split between run and build. 

We have a big proposal and request for funding, you know, that 

will be coming forward—— 
31 

Mr. GROTHMAN. When you talk to other people—and I’m already 

past my time limit here. Do they feel you’re up-to-date or do they 

say this is where we were 15 years ago, or what do they say? 

Mr. OLSON. They, like us, have an enormously complex set of 

systems. So a GAO report just came out, we had, you know, the 

honorary of a 51-year old system. A 51-year-old system, that is the 

year it was put into production. It gets down to I think what’s the 

definition of legacy. I mean, we joke sometimes in the IT business 

that legacy begins the day after you implement the system for the 

first day. You know, so the definition of legacy is something that 

there’s a fair amount of debate on. 

You know, if I were to take that 51-year-old system and tell you 

it’s running on a mainframe that’s four years old, is it a legacy system. There is a variety of—— 

Mr. GROTHMAN. In general, though, when you talk to people, because I’m way over, my subcommittee chair is being very gracious. 

When you talk to people, where do they feel about where you are? 

Mr. OLSON. Oh, absolutely, they say we need to make significant 

changes, and we’re committed to that. 

Mr. GROTHMAN. Do they say, like, we are where we were 15 

years ago or something. I mean, you hear some of these stories that 

the government is so far behind where everybody else is. 

Mr. OLSON. I’m not going to debate that, but I will tell you that 

I met with a group of financial service CIOs from some of the country’s biggest banks, and it was amazing how similar of the challenges that we have in terms of our portfolio of applications. 

Mr. GROTHMAN. Okay. Thank you. 

Mr. CONNOLLY. I thank the gentleman. Mr. Olson, let me followup on your answers to Mr. Grothman, however. I think it’s a 

little misleading to compare yourself to the private sector, we’re 

kind of roughly the same—— 

Mr. OLSON. Absolutely. 

Mr. CONNOLLY. Same ratio. There is no private sector company 

I know of—— 

Mr. OLSON. There is not. 

Mr. CONNOLLY. [continuing]. that has a 51-year-old operating 

system still operating and you’re dependent on. 

Mr. OLSON. Well, yes. I’m not trying to defend that. 

Mr. CONNOLLY. I understand. But it goes deeper, doesn’t it? So 

I remember during the Obama years, the IRS was so starved that 

the average computer, the average PC. For example, was in the 

eight to nine year range. In the private sector any modern company 

is replacing computers every two or three years. 

Mr. OLSON. Right. 

Mr. CONNOLLY. So already we’re at a huge disadvantage, and little wonder that we had a lot of hard drive crashes, because it just 

was out living its life span, and we were really taxing that hardware really behind its useful life. 

We also had for IRS, if you wanted to archive material and be 

able to retrieve it, the instruction was, print and save. Now there 

is no private sector company that would accept that as a standard. 

IRS has to because we weren’t allowing them to invest in their 

technology. 
32 

So I just wanted to clarify that in the case certainly of at least 

your big constituent agency, IRS, it is a victim directly of investment starvation. 

Mr. OLSON. Absolutely. And I don’t mean to—I think I just wanted to paint that it was a more nuanced picture, and we are trying 

to look at what is a very large portfolio to identify the places where 

we really need to make that investment and move quickly, as opposed to just painting a broad brush to what is almost a $300 billion dollars spend. 

Mr. CONNOLLY. As I said earlier, I’ve been on this case for quite 

some time. And the IRS—I regret that my colleagues on the other 

side finally got around to wanting to do something only because 

they realized their tax bill was at jeopardy if they didn’t because 

you couldn’t implement it. I wish we had made those investments 

earlier for the sake of serving the American public with or without 

a tax bill. 

Mr. OLSON. Agreed. 

Mr. CONNOLLY. And hopefully that will be the ethos going forward. Ms. Harris, anything else for the good of the order? Anything 

we haven’t covered that we ought to at least mention? 

Ms. HARRIS. I think we’ve covered everything. 

Mr. CONNOLLY. We’ve covered everything. 

Ms. HARRIS. We have, sir. 

Mr. CONNOLLY. Let the record show, GAO believes we have covered everything. But, again, I want to thank you for your leadership and your incredible staff work from the very top. I mean, you 

know, this item has been on the high risk list for a long time. 

GAO unequivocally got behind FITARA and supported the legislation and exhorted Congress to pass it, and has been with us 

every step of the way as we insist on its implementation. 

And we couldn’t have done it without you, and I think you’re 

really one of the great heros of—if this legislation is transformative 

over time, GAO shares in the credit, and we thank you. 

Let me see, what am I doing here? I am adjourning. Okay. I 

want to thank our witnesses. And without objection, all members 

will have five legislative days within which to submit additional 

written questions for the witnesses, and those questions will come 

from us. 

And if you can get back to us in a timely fashion, through the 

chair, we’ll distribute them to the members, should they appear. 

I want to wish you all a good day. Thank you again for your patience with the House schedule. Good luck on your trip, Ms. Harris. 

This hearing is adjourned. 

[Whereupon, at 5:55 p.m., the subcommittee was adjourned.] 

Æ