U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

29–502 PDF 2018

THE FEDERAL INFORMATION TECHNOLOGY 

ACQUISITION REFORM ACT 

(FITARA) SCORECARD 5.0 

JOINT HEARING 

BEFORE THE

SUBCOMMITTEE ON 

INFORMATION TECHNOLOGY 

AND THE

SUBCOMMITTEE ON 

GOVERNMENT OPERATIONS 

OF THE

COMMITTEE ON OVERSIGHT 

AND GOVERNMENT REFORM 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

NOVEMBER 15, 2017 

Serial No. 115–55 

Printed for the use of the Committee on Oversight and Government Reform 

( 

Available via the World Wide Web: http://www.fdsys.gov 

http://oversight.house.gov 


KING-6430 with DISTILLER
(II) 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM

Trey Gowdy, South Carolina, Chairman 

John J. Duncan, Jr., Tennessee 

Darrell E. Issa, California 

Jim Jordan, Ohio 

Mark Sanford, South Carolina 

Justin Amash, Michigan 

Paul A. Gosar, Arizona 

Scott DesJarlais, Tennessee 

Blake Farenthold, Texas 

Virginia Foxx, North Carolina 

Thomas Massie, Kentucky 

Mark Meadows, North Carolina 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Mark Walker, North Carolina 

Rod Blum, Iowa 

Jody B. Hice, Georgia 

Steve Russell, Oklahoma 

Glenn Grothman, Wisconsin 

Will Hurd, Texas 

Gary J. Palmer, Alabama 

James Comer, Kentucky 

Paul Mitchell, Michigan 

Greg Gianforte, Montana 

Elijah E. Cummings, Maryland, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Stephen F. Lynch, Massachusetts 

Jim Cooper, Tennessee 

Gerald E. Connolly, Virginia 

Robin L. Kelly, Illinois 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 

Stacey E. Plaskett, Virgin Islands 

Val Butler Demings, Florida 

Raja Krishnamoorthi, Illinois 

Jamie Raskin, Maryland 

Peter Welch, Vermont 

Matt Cartwright, Pennsylvania 

Mark DeSaulnier, California 

Jimmy Gomez,California 

SHERIA CLARKE, Staff Director 

ROBERT BORDEN, Deputy Staff Director 

WILLIAM MCKENNA, General Counsel 

TROY STOCK, Subcommittee on Information Technology Staff Director 

KILEY BIDELMAN, Clerk 

DAVID RAPALLO, Minority Staff Director 


KING-6430 with DISTILLER
(III) 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY

Will Hurd, Texas, Chairman 

Paul Mitchell, Michigan, Vice Chair 

Darrell E. Issa, California 

Justin Amash, Michigan 

Blake Farenthold, Texas 

Steve Russell, Oklahoma 

Robin L. Kelly, Illinois, Ranking Minority 

Member 

Jamie Raskin, Maryland 

Stephen F. Lynch, Massachusetts 

Gerald E. Connolly, Virginia 

Raja Krishnamoorthi, Illinois 

SUBCOMMITTEE ON GOVERNMENT OPERATIONS

Mark Meadows, North Carolina, Chairman 

Jody B. Hice, Georgia, Vice Chair 

Jim Jordan, Ohio 

Mark Sanford, South Carolina 

Thomas Massie, Kentucky 

Ron DeSantis, Florida 

Dennis A. Ross, Florida 

Rod Blum, Iowa 

Gerald E. Connolly, Virginia, Ranking 

Minority Member 

Carolyn B. Maloney, New York 

Eleanor Holmes Norton, District of Columbia 

Wm. Lacy Clay, Missouri 

Brenda L. Lawrence, Michigan 

Bonnie Watson Coleman, New Jersey 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(V) 

C O N T E N T S 

Page 

Hearing held on November 15, 2017 ...................................................................... 1 

WITNESSES 

Mr. Dave Powner, Director of IT Management Issues, Government Accountability Office 

Oral Statement ................................................................................................. 4 

Written Statement ............................................................................................ 6 

Mr. Max Everett, Chief Information Officer, Department of Energy 

Oral Statement ................................................................................................. 41 

Joint Written Statement .................................................................................. 43 

Ms. Alison Doone, Acting Chief Financial Officer, Department of Energy ......... 53 

Mr. John Bashista, Director of Acquisition Management, Department of Energy ........................................................................................................................ 58

Ms. Barbara Helland, Associate Director of Advanced Scientific Computing 

Research, Department of Energy ........................................................................ 58 

PANEL II: 

Mr. Dave Powner, Director of IT Management Issues, Government Accountability Office 

Oral Statement ................................................................................................. 60 

Mr. Wade Warren, Acting Deputy Administrator, U.S. Agency for International Development 

Oral Statement ................................................................................................. 60 

Written Statement ............................................................................................ 62 

Mr. Jay Mahanand, Chief Information Officer, U.S. Agency for International 

Development ......................................................................................................... 67 

Mr. Reginald Mitchell, Chief Financial Officer, U.S. Agency for International 

Development ......................................................................................................... 68 

PANEL III: 

Mr. Dave Powner, Director of IT Management Issues, Government Accountability Office 

Oral Statement ................................................................................................. 74 

Ms. Althea Coetzee Leslie, Deputy Administrator, Small Business Administration 

Oral Statement ................................................................................................. 75 

Written Statement ............................................................................................ 77 

Ms. Maria Roat, Chief Information Officer, Small Business Administration ..... 82 

Mr. Tim Gribben, Chief Financial Officer, Small Business Administration ....... 84 

APPENDIX 

Opening Statement of Ranking Member Gerald E. Connolly .............................. 86 

Memo from Mr. Max Everett to the Secretary of the Department of Energy 

regarding the designation of the CIO as direct report to the Secretary, 

submitted by Chairman Hurd ............................................................................. 89 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(1) 

THE FEDERAL INFORMATION TECHNOLOGY 

ACQUISITION REFORM ACT 

(FITARA) SCORECARD 5.0 

Wednesday, November 15, 2017 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON INFORMATION TECHNOLOGY JOINT

WITH SUBCOMMITTEE ON GOVERNMENT OPERATIONS, 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM, 

Washington, D.C. 

The subcommittees met, pursuant to call, at 2:45 p.m., in Room 

2154, Rayburn House Office Building, Hon. Will Hurd [chairman of 

the Subcommittee on Information Technology] presiding. 

Present: Representatives Hurd, Amash, Massie, Gianforte, Blum, 

Kelly, Connolly, Norton, and Krishnamoorthi. 

Mr. HURD. The Subcommittee on Information Technology and the 

Subcommittee on Government Operations will come to order. 

Without objection, the chair is authorized to declare a recess at 

any time. 

And I now recognize myself for 5 minutes for my opening remarks. 

Good afternoon. I appreciate you all being here today. Today’s 

hearing is part of this committee’s continuing oversight of Federal 

IT. This began with GAO’s high-risk report and the designation of 

IT acquisition on that report back in February of 2015, and it’s 

been a priority of ours ever since. 

And due to the importance we place on this issue, our committee 

staffs worked with GAO to develop a scorecard to assess agencies’ 

FITARA implementation efforts. This bipartisan scorecard has 

been issued every 6 months, beginning 2 years ago on November 

4, 2015. 

The scorecard has evolved each iteration in response to GAO recommendations and stakeholder feedback. Scorecard 5.0 adds a fifth 

graded category to assess agencies’ management of software licenses. We previewed this category as part of scorecard 4.0. For 

scorecard 6.0, a measure of whether agencies have established 

working capital funds as authorized by the MGT Act, which I was 

pleased to see included in the final NDAA, will be made a part of 

the scorecard. 

Ultimately, I’d like to see the scorecard evolve beyond FITARA 

implementation to more of a digital hygiene score for agencies. 

Adding megabyte implementation to this scorecard is a step in that 

direction. 


KING-6430 with DISTILLER
2 

The inclusion of software licensing had a negative overall impact 

on the grades. Since the last scorecard, 3 agencies’ grades increased, 15 agency grades stayed the same, and 6 decreased. If 

software licensing were not included, 8 agencies’ grades would have 

increased, 14 would have stayed the same, and 2 would have decreased. So progress is being made, just not as quick as it should 

be and needs to be. 

Legacy IT is a continuing fiscal and cybersecurity risk to our Nation. Those 17 agencies received an F on this new metric for the 

FITARA scorecard 5.0. It is worth noting that each of these agencies has efforts underway to create and use an inventory of software licenses. 

I hope to hear from each agency today how they plan to improve 

their score in this area. I also hope to hear from Mr. Powner, his 

thoughts on where we will be governmentwide on this metric in 6 

months for scorecard 6.0. 

Today’s hearing features three panels, with officials from the Department of Energy, the United States Agency for International 

Development, and the Small Business Administration. Their grades 

are a D-plus, A-minus, and C-minus. 

As always, I’m honored to be exploring these issues in a bipartisan fashion with my friend and ranking member, the Honorable 

Robin Kelly, from Illinois. I’m also pleased to be joined by Chairman Meadows and Ranking Member Connolly from the Government Operations Subcommittee. I could not have asked for better 

partners in the effort to modernize technology in the Federal Government. And I thank my colleagues and the witnesses and all who 

have joined us in person, and for those folks who are watching online, for participating today. 

I now recognize my friend, the ranking member of the Information Technology Subcommittee, Ms. Kelly, for 5 minutes and her 

opening statement. 

Ms. KELLY. Before we begin today’s hearing, I also want to thank 

you, Chairman Hurd, Chairman Meadows, and Ranking Member 

Connolly, for your steadfast leadership as our subcommittees continue working together to oversee the improvement of Federal IT 

systems. I’m glad to have such great partners in this endeavor. 

Improving the efficiency and security of the Federal Government’s IT systems is essential to our Nation’s security. Crucial to 

that effort is the ongoing oversight conducted by our subcommittees 

to hold agencies accountable for implementing key aspects of the 

Federal Information Technology Acquisition Reform Act. An important part of that oversight has been the scorecard our subcommittees developed for grading agency progress and meeting the 

FITARA requirements. 

Today, our subcommittee released the fifth version of the scorecard. It’s been 2 years since we released the first one and held our 

first hearing on this issue. Since that time, we’ve strengthened the 

role of the CIO at many agencies, increased transparency in project 

management, and we’ve saved billions of taxpayer dollars. I’m 

proud of the work we’ve accomplished together so far. 

The new scorecard, however, shows that progress is difficult and 

that we still have a long way to go. For example, as the chairman 

talked about, while some agencies like the U.S. Agency for InterVerDate Nov 24 2008 11:29 May 01, 2018 Jkt 000000 PO 00000 Frm 00008 Fmt 6633 Sfmt 6633 H:\29502.TXT APRIL

KING-6430 with DISTILLER
3 

national Development has done well, going from a D in 2015 to an 

A-minus today, others like the SBA has fallen behind and gone 

from D in 2015 to a C-minus today. 

Overall, the grades for only three agencies went up on the scorecard, 15 stayed the same, and 6 actually went down. The scorecard 

makes clear that agencies still have a long way to go to address 

the challenge of reducing the growing number of Federal data centers. 

The FITARA Enhancement Act that was introduced by Ranking 

Member Connolly earlier this year would extend the timeline for 

agencies to close any unneeded data centers. The bill will also provide greater support to agency CIOs in their effort to eliminate and 

consolidate large numbers of data centers. 

Since the release of the last scorecard, the subcommittees have 

added software licensing as a metric of performance to this one. 

The overall grades in this category indicate that agencies are struggling when it comes to the management of their software licenses. 

I am concerned about this most recent scorecard performance, 

and look forward to hearing from today’s agencies on the struggles 

and challenges they are facing in FITARA implementation and how 

Congress can be more helpful. 

There is simply too much at stake when it comes to FITARA. 

This isn’t just about saving taxpayer money; it’s about improving 

the overall general hygiene of the Federal Government, and the 

scored metrics here are the basics of running any shop. 

I want to thank the witnesses for testifying today. 

Mr. Powner, you might just be the most popular witness on the 

Hill. This is your fifth hearing with us on FITARA. I’m also looking 

forward to hearing from all the agencies here today. Thank you so 

much. 

Thank you, Mr. Chair. 

Mr. HURD. Thank you, Ranking Member. 

And when the other members get here and want to do opening 

remarks, we can do that at the next panel. But let’s go ahead and 

get into our first panel. 

I’d like to introduce the witnesses. As the gentlewoman from Illinois recognized, Mr. Dave Powner, one of probably—holds the 

record of number of times coming before this committee, the director of IT management issues at the Government Accountability Office. 

Max Everett, chief information officer at the Department of Energy; Ms. Alison Doone, acting chief financial officer at the Department of Energy; and Mr. John Bashista, director of acquisition 

management, also at DOE; and Ms. Barbara Helland, associate director of advanced scientific computing research at the Department 

of Energy. Appreciate you all being here. 

And pursuant to committee rules, all witnesses will be sworn before you testify, so please rise and raise your right hand. 

Do you solemnly swear or affirm that the testimony you’re about 

to give is the truth, the whole truth, and nothing but the truth, so 

help you God? 

Thank you. 

Let the record reflect all witnesses answered in the affirmative. 


KING-6430 with DISTILLER
4 

In order to allow time for discussion, please limit your testimony 

to 5 minutes, and your entire written statement will be made part 

of the record. As a reminder, the clock in front of you shows your 

remaining time. The light will turn yellow when you have 30 seconds left, and the red is when your time is up. Please also remember to push the button to turn on your microphone before speaking. 

And now I’d like to recognize Mr. Dave Powner for his opening 

remarks. 

WITNESS STATEMENTS 

STATEMENT OF DAVE POWNER 

Mr. POWNER. Chairman Hurd, Ranking Member Kelly, and members of the subcommittees, I would like to thank you and your staff 

for your continued oversight on the implementation of FITARA 

with this fifth set of grades. 

We’ve added a fifth category to grades, software licensing, at 

your request, so now the FITARA scorecard covers five of the seven 

major areas of this law. Overall, three agencies’ grades went up: 

Education, OPM, and SBA; 6 went down; and 15 remained the 

same. Of the six that went down—Energy, DHS, HUD, Transportation, EPA, and Justice—none had a software license inventory, 

and received Fs in this subcategory. 

Regarding the software license area, 6 months ago when you 

previewed this area with scorecard 4.0, only three agencies had 

complete inventories. Now, seven do. And six of these seven report 

savings in this area: Ag, Education, GSA, NASA, VA, and USAID. 

Those six received As for this. Labor gets a C, and 17 agencies 

without inventories receive Fs. Progress, but clearly not enough, 

given that this was a major section of FITARA and was followed 

up with the MEGABYTE Act. 

Another area where significant progress needs to be made is optimizing data centers. SSA, EPA, and GSA report solid progress 

against the five optimization metrics. Education and HUD are out 

of the data center business, as they no longer have any agencyowned data centers. The other 19 agencies have a ways to go to optimize these centers. 

The key point here is that additional and substantial savings can 

still be realized as we see better utilization of these facilities and 

equipment. 

I’d like to conclude this overview by thanking this committee, 

Chairman Hurd and Meadows, and Ranking Members Kelly and 

Connolly, and your dedicated staff, not only for your consistent and 

thorough oversight of FITARA, but also for your followup with the 

FITARA extension and the MGT Act to give agencies more time to 

implement more completely and to provide additional avenues for 

reinvesting savings in modernization priorities. 

Now turning to the Department of Energy. Energy plans to 

spend about $1.8 billion on IT this year. About half of this spending is for IT programs at the National Nuclear Security Administration. Energy’s grades have fluctuated over the five scorecards 

between Fs and Cs, and their current grade is a D-plus. 

The plus here is of major significance, and I would very much 

like to commend Max Everett and the Department’s leadership as 


KING-6430 with DISTILLER
5 

Energy is the only agency that has elevated their CIO reporting 

since FITARA was enacted. 

Another positive note is in the area of incremental development 

where they received an A. This is consistent with the report that 

we just issued on this topic where Energy was only one of four 

agencies that had incremental certification policy consistent with 

OMB guidance in FITARA. 

Turning to areas where Energy needs to improve, let’s start with 

CIO tenure. Since 2004, the average CIO tenure at Energy has 

only been 1.7 years. This is a major issue and reason why IT has 

not been effectively managed. 

On data centers, Energy is reported saving $21 million between 

2012 and 2017. However, they report not meeting any of the five 

metrics and have no additional planned savings. Their closures will 

fall short of OMB’s goals for both small and large centers. The bottom line here is that if you’re short on metrics, there is likely more 

closures and savings to be had. 

Energy’s software license inventory is not complete. It covers 

CIO-controlled licenses, and they’re working on completing the inventory for the other components. 

Finally, I’d like to note that our work for this committee on IT 

budgeting and CIO authorities shows that Energy’s CIO has challenges in the area of IT budgeting and execution, meaning that 

there needs to be more visibility into the IT budget and better governance over their important system acquisitions. 

Mr. Chairman, this concludes my comments on the Department 

of Energy. 

[Prepared statement of Mr. Powner follows:] 


KING-6430 with DISTILLER
6 


KING-6430 with DISTILLERInsert offset folio 1 here 29502.001

United States Government Accountability Office 

Testimony before the Subcommittees on 

Government Operations and Information 

Technology, Committee on Oversight 

and Government Reform, House of 

Representatives 

For Release on Delivery I N FO RMAJ IoN Expected at 2:00 p.m. ET Wednesday, November 15, 2017 

GA0-18-234T 

TECHNOLOGY 

Further Implementation of 

FITARA Related 

Recommendations Is 

Needed to Better Manage 

Acquisitions and 

Operations 

Statement of David A. Pawner, Director 

Information Technology Management Issues 
7 


KING-6430 with DISTILLERInsert offset folio 2 here 29502.002

GIJ) 

fligbJights 

Hi!ilJ!ignl!l ofQAd-1~4<!4~. ~ te~tirilony before th& ~~tp~ ot\G:a:vemment OporaMnsO!\<! tnt<irmOljon Teottnofi)gy, ~on Oversighla1\d Goyemment Ref~'t:fous~pf R~sentattves 

Why GAP Pld 1'1116 Study 

The. 1eJeiltlgolll!mnl~(l( ))fans to Invest 

almost $96.bllf!oito!ll1'i!! fi~af year 201!kfill$l<lri¢<~lly; !i>~in~tm~ 

oovet0ollfte;tr f311~ i(tcurred oost 

overrmisarid s.cll(jdQle snppllges, or contrib~ Jiltlt! to.riliSsioiHelated 

out<:omt!s. A®OrdingJY, lti pecemb&r 201:4. Ct<llSre,s~~trscli!d fliAR:A, 

aimed atlmp;<>Ylfl!l~~eh<:ies'• . ·. acqui~j!Qnll <>fiT; Furif)er; infeb!U'Ity 

2015; wxo ad<jed tmJ)mvltig 111e 

manll(l$mentilf lT acQUisitions and 

operations t<ic itl! high-riSk list. 

Thi&st;l!em~tsumma11Ze~~a9ericl~ 

progr~S!Ii'!lrnjjroYi(19.1l\a.m~emen.t 

of ITaeqit!Sitiolls $!!dopeilttions. This.· 

st~l$11ilnHsbase<lqn.G;<IQ's pr)oNmd recenll)i:pul:>fi\ll!ed repelts ()If (1) dllta center<;Otrsl>Jidm~n. (ll) !i$1< lev!)ls of 

major i!l\ll\stment~~ re!l"l''ed ort 

OMS'S. IT tll!shb0iiild;.(3) 

implemert~a!lon Of ln(lremental 

l:leveli!!Pment wacll!:!?si an<f (4) · mim~!iertlejjtt>I..Oflware licenses. 

What GAO Recommends 

From !ls<:al:t•a;s. 2010 lf1rough 2015. 

GAOma~ellll~taoo . , ... · re<:ommendal1<>01i'l<1·<SlM~ and 1ederal agem:i~ to.addreS$'shOJ1.coming~ in IT 

ac:qu!~)tion\t Md openitiJ:Ins. Md ineludd<l r~oolpme)'l!latlonslo lmpr<>Ye tile .oversignfMd J!ll'aC\Ition .ofth~ data center donsol!l:la'jion_imtiatlvll, tf1e 

acGU@.<>;t aM. rel~btl~of the 

Oa$ht>Qiafd; iQ~ntal<jelleloplllent 

polici<;Js. 'md~are t!<;el1.•" ma~l>rnent; Mq$t agll,ncles agnied · with GAo:s}'eeg!l!menl!ations or oou no.~nls.ilna.~uon •. sirtc:efi~oal 

Yea! 2Q1tlt'Cl"':0'llallmad!i more tflan l!OOne\N•~t~nimendati!;>!ls in tf11s area; GlAQ. Wlllt;ontinu.e to monitor 

agencl!'~~' irwlemeiil$!10n oftl,!se 

re<:omrnendations. 

v.,GAP;tW:l-~t.Jorm<ll1>mlorinal1on .•. oontact DavidA, Powner~t.(202)512'·S2a6 or 

-rd@gab,lloy. · 

INFORMATION TECHNOLOGY 

Further Implementation of FITARA Related 

Recommendations Is Needed to Better Manage 

Acquisitions and Operations 

What GAO Found 

The Office of Management and Budget (OMB) and federal agencies have taken 

steps to improve information technology (IT) through a series of initiatives, and 

as of November 2017. had fully implemented about 56 percent of the 

approximately 800 related GAO recommendations. However, additional actions 

are needed. 

• Consolidating data centers. OMB launched an initiative in 2010 to reduce 

data centers, which was reinforced by the Federal Information Technology 

Acquisition Reform Act (FITAR:A) In 2014. However, in a series of reports 

that GAO issued over the past 6 years, the agency noted that, while data 

center consolidation could potentially save the federal government billions of 

dollars, weaknesses existed in several areas, including agencies' data center 

consolidation plans, data center optimization, and OMB's tracking and 

reporting on related cost savings. In these reports, GAO made a matter for 

Congressional consideration, and a total of 160 recommendations to OMB 

and 24 agencies. to improve the execution and oversight of the initiative. 

Most agencies and OMB agreed with the recommendations or had no 

comments. As of November 2017, 84 of the recommendations remained 

open. 

Enhancing transparency. OMB's IT Dashboard provides information on 

major Investments at federal agencies, including ratings from Chief 

Information Officers that should reflect the level of risk facing an investment. 

Over the past 6 years, GAO has issued a series of reports about the 

Dashboard that noted both significant steps OMB has taken to enhance the 

oversight, transparency, and accountability of federal IT investments by 

creating its Dashboard, as well as concerns about the accuracy and reliability 

ofthe data. In total, GAO has made 47 recommendations to OMB and 

federal agencies to help improve the accuracy and reliability of the 

information on the Oashboard and to increase its availability. Most agencies 

agreed with the recommendations or had no comments. As of November 

2017, 25 of these recommendations remained open. 

• Implementing incremental development. OMB has emphasized the need 

for agencies to deliver investments in smaller parts, or increments, in order to 

reduce risk and deliver capabilities more quickly. Since 2012, OMB has 

required investments to deliver functionality every 6 months. Further, GAO 

has issued reports highlighting additional actions needed by OMB and 

agencies to improve their implementation of incremental development. In 

these reports, GAO made 42 recommendations. Most agencies agreed or did 

not comment on the recommendations. As of November 2017, 34 of the 

recommendations remained open. 

Managing software licenses. Effective management of software licenses 

can help avoid purchasing too many licenses that result in unused software. 

In May 2014, GAO reported that better management of licenses was needed 

to achieve savings, and made 136 recommendations to improve such 

management. Most agencies generally agreed with the recommendations or 

had no comments. As of November 2017, 112 of the recommendations 

remained open. 

------------- United States Government Accountability Office 
8 


KING-6430 with DISTILLERInsert offset folio 3 here 29502.003

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, 

and Members of the Subcommittees: 

I am pleased to be here today to provide an update on federal agencies' 

efforts to improve the acquisition of information technology (IT). As I have 

previously testified, the effective and efficient acquisition of IT has been a 

long-standing challenge in the federal government 1 In particular, the 

federal government has spent billions of dollars on failed and poorly 

performing IT investments, which often suffered from ineffective 

management Recognizing the importance of government-wide 

acquisition of IT, in December 2014, Congress enacted federal IT 

acquisition reform legislation (commonly referred to as the Federal 

Information Technology Acquisition Reform Act, or FITARA). 2 

In addition, in February 2015, we added improving the management of IT 

acquisitions and operations to our list of high-risk areas for the federal 

government 3 We recently issued an update to our high-risk report and 

noted that, while progress has been made in addressing the high-risk 

area of IT acquisitions and operations, significant work remains to be 

completed4 

My statement today provides an update on agencies' progress in 

improving the management of IT acquisitions and operations. The 

statement is based on our prior and recently published reports that 

discuss federal agencies' (1) data center consolidation efforts, (2) risk 

levels of major investments as reported on OMB's IT Dashboard, (3) 

implementation of incremental development practices, and (4) 

management of software licenses. A more detailed discussion of the 

1

GAO, Information Technology: Sustained Management Attention to the Implementation 

of FITARA Is Needed to Better Manage Acquisitions and Operations, GA0-17-686T 

(Washington, D.C.: June 13, 2017). 

ZCarf Levin and Howard P. 'Buck' McKeon National Defense Authorization Act for Fiscal 

Year 2015, Pub. L No. 113-291, div. A, title VIII, subtitle D, 128 Stat 3292, 3438-3450 

(Dec. 19, 2014). 

3

GAO, High-Risk Series: An Update, GA0-15-290 (Washington, D.C.: Feb. 11, 2015). 

GAO maintains a high~risk program to focus attention on government operations that it 

identifies as high risk due to their greater vulnerabilities to fraud, waste, abuse, and 

mismanagement or the need for transformation to address economy, efficiency, or 

effectiveness challenges. 

4

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Effutts 

Needed on Others, GA0-17-317 (Washington, D.C.: Feb. 15, 2017). 

Page 1 GA0-18·234T 
9 


KING-6430 with DISTILLERInsert offset folio 4 here 29502.004

Background 

objectives, scope, and methodology for this work is included in each of 

the reports that are cited throughout this statement. 

We conducted the work upon which this statement is based in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives. 

According to the President's budget, the federal government plans to 

invest more than $96 billion for IT in fiscal year 2018-the largest amount 

ever. However, as we have previously reported, investments in federal IT 

too often result in failed projects that incur cost overruns and schedule 

slippages, while contributing little to the desired mission-related 

outcomes. For example: 

The Department of Veterans Affairs' Scheduling Replacement Project 

was terminated in September 2009 after spending an estimated $127 

million over 9 years. 5 

The tri-agency' National Polar-orbiting Operational Environmental 

Satellite System was halted in February 2010 by the White House's 

Office of Science and Technology Policy after the program spent 16 

years and almost $5 billion. 7 

5

GAO, Information Technology: Management Improvements Are Essential to VA's Second 

Effort to Replace Its Outpatient Scheduling System, GA0-1 0-579 (Washington, D.C.: May 

27, 2010). 

6The weather satellite program was managed by the National Oceanic and Atmospheric 

Administration, the Department of Defense, and the National Aeronautics and Space 

Administration. 

7

See, for example, GAO, Polar-Orbiting Environmental Satellites: With Costs Increasing 

and Data Continuity at Risk, Improvements Needed in Tri-agency Decision Making, 

GA0-09-564 (Washington, D.C.: June 17, 2009) and Environmental Satellites: PolarOrbiting Satellite Acquisition Faces Delays; DeciSions Needed on Whether and How to 

Ensure Climate Data Continuity, GA0-08-518 (Washington, D.C.: May 16, 2008). 

Page2 GA0-18-234T 
10 


KING-6430 with DISTILLERInsert offset folio 5 here 29502.005

The Department of Homeland Security's Secure Border Initiative 

Network program was ended in January 2011, after the department 

obligated more than $1 billion for the program• 

The Office of Personnel Management's Retirement Systems 

Modernization program was canceled in February 2011, after the 

agency had spent approximately $231 million on its third attempt to 

automate the processing of federal employee retirement claims. 9 

The Department of Veterans Affairs' Financial and Logistics 

Integrated Technology Enterprise program was intended to be 

delivered by 2014 at a total estimated cost of $609 million, but was 

terminated in October 2011. 10 

The Department of Defense's Expeditionary Combat Support System 

was canceled in December 2012 after spending more than a billion 

dollars and failing to deploy within 5 years of initially obligating 

funds. 11 

Our past work found that these and other failed IT projects often suffered 

from a lack of disciplined and effective management, such as project 

planning, requirements definition, and program oversight and 

governance. In many instances, agencies had not consistently applied 

best practices that are critical to successfully acquiring IT. 

8

See, for example, GAO, Secure Border Initiative: DHS Needs to Strengthen Management 

and Oversight of Its Prime Contractor, GA0-11-6 (Washington, D.C.: Oct. 18, 2010); 

Secure Border lnll.iative: DHS Needs to Reconsider Its Proposed Investment in Key 

Technology Program, GA0-10-340 (Washington, D.C.: May 5, 2010); and Securo Border 

Initiative: DHS Needs to Address Testing and Performance Limitations That Place Key 

Technology Program at Risk, GA0-10-158 (Washington, D.C.: Jan. 29, 2010). 

9

See, for example, GAO, Office of Personnel Management: Retirement Modernization 

Planning and Management Shortcomings Need to Be Addressed, GA0-09-529 

(Washington, D.C.: Apr. 21, 2009) and Office of Personnel Management: Improvements 

Needed to Ensure Successful Retirement Systems Modernization, GA0-08-345 

(Washington, D.C.: Jan. 31, 2008). 

10GAO, Information Technology: Actions Needed to Fully Establish Program Management 

Capability for VA's Financial and Logistics Initiative, GA0-10-40 (Washington, D.C .. Oct. 

26, 2009). 

11GAO, DOD Financial Management: Implementation Weaknesses in Army and Air Force 

Business Systems Could Jeoparc#ze DOD's Auditabifity Goals, GA0-12-134 (Washington, 

D.C.: Feb. 28, 2012) and DOD Business Transformation: Improved Management 

Oversight of Business System Modernization Efforts Needed, GA0-11-53 (Washington, 

D.C.: Oct. 7, 2010). 

Page3 GA0·18-234T 
11 


KING-6430 with DISTILLERInsert offset folio 6 here 29502.006

FITARA Can Improve 

Agencies' Management of 

IT 

Such projects have also failed due to a Jack of oversight and governance. 

Executive-level governance and oversight across the government has 

often been ineffective, specifically from chief information officers (CIO). 

For example, we have reported that some CJOs' roles were limited 

because they did not have the authority to review and approve the entire 

agency IT portfolio.12 

FIT ARA was intended to improve agencies' acquisitions of IT and enable 

Congress to monitor agencies' progress and hold them accountable for 

reducing duplication and achieving cost savings. The law includes 

specific requirements related to seven areas.13 

Federal data center consolidation initiative (FDCCI). Agencies are 

required to provide OMB with a data center inventory, a strategy for 

consolidating and optimizing their data centers (to include planned 

cost savings}, and quarterly updates on progress made. The Jaw also 

requires OMB to develop a goal for how much is to be saved through 

this initiative, and provide annual reports on cost savings achieved. 

Enhanced transparency and improved risk management. OMB 

and covered agencies are to make detailed information on federal IT 

investments publicly available, and agency CIOs are to categorize 

their investments by level of risk. Additionally, in the case of major IT 

investments 14 rated as high risk for 4 consecutive quarters, the law 

requires that the agency CIO and the investment's program manager 

12GAO, Federal Chief Information Officers: Opportunities Exist to Improve Role in 

Information Technology Management, GA0-11-634 (Washington, D.C.: Sept. 15, 2011). 

1

3rhe provisions apply to the agencies covered by the Chief Financial Officers Act of 

1990, 31 U.S. C.§ 901{b). These agencies are the Departments of Agriculture, 

Commerce, Defense, Education, Energy, Health and Human Services, Homeland 

Security, Housing and Urban Development, Justlce, Labor, State, the Interior, the 

Treasury, Transportation, and Veterans Affairs; the Environmental Protection Agency, 

General Services Administration, National Aeronautics and Space Administration, National 

Science Foundation, Nuclear Regulatory Commission, Office of Personnel Management, 

Smarr Business Administration, Social Security Adminlstraflon, and U.S. Agency for 

International Development. However, F!TARA has generally limited application to the 

Department of Defense. 

14Major IT investment means a system or an acquisition requiring special management 

attention because it has significant program or policy implications; high executive visibility; 

high development, operating, or maintenance costs; an unusual funding mechanism; or is 

defined as major by the agency's capita! planning and investment control process. 

Page4 GA0·1B·234T 
12 


KING-6430 with DISTILLERInsert offset folio 7 here 29502.007

conduct a review aimed at identifying and addressing the causes of 

the risk. 

Agency CIO authority enhancements. CIOs at covered agencies 

are required to (1) approve the IT budget requests of their respective 

agencies, (2) certify that OMS's incremental development guidance is 

being adequately implemented for IT investments, (3) review and 

approve contracts for IT, and (4) approve the appointment of other 

agency employees with the title of CIO. 

Portfolio review. Agencies are to annually review IT investment 

portfolios in order to, among other things, increase efficiency and 

effectiveness and identify potential waste and duplication. In 

establishing the process associated with such portfolio reviews, the 

law requires OMB to develop standardized performance metrics, to 

include cost savings, and to submit quarterly reports to Congress on 

cost savings. 

Expansion of training and use of IT acquisition cadres. Agencies 

are to update their acquisition human capital plans to address 

supporting the timely and effective acquisition of IT. In doing so, the 

law calls for agencies to consider, among other things, establishing IT 

acquisition cadres or developing agreements with other agencies that 

have such cadres. 

Government-wide software purchasing program. The General 

Services Administration is to develop a strategic sourcing initiative to 

enhance government-wide acquisition and management of software. 

In doing so, the law requires that, to the maximum extent practicable, 

the General Services Administration should allow for the purchase of 

a software license agreement that is available for use by all executive 

branch agencies as a single user. 15 

Maximizing the benefit of the Federal Strategic Sourcing 

Initiative." Federal agencies are required to compare their purchases 

of services and supplies to what is offered under the Federal Strategic 

1

5rhe Making Electronic Government Accountable by Yielding Tangible Efficiencies Act of 

2016, or the "MEGABYTE Act" further enhances CIOs' management of software licenses 

by requiring agency CIOs to establish an agency software licensing policy and a 

comprehensive software license inventory to track and maintain licenses, among other 

requirements. Pub. L. No. 114-210 (July 29, 2016); 130 Stat. 824. 

16The Federal Strategic Sourcing Initiative is a program established by the General 

Services Administration and the Department of the Treasury to address government~wide 

opportunities to strategically source commonly purchased goods and services and 

eliminate duplication of efforts across agencies, 

Page 5 GA0-18·234T 
13 


KING-6430 with DISTILLERInsert offset folio 8 here 29502.008

Sourcing Initiative. OMB is also required to issue regulations related 

to the initiative. 

In June 2015, OMB released guidance describing how agencies are to 

implement FITARA. 17 This guidance is intended to, among other things: 

assist agencies in aligning their IT resources with statutory 

requirements; 

establish government-wide IT management controls that will meet the 

law's requirements, while providing agencies with flexibility to adapt to 

unique agency processes and requirements; 

clarify the CIO's role and strengthen the relationship between agency 

CIOs and bureau CIOs; and 

strengthen CIO accountability for IT costs, schedules, performance, 

and security. 

The guidance identified several actions that agencies were to take to 

establish a basic set of roles and responsibilities (referred to as the 

common baseline) for CIOs and other senior agency officials, which were 

needed to implement the authorities described in the law. For example, 

agencies were required to conduct a self-assessment and submit a plan 

describing the changes they intended to make to ensure that common 

baseline responsibilities were implemented. Agencies were to submit their 

plans to OMB's Office of E-Government and Information Technology by 

August 15, 2015, and make portions of the plans publicly available on 

agency websites no later than 30 days after OM B approval. As of 

November 2016, all agencies had made their plans publicly available. 

In addition, in August 2016, OMB released guidance intended to, among 

other things, define a framework for achieving the data center 

consolidation and optimization requirements of FIT ARA. 18 The guidance 

includes requirements for agencies to: 

maintain complete inventories of all data center facilities owned, 

operated, or maintained by or on behalf of the agency; 

17 OMS, Management and Oversight of Federal Information Technology, Memorandum M15-14 (Washington, D.C.: June 10, 2015). 

180MB, Data Center Optimization Initiative (DCOI), Memorandum M-16~19 (Washington 

D.C.: Aug. 1, 2016). 

Page 6 GA0-18-234T 
14 


KING-6430 with DISTILLERInsert offset folio 9 here 29502.009

IT Acquisitions and 

Operations Identified by 

GAO as a High-Risk Area 

develop cost savings targets for fiscal years 2016 through 2018 and 

report any actual realized cost savings; and 

measure progress toward meeting optimization metrics on a quarterly 

basis. 

The guidance also directs agencies to develop a data center 

consolidation and optimization strategic plan that defines the agency's 

data center strategy for fiscal years 2016, 2017, and 2018. This strategy 

is to include, among other things, a statement from the agency CIO 

indicating whether the agency has complied with all data center reporting 

requirements in FITARA. Further, the guidance indicates that OMS is to 

maintain a public dashboard that will display consolidation-related costs 

savings and optimization performance information for the agencies. 

In February 2015, we introduced a new government-wide high-risk area, 

Improving the Management of IT Acquisitions and Operations. 19 This area 

highlighted several critical IT initiatives in need of additional congressional 

oversight, including (1) reviews of troubled projects; (2) efforts to increase 

the use of incremental development; (3) efforts to provide transparency 

relative to the cost, schedule, and risk levels for major IT investments; (4) 

reviews of agencies' operational investments; (5) data center 

consolidation; and (6) efforts to streamline agencies' portfolios of IT 

investments. We noted that implementation of these initiatives was 

inconsistent and more work remained to demonstrate progress in 

achieving IT acquisition and operation outcomes. 

Further, our February 2015 high-risk report stated that, beyond 

implementing FITARA, OMB and agencies needed to continue to 

implement our prior recommendations in order to improve their ability to 

effectively and efficiently invest in IT. Specifically, from fiscal years 2010 

through 2015, we made 803 recommendations to OMB and federal 

agencies to address shortcomings in IT acquisitions and operations. 

These recommendations included many to improve the implementation of 

the aforementioned six critical IT initiatives and other government-wide, 

cross-cutting efforts. We stressed that OMB and agencies should 

demonstrate government-wide progress in the management of IT 

investments by, among other things, implementing at least 80 percent of 

Page7 GA0~18-234T 
15 


KING-6430 with DISTILLERInsert offset folio 10 here 29502.010

our recommendations related to managing IT acquisitions and operations 

within 4 years. 

In February 2017, we issued an update to our high-risk series and 

reported that, while progress had been made in improving the 

management of IT acquisitions and operations, significant work still 

remained to be completed. 2

° For example, as of November 2017, OMB 

and agencies had fully implemented 452 (or about 56 percent) of the 803 

recommendations. This was an increase of about 284 recommendations 

compared to the number of recommendations we reported as being fully 

implemented in 2015. Figure 1 summarizes the progress that OMB and 

agencies have made in addressing our recommendations as compared to 

the 80 percent target, as of November 2017. 

Figure 1: Summary of the Office of Management and Budget's and Federal 

Agencies' Progress in Addressing GAO's Recommendations, as of November 2017 

•• 40 60 

Pereent of recommendations Implemented (fiscal years 2010 through 2015} 

Sourc&: Office of Management and Budget an\'1 agsocydata. I GA0.18-234T 

80 100 

In addition, in fiscal year 2016, we made 202 new recommendations, thus 

further reinforcing the need for OMB and agencies to address the 

shortcomings in IT acquisitions and operations. Also, beyond addressing 

our prior recommendations, our 2017 high-risk update noted the 

importance of OMB and federal agencies continuing to expeditiously 

implement the requirements of FITARA. 

To further explore the challenges and opportunities to improve federal IT 

acquisitions and operations, we convened a forum on September 14, 

2016, to explore challenges and opportunities for CIOs to improve federal 

IT acquisitions and operations-with the goal of better informing 

policymakers and government leadership21 Forum participants, which 

included 13 current and former federal agency CIOs, members of 

21GAO, information Technology: Opportunities for Improving Acquisitions and Operations, 

GA0-17-251SP (Washington, D.C.: Apr. 11, 2017). 

Page 8 GA0-18-234T 
16 


KING-6430 with DISTILLERInsert offset folio 11 here 29502.011

Congress, and private sector IT executives, identified key actions related 

to seven topics: (1) strengthening FITARA, (2) improving CIO authorities, 

(3) budget formulation, (4) governance, (5) workforce, (6) operations, and 

(7) transition planning. A summary of the key actions, by topic area, 

identified during the forum is provided in figure 2. 

PageS 
17 


KING-6430 with DISTILLERInsert offset folio 12 here 29502.012

Figure 2: Key Actions. by Topic Area, Identified by Forum Participants to Improve Information Technology Acquisitions and 

Operations 

• Congressional oversight could be more aggressive 

• Office of Management and Budget (OMB} may need to strengthen its role 

• The Department of Defense should be required to implement all provisions of the 

Federal Information Technology Acquisition Reform Act (FITARA) 

• Have the Chief Information Officers (CIO) Council play an enhanced role in 

improving authorities 

• Implement collaborative governance 

• Evolve the role of the CIO to enable change 

• Focus on cybersecurity to change existing cultures 

• Use information technology (IT) spend plans to improve budgets 

• Examine agency programs to capture additional IT spending 

• Simplify the definition of IT 

• Work more closely with procurement organizations 

• Work with congressional committees to explore budgeting ftexibilities 

• Obtain support from agency leadership 

• Enhance governance at OMB and agencies 

• Use security authorities to enhance governance 

• Strengthen oversight for IT purchased as a service 

• Buy more and develop less 

• Evolve procurement processes to align with new technologies 

• Attract more qualified CIOs by appealing to key missions 

• Have the Federal CIO play a more active role in attracting agency CIOs 

• Give CIOs more human resource flexibilities 

• Focus on attracting and investing in a more holistic IT workforce 

• Better integrate private sector talent into the IT workforce 

• Use a strategic approach for legacy system migration 

• Migrate more services to the cloud 

• Implement strategies to mitigate the impact on jobs when closing data centers 

• Convey IT and cyber issues early to leadership 

• Encourage Congress to focus on IT and cybersecurity at confirmation hearings 

• Ensure that IT and cyber issues are OMB priorities 

• Ensure GAO plays a role highlighting its work and expertise 

In addition, in January 2017, the Federal CIO Council concluded that 

differing levels of authority over IT-related investments and spending 

Page 10 GA0·18·234T 
18 


KING-6430 with DISTILLERInsert offset folio 13 here 29502.013

Current Administration 

Has Undertaken Efforts to 

Improve Federal IT 

have led to inconsistencies in how IT is executed from agency to agency. 

According to the Council, for those agencies where the CIO has broad 

authority to manage all IT investments, great progress has been made to 

streamline and modernize the federal agency's footprint. For the others, 

where agency CIOs are only able to control pieces of the total IT footprint, 

it has been harder to achieve improvements.22 

The current administration has initiated additional efforts aimed at 

improving federal IT, including digital services. Specifically, in March 

2017, the administration established the Office of American Innovation, 

which has a mission to, among other things, make recommendations to 

the President on policies and plans aimed at improving federal 

government operations and services and on modernizing federal IT. In 

doing so, the office is to consult with both OMB and the Office of Science 

and Technology Policy on policies and plans intended to improve 

government operations and services, improve the quality of life for 

Americans, and spur job creation.2' 

In May 2017, the administration also established the American 

Technology Council, which has a goal of helping to transform and 

modernize federal agency IT and how the federal government uses and 

delivers digital services. The President is the chairman of this council, and 

the Federal CIO and the United States Digital Service24 administrator are 

members. 

22CIO Council, State of Federal Information Technology (Washington, D.C.: January 

2017). 

2

3-rhe White House Office of Science and T echno!ogy Policy provides the President and 

others within the Executive Office of the President with advice on the scientific, 

engineering, and technological aspects of the economy, national security, homeland 

security, health, foreign relations, the environment, and the technological recovery and 

use of resources, among other topics. 

24The United States Digital Service is an office within OMB which aims to improve the 

most important public-facing federal digital services. 

Page 11 GA0~18-234T 
19 


KING-6430 with DISTILLERInsert offset folio 14 here 29502.014

Congress Has Taken 

Action to Continue 

Selected FITARA 

Provisions and Modernize 

Federal IT 

Agencies Have Taken 

Steps to Implement 

FITARA, but 

Additional Actions are 

Needed to Address 

Related 

Recommendations 

Congress has recognized the importance of agencies' continued 

implementation of FITARA provisions, and has taken legislative action to 

extend selected provisions beyond their original dates of expiration. For 

example, Congress has passed legislation to: 25 

remove the expiration date for enhanced transparency and improved 

risk management provisions, which were set to expire in 2019; 

remove the expiration date for portfolio review, which was set to 

expire in 2019; and 

extend the expiration date for FDCCI from 2018 to 2020. 

In addition, Congress is considering legislation to ensure the availability of 

funding to help further agencies' efforts to modernize IT.26 Specifically, 

recently proposed legislation calls for agencies to establish working 

capital funds for use in transitioning from legacy systems, as well as for 

addressing evolving threats to information security. The legislation also 

proposes the creation of a technology modernization fund within the 

Department of the Treasury, from which agencies could borrow money to 

retire and replace legacy systems as well as acquire or develop systems. 

Agencies have taken steps to improve the management of IT acquisitions 

and operations by implementing key FITARA initiatives. However, 

agencies would be better positioned to fully implement the law and, thus, 

realize billions in cost savings and additional management improvements, 

if they addressed the numerous recommendations we have made aimed 

at improving data center consolidation, increasing transparency via 

OMB's IT Dashboard, implementing incremental development, and 

managing software licenses. 

25FITARA Enhancement Act of 2017, H.R. 3243, 115th Cong. (2017). 

26National Defense Authorization Act for Fiscal Year 2018, H.R 2810, 115th Cong., div. A, 

Title X, Subtitle H (as passed by the Senate on Sept. 18, 2017). A conference agreement 

on this legislation is pending. 

Page 12 GA0-18-234T 
20 


KING-6430 with DISTILLERInsert offset folio 15 here 29502.015

Agencies Have Made 

Progress in Consolidating 

Data Centers, but Need to 

Take Action to Achieve 

Planned Cost Savings 

One of the key initiatives to implement FITARA is data center 

consolidation, OMB established FDCCI in February 2010 to improve the 

efficiency, performance, and environmental footprint of federal data 

center activrties, and the enactment of FIT ARA reinforced the initiative. 

However, in a series of reports that we issued from July 2011 through 

August 2017, we noted that, while data center consolidation could 

potentially save the federal government billions of dollars, weaknesses 

existed in several areas, including agencies' data center consolidation 

plans, data center optimization, and OMB's tracking and reporting on 

related cost savings. 27 In these reports, we made a matter for 

Congressional consideration, and a total of 160 recommendations to 

OMB and 24 agencies to improve the execution and oversight of the 

initiative. Most agencies and OMB agreed with our recommendations or 

had no comments, As of November 2017, 84 of these recommendations 

remained open. 

For example, in May 2017, we reported28 that the 24 agencies29 

participating in FDCCI collectively had made progress on their data center 

closure efforts. Specifically, as of August 2016, these agencies had 

identified a total of 9,995 data centers, of which they reported having 

closed 4,388, and having plans to close a total of 5,597 data centers 

Data Center Optimization: Agencies Need to Address Challenges and Improve 

Progress to Achieve Cost Savings Goal, GA0-17-448 (Washington, D.C.: Aug. 15, 2017); 

Data Center Optimization: Agencies Need to Complete Plans to Address Inconsistencies 

in Reponed Savings, GA0-17-388 (Washington, D.C.: May 18, 2017); Data Center 

Consolidation: Agencies Making Progress, but Planned Savings Goals Need to Be 

Established [Reissued on March 4, 2016], GA0-16-323 (Washington, D.C.: Mar. 3, 2016); 

Data Center Consolidation: Reporting Can Be Improved to Reflect SubstanUal Planned 

Savings, GA0-14-713 {Washington, D.C.: Sept. 25, 2014); Data Center Consolidation: 

Strengthened Oversight Needed to Achieve Cost Savings Goal, GA0-13·378 

(Washington, D.C.: Apr. 23, 2013); Data Center Consolidation: Agencies Making Progress 

on Efforts, but Inventories and Plans Need to Be Completed, GA0-12-742 {Washington, 

D.C.: July 19, 2012); and Data Center ConsolidaUon: Agencies Need to Complete 

Inventories and Plans to Achieve Expected Savings, GA0-11-565 (Washington, D.C.: July 

19, 2011). 

28GA0-17 -388. 

~he 24 agencies that FITARA requires to participate in FDCCI are the Departments of 

Agriculture, Commerce, Defense, Education, Energy, Health and Human Services, 

Homeland Security, Housing and Urban Development, the Interior, Justice, Labor, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency; 

Genera! Services Administration; National Aeronautics and Space Administration; National 

Science Foundation; Nuclear Regulatory Commission; Office of Personnel Management; 

Small Business Administration; Social Security Administration; and U.S. Agency for 

International Development. 

Page 13 GA0-18-234T 
21 


KING-6430 with DISTILLERInsert offset folio 16 here 29502.016

through fiscal year 2019. Notably, the Departments of Agriculture, 

Defense, the Interior, and the Treasury accounted for 84 percent of the 

completed closures. 

In addition, that report noted that 18 of the 24 agencies had reported 

achieving about $2.3 billion collectively in cost savings and avoidances 

from their data center consolidation and optimization efforts from fiscal 

year 2012 through August 2016. The Departments of Commerce, 

Defense, Homeland Security, and the Treasury accounted for 

approximately $2.0 billion (or 87 percent) of the totaL 

Further, 23 agencies reported about $656 million collectively in planned 

savings for fiscal years 2016 through 2018. This is about $3.3 billion less 

than the estimated $4.0 billion in planned savings for fiscal years 2016 

through 2018 that agencies reported to us in November 2015. Figure 3 

presents a comparison of the amounts of cost savings and avoidances 

reported by agencies to OMB and the amounts the agencies reported to 

us. 

Figure 3: Comparison of Fiscal Years 2016~2018 Planned Cost Savings and 

Avoidances Reported to GAO in November 2015 versus Those Reported to the 

Office of Management and Budget in April 2017 

$3.3 billion difference 

1.0 2.0 3.0 

Total planned cost savings and avoidances. (in billions) 

4.0 

- Reported in agency Data Center Consolidation Initiative {DCOI) strategic plans 

Source:GAOanalyjli&otagencydata.! GA0.18·2:l4T 

As mentioned previously, FITARA required agencies to submit multi-year 

strategies to achieve the consolidation and optimization of their data 

centers no later than the end of fiscal year 2016. Among other things, this 

strategy was to include such information as data center consolidation and 

Page 14 GA0·18-234T 
22 


KING-6430 with DISTILLERInsert offset folio 17 here 29502.017

optimization metrics, and year-by-year calculations of investments and 

cost savings through October 1, 2018. 

Further, OMS's August 2016 guidance on data center optimization 

contained additional information for how agencies are to implement the 

strategic plan requirements of FIT ARA, and stated that agencies were 

required to publicly post their strategic plans to their agency-owned digital 

strategy websites by September 30, 2016. 30 

As of April 2017, only 7 of the 23 agencies that submitted their strategic 

plans-the Departments of Agriculture, Education, Homeland Security, 

and Housing and Urban Development; the General Services 

Administration; the National Science Foundation; and the Office of 

Personnel Management-had addressed all five elements required by the 

OMS memorandum implementing FITARA The remaining 16 agencies 

either partially met or did not meet the requirements. For example, most 

agencies partially met or did not meet the requirements to provide 

information related to data center closures and cost savings metrics. The 

Department of Defense did not submit a plan and was rated as not 

meeting any of the requirements. 

To better ensure that federal data center consolidation and optimization 

efforts improve governmental efficiency and achieve cost savings, in our 

May 2017 report, we recommended that 11 of the 24 agencies take action 

to ensure that the amounts of achieved data center cost savings and 

avoidances are consistent across all reporting mechanisms. We also 

recommended that 17 of the 24 agencies each take action to complete 

missing elements in their strategic plans and submit their plans to OMS in 

order to optimize their data centers and achieve cost savings. Twelve 

agencies agreed with our recommendations, 2 did not agree, and 10 

agencies and OMS did not state whether they agreed or disagreed. 

More recently, in August 2017, we reported that agencies needed to 

address challenges in optimizing their data centers in order to achieve 

cost savings.31 Specifically, we noted that, according to the 24 agencies' 

data center consolidation initiative strategic plans as of April 2017, most 

agencies were not planning to meet OMS's optimization targets by the 

Data Center Optimization Initiative (OCOI), Memorandum M-16-19 (Washington, 

1, 2016). 

31GA0-17-448. 

Page 15 GA0-18-234T 
23 


KING-6430 with DISTILLERInsert offset folio 18 here 29502.018

end of fiscal year 2018. Further, of the 24 agencies, 5-the Department of 

Commerce and the Environmental Protection Agency, National Science 

Foundation, Small Business Administration, and U.S. Agency for 

International Development-reported plans to fully meet their applicable 

targets by the end of fiscal year 2018;32 13 reported plans to meet some, 

but not all, of the targets; 4 reported that they did not plan to meet any 

targets; and 2 did not have a basis to report planned optimization 

milestones because they do not report having any agency-owned data 

centers. Figure 4 summarizes agencies' progress in meeting OMB's 

optimization targets as of February 2017, and planned progress to be 

achieved by September 2017 and September 2018, as of April 2017. 

32U.S. Agency for International Development did not have any tiered data centers in its 

data center inventory. Therefore, the agency only had a basis to report on its plans to 

meet the one OMB optimization metrfc applicable to its non-tiered data centers (i.e., 

server utilization and automated monitoring). 

Page 16 
24 


KING-6430 with DISTILLERInsert offset folio 19 here 29502.019

Figure 4: Agency-Reported Plans to Meet or Exceed the Office of Management and Budget's (OMB) Data Center Optimization 

Targets 

Agency 

Department of Agriculture 

Department of Commerce 

Department of Defense 

Department of Education" 

Department of Energy 

Department of Health and Human Services 

Department of Homeland Security 

Current progress from OMS's 

lnfonnation Technology 

Dashboard (as of February 2017} 

• 

Not applicable 

Planned optimization performance from agency data 

center optimization strategic plan (as of April2017) 

September 2017 September 2018 

• Not applicable Not applicable 

• • Department of Housing and Urban Oevelopment4 

Department of the Interior 

Not applicable Not applicable Notappli<:able 

Department of Justice 

Department of labor 

Department of State 

Department of Transportation 

Department of the Treasury 

Department of Veterans Affairs 

Environmental Protection Agency 

General Services Administration 

Na!ionat Aeronautics and Space Administration 

National Science Foundation!) 

Nuclear Regulatory Commission 

Office of Personnel Management 

Small Business Administration 

Social Security Administration 

U.S. Agency for International Developmentc 

I I 

• 

• 

• I I • • • D 

• • • • • I I • 

D D II Sourw: GAO analysis ofOMB !nfcrnllltkm Technology Dashboard and agt~ney data. I GA0.1~234T 

Note: The five boxes in each column represent OMB's five opttmtzation targets relative to (1) server 

utilization and automated monitoring; (2) energy metering; (3) power usage effectiveness; (4) facility 

utilization; and (5) virtualization. The shaded areas identify agencies' current and planned progress in 

meeting or exceeding OMB's fiscal year 2018 target for each metric. 

a Agency did not have any reported agency-owned data centers in its inventory and, therefore, did not 

have a basis to measure and report on optimization progress. 

Page 17 GA0-18-234T 
25 


KING-6430 with DISTILLERInsert offset folio 20 here 29502.020

"The National Science Foundation did not have any reported agency-owned tiered data centers in its 

inventory as of February 2017 and, therefore, did not have a basis to report on progress for four of 

the five metrics. However, according to the agency's April 2017 data center optimization strategic 

plan, it will have a basis to report on aH five metrics in fiscal years 2017 and 2018. 

"The U.S. Agency for International Development did not have any reported agency-owned tiered data 

centers in its inventory and, therefore, did not have a basis to measure and report on four of the five 

metrics. 

FITARA required OMB to establish a data center optimization metric 

specific to measuring server efficiency, and required agencies to report 

on progress in meeting this metric. To effectively measure progress 

against this metric, OMB directed agencies to replace the manual 

collection and reporting of systems, software, and hardware inventory 

housed within agency-owned data centers with automated monitoring 

tools and to complete this effort no later than the end of fiscal year 2018. 

Agencies were required to report progress in implementing automated 

monitoring tools and server utilization averages at each data center as 

part of their quarterly data center inventory reporting to OMB. 

As of February 2017,4 of the 22 agencies reporting agency-owned data 

centers in their inventory"- the National Aeronautics and Space 

Administration, National Science Foundation, Social Security 

Administration, and U.S. Agency for International Development-reported 

that they had implemented automated monitoring tools at all of their data 

centers. Further, 10 reported that they had implemented automated 

monitoring tools at between 1 and 57 percent of their centers, and 8 had 

not yet begun to report the implementation of these tools. In total, the 22 

agencies reported that automated tools were implemented at 123 (or 

about 3 percent) of the 4,528 total agency-owned data centers, while the 

remaining 4,405 (or about 97 percent) of these data centers were not 

reported as having these tools implemented. Figure 5 summarizes the 

number of agency-reported data centers with automated monitoring tools 

implemented, including the number of tiered and non-tiered centers. 

agencies-the Department of Education and Housing and Urban Development-do 

not have any agency~owned data centers; therefore, they do not have a basis for 

implementing automated monitoring tools. 

Page 18 GA0-18-234T 
26 


KING-6430 with DISTILLERInsert offset folio 21 here 29502.021

Figure 5: Number of Agency~Reported Data Centers with Automated Monitoring Tools tmplemented1 as of February 2017 

4,528 

123 Data centers with automated 

monitoring tools - 3% 

Total number of 

agency-owned data centers 

Source: GAO analysis ofOffloo of Management and Budge! and agency data. ! GA0-16-234T 

Risks Need to Be Fully 

Considered When 

Agencies Rate Their Major 

Investments on OMS's IT 

Dashboard 

To address challenges in optimizing federal data centers, in our August 

2017 report, we made recommendations to 18 agencies and OMB. Ten 

agencies agreed with our recommendations, three agencies partially 

agreed, and six (including OMB) did not state whether they agreed or 

disagreed. 

To facilitate transparency across the government in acquiring and 

managing IT investments, OMB established a public website-the IT 

Dashboard-to provide detailed information on major investments at 26 

agencies, including ratings of their performance against cost and 

schedule targets. Among other things, agencies are to submit ratings 

from their CIOs, which, according to OMS's instructions, should reflect the 

level of risk facing an investment relative to that investment's ability to 

accomplish its goals. In this regard, FITARA includes a requirement for 

CIOs to categorize their major IT investment risks in accordance with 

OMB guidance. 34 

U.S. C.§ 11302(c)(3)(C), 

Page 19 
27 


KING-6430 with DISTILLERInsert offset folio 22 here 29502.022

Over the past 6 years, we have issued a series of reports about the 

Dashboard that noted both significant steps OMB has taken to enhance 

the oversight, transparency, and accountability of federal IT investments 

by creating its Dashboard, as well as concerns about the accuracy and 

reliability of the data.35 1n total, we have made 47 recommendations to 

OMB and federal agencies to help improve the accuracy and reliability of 

the information on the Dashboard and to increase its availability. Most 

agencies agreed with our recommendations or had no comments. As of 

November 2017, 25 recommendations remained open. 

In June 2016, we determined that 13 of the 15 agencies selected for indepth review had not fully considered risks when rating their major 

investments on the Dashboard. Specifically, our assessments of risk for 

95 investments at the 15 selected agencies36 matched the CIO ratings 

posted on the Dashboard 22 times, showed more risk 60 times, and 

showed less risk 13 times. Figure 6 summarizes how our assessments 

compared to the selected investments' CIO ratings. 

35GAO, IT Dashboard: Agencies Need to Fully Consider Risks When Rating Their Major 

Investments, GA0-16-494 (Washington, D.C.: June 2, 2016); IT Dashboard: Agencies Are 

Managing Investment Risk, but Related RaUngs Need to Be More Accurate and Available, 

GA0-14-64 (Washington, D.C.: Dec. 12, 2013); IT Dashboard: Opportunities Exist to 

Improve Transparency and Oversight of Investment Risk at Select Agencies, GA0-13-98 

(Washington, D.C.: Oct. 16, 2012); IT Dashboard: Accuracy Has Improved, and Additional 

Efforts Are under Way to Better Inform Decision Making, GA0-12-210 (Washington, D.C.: 

Nov. 7, 2011 ); Information Technology: OMB Has Made Improvements to Its Dashboard, 

but Furlher Work Is Needed by Agencies and OMB to Ensure Data Accurocy, 

GA0-11-262 (Washington, D.C.: Mar.15, 2011); and Information Technology: OMB's 

Dashboard Has Increased Transparency and Oversight, but Improvements Needed, 

GA0-10-701 (Washington, D.C.: July 16, 2010). 

36The 15 selected agencies were the Departments of Agriculture, Commerce, Defense, 

Education, Energy, Health and Human Services, Homeland Security, the Interior, State, 

Transportation, the Treasury, and Veterans Affairs; the Environmental Protection Agency; 

General Services Administration; and Social Security Administration. 

Page 20 GA0-18-234T 
28 


KING-6430 with DISTILLERInsert offset folio 23 here 29502.023

Figure S: Comparison of Selected Investments' April 2015 Chief Information Officer Ratings to GAO's Assessments 

Chief Information Officer 

ratings for selected 

investments 

GAO's assessment of 

selected investments' risk 

Lowrisk ~~~~ Medlumrisk- High risk 

Sou!'Cfl: GAO's ass.essment of data from the Offk;e of Management and Budget's; Information Technology Dash:boatd. 1 GA0.1&-234T 

Aside from the inherently judgmental nature of risk ratings, we identified 

three factors which contributed to differences between our assessments 

and the CIO ratings: 

Forty of the 95 CIO ratings were not updated during April 2015 (the 

month we conducted our review), which led to differences between 

our assessments and the CIOs' ratings. This underscores the 

importance of frequent rating updates, which help to ensure that the 

information on the Dashboard is timely and accurately reflects recent 

changes to investment status. 

Three agencies' rating processes spanned longer than 1 month. 

Longer processes mean that CIO ratings are based on older data, and 

may not reflect the current level of investment risk. 

Seven agencies' rating processes did not focus on active risks. 

According to OMS's guidance, CIO ratings should reflect the CIO's 

assessment of the risk and the investment's ability to accomplish its 

goals. CIO ratings that do no incorporate active risks increase the 

chance that ratings overstate the likelihood of investment success. 

As a result, we concluded that the associated risk rating processes used 

by the 15 agencies were generally understating the level of an 

investment's risk, raising the likelihood that critical federal investments in 

IT are not receiving the appropriate levels of oversight. 

To better ensure that the Dashboard ratings more accurately reflect risk, 

we made 25 recommendations to 15 agencies to improve the quality and 

Page 21 GA0·18·234T 
29 


KING-6430 with DISTILLERInsert offset folio 24 here 29502.024

Agencies Need to 

Increase Their Use of 

Incremental Development 

Practices 

frequency of their CIO ratings. Twelve agencies generally agreed with or 

did not comment on the recommendations and three agencies disagreed, 

stating that their CIO ratings were adequate. However, we noted that 

weaknesses in these three agencies' processes still existed and that we 

continued to believe our recommendations were appropriate. 

OMB has emphasized the need to deliver investments in smaller parts, or 

increments, in order to reduce risk, deliver capabilities more quickly, and 

facilitate the adoption of emerging technologies. In 2010, it called for 

agencies' major investments to deliver functionality every 12 months and, 

since 2012, every 6 months. Subsequently, FITARA codified a 

requirement that agency CIOs certify that IT investments are adequately 

implementing incremental development, as defined in the capital planning 

guidance issued by OMB37 Further, subsequent OMB guidance on the 

law's implementation, issued in June 2015, directed agency CIOs to 

define processes and policies for their agencies which ensure that they 

certify that IT resources are adequately implementing incremental 

development. 38 

However, in May 2014, we reported39 that 66 of 89 selected investments 

at five major agencies40 did not plan to deliver capabilities in 6-month 

cycles, and less than half of these investments planned to deliver 

functionality in 12-month cycles. We also reported that only one of the five 

agencies had complete incremental development policies. Accordingly, 

we recommended that OMB clarify its guidance on incremental 

development and that the selected agencies update their associated 

policies to comply with OMS's revised guidance (once made available), 

and consider the factors identified in our report when doing so. 

Four of the six agencies agreed with our recommendations or had no 

comments, one agency partially agreed, and the remaining agency 

disagreed with the recommendations. The agency that disagreed did not 

U.S.C. § 11319(b)(1)(B)(ii). 

380MB, Memorandum M~15-14, 

39GAO, Information Technology: Agencies Need to Establish and Implement Incremental 

Development Policies, GA0-14-361 (Washington, D.C.: May 1, 2014). 

4

0-rhese five agencies are the Departments of Defense, Health and Human Services, 

Homeland Security, Transportation, and Veterans Affairs. 

Page 22 GA0·18·234T 
30 


KING-6430 with DISTILLERInsert offset folio 25 here 29502.025

believe that its recommendations should be dependent upon OMB taking 

action to update guidance. In response, we noted that only one of the 

recommendations to that agency depended upon OMB action, and we 

maintained that the action was warranted and could be implemented. 

Subsequently, in August 2016, we reported41 that agencies had not fully 

implemented incremental development practices for their software 

development projects. Specifically, we noted that, as of August 31, 2015, 

22 federal agencies" had reported on the Dashboard that 300 of 469 

active software development projects (approximately 64 percent) were 

planning to deliver usable functionality every 6 months for fiscal year 

2016, as required by OMB guidance. The remaining 169 projects (or 36 

percent) that were reported as not planning to deliver functionality every 6 

months, agencies provided a variety of explanations for not achieving that 

goal. These included project complexity, the lack of an established project 

release schedule, or that the project was not a software development 

project. 

Further, in conducting an in-depth review of seven selected agencies' 

software development projects,43 we determined that 45 percent of the 

projects delivered functionality every 6 months for fiscal year 2015 and 55 

percent planned to do so in fiscal year 2016. However, significant 

differences existed between the delivery rates that the agencies reported 

to us and what they reported on the Dashboard. For example, for four 

agencies (the Departments of Commerce, Education, Health and Human 

Services, and Treasury), the percentage of delivery reported to us was at 

least 10 percentage points lower than what was reported on the 

Dashboard. These differences were due to (1) our identification of fewer 

software development projects than agencies reported on the Dashboard 

41GAO, Information Technology Reform: Agencies Need to Increase Their Use of 

Incremental Development Practices, GA0~16-469 (Washington, D.C.: Aug. 16, 2016). 

42These 22 agencies are the Departments of Agriculture, Commerce, Defense, Education, 

Energy, Health and Human Services, Homeland Security, Housing and Urban 

Development, the Interior, Justice, Labor, State, Transportation, the Treasury, and 

Veterans Affairs; the Environmental Protection Agency, General Services Administration, 

National Archives and Records Administration, Office of Personnel Management, Small 

Business Administration, Social Security Administration, and U.S. Agency for International 

Development. 

4

1-hese seven agencies are the Departments of Commerce, Defense, Education, Health 

and Human Services, Homeland Security, Transportation, and the Treasury. These 

agencies were chosen because they reported a minimum of 12 investments that were at 

least 50 percent or more in development on the Dashboard for fiscal year 2015. 

Page 23 GA0-18-234T 
31 


KING-6430 with DISTILLERInsert offset folio 26 here 29502.026

and (2) the fact that information reported to us was generally more current 

than the information reported on the Dashboard. 

We concluded that, by not having up-to-date information on the 

Dashboard about whether the project is a software development project 

and about the extent to which projects are delivering functionality, these 

seven agencies were at risk that OMB and key stakeholders may make 

decisions regarding the agencies' investments without the most current 

and accurate information. As such, we recommended that the seven 

selected agencies review major IT investment project data reported on 

the Dashboard and update the information as appropriate, ensuring that 

these data are consistent across all reporting channels. 

Finally, while OMB has issued guidance requiring agency CIOs to certify 

that each major IT investment's plan for the current year adequately 

implements incremental development, only three agencies (the 

Departments of Commerce, Homeland Security, and Transportation) had 

defined processes and policies intended to ensure that the CIOs certify 

that major IT investments are adequately implementing incremental 

development•• Accordingly, we recommended that the remaining four 

agencies-the Departments of Defense, Education, Health and Human 

Services, and the Treasury-establish policies and processes for 

certifying that major IT investments adequately use incremental 

development. 

The Departments of Education and Health and Human Services agreed 

with our recommendation, while the Department of Defense disagreed 

and stated that its existing policies address the use of incremental 

development. However, we noted that the department's policies did not 

comply with OMB's guidance and that we continued to believe our 

recommendation was appropriate. The Department of the Treasury did 

not comment on its recommendation. 

More recently, in November 2017, we reported that agencies needed to 

improve their certification of incremental development.45 Specifically, 

agencies reported that 62 percent of major IT software development 

investments were certified by the agency CIO for implementing adequate 

of Management and Budget, FY2017 IT Budget- Capital Planning Guidance. 

45GAO, Information Technology Reform.· Agencies Need to Improve CerUficaUon of 

Incremental Development, GA0-18-148 (Washington, D.C.: Nov. 7, 2017). 

Page 24 GA0·18·234T 
32 


KING-6430 with DISTILLERInsert offset folio 27 here 29502.027

incremental development in fiscal year 2017, as required by FITARA as of 

August 2016. Table 1 identifies the number of federal agency major IT 

software development investments certified for adequate incremental 

development, as reported on the IT Dashboard for fiscal year 2017. 

Table1: Federal Agency Major lnfonnation Technology (IT) Software Development 

Investments Certified for Adequate Incremental Development, as Reported on the IT 

Dashboard for Fiscal Year 2017 

Number of Percent of 

investments investments 

certified for certified for 

Number of adequate adequate 

major incremental incremental 

Agency investments development development 

U.S. Department of Agriculture 4 57% 

Department of Commerce 11 10 91% 

Department of Defense 33 10 30% 

Department of Education 6 86% 

Department of Energy 33% 

Department of Health and Human 

Services 24 20 83% 

Department of Homeland Security 10 6 60% 

Department of Housing and Urban 

Development 100% 

Department of the Interior 67% '"" ____ Department of Justice 100% 

Department of Labor 100% 

Department of State 5 100% 

Department of Transportation 12 3 25% 

Department of the Treasury 10 30% 

Department of Veterans Affairs 10 10 100% 

Environmental Protection Agency 100% 

General Services Administration 100% 

Office of Personnel Management 100% 

Small Business Administration 100% 

Social Security Administration 10 30% 

U.S. Agency for International 

Development 100% 

Total 166 103 62% 

Source GAO analys•s of IT Dashboard data as of Avgusl31, 2016. 1 GA0.1S.::134T 

Page 25 
33 


KING-6430 with DISTILLERInsert offset folio 28 here 29502.028

Officials from 21 of the 24 agencies in our review reported that challenges 

hindered their ability to implement incremental development, which 

included: (1) inefficient governance processes; (2) procurement delays; 

and (3) organizational changes associated with transitioning from a 

traditional software methodology that takes years to deliver a product, to 

incremental development, which delivers products in shorter time frames. 

Nevertheless, 21 agencies reported that the certification process was 

beneficial because they used the information from the process to assist 

with identifying investments that could more effectively use an 

incremental approach, and used lessons learned to improve the agencies' 

incremental processes. 

In addition, as of August 2017, only 4 of the 24 agencies had clearly 

defined CIO incremental development certification policies and processes 

that contained descriptions of the role of the CIO in the process and how 

the CIO's certification will be documented; and included definitions of 

incremental development and time frames for delivering functionality 

consistent with OMB guidance. Figure 7 summarizes our analysis of 

agencies' policies for CIO certification of the adequate use of incremental 

development in IT investments. 

Page 26 GA0~18-234T 
34 


KING-6430 with DISTILLERInsert offset folio 29 here 29502.029

Figure 7: Analysis of Agencies' Policies for Chief Information Officer Certification of the Adequate Use of Incremental 

Development in Information Technology Investments 

Has a policy but 

it does not 

clearly detail 

the certification 

Department of Commerce 

Department of Energy 

Department of Homeland Security 

Department of Transportation 

Department of Education 

Department of the Interior 

Department of Labor 

Department of State 

Department of the Treasury 

Department of Veterans Affairs 

General Services Administration 

National Science Foundation 

Office of Personnel Management 

Social Security Administration 

U.S. 

Department of Heafih and Human Services 

Department of Housing and Urban Development 

Department of Justice 

Environmental Protection Agency 

National Aeronautics and Space A-dministration 

Small Business Administration 

U.S. Agency for International Development 

U.S. Department of Agricufture 

Source: GAO analysis of agency Chief Information Officer certification policies and processes. 1 GA0-18-234T 

Lastly, we reported that OMB's capital planning guidance for fiscal year 

201846 (issued in June 2016) lacked clarity regarding how agencies were 

to address the requirement for certifying adequate incremental 

development While the 2018 guidance stated that agency CIOs are to 

provide the certifications needed to demonstrate compliance with 

FITARA, the guidance did not include a specific reference to the provision 

requiring CIO certification of adequate incremental development We 

noted that, as a result of this change, OMB placed the burden on 

agencies to know and understand how to demonstrate compliance with 

FITARA's incremental development provision. Further, because of the 

lack of clarity in the guidance as to what agencies were to provide, OMS 

FY 2017 IT Budget-Capital Planning Guidance. 

Page 27 GA0-18·234T 
35 


KING-6430 with DISTILLERInsert offset folio 30 here 29502.030

Agencies Need to Better 

Manage Software 

Licenses to Achieve 

Savings 

could not demonstrate how the fiscal year 2018 guidance ensured that 

agencies provided the certifications specifically called for in the law. 

Accordingly, in August 2017, OMB issued its fiscal year 2019 guidance,'7 

which addressed the weaknesses we identified in the previous fiscal 

year's guidance. Specifically, the revised guidance requires agency CIOs 

to make an explicit statement regarding the extent to which the CIO is 

able to certify the use of incremental development, and to include a copy 

of that statement in the agency's public congressional budget justification 

materials. As part of the statement, an agency CIO must also identify 

which specific bureaus or offices are using incremental development on 

all of their investments. 

In our November 2017 report, we made 19 recommendations to 17 

agencies to improve reporting and certification of incremental 

development. Eleven agencies agreed with our recommendations, 1 

partially agreed, and 5 did not state whether they agreed or disagreed. 

OMB disagreed with several of our conclusions, which we continued to 

believe were valid. 

In total, from May 2014 through November 2017, we have made 42 

recommendations to OMB and agencies to improve their implementation 

of incremental development. As of November 2017, 34 of our 

recommendations remained open. 

Federal agencies engage in thousands of software licensing agreements 

annually. The objective of software license management is to manage, 

control, and protect an organization's software assets. Effective 

management of these licenses can help avoid purchasing too many 

licenses, which can result in unused software, as well as too few licenses, 

which can result in noncompliance with license terms and cause the 

imposition of additional fees. 

As part of its PortfolioStat initiative, OMB has developed policy that 

addresses software licenses. This policy requires agencies to conduct an 

annual, agency-wide IT portfolio review to, among other things, reduce 

commodity IT spending. Such areas of spending could include software 

licenses. 

FY 20191T Budget-Capital Planning Guidance. 

Page 28 GA0~18-234T 
36 


KING-6430 with DISTILLERInsert offset folio 31 here 29502.031

In May 2014, we reported on federal agencies' management of software 

licenses and determined that better management was needed to achieve 

significant savings government-wide48 In particular, 22 of the 24 major 

agencies did not have comprehensive license policies and only 2 had 

comprehensive license inventories. In addition, we identified five leading 

software license management practices, and the agencies' 

implementation of these practices varied. 

As a result of agencies' mixed management of software licensing, 

agencies' oversight of software license spending was limited or lacking, 

thus potentially leading to missed savings. However, the potential savings 

could be significant considering that, in fiscal year 2012, 1 major federal 

agency reported saving approximately $181 million by consolidating its 

enterprise license agreements, even when its oversight process was ad 

hoc. Accordingly, we recommended that OMB issue needed guidance to 

agencies; we also made 135 recommendations to the 24 agencies to 

improve their policies and practices for managing licenses. Among other 

things, we recommended that the agencies regularly track and maintain a 

comprehensive inventory of software licenses and analyze the inventory 

to identify opportunities to reduce costs and better inform investment 

decision making. 

Most agencies generally agreed with the recommendations or had no 

comments. As of November 2017, 112 of the recommendations had not 

been implemented. Table 2 reflects the extent to which agencies 

implemented recommendations in these areas. 

Table 2: Agencies' Implementation of Software License Management 

Recommendations 

Tracks and 

maintains a Uses inventory to comprehensive make decisions 

Agency inventory and reduce costs 

Department of Agriculture • • Department of Commerce () • Department of Defense () () 

Department of Education • • Department of Energy () () 

Federal Software Licenses: Better Management Needed to Achieve Significant 

Savings Government-Wide, GA0-14-413 (Washington, D.C.: May 22, 2014). 

Page 29 GA0-18-234T 
37 


KING-6430 with DISTILLERInsert offset folio 32 here 29502.032

Tracks and 

maintains a Uses inventory to 

comprehensive make decisions 

Agency inventory and reduce costs 

Department of Health and Human Services () () 

Department of Homeland Security () () 

Department of Housing and Urban () () Development 

Department of Justice () () 

Department of Labor • () 

Department of State () () 

Department of the Interior () () 

Department of the Treasury () () 

Department ofT ransportation () () 

Department of Veterans Affairs • • Environmental Protection Agency () () 

General Services Administration • • National Aeronautics and Space 

Administration • • Nuclear Regulatory Commission () () 

National Science Foundation () () 

Office of Personnel Management () () 

Small Business Administration () () 

Social Security Administration () () 

U.S. Agency for International Development • • Key: 

e Fully-the agency provided evidence that it fully addressed this recommendation 

f) Partially-the agency had plans to address this recommendation 

Source. GAO analys•s f GA0-11J..234T 

In conclusion, with the enactment of FITARA, the federal government has 

an opportunity to save billions of dollars; improve the transparency and 

management of IT acquisitions and operations; and to strengthen the 

authority of CIOs to provide needed direction and oversight. The forum 

we held also recommended that CIOs be given more authority, and noted 

the important role played by the Federal CIO. 

Most agencies have taken steps to improve the management of IT 

acquisitions and operations by implementing key FITARA initiatives, 

Page 30 GA0·18·234T 
38 


KING-6430 with DISTILLERInsert offset folio 33 here 29502.033

GAO Contacts and 

Staff 

Acknowledgments 

including data center consolidation, efforts to increase transparency via 

OMB's IT Dashboard, incremental development, and management of 

software licenses; and they have continued to address recommendations 

we have made over the past several years. However, additional 

improvements are needed, and further efforts by OMB and federal 

agencies to implement our previous recommendations would better 

position them to fully implement FITARA. 

To help ensure that these efforts succeed, OMB's and agencies' 

continued implementation of FITARA is essential. In addition, we will 

continue to monitor agencies' implementation of our previous 

recommendations. 

Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, 

and Members of the Subcommittees, this completes my prepared 

statement. I would be pleased to respond to any questions that you may 

have at this time. 

If you or your staff have any questions about this testimony, please 

contact Dave Powner, Director, Information Technology at (202) 512-

9286 or pownerd@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this statement. GAO staff who made key contributions to this testimony 

are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, 

Meredith Raymond, and Bradley Roach (Analyst in Charge). 

Page 31 GA0~18·234T 
39 


KING-6430 with DISTILLERInsert offset folio 34 here 29502.034

{102400) 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further pennission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately. 
40 


KING-6430 with DISTILLERInsert offset folio 35 here 29502.035

GAO's Mission 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone 

Connect with GAO 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

Strategic Planning and 

External Liaison 

The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO's commitment to good government 

is reflected in its core values of accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO's website (http:llwww.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov 

and select "E-mail Updates." 

The price of each GAO publication reflects GAO's actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO's website, http:llwww.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information. 

Connect with GAO on Facebook, Flickr, linkedln, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. listen to our Podcasts. 

Visit GAO on the web at www.gao.gov and read The Watchblog. 

Contact: 

Website: http://www.gao.gov/fraudnetffraudnet.htm 

E-mail: fraudnet@gao.gov 

Automated answering system: (800) 424-5454 or (202) 512-7470 

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548 

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 

U.S. Government Accountability Office, 441 G StreetNW, Room 7149 

Washington, DC 20548 

James-Christian Blackwood, Managing Director, spel@gao.gov, (202) 512-4707 

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548 

..! ..... ...... Please Print on Recycled Paper. 
41 

Mr. HURD. Thank you, Mr. Powner. 

Now every agency is going to provide one oral remark, and I believe, Mr. Everett, you’re going to do that for Department of Energy. So now you’re recognized for 5 minutes. 

STATEMENT OF MAX EVERETT 

Mr. EVERETT. Good afternoon, Chairman Hurd and Ranking 

Member Meadows, Ranking Member Kelly, and Ranking Member 

Connolly, and distinguished members of the committee. 

On behalf of the Secretary and deputy secretary, I want to thank 

you for inviting me to testify about the Department of Energy’s implementation of FITARA. FITARA and its cybersecurity complement, FISMA, provide me the authority I need to manage DOE’s 

information technology resources and cybersecurity program. 

I would also like to just mention, my colleagues have come up 

here who are helping us, that you introduced, they are going to be 

a critical part of telling you about the progress we’re making at the 

Department. 

I would also like to acknowledge the dedicated career and contractor IT and cybersecurity professionals across the Department 

whose critical efforts transcend changes in administration. The 

team provided me a strong baseline from which to build, specifically, Mr. Robby Green, who did an outstanding job as the acting 

DOE CIO prior to my appointment. 

In order to effectively exercise FITARA responsibilities, I now report directly to the Secretary and deputy secretary, as Mr. Powner 

noted. They recognize not only the statutory requirement for this, 

but the best practice for public and private sector organizations to 

have technology leadership represented at the executive level. 

This change originated with a secretarial memorandum, and is 

reflected in the DOE organizational chart. I have regular meetings 

with the deputy secretary who every month calls to order the Department’s senior leadership to evaluate progress on DOE’s IT and 

cybersecurity strategic goals. My reporting and working relationships with them are evidence of the success of this FITARA requirement. Direct access to senior leadership is critical to effective 

IT management at the program office level as well. 

My office is developing guidance to program offices with embedded CIOs or officials with CIO-like functions, that they follow the 

FITARA reporting model and elevate these officials to a direct reporting relationship with their respective senior leadership. 

The deputy secretary has instructed that my office should be engaged in the hiring process for any IT management series 2210s 

across the Department. Both at DOE and throughout Federal Government, the traditional outdated model of an IT worker is a challenge. We need professionals with multidisciplinary skills, not just 

the coding and network and typical skills that we look at for IT 

professionals. 

With respect to consolidation and optimization of data centers, 

we’ve closed 84 data centers since 2010, resulting in savings of approximately $21 million, and plan to shutter another 11 more by 

the end of fiscal year 2018. That said, we need to do more in this 

area, which is why we’re examining ways to effectively accelerate 

that process. 


KING-6430 with DISTILLER
42 

One catalyst for optimizing DOE data centers is our expanded 

use of cloud services. Our diverse department with 97 sites in 27 

States can see significant value from increasing our use of cloud 

computing. 

The National Labs are an integral component of the department, 

and as CIO, I engage with the labs through a number of means, 

including the annual laboratory planning and appraisal reviews. I 

have the opportunity to comment on National Lab IT activities and 

can refocus our efforts to address our concerns through development of performance evaluation and measurement plans, which define notable outcomes that the labs must meet in the coming year. 

I have regular meetings with our National Lab CIOs. I also speak 

regularly with the National Lab directors, as well as the lab operating board and participate in their governance meetings. 

DOE is closely monitoring the pending MGT Act to leverage any 

benefits that come out of that. We intend to use FITARA as well 

to continue to be more granular and transparent in our IT cost in 

order to prioritize the digital transformation that we need to undertake as a department. 

In detailing the changes, improvements, and the many challenges that I have seen, it’s been my aim to demonstrate that our 

department is moving in the right direction. The Department’s IT 

and cybersecurity governance mechanisms are inclusive, transparent, and we’re seeking to facilitate timely performance of our diverse mission. 

I firmly believe we’re continuing to advance and improve, which 

would not be possible without the authorities granted by FITARA. 

I’m encouraged by the interest and the efforts of this committee 

and the efforts as well shown by our leadership at the Department, 

and I look forward to achieving those shared goals. 

It’s been my distinct honor to testify here today. And I would be 

pleased now to address your questions. Thank you. 

[Prepared joint statement of Mr. Everett, Ms. Doone, Mr. 

Bashista, and Ms. Helland follows:] 


KING-6430 with DISTILLER
43 


KING-6430 with DISTILLERInsert offset folio 36 here 29502.036

TESTIMONY of the U.S. Department of Energy 

Max Everett 

Chieflnformation Officer 

and 

Alison Doone 

Chief Financial Officer (acting) 

and 

John Bashista 

Senior Procurement Executive 

and 

Barbara Helland 

Associate Director of Advanced Scientific Computing Research 

Before the 

Subcommittees on Information Technology and Government Operations of the 

Committee on Oversight and Government Reform 

U.S. House of Representatives 

November 15,2017 

Good afternoon Chairmen Hurd and Meadows, Ranking Members Kelly and Connolly, and 

distinguished Members of the Committee. On behalf of the Secretary and Deputy Secretary of 

Energy, I thank you for inviting me to testifY about the Department of Energy's (DOE or 

Department) implementation of what is commonly referred to as the lssa-Connolly Federal 

Information Technology Acquisition Reform Act (FITARA). FITARA and its complement on the 

cybersecurity front, the Federal Information Security Modernization Act (FISMA), provide me 

the authority necessary to manage DOE's information technology (IT) resources and 

cybersecurity program. Today, I will testifY on the progress we are making in exercising our 

FITARA authority, discuss the status of key programs, and share insights into some of our 

challenges. 

To begin, I would be remiss to not acknowledge the dedicated career and contractor IT and 

cybersecurity professionals across the Department whose critical efforts transcend changes in 

administrations. On my first day, the team provided me a strong baseline from which to build. 
44 


KING-6430 with DISTILLERInsert offset folio 37 here 29502.037

ORGANIZATION 

As the DOE Chief Information Officer (CIO), I report directly to the Secretary and Deputy 

Secretary. The Secretary and Deputy Secretary recognized not only the requirement of FITARA 

on this issue-but the driver behind it: the best practice for public and private sector 

organizations to have technology leadership represented at the executive-level of all 

organizations. I have direct access to the Secretary and Deputy Secretary and take direction only 

from them. This change originated with a Secretarial memorandum and is reflected in DOE's 

organizational chart. 

The Secretary has made cybersecurity a priority for the Department, both in our role as the 

Sector-Specific Agency for the Energy sector, and by adopting best-in-class cybersecurity risk 

management practices across the Department. On an operational level, I have regular meetings 

with the Deputy Secretary, who every month calls to order the Department's senior leadership to 

evaluate progress on DOE's IT and cybersecurity strategic goals. My reporting and working 

relationships with them are evidence of the success of this FITARA requirement. 

WORKFORCE 

My Office is working with the Department's Chief Human Capital Officer (CHCO) to develop 

and improve guidance to DOE program offices with embedded CIOs (or officials with CIO-like 

functions), with the expectation that they follow the FITARA reporting model and elevate these 

officials to a direct reporting relationship with their respective senior leadership. Per FITARA, 

my Office is engaged with hiring officials for these positions and rating their performance. The 

Deputy Secretary has instructed the CHCO that my Office should be engaged in the hiring 

process for anyone slotted in an Office of Personnel Management IT Management Series 2210. 

While this direction will result in me obtaining a more comprehensive view of-and the ability 

to set expectations and establish priorities for-the Department's IT workforce, I recognize that 

IT and cybersecurity work is performed by individuals across a variety of duty stations. Both at 

DOE and throughout the Federal Government, the traditional, outdated model of an "IT worker" 

is a challenge, much like our legacy IT systems and unsupported software. We need 

professionals with multi-disciplinary skill sets, not just coding or network operations. They need 

to understand, for example, policy development and implementation, acquisitions, contracts, 

human resources, technical writing, supply chain and risk management, and inter- and intraagency coordination. These professionals need to be customer-focused, tailoring systems and 

operations to meet customer needs from the start, instead of trying to drive customer behavior 

from the top-down. 

DATA CENTER CONSOLIDATION 

Frankly, the Department is not where it should be in this area. Our current inventory includes 

289 data centers; we are working to increase the scope and fidelity of this inventory. We have 

closed 84 data centers since fiscal year (FY) 20 I 0 resulting in savings of approximately 

$21 million and plan to shutter another II more by the end ofFY 2018. We are examining ways 

to do more, and to accelerate the process. One catalyst for optimizing DOE data centers is our 

2 
45 


KING-6430 with DISTILLERInsert offset folio 38 here 29502.038

expanded use of cloud services. Our diverse Department, with 97 sites in 27 states, will see 

significant value from the use of cloud computing. 

INCREMENTAL DEVELOPMENT 

Through our FITARA IT acquisition approval process, we require Departmental elements to 

certify the use of incremental development or explain why it is not indicated. We also validate 

the use of incremental development through our IT Dashboard process, and during our 

Investment Review Board's examinations ofm1\ior IT investments across DOE's program 

offices. Please note that most of our projects involve operations and maintenance, and not 

development, modernization, or enhancement. We are aware that we need to modernize--while 

it is difficult at first, we know it will pay dividends in the long run. 

PORTFOLIO REVIEW EFFORTS 

Ofthe Department's FY 2018 $2.1 billion IT budget, 16 major IT investments total $502 million. 

Following the Subcommittees' issuance of the FITARA Scorecard 4.0, with assistance from our 

colleagues in the Government Accountability Office, we deconstructed our scores to identify 

ways to improve our overall performance. We learned that the Subcommittees want CIOs to 

capture and reflect risk more accurately. Accordingly, we recalibrated our risk ratings for our 

major IT investments to be more aggressive and forward-looking. This ensures that we 

adequately consider, inter alia, losses of good program managers and changes in vendors. 

Although we did not identify any major IT investments as falling into the Office of Management 

and Budget's (OMB) red category, we recently downgraded several to yellow pursuant to our 

new risk calculus. 

From FY 2012 to FY 2017, we reported approximately $66 million in cost savings, of which 

$5 million came in FY 2017. We know that we can do better in this area. 

SOFTWARE LICENSE MANAGEMENT 

We have made progress when it comes to improving software license management. In August 

2017, we issued an enterprise-wide data call to develop a baseline inventory of software licenses 

purchased, deployed, and used. We will conduct another data call to collect information on 

software licensing contracts. With respect to policy documentation, by this December we plan to 

complete a software management centralization plan (which is in draft form) and to develop a 

vendor management strategy. We can also leverage the Department of Homeland Security's 

Continuous Diagnostics and Mitigation program's tools and dashboards to locate, identify, and 

validate software (and hardware) assets within our managed environments. 

The Department's Senior Procurement Executive, working with my Office, will be issuing 

guidance to program offices that will strengthen existing guidance regarding the CIO's review 

and approval ofiT acquisitions. This maturing FITARA acquisition review process gives us 

valuable information on software licensing, and provides an avenue for inquiring into software 

use enterprise-wide. While we have realized some cost savings in this area, we recognize that a 

3 
46 


KING-6430 with DISTILLERInsert offset folio 39 here 29502.039

more robust, enterprise-wide, coordinated effort using a variety of tools and approaches is 

indicated. 

APPLICATION OF FITARA TO THE NATIONAL LABORATORIES 

At a previous hearing before the Subcommittees, Ranking Member Connolly expressed a strong 

interest in FITARA 's application to the National Laboratories (National Labs). 

As CIO, I engage with all National Labs through the Annual Laboratory Planning and Appraisal 

reviews. Not only do I have the opportunity to comment on National Lab IT activities, I can refocus their efforts to address my concerns through the development of Performance Evaluation 

and Measurement Plans that define notable outcomes that the National Labs must meet in the 

upcoming year. 

By way of illustration, the Office of Science (SC), which oversees ten National Labs for the 

Department, uses a planning and appraisal process with a common structure and scoring system. 

In FY 2016, SC added IT reporting to its Business Systems performance goal for its National 

Labs, and requested information on their current and planned IT and mission-related computing 

investments, as well as a description of their respective processes for approving computing 

procurements. In FY 2017, SC worked with the National Labs' CIOs to further refine their 

processes and to establish a common format; data from that effort has been shared with me. 

DOE FITARA COORDINATION 

Following the Secretary and Deputy Secretary's leadership, my counterparts-the CHCO, the 

Senior Procurement Executive, and the Acting Chief Financial Officer (CFO)-and I meet 

regularly and closely coordinate on the effective use of FITARA authority at DOE. Building on 

the coordination between my Office and that of the CFO, which resulted in the issuance of joint 

IT budget guidance for FY 2018, this year we again issued IT budget guidance and hosted an 

OMB briefing for DOE's Capital Planning and Investment Control officers on the new 

Technology Business Management approach. As mentioned earlier, the Department will issue 

guidance on hiring of CIOs and 221 Os to ensure that my Office is directly involved in hiring and 

performance assessments for those CIOs. As previously stated with respect to procurements, the 

Senior Procurement Executive, in coordination with my Office, will be issuing guidance that will 

strengthen existing guidance relating to my approval ofiT purchases. 

This coordination also extends to the Department's program offices. One program office 

approached my Office for assistance with reviewing draft procurement documents for a proposed 

$1 billion procurement, which included IT and cybersecurity elements, to ensure that the 

program office was aligned with my Office's strategy from the ground up. In another case, my 

Office and a program office that manages a world-class data transport network are examining 

ways to leverage this asset enterprise-wide. 

4 
47 


KING-6430 with DISTILLERInsert offset folio 40 here 29502.040

IT ACQUISTION REFORM AND SECURITY 

As I mentioned at the start, FITARA and FISMA authorities provide me the leverage necessary to 

push toward stretch goals, which I acknowledge may be uncomfortable to some. The 

Department needs a Digital Transformation, and we have identified several areas for immediate 

action, namely: 

• Headquarters Network Refresh/National Capital Region Network Upgrade 

• Integrated Joint Cybersecurity Coordination Center Unclassified Security Operations 

Center 

• Unified CommunicationsNoice over Internet Protocol 

• Headquarters Data Center Migration (Infrastructure as a Service) 

• Secure Mobility and Remote Access Enhancements 

We intend to use FITARA to continue to be more granular and transparent with our IT costs in 

order to efficiently and effectively implement our Digital Transformation efforts. 

CONCLUSION 

In detailing the changes, improvements, and challenges that I have seen during my short time as 

the DOE CIO, it has been my aim to demonstrate that the Department is moving in the right 

direction. The Department's robust IT and cybersecurity governance mechanisms are inclusive, 

transparent, and facilitate timely performance of DOE's diverse mission. I firmly believe we are 

continuing to advance and improve, which would not be possible without the authorities 

provided to us by FITARA. I am encouraged by the interest in and support of our efforts shown 

by the leadership and Members of the Subcommittees, and I look forward to achieving our 

shared goals. 

It has been my distinct honor to testify before you today, and I would be pleased to address your 

questions. 

5 
48 

Mr. HURD. Thank you, Mr. Everett. 

Now I’m going to recognize the gentleman from Montana, Mr. 

Gianforte, for 5 minutes of questions. 

Mr. GIANFORTE. Thank you, Mr. Chairman and Ranking Member 

Kelly. 

I’m new on the Hill. I spent my career in the private sector doing 

IT deployments for large organizations, including deployments at 

170 Federal agencies. So I very much appreciate you each being 

here. 

I wanted to focus on three specific things: First, for Mr. Powner 

generally and then Mr. Everett specifically at DOE, around some 

best practices that are used in the private sector and to what extent they’re present. You’ve already mentioned one, Mr. Everett, 

the movement to the cloud. Why don’t we start there. 

I’m curious, Mr. Powner, to what extent is movement to the 

cloud a priority within the agencies that you work with and audit? 

And do you have any metrics around percentage of enterprise applications moved into cloud facilities? 

Mr. POWNER. I don’t have good metrics on those percentages, but 

we have tracked movement to the cloud as a percentage of their IT 

budget. That’s been somewhere in like—on average, it’s about 4 to 

5 percent when you look at agencies’ IT budget. 

So the bottom line on this is clearly there needs to be more movement to the cloud. You know, we started this years ago, and the 

security was the big concern, and then you had the intel community going to the cloud. Folks felt more comfortable with that. We 

clearly need to go more to the cloud. 

I think when you look at the data center situation, there are 

about at least a third of the agencies that project they’re going to 

be nowhere near optimizing their centers, and they ought to be 

looking to outsource that and go towards the cloud, you know, for 

many of those data centers and everything. 

A couple agencies are already out of the business. We probably 

need a few more of them if they can’t manage this more effectively. 

Mr. GIANFORTE. And when you say cloud, do you mean consolidated data centers or are you actually moving to more commercial, 

multi-tenant applications? 

Mr. POWNER. It’s all the over the board. There’s—you know, infrastructure is a service. You’ve also got software as a service. So 

it’s both the infrastructure and some of the applications. 

Clearly, when you look at the commodity or business systems, 

there is—that’s kind of a no-brainer. In a lot of those areas we 

ought to be going more towards cloud services. There is some big 

applications, electronic health records, I know we’ve talked to the 

chairman about this a lot, with the VA and DOD going to the common electronic health record. There’s commercial products that are 

out there. 

Mr. GIANFORTE. Mr. Everett, at DOE. 

Mr. EVERETT. Sure. So I would certainly address, across the Federal Government, I think the numbers are disappointing. At DOE, 

I think they’re—you know, having come in, I think they’re very disappointing. We need to be moving much more quickly on—again, 

I think you hit on that—the commodity IT activities we need to 

move more quickly to the cloud. I think that will help us certainly 


KING-6430 with DISTILLER
49 

with data center. I think there is some value to moving out of Federal data centers into hosted environments, not as an end goal, but 

I think that starts to break some of the workforce and cultural 

challenges we have. 

We’ve got to have the right skill sets to make a move to a cloud. 

It’s a different—it is different skill sets. It’s much more about managing services, managing service levels, rather than managing people and sort of the turning dials. We’ve got to do a lot of work 

around that. Those things have to go together. I believe they can 

go together in peril. 

In some cases, you know—frankly, my hope is that we just find 

some things and rip the Band-Aid and just move things. We’ve got 

a lot of commodity things that should, frankly, be able to move very 

quickly to the cloud. 

Mr. GIANFORTE. Yeah. As we talk about these scorecards, it 

might be interesting to look at what percentage have we moved to 

the cloud. I know in our own experience doing these enterprise deployments, an off-the-shelf cloud deployment typically can speed 

deployment by 5X and typically reduces operating cost by 80 percent over the life of the system, and that’s just good for taxpayers 

and it’s better from a security perspective. 

The second area I want to talk on, you mentioned the shortage 

of labor, particularly in the cybersecurity area. One of the practices 

in the private sector is the use of commercial third-party firms for 

either cybersecurity audits or penetration testing. To what extent 

is that a general practice, Mr. Powner, and then specifically at 

DOE? 

Mr. POWNER. I think when you start looking at contractors and 

third parties, it’s pretty heavy in the Federal Government. I think 

the challenge in the Federal Government is having enough of an 

IT workforce to oversee those contractors. I mean, because we’ve 

got prime contracts and then you’ve got program management 

that’s being outsourced to private sector firms. Clearly, the security 

penetration tests and all that, that’s going out. 

So the challenge, I think, in the government is having enough of 

qualified IT workforce to oversee those key contracts where we 

don’t have the internal skills. 

Mr. GIANFORTE. Okay. Mr. Everett, we have about 30 seconds. 

Mr. EVERETT. I would concur with that. I think one of our challenges is we’re, you know—frankly, we’re very contractor heavy. 

We depend on the skills that our contractors bring, but we need— 

our Federal workforce has got to have some skills in terms of, 

again, managing them, managing business requirements, managing the budgets around that. I think those are a critical element 

to doing that. And we’ve got—and, again, that takes some of the 

Federal workforce. They have to know the right questions. They 

have to be looking for the right solutions to then bring in the proper contracting and talent and capability. 

And I think you know that recruiting, you know from your private sector experience as I do, that’s an extraordinary challenge we 

face right now. 

Mr. GIANFORTE. Yeah. Okay. Thank you. 

I yield back, Mr. Chairman. 

Mr. HURD. The gentleman yields back. 


KING-6430 with DISTILLER
50 

I now recognize Ms. Kelly for 5 minutes of questions. 

Ms. KELLY. Thank you, Mr. Chair. 

The committee’s scorecard shows that since the release of one of 

its last scorecards, June 2017, many agencies appear to have hit 

roadblocks in their progress under FITARA. For example, as we’ve 

talked about, the current scorecard shows that the overall letter 

grades for 15 agencies stayed the same, 6 went down, and only 3 

increased. 

Mr. Powner, in which of the five key areas of FITARA that was 

scored has GAO found agencies are struggling the most? 

Mr. POWNER. Well, clearly, when you look back on the 4.0, I 

think the data center optimization, because we added the metrics 

category there, it wasn’t just based on savings, and that was at the 

request of a lot of folks. 

And, again, there’s about—there’s 2 agencies that are out of the 

data center business, 3 agencies doing a decent job, and 19 that I 

would say are doing poorly, and that’s a big reason why the grades 

went down. And then now with 5.0, when you have 17 agencies getting Fs because they don’t have a software license inventory, that’s 

a key reason. So those are the two big ones. 

Ms. KELLY. And so what accounts for the challenges? Is it just 

the software license, or what’s accounting for the challenges? 

Mr. POWNER. I think when you look at the data centers, I do 

think it’s—given where we were at, for instance, on server utilization, to try to go from a 9 to 12 percent to 65 percent metric that 

OMB has, okay, that’s a big leap. 

The software licensing, I have a hard time understanding that. 

We did a report 4 years ago that told agencies that they should get 

software licenses. It was in FITARA. It’s one of the seven sections. 

You followed up with MEGABYTE. I think it’s inexcusable that we 

do not have software license inventories at this point in time. 

Ms. KELLY. Thank you. 

Mr. Everett, the Department of Energy was one of the three 

agencies whose letter grade actually went down. What are the challenges you’re facing? 

Mr. EVERETT. There’s a number, as you can clearly see. I think, 

look, the reality is our scorecard accurately represents some significant challenges we have. And Mr. Powner hit on, frankly, two of 

them. One of them is we have too many data centers that we don’t 

have a handle around, and we need to more aggressively—again, 

part of this is we’re—on the data centers we’re doing some things 

around DCIM, which gives us some better measurements of actually how we’re using those existing data centers. 

I think that will drive some business requirements and some 

business cases to close some and help us actually use them better. 

But the better answer to that is move to the cloud. Again, for 

things that are a simple commodity, the answer is we’ve got to get 

to the cloud and we’ve got to do it faster. 

I can’t disagree either on—you know, look, some of my nontechnical colleagues at the Department have asked me, why don’t we 

have a software asset inventory. And they’re right. It shouldn’t be 

that hard. 

Now, I will say that we did a data call. We have, I think, over 

64,000 lines within the database we collected of that. We have a 


KING-6430 with DISTILLER
51 

significant inventory. It’s not complete, and we’re not going to represent it as complete until it is. The vast majority of that that came 

back was, in fact, provided electronically, so that exists in pockets 

in parts of our department. 

We have a number of gaps in the Department, areas that don’t 

have that capability. So one of the things we’re doing is leveraging. 

We’re going back and looking at CDM. We have gaps in our CDM 

deployment, and we’re actually going back and trying to line that 

up and find out, all right, where do we have gaps within programs 

and offices that need help at the enterprise level from my office to 

come back and fill the gaps so that we can have a complete software asset inventory. 

And, again, I just want to add, the software asset inventory is 

valuable not just to have it; it drives—you know, as I work with 

our acquisition team and work in conjunction with them, it’s going 

to save us money. We know that for a fact. 

It’s going to help us reduce our threat surface because it’s going 

to tell us what kind of software we have or don’t have. And then 

it’s going to help us drive our IT transformation as we can see the 

gaps in capability or, frankly, where we have overlap in capability 

where we probably have people buying two or three different of the 

same capability in different software packages. That just needs to 

be eliminated. 

So there’s no painting it any other way. Again, I understand 

many people are failing at it, but I don’t—it’s not rocket science. 

It’s not hard. And we are pushing rapidly through those means to 

get it fixed. 

Ms. KELLY. And do you have any, not saying everything all at 

once, but any time projections or what do you see? 

Mr. EVERETT. So with respect to—certainly with the software inventory piece, we’re in the process right now, we’ve brought somebody into actually to help us be strategic about CDM. And, again, 

our focus there is what are the gaps. 

We have a lot of people that have really great capabilities that 

meet many of the CDM requirements and needs. What we’re looking for is where are the gaps. And then as an enterprise, as a department, how do we come in and help them fill those gaps. 

And, again, because we have a number—we have a very federated, diverse department, we have a lot of good best practices. 

We’ve got a lot of labs and other folks who have great tools in 

place. We’re working with them to get actually what’s working for 

them and try and replicate that or build it across the Department. 

I’ll say on, again, on data centers, one of the immediate things 

we’re working on is we’ve had some folks working on this DCM 

pilot. And, again, our labs have actually led the way. A number of 

our labs have put DCM tools in place and have worked with my 

team to share best practices that we can do across the Department. 

So our next step there is a pilot that we expand across the Department. That’s going to give us a more accurate picture. And I think 

what it’s going to show is that we have a lot of data centers. We 

just don’t need anymore. 

Ms. KELLY. Thank you. 

Mr. HURD. My first question’s actually for Mr. Powner, but you’re 

going to have to look for something. Towards the end of your stateVerDate Nov 24 2008 11:29 May 01, 2018 Jkt 000000 PO 00000 Frm 00057 Fmt 6633 Sfmt 6633 H:\29502.TXT APRIL

KING-6430 with DISTILLER
52 

ment, you talked about budget and system acquisition. I want you 

to pull that up. And while you’re looking for that, I’m going to go 

to Mr. Everett. 

Mr. Everett, take about 30 seconds and tell me how your position 

changed from to reporting to directly to the agency head or the 

deputy agency head. 

Mr. EVERETT. Sure. Well, I—as I walked to the Department in 

July, you know, obviously I’d done a little research before I walked 

in. I knew that was the case. I’ve been around Federal Government 

and private sector the last number of years, so I was very aware 

that this is a challenge across government. And I knew walking in 

the door that that was something I was going to immediately have 

changed. 

The good news for me was I have a Secretary and a deputy secretary, both of whom have seen in public and private sector that 

that was valuable and important. They understood, without really 

any argument from me, that that was simply a best practice. And 

so, literally, it probably would have even happened faster. It just 

took a while to get the memo written and get it passed up to the 

front office. 

But for our office, I’ll simply tell you that our leadership understood that it wasn’t even really a question. It was an expectation 

that IT would be part of the leadership and part of this process. 

Mr. HURD. I would like to attribute that to Secretary Perry’s 

training at the illustrious Texas A&M University for giving him 

that understanding. 

And without objection, I’d like to introduce into the record a 

memo from Max Everett to the Secretary of Department of Energy 

about the designation of the CIO as a direct report to the Secretary, deputy secretary. 

So ordered. 

Mr. HURD. For those that are going to read about this on 

FedScoop, and CIOs that are not reporting directly to an agency 

head or deputy agency head, they should see this memo. And unfortunately, there is still 12 departments or agencies where the 

Federal CIO doesn’t report directly. 

I just want to clarify a point, Mr. Everett, because I think you 

addressed it fairly well. Can you answer that you know 100 percent 

of what’s on your network? 

Mr. EVERETT. Right now, I would have to tell you the answer is 

no. I think the vast majority of people who tell you that, I’m not 

sure that they’re being accurate. 

Mr. HURD. Gotcha. Because my assumption is, if you have a 

number of agencies that don’t understand what software they have 

on their system, they also don’t know what hardware they have on 

their system. And that introduction of unknown vulnerabilities is 

scary. 

Mr. Powner, did you find the quote I was looking for? 

Mr. POWNER. Yes, I did. 

Mr. HURD. Can you repeat that statement, please? 

Mr. POWNER. ‘‘Finally, I’d like to note that our work for this committee on IT budgeting and CIO authority shows that Energy CIO 

is challenged in the areas of IT budgeting in execution, meaning 


KING-6430 with DISTILLER
53 

that there needs to be better visibility into the IT budget and better governance over their system acquisitions.’’ 

Mr. HURD. Ms. Doone, you’re the CFO, correct, acting CFO? 

Ms. DOONE. Yes. 

Mr. HURD. What are you going to do to help Mr. Everett with 

that problem? 

Ms. DOONE. We have been working—the CFO office has been 

working with CIO since the enactment of FITARA to do just that, 

to improve the alignment of the IT portfolio with the budgeting 

process. 

Even before the OMB guidance was issued back in 2015 for the 

fiscal year 2017 budget cycle, we issued guidance out to all the program offices to have them identifying their IT spend by program 

activity and by project. CIO did the likewise, so that their IT portfolio would start delineating the IT across the entire department. 

Mr. HURD. Ms. Doone, do you have responsibility—financial responsibilities over the National Laboratories as well? 

Ms. DOONE. The National Laboratories financial responsibility is 

managed by the program offices. So they report and they submit 

their budget request up through the program offices, who put their 

budgets included in their program office budgets that come to CFO. 

Mr. HURD. So as the CFO of Department of Energy, you have the 

similar challenges that your colleague, Mr. Everett, has with these 

siloed activities by the National Labs, that even though you’re responsible for all the Department of Energy, that you may not have 

the greatest insight into that. Is that an accurate statement? 

Ms. DOONE. It is an accurate statement, but I would suggest that 

it’s getting better. With the expansion of the IT portfolio over the 

last couple of years, we and CIO have expanded the number of 

data elements that the program offices are providing us. So we are 

now able to reconcile the IT portfolio with the budget submission 

that we are getting from the program offices. 

And I think one of the biggest benefits that we’ve had—we started working directly with CIO from the very beginning of the enactment of FITARA. I think the biggest accomplishment has been the 

budget and financial management staff in the program offices and 

their IT counterparts working closely together for the first time. 

And I think that’s where we’re going to begin to see more visibility 

and better transparency, and it’s been both at the Federal program 

office level and at the National Laboratory level. 

Mr. HURD. Thank you. 

The gentleman from the Commonwealth of Virginia is now recognized for his 5 minutes of questions. 

Mr. CONNOLLY. I thank the chair, and welcome to the panel. 

By the way, I would say to my friend from Montana, as someone 

who also spent 20 years in the private sector before coming here, 

in the technology sector, one might look for metrics. If you want 

to know how you’re doing in cloud, look at the data on data center 

consolidation, because you’re not moving to the cloud if that’s not 

being consolidated. If you’re consolidating it, you are moving to the 

cloud, because you have to. 

Now, Mr. Everett, let me just say, I believe you get it and I believe you are an agent of change. And I think the memo the chairman cited gives evidence of that. So don’t take this hostilely, but 


KING-6430 with DISTILLER
54 

your words are welcome, but you got an F in data center consolidation. Your score went down, not up, which suggests regression. 

And it is the Department of Energy, the National Labs, that kind 

of in the dead of night went to the U.S. Senate and got an exemption for themselves. The ink wasn’t even dry in FITARA. Last time 

I checked, that’s under your purview, which would suggest resistance to change, to trying to get this right. 

So why should we believe, you notwithstanding, all of you being 

sincere human beings, why should we not believe that, frankly, the 

Department of Energy is retrograde, they’re not with the program, 

they’re not cooperating, they’re treading water in the hopes we’ll 

give up and stop looking, and progress, you know, is just not in the 

forecast? 

Mr. EVERETT. Well, we have to make that change. 

Mr. CONNOLLY. I can’t hear you. 

Mr. EVERETT. Apologies. Ranking Member, I think the answer is 

we have to make that change. I hope that you don’t give up. 

Mr. CONNOLLY. Oh, we won’t give up. 

Mr. EVERETT. I know you won’t, but, you know, even beyond my 

tenure, I hope that you don’t give up. One of the reasons that Ms. 

Helland is up here is, I can tell you, in my 41⁄2 months at the Department, her work in the Office of Science has been a huge help 

and a huge part of correcting some of those issues. 

I can tell you that our approach, and this starts directly with my 

Secretary and deputy secretary, and I have been in their presence 

when they told this directly to the lab directors was that there is 

one department. That is their expectation. That is the expectation 

they have given to me. That is the expectation I repeat on a regular basis. 

And so I believe that’s—you know, history aside, I believe that’s 

a starting point. I’m glad that Ms. Helland joined us, because, 

again, she has been an ally to me. I think she can talk about some 

of the work she’s actually been doing to help us build some of the 

reporting mechanisms around CPIC, around FITARA, around how 

we hold the labs to a level of accountability that we expect for everyone in the Federal Government. 

Mr. CONNOLLY. And I want to hear that from Ms. Helland, but— 

just one more—but you got an F in data center consolidation, 

which is the heart and sole of FITARA. It’s how we save money. 

It’s how we reinvest in ourselves. It’s how—it’s an actual metric 

whereby we measure are we making progress or not. Tell me why 

you got an F. 

Mr. EVERETT. Because we haven’t done the job. I mean, there is 

no way around it. 

Mr. CONNOLLY. All right. Have you set metrics for yourself internally? 

Mr. EVERETT. We have. 

Mr. CONNOLLY. Okay. How many data centers are there in the 

Department of Energy? 

Mr. EVERETT. I’ll pull it up here, but there are—— 

Mr. CONNOLLY. All right. Take you time while we listen to Ms. 

Helland. 

Mr. EVERETT. 289. 


KING-6430 with DISTILLER
55 

Mr. CONNOLLY. 289, okay. He’s telling the truth, right? No. So 

289. Have you set a goal for yourself that by, you know, a year 

from now or the next report card there will be 289 minus X? 

Mr. EVERETT. The existing goal is 11, is to reduce it by 11. 

Mr. CONNOLLY. By 11? 

Mr. EVERETT. By 11. 

Mr. CONNOLLY. Well, that’s a pretty modest goal. 

Mr. EVERETT. I think that’s exceedingly modest. 

Mr. CONNOLLY. So can we be a little more robust in our goal setting? 

Mr. EVERETT. We will be more robust. We are pulling together 

and working hard. I want to be thoughtful. I don’t want to give a 

number I can’t back up. 

Mr. CONNOLLY. I understand. 

Mr. EVERETT. But at the same time, no, the answer is 11 is a 

pittance. 

Mr. CONNOLLY. But so I would just say, also again to my friend 

from Montana, and I think he would agree, I have experience both 

in the public sector and the private sector. If you don’t set heroic 

goals, stretch goals, nothing happens. Now, not impossible goals, 

because then nothing happens either, but stretch goals. And so 11 

is hardly a stretch goal. And I hope when you come back here, 

you’re able to say, well, we said 11 and it’s 110. We got it off by 

a zero. 

My time is going to run out, but, Ms. Helland, I want to give you 

an opportunity to comment on the National Labs. 

Ms. HELLAND. Thank you. We actually started in 2015, July of 

2015, working with the Office of Science labs. And at that time, we 

also had three Energy labs that we were working with to look at 

our lab planning and appraisal process, which is a way that we actually included CIOs in that process so that we could see—we 

asked them to report on their current IT spending and their current research computing, so that this instrument became effective 

for the other program office—or other program offices in the Office 

of Science. 

Mr. CONNOLLY. Well, I just want to say in closing that I echo 

what the chairman and Ms. Kelly said. What makes me feel better 

about your score is you, because I think you are committed to making this happen, and the reporting sequence is now right. And 

when you’re in that kind of position, you can make things happen, 

and it’s pretty clear you’re committed to doing that. And so we’ll 

back you up. We’ll help you. We’re not going away. 

And I applaud my colleague, Mr. Hurd, on the Republican side 

of the aisle, for absolutely—and Mr. Meadows is near, but the four 

of us, you know, are just not going to give up. And we’re here to 

try to both nudge and support and use it to your advantage. Thank 

you so much. 

Thank you, Mr. Chairman. 

Mr. HURD. Now it’s my pleasure to recognize the distinguished 

gentlewoman from the District of Columbia, Ms. Eleanor Holmes 

Norton, for her 5 minutes of questioning. 

Ms. NORTON. I thank my friend for yielding, and I thank him for 

this hearing, and our witnesses for their informative testimony. 


KING-6430 with DISTILLER
56 

This is a hearing about the Federal Information Technology Reform Act, the act itself. I’m trying not to use letters and acronyms. 

And it’s essentially about IT and the progress we are making at a 

time when that can determine, in private industry, go or stop. I regard it as just as important for the Federal Government. 

I was intrigued by the work of the chief information officers that 

GAO looked at how enhanced authority was assisting the chief information officers in certifying major IT investments. And here’s 

where I need clarification. They said, and I’m quoting here, ‘‘adequately implementing incremental development.’’ I got intrigued, 

what in the world is that, and had staff look it up, and discovered 

that adequately implementing incremental development is for the 

investment to deliver functionality every 6 months. 

So in order for me to understand what that meant, I took as an 

example, since you were testifying here today, Department of Energy, because it was among the agencies that achieved an A score 

on this particular—in this particular category. 

What was responsible—you make me understand incremental development. If you apply it to the Department of Energy, and make 

me understand how the Department of Energy earned an A rating 

for incremental development. 

Mr. EVERETT. So I’d love to take all the credit for that, but that 

I think has been a historical strength of the Department. And, 

again, some of our career folks have been a key component of keeping that going. 

The focus of that is around—I don’t think it’s a secret to many 

of us who have been around D.C. that, historically, when departments engage in long, multiyear projects, those tend to have significant problems in financial management and delivery. 

So the—I think it’s a very good thing to be measuring that, because the importance of that is, when you’re actually delivering capability—you know, this is—you know, in the private industry, it 

would typically cause sort of agile development. You’re constantly 

adding showing capability. You’re demonstrating that you’re actually producing something. 

The flip side of that would be if we did some large, multiyear development and said, we’ll start here, 2 years later, we’ll see what 

happens, historically that has been a very poor management technique in IT and certainly in the Federal Government. 

What I’ve observed so far at the Department of Energy is I think 

we’re deserving of that grade, because I think there’s a lot of focus 

on, again, that incremental movement to make sure we’re delivering something in sort of bite-sized manageable chunks. 

Ms. NORTON. That really does make me understand it. It certainly makes me understand why this every 6 months. And for IT, 

clearly every 6 months is important. 

But since you already are looking every 6 months, what will you 

suggest for those who don’t have—I mean, you’re looking at them 

every 6 months too. So what do they need to do so that every 6 

months—do we need a shorter timeframe for people who don’t have 

A scores, for example? 

Mr. EVERETT. Yeah. I mean, I think you—you’ve got to start— 

you know, you may start to drive the metric a little shorter. You 

may not necessarily have delivery. But finding ways to measure 


KING-6430 with DISTILLER
57 

that—again, the goal of it is just practically to be intermittently actually watching and seeing what’s—— 

Ms. NORTON. Well, does it, in fact, result in increases in the 

score? 

Mr. EVERETT. Oh, yeah, it does. I mean, it certainly has for us. 

Ms. NORTON. By looking every 6 months, even with those who 

haven’t received this A rating, then their ratings tend to go up because you’re looking every 6 months. 

Mr. EVERETT. Yeah. I think you’ve constantly got to watch that 

and measure it and make sure that they really are showing actual 

measurable deliverables and improvements. 

Ms. NORTON. Mr. Powner, did you have anything to add to that? 

Mr. POWNER. No. I think it’s clearly a best practice to go with 

shorter deliveries instead of longer deliveries. I do think—you 

know, when we measure this, we know where all the warts are 

looking under the covers here. So the one thing is this is how they 

plan. If you look closely at whether they deliver against the plan, 

it might be a little less so we shouldn’t get too comfortable. 

The other thing that I would like to say is, as we understand 

more what we actually spend on IT, there’s probably more software 

development projects that should get listed under this category, 

and it might not look so rosy. 

So I don’t want to rain on the parade, but I do think it’s important to make sure we understand that there’s still work for some 

of the those agencies that have As. Go small and it’s much better. 

Ms. NORTON. Appreciate that criticism. 

And thank you, Mr. Chairman. 

Mr. HURD. Thank you. 

A couple of quick questions for you, Ms. Doone, and you, Ms. 

Helland. 

Ms. Doone, what are you going to do to help Mr. Everett populate the Working Capital Fund that we are going to create with a 

successful implementation of the MGT Act? 

Ms. DOONE. Well, once the MGT is enacted, we’ll have to take 

a look at the structure of the Working Capital Fund. 

DOE has an existing Working Capital Fund, and there are several line items in our current Working Capital Fund that are managed by CIO. The most significant one is a cybersecurity investment of about $35 million, which is intended for enterprise-wide 

cybersecurity. So we already leverage our existing Working Capital 

Fund to support his efforts in a number of areas, including network 

support as well. 

Mr. HURD. So the Working Capital Funds created by MGT is 

something that only the CIO can touch, and it’s to put money that 

is saved from doing things like transitioning into the cloud, getting 

your software licensing under control, because the savings that 

they’re going to realize, they’re not going to be able to use in that 

calendar year. 

How do we make sure that that’s captured so that by the end of 

next fiscal year, that money is transferring to that account? 

Ms. DOONE. Yeah. That would be something that we would have 

to look at. And, yes, if this were a mechanism totally dedicated to 

capturing the savings from the variety of IT savings, then that 

would be something that we could do and perhaps look at that and 


KING-6430 with DISTILLER
58 

see if that could then support it. Because that would be a mechanism that would target that money, those savings directly recouping them and allowing CIO to invest into much-needed enterprise 

IT modernization. 

Mr. HURD. Do you think we can do that within a calendar year, 

12 months? There’s only one answer to that, by the way. 

Ms. DOONE. It’s certainly a very straightforward request to recapture savings. The challenge is identifying those savings and getting them captured and moving them over to—— 

Mr. HURD. As long as you’re in this position, are you committed 

to helping Mr. Everett do that? 

Ms. DOONE. Oh, absolutely. 

Mr. HURD. Mr. Bashista, are you involved too? 

Mr. BASHISTA. Yes, sir. A number of initiatives that we’re supporting the CIO, as we discussed, the CFO and CIO in procurement and contracting, we face a lot of the same challenges being 

decentralized. So on a programmatic basis—— 

Mr. HURD. I get it. But are you going to help Mr. Everett make 

sure we capture that savings when he improves the software licensing, introduces CDM, and figures out their technology doesn’t 

have, and he saves money, are you going to help us make sure and 

work with Ms. Doone in getting that in an MGT Working Capital 

Fund? 

Mr. BASHISTA. Absolutely. 

Mr. HURD. Awesome. 

Ms. Helland, the National Laboratory CIO’s council, who does 

that report to? 

Ms. HELLAND. It actually reports to—I mean, it was formed by 

the National Lab—the CIOs at the National Labs for them to identify common practices and best practices across the labs so that 

they could work together. Technically, I’m not sure it reports to 

anybody, but we certainly—both Max and I sit on the executive 

board. 

Mr. HURD. Mr. Everett, do you have a response to that? 

Mr. EVERETT. So the NL CIO council reports to the—I believe it’s 

to the National Lab director’s executive council. 

Mr. HURD. Do you have insight into the types of things the CIOs 

at the National Labs are putting on their network? 

Mr. EVERETT. We do. And we’re—so we don’t have full—again, 

and I tell you, in all honesty, I don’t have that fully on our current 

network. We are in the process. And, again, at the direction of our 

deputy secretary, within 2 weeks of his joining, we put forward a 

memo under his name that I am responsible for as part of our 

iJC3, which is for our enterprise SOC, that all elements of the Department, including all laboratories, sites, Federal program offices, 

everybody is going to be responsible. And we’re working right now 

to deliver certain data that I have put together a taxonomy on that 

will come up for us in a consolidated manner so that we have—and, 

again, that’s an initial visibility across every network in the Department. 

The move from that will be to then incorporate the CDM capabilities, to your point, so that we can see hardware, software, all 

the other pieces, so that we can have that visibility of our 

cybersecurity posture across the entire Department, labs included. 


KING-6430 with DISTILLER
59 

Mr. HURD. Great. And, Mr. Powner, I’m looking forward to GAO 

reviewing and ensuring that is moving in that direction. 

I want to thank our witnesses for appearing before us. 

Mr. CONNOLLY. Mr. Chairman? 

Mr. HURD. Yes, sir. 

Mr. CONNOLLY. Just a footnote to—— 

Mr. HURD. I yield to my gentleman—my friend from the Commonwealth. 

Mr. CONNOLLY. I thank my friend. 

Just I was listening to your questioning of Ms. Doone, if you’re 

looking for more savings, maybe you might expand that goal of 11 

data centers being consolidated. I was just doing a little quick 

math on the back of my envelope, and with that—if that’s our annual goal, it’s going to take 27 years to address the total number 

of data centers you’ve got at the Department of Energy. 

So, I mean, I do think there’s some real room for expansion there 

that would have big payoff, and the MGT legislation rewards it. 

And, oh, by the way, working with Mr. Powner and my colleagues, 

the FITARA extension bill that extends the sunsets, including a 

data center consolidation, is, as we speak, on its way to the President for his signature. 

So there will be several more years of scrutiny over data center 

consolidation. So use that time and effectuate those savings, especially in anticipation of the authority you’re going to get, especially 

through the leadership of my friend Mr. Hurd, in the MGT legislation. 

Thank you, Mr. Chairman. 

Mr. HURD. Thank you. 

I’d like to thank our witnesses for appearing before us today. The 

subcommittees will now have a very, very brief recess, 2 minutes, 

to set up for our second panel. 

The subcommittee stands in recess, subject to the call of the 

chair. 

[Recess.] 

Mr. HURD. The subcommittees will come to order. 

I’m pleased to introduce our second panel. Again, the illustrious 

Dave Powner; Mr. Jay Mahanand, the CIO for the U.S. Agency for 

International Development; Mr. Reginald Mitchell, CFO for 

USAID; and Mr. Wade Warren, acting deputy administration at 

USAID. Welcome to you all. 

And pursuant to committee rules, all witnesses will be sworn in 

before they testify, so please rise and raise your right hand. 

Do you solemnly swear or affirm the testimony you’re about to 

give is the truth, the whole truth, and nothing but the truth, so 

help you God? 

Thank you. 

Let the record reflect all witnesses answered in the affirmative. 

Again, in order to allow time for discussion, please limit your testimony to 5 minutes. The entire written statement will be made 

part of the record. 

Again, as a reminder, the clock in front of you, when it turns yellow, you have 30 seconds; when it turns red, your time is up. And 

please turn on and off your microphone. 

I now recognize Mr. Powner for an abbreviated statement. 


KING-6430 with DISTILLER
60 

PANEL II: 

STATEMENT OF DAVE POWNER 

Mr. POWNER. Thank you, Mr. Chairman. 

USAID plans to spend about $40 million on IT this year. Eightytwo percent of this is used for operational systems, leaving just 

over $25 million for new development. One of the largest investments is its financial management system that is used to manage 

and report on foreign assistance funds. Last year, over $13 million 

was spent on the system, and over the years, over $225 million has 

been spent on this critical system. 

USAID’s overall grade jumped from three straight Ds with your 

first three scorecards to an A the last two. They are the only agency to receive an A on the FITARA scorecard. 

There are lots of positives here. Their CIO tenure is better than 

most. They have had only two CIOs since 2009. They have As in 

four of the five areas. They report the second highest portfolio stat 

savings as a percentage of their overall spend. Management of 

their software licenses has been centralized since 2004, resulting in 

an A in this area. 

The one area where we did not see an A is on data center optimization. USAID still needs to meet the server utilization metrics for 

its 80-plus nontiered or smaller data centers. 

Finally, I’d like to note that our work for this committee on CIO 

authorities shows that there is still some work to do on IT budgeting and execution, especially on improving governance over its IT 

acquisitions. 

Mr. Chairman, this concludes my comments on USAID. 

Mr. HURD. Thank you, sir. 

Again, only one person is going to provide remarks for USAID. 

Who is that going to be? 

Mr. Warren, you’re now recognized for 5 minutes. 

STATEMENT OF WADE WARREN 

Mr. WARREN. Thank you. 

Thank you, Chairman Hurd and Ranking Member Kelly and 

members of the subcommittee, for inviting me here to testify today 

regarding USAID’s progress on FITARA. We’re grateful for your 

support on this effort. 

I brought with me today my colleagues, Regi Mitchell, who is 

USAID’s chief financial officer; and Jay Mahanand, who is our 

chief information officer. They have both been very instrumental in 

our technology reform efforts, and I’m happy to have them with me 

here today and to help answer questions. 

As you know, USAID is a global agency. Our work is often done 

under the most difficult circumstances, from a tent in Mexico City 

after the recent earthquake, to a small mission in East Timor 

where the internet connection is less than reliable, to a refugee 

camp in Jordan. 

Strong and effective information technology systems are essential 

to USAID achieving its mission in a modern world. And so USAID 

is proud to have received the first A rating ever given under the 

FITARA scorecard. But it hasn’t always been this way at USAID. 


KING-6430 with DISTILLER
61 

Eight years ago, USAID’s IT was in disarray. In Washington, we 

spent hundreds of thousands of dollars every year acquiring new 

equipment and on powering and cooling our data center. What we 

got for it were regular outages and a system that left employees 

tethered to their desks. 

In the field, the situation was even worse. USAID often operates 

in countries with low bandwidth, and our old email system did not 

function well in this environment, leaving many staff waiting for 

long periods of time for email messages to load, if they were able 

to access email at all. 

Seven years ago, in February 2010, we realized that the status 

quo was not sustainable, and we began taking steps that ultimately 

gave USAID a cloud-based email system. And over the last few 

years, the Agency has developed into the leading Federal agency 

for cloud computing. 

So today, I would like to share with you what we view as the 

four keys to our success. First, we accepted that updating our IT 

system would be risky, that we would run into problems, and that 

we would not get everything right the first time. We knew that we 

needed to improve, and we were willing to take those risks. We embraced change. 

Second, we had real buy-in from agency leadership. We realized 

that for USAID to remain the world’s premier international development agency, modernizing our technology had to be a top priority. We committed significant financial and human resources to 

this effort and championed it from the top down. 

Third, we continue to improve, plan for what we know will come, 

and deliver results. Today, we have embraced a culture of incremental progress. And we regularly make small investments in our 

information systems that keep them from going out of date or losing interoperability. And I’m proud to say that because of these investments, USAID is not operating a single legacy system. 

And fourth, we committed to hiring experts at a senior level who 

have the technical know-how to implement these changes and keep 

us ahead of the curve. We worked hard to recruit knowledgeable, 

experienced staff, and provide training and support for the staff we 

have. 

All of this hard work has led to important increases in efficiency 

for our workforce and significant cost savings that today we are 

using to reinvest in our platforms. 

Mr. WARREN. Moving forward, we will ensure that we continue 

to remain ahead of the curve and lead the U.S. Government in our 

embrace and effective use of modern information technology. 

To further optimize data center operations, the agency is in the 

process of migrating our already outsourced data center to a cloud 

environment, and USAID is taking steps to actively manage the 

cybersecurity risks that we all are aware of today. 

So in conclusion, we are committed to maintaining our status as 

a Federal leader in IT space. We look forward to collaborating with 

you to address future challenges and new opportunities for reform. 

Thank you for your time, and thank you for your support of our 

efforts. 

[Prepared statement of Mr. Warren follows:] 


KING-6430 with DISTILLER
62 


KING-6430 with DISTILLERInsert offset folio 41 here 29502.041

Testimony of Wade Warren 

Acting Deputy Administrator 

United States Agency for International Development (USAID) 

Before the House Oversight and Government Reform Committee 

Subcommittee on Information Technology 

Subcommittee on Government Operations 

Wednesday, November 15,2017, 2:00PM 

Introduction 

Chainnan Hurd, Chainnan Meadows, Ranking Member Kelly, Ranking Member 

Connolly, members ofboth the Subcommittees on Infonnation Technology and 

Government Operations, thank you for inviting me to testifY today. I am grateful 

for the Committee's support for the work of the United States Agency for 

International Development (USAID) in infonnation technology refonn, and I am 

pleased to have this opportunity to discuss our progress in complying with the 

standards set out in the Federal Infonnation Technology Acquisition Refonn Act 

(FITARA). I have brought with me today Reggie Mitchell, USAID's Chief 

Financial Officer, and Jay Mahanand, USAID's Chieflnfonnation Officer, who 

have been instrumental in our technology refonn efforts to help answer questions. 

USAID is a global agency, charged with ending extreme poverty, and promoting 

resilient democratic societies while advancing U.S. security and prosperity. We 

employ more than 12,000 people and work in more than 100 countries. Our work 

is often done under the most difficult circumstances -- from a tent in Mexico City 

following the recent earthquake, to a small Mission in East Timor with a less-thanreliable internet connection, to a refugee camp in Jordan. We are an organization 

that depends on agile and mobile infonnation technology. 

We are also extremely data driven. For example, our Chief Geographer and 

GeoCenter use satellite data, demographic infonnation, gee-statistics, and digital 

mapping to infonn our decisions about where to target resources to maximize our 

development impact. Our Economic Analysis and Data Service provides a central 

source for all federally funded foreign assistance and international socioeconomic 

data. 

Strong and effective infonnation technology systems are essential to USAID 

achieving its mission in a modem world. As a relatively small agency with a 

relatively small IT budget managing a worldwide network, USAID has no choice 

but to embrace efficient IT. USAID is proud to have received the first A rating 
63 


KING-6430 with DISTILLERInsert offset folio 42 here 29502.042

ever given under the FIT ARA Scorecard; our score reflects years of hard work to 

put in place key refonns to address the deficiencies of prior years. 

Modernizing Our IT Systems 

Eight years ago, USAID's IT was in disarray. We operated our own data center in 

the basement of the Ronald Reagan Building, and each Mission overseas 

maintained its own servers. In Washington, we spent hundreds of thousands of 

dollars every year acquiring new equipment, powering, and cooling our data center 

-- what we got was regular outages and a system that left employees tethered to 

their desks. We lacked WiFi, laptops, and efficient remote access to email, and we 

collaborated by emailing documents from person to person. 

In the field, the situation was even worse. USAID often operates in countries with 

low bandwidth. Our old email system did not function well in this environment, 

leaving many overseas staff waiting for long periods of time for email messages to 

load, if they were able to use their email at all. These operating constraints caused 

us to reconsider what we needed from an IT system. Not surprisingly, access to 

email for staff positioned in high-priority critical areas topped the list. 

In February 2010, we realized that the status quo was not sustainable. Our need for 

greater email reliability abroad, for increased data storage, and for greater mobility, 

compelled us to look for a new, modern email system. Spurred by calls from the 

Office of Management and Budget and the White House to modernize our 

technology and move to a cloud-based platfonn, we began taking steps that 

ultimately gave USAID a cloud-based email system by 2012. 

Over the last few years, the Agency has developed into the leading federal agency 

for cloud computing investments with at least 20 percent of its operational IT 

spending dedicated to cloud solutions. 

Keys to Success 

These investments in technology modernization have made us one of the most 

technologically efficient and effective agencies in the Federal Government. So 

today, I would like to share what we view as the keys to our success. 

First, we accepted that updating our IT would be risky, that we would run into 

problems, and that we would not get everything right the first time. We knew that 

we needed to improve, and we were willing to take those risks. We embraced 

2 
64 


KING-6430 with DISTILLERInsert offset folio 43 here 29502.043

change. We brought people along and encouraged them to try new things, like the 

cloud. By being open about the changes underway, we smoothed the way for 

adoption. We strived for constant and clear communication about what was 

happening and why it was happening. And we were there to answer questions as 

they came in. 

I was hesitant when we first moved to the cloud. I led USAID's planning ahead of 

the transition, and my staff suggested we use a cloud-based word processor. At 

first I was resistant, but I was brought along and soon saw the value of editing 

quick-turnaround documents in real time -- from the office or from home, during 

regular work hours or late into the evening, as the situation dictated. 

Following the transition, we were able to push out the entire library of transition 

documents to the whole Agency in one afternoon -- something we could never 

have done through email. And today those documents remain online for reference 

by anyone at USAID. 

A second key to success, and related to the first point, we had real buy-in from the 

Agency leadership. We supported and funded modernization efforts, recognizing 

that in order for USAID to achieve its mission we needed to provide world-class 

technical support to employees. We realized that for USAID to remain the world's 

premier international development agency, modernizing our technology had to be a 

top priority. We committed significant financial and human resources to this effort 

and championed it from the top, with leadership committing to being among the 

first adopters. 

Third, we continue to improve, plan for what we know will come, and deliver 

results. Today, rather than holding off on technology adoption until we need to 

make a significant leap forward, we have embraced a culture of incremental 

progress. We constantly phase in new technology and make small updates to our 

platforms. We regularly make small investments in our information systems that 

keep them from going out of date or losing interoperability. I am proud to say that 

because of these investments, today, USAID is not operating a single legacy 

system. 

Fourth, we committed to hiring experts at a senior level who have the technical 

know-how to implement these changes and keep us ahead of the curve. We 

worked hard to recruit knowledgeable, experienced staff and provide training and 

support for the staff we have. The skills and abilities of our IT workforce remain 

3 
65 


KING-6430 with DISTILLERInsert offset folio 44 here 29502.044

one of the key determining factors of whether we are successful in providing the 

information services we need as an organization. 

Looking Ahead 

All of this hard work has led to important increases in efficiency for our workforce 

and significant cost savings that today we are using to reinvest into our platforms. 

Moving forward, we will ensure that we continue to remain ahead of the curve and 

lead the U.S. Government in our embrace and effective use of modern information 

technology. 

To further optimize data center operations, the Agency is in the process of 

migrating our already outsourced data center to a cloud environment, which will 

provide a much more dynamic and flexible model for infrastructure procurement 

and management. This new arrangement will allow us to acquire and pay for only 

those services that are required, giving us the ability to easily and quickly scale up 

or down as needed. 

USAID is working to develop a comprehensive Agency-wide software license 

inventory to ensure the best use of the Agency budget. This helps ensure that 

USAID is tracking spending and enterprise licenses to help maintain the 

appropriate number oflicences for our Agency. We have also used this inventory 

to respond to the reporting requirements contained in the Making Electronic 

Government Accountable By Yielding Tangible Efficiencies (MEGABYTE) Act 

of2016. 

Finally, USAID is taking steps to actively manage the cybersecurity risk that we 

are all aware exists today. USAID's Office of the Chieflnformation Officer 

detects and mitigates more than 200,000 malware and intrusion events per month. 

We have made cybersecurity a critical priority and have worked closely with the 

Office of Management and Budget, the Department of Homeland Security, the 

Federal Chiefinformation Officers Council, and other federal organizations to 

protect our networks, systems, and information from unauthorized access or 

disruption while continually providing essential services and protecting privacy. In 

response to the May 2017 Cybersecurity Executive Order, USAID was ranked by 

the Department of Homeland Security and Office of Management and Budget, as 

"Managing Risk," meaning the Agency is able to actively manage the 

cybersecurity risk to the enterprise, making us one of the few federal agencies to 

receive this rating. 

4 
66 


KING-6430 with DISTILLERInsert offset folio 45 here 29502.045

Conclusion 

USAID is committed to maintaining our status as a federal leader in the IT space. 

would like to thank Members of Congress, and members of these Subcommittees 

in particular, for your continued leadership, interest in, and support for our work. 

We look forward to collaborating with you to address future challenges and new 

opportunities for reform. Thank you for your time; we welcome your questions. 

5 
67 

Mr. HURD. Well, Mr. Warren, thank you for not taking all of your 

time, number one. And I also want to say thank you for what your 

organization does. I had the honor of serving alongside many of the 

men and women in USAID, and I know the work that you do and 

saw it up close and personal. And, Mr. Mitchell and Mr. 

Mahanand, you facilitate that activity. So what you do is very important, not only for our country, but for the countries that we are 

working in. So I am a supporter of your organization. 

That being said, Mr. Warren, my first question is why does Mr. 

Mahanand not report directly to you or Ambassador Green? 

Mr. WARREN. Thank you. We have—in our agency, we have an 

assistant administrator for management, and she has responsibility 

for the CFO function, the CIO function, the facilities management, 

and the budget of the operational budget for the agency. She reports to me. But the CIO and the CFO both have a dotted line to 

the administrator. They are free to go to him directly when they 

have issues that are of concern to them. And that’s the way we’ve 

been managing ourselves over the—over the last number of years. 

You may be aware, however, that we are in a redesigned effort 

with the State Department now to look at how the State Department and USAID work together and how we can change our procedures internally to make them more effective and looking at the reporting relationships of the CIO and the CFO was part of what we 

are looking at now. 

Mr. HURD. Mr. Powner, do you have any opinion? 

Mr. POWNER. I think clearly it’s much better if you report up to 

the box. Right? And I think as long as there’s access. We’ve seen 

sometimes where there’s this management guru in between, and 

we’ve heard this. The key question is whether that access is consistent and enough to the top when you need to get the right decisions and the right support. 

Mr. HURD. Mr. Mahanand, I’m going to assume that since there’s 

only been two CIOs—since when Mr. Powner? 

Mr. POWNER. Since 2009. 

Mr. HURD. —since 2009, I’m assuming you have a positive opinion of your access to senior leaders within your organization. 

Mr. MAHANAND. Yes, I do. I mean, I’ve—any time there’s a need 

to escalate, I will do that. But in the current structure, there is no 

need. The—as far as the system administrator for management, I 

mean, my daily op—my daily interaction is with her. And so I’ve 

not—don’t have the need to actually go to her—or go to the administrator. Most of my activities go through her. 

Mr. HURD. Can you answer with 100 percent certainty that you 

know everything’s on your network? 

Mr. MAHANAND. Maybe 99.9 percent. On our network, we do 

have—we do have monitoring software. I’m talking about the physical network here. So we do have port security. We have—anything 

that actually touches the network, we are notified of that. 

What we’re not—what I’m not really sure about is really the 

services that’s purchased outside and not necessarily connected in 

the network. That is something that we actually track in terms of 

looking into software, but there’s—you know, there’s a potential in 

shadow IT within the agency, and that is the only thing that I’m 

not positive about. 


KING-6430 with DISTILLER
68 

Mr. HURD. How do you do CDM? 

Mr. MAHANAND. CDM, right now, we’re in phase I, and it’s 

scheduled to be deployed February of 2018. 

Mr. HURD. Deployed in 2018. So complete within 4 months? 

Mr. MAHANAND. Yes. I mean, we actually started about 2 years 

ago. We’ve piloted CDM, and so the final deployment is in February of 2018. 

Mr. HURD. So the pilot deployment, do you have the enforcement 

mode engaged? 

Mr. MAHANAND. I believe so. 

Mr. HURD. Can you get me an answer? 

Mr. MAHANAND. Yes, I can. 

Mr. HURD. Thank you. 

Mr. Mitchell, how are you going to help Mr. Mahanand create a 

Working Capital Fund once MGT is complete, so when he is able 

to get a complete insight into his network and saves money, he has 

access to that Working Capital Fund? 

Mr. MITCHELL. We would—I will be able to support our chief information officer by setting up this fund and working with them to 

develop the procedures and policies governing the operations of this 

particular fund. 

I think it’s important to note that the budget per se does not fall 

under my purview, but I do have budget execution. And I do work 

with Mr. Mahanand and his staff as far as providing them with 

real-time data, executional data, so that he can better have decision-making capabilities. 

Mr. HURD. So if their budget doesn’t fall under CFO, who does 

the budget fall under? 

Mr. MITCHELL. The operation budget, including the capital investment fund, falls under the office of management policy, budget, 

and planning office, and that office is located in the Management 

Bureau. 

Mr. HURD. And, Mr. Warren, that is this person you described—— 

Mr. WARREN. Yes. This assistant administrator for management 

has responsibility for the CFO, the CIO, and the operational budget. 

Mr. HURD. So, Mr. Warren, in my remaining 15 seconds, what 

are you going to do to help to make sure Mr. Mahanand has the 

MGT Working Capital Fund so he can use that at the end of next 

fiscal year? 

Mr. WARREN. Well, as I stated, the senior leaders of the Agency, 

both the career and the political staff, are very supportive of the 

IT function. We recognize that we can’t do our work around the 

world without it. And we—I—Jay and Reggie and I work closely to 

ensure that our IT needs are met, so I’d be very supportive. 

Mr. HURD. Ms. Kelly, you’re recognized for 5 minutes. 

Ms. KELLY. Thank you. 

The IT Dashboard is a public website that allows Federal agencies, industry, and the general public to see the details about Federal information technology investments and their risks. Those 

risks are submitted by the CIO for those agencies. 

Mr. Powner, can you briefly explain why the IT Dashboard exists 

and what factors affect scoring? 


KING-6430 with DISTILLER
69 

Mr. POWNER. So the IT Dashboard is there to make sure we have 

visibility into the major investments. We look at the roughly $100 

billion that we spend, so that’s roughly half of what was on these 

major larger investments. So we know what they are, and we also 

have some costs and schedule performance. But a key part of that 

is the CIO rating. 

So, for instance, USAID has 87 major investments. Interestingly, 

they get an A in this area because they don’t have a single green 

on the Dashboard, everything’s red or yellow, where they acknowledge risk. You could do that different ways. We like to see the acknowledgement of risk because these things are typically difficult 

and you want to admit the risk so that they can be effectively managed. 

Ms. KELLY. And you talked about USAID, but the other agencies 

in general, are they doing a good job, accurately reporting, not 

doing a good job? And what are the implications for not accurately 

reporting? 

Mr. POWNER. I think over time, especially with your scorecard, 

we see more risk acknowledged on that dashboard, so that’s been 

a good thing. There’s some agencies that had a complete flip. They 

were all green, and then all of a sudden, they’re, you know, heavy 

on the reds and yellows, which that’s a more accurate reporting. 

So we’ve seen improvements in these areas. There’s still some 

concern. 

Yeah. The other area of concern is sometimes some large investments are categorized as nonmajors, and that’s one way to hide visibility on the Dashboard. And again, we know who those agencies 

are, and we’re kind of watching some of those larger nonmajors. 

Ms. KELLY. Okay. Thank you. 

Mr. Mahanand, in the category of transparency, USAID received 

transparency in risk management an A. Can you briefly explain 

how USAID goes about determining the levels of risk facing its 

major IT projects? 

Mr. MAHANAND. Sorry. For us, we have five major business 

cases. Three of them is in operations. And so—but they provide 

critical function for the Agency. And so what we look—we take a 

look at—we start previously taking a look at the mid rating here, 

as far as the risk is concerned. So, you know, we look at the 

projects that’s being executed. We looked at the overall importance 

of the specific program, and we make a determination of what is 

happening to—specifically in activities in those areas. 

And so when the—quarterly when the report comes to me, I take 

a look at it. We review it with the program staff. I make a determination exactly where we feel that the risk grading should reside. 

For the most part, we start with a three. We usually start with a 

five, because some of these business cases were in operations, and 

we didn’t think necessarily that is something we need to really 

worry about. 

But given the fact, you know, we heard from GAO in terms of 

we want to see the risk grading realized, and actually we thought 

what we were doing and then started a three. And then we would 

make decisions based on where we are with those projects within 

those business cases or investments. We would make a decision 

whether or not the project is risky or not risky. But we continued 


KING-6430 with DISTILLER
70 

this to start at a three and then we are way back and forth between a three, between a one and a five. 

Ms. KELLY. Just out of curiosity, because you have done so well 

with you’re a ratings, do other agencies ever call and find out what 

you’ve done or what your secret is? 

Mr. MAHANAND. Yeah. We’ve actually—we’ve gotten calls from 

three—about five agencies. We’ve spoken to them. We’ve actually 

spoken to the specific working group for GSA and some of the 

things we’ve done. 

I mean, just from a history perspective, some of the things we’ve 

done before previously, like the data center consolidation. We got 

rid of our data center NRB in 2011. We just didn’t get credit for 

it as we move along, because we started really early in that. And 

from our perspective is that we just wanted to make sure that the 

data itself and the information and the reason behind the specific 

intent of each one of these scores. 

And so we looked at that—because I thought we did really well. 

We continue to do well, and I wanted to make sure that, you know, 

our progress, our performance reflects the scoring. That’s where we 

actually found out there were some errors in how we were reporting. And so we—we basically worked with GAO and figure out 

what those areas are, corrected it, and basically provide the evidence that, you know, we are where we are with those scores. And 

that’s why you saw from a D to an A. 

Mr. WARREN. If I could just add a thought. Our approach and attitude about IT risk, I think, is part of a broader agency perspective on risk. And we work in some dangerous, risky places around 

the world. And so we try as an agency to be very aware of and 

forthright about the risk that we’re facing. And Reggie and I actually lead an agencywide risk assessment process every year that 

looks at IT risks, financial risks, physical security risks. And so the 

sort of transparency that we bring to the IT risk, I think, is part 

of a broader culture in the agency about confronting risk. 

Ms. KELLY. I yield back. 

Mr. HURD. The gentleman from Montana is recognized. 

Mr. GIANFORTE. Thank you, Mr. Chairman. 

Mr. Warren, I understand from your testimony that you’ve 

moved 100 percent to the cloud. Is that correct? 

Mr. MAHANAND. I would say, again, maybe 99.9 percent. 

Mr. GIANFORTE. Let me congratulate you on your aggressiveness 

adoption of these newer technologies. 

I’m curious, in that transition, how much work was done to move 

from, let’s say, more custom software to more commercial off-theshelf software, and where would you be in that transition? 

Mr. MAHANAND. So as far as moving to the cloud, there’s specific 

things that we have in terms of infrastructure as a service, platform as a service, or software as a service. Every application we 

look at we basically make a determination. We go back to the cloud 

first policy. Any new application that comes up, we look at it, we 

basically said whether or not there is a surface—a service offering 

out there that we can actually use. 

So, for instance, we—when we were modernizing our internet on 

our internet, we basically look at the—look at the specific services, 

and we actually went with cloud services instead of going with, you 


KING-6430 with DISTILLER
71 

know, commercial off-the-shelf software. So those are the types of 

decisions we make when we actually look at software or look at renewed software. 

Mr. GIANFORTE. And, Mr. Powner, is there, in your observations—I mean, we know that when we send a committee off to design a piece of software and we tell them we want a horse, we often 

get a camel as a result, because there’s so many requirements that 

are included. And this—when we build custom software, it just 

drives up the cost and increases brittleness of integrations and 

these sorts of things. 

In your observations from working with the agencies, how do 

you—where are we in this transition from custom designing everything to the bias that Mr. Mahanand has expressed towards commercial off-the-shelf software? 

Mr. POWNER. Collectively as a government, we still custom design way too much than we need to. And the problem there is in 

the government changing your business process to adapt to commercial products is, is we’re way behind, especially when you compare that to the private sector. There’s such an unwillingness to 

adapt those business processes and adopt to commercial software. 

So we need more and more of that going forward. 

Mr. GIANFORTE. But you believe that a bias towards commercial 

off-the-shelf would be a best practice and it would reduce cost? 

Mr. POWNER. Absolutely. Absolutely. And change our business 

processes. Look at these financial management systems that we try 

to put in place. Why do some folks implement them right out of the 

box and others we try to modify 3 years to implement a commercial 

financial management system? 

Mr. GIANFORTE. Yeah. Mr. Mitchell, in this transition, how much 

money has been saved moving to the cloud? 

Mr. MITCHELL. I would have to defer to our chief information officer. 

Mr. MAHANAND. I think we’d have to look at each specific offering. For example, our data centers, we—from 2013 to 2016, we 

saved about $8 million, but each—we haven’t—I don’t think we 

have accumulated the number of our savings. I think it’s about for 

the last—if we calculated, about maybe 60—I don’t know, $50 to 

$60 million for the last 3 or 4 years. 

Mr. GIANFORTE. Just to put that in perspective, what percentage 

is that of your total budget? 

Mr. MAHANAND. So our budget is about $100 million in OE and 

about $25 in DME, so that would actually be about 60 percent. 

Mr. GIANFORTE. Sixty percent savings from moving to the cloud? 

Mr. MAHANAND. Yeah. 

Mr. GIANFORTE. Okay. And what have you experienced from a 

system reliability and security perspective? Has system reliability 

and security gotten better or is it harder in the cloud? 

Mr. MAHANAND. I think its gotten better. I mean, I think, as Mr. 

Warren said, when we first moved emails to the cloud, I think we 

had outages daily. We moved to a cloud email system, I think we 

were the second in the Federal Government to do that. And I can’t 

remember being down for more than an hour till now. And this 

happened in 2011, I think we started. 

Mr. GIANFORTE. And from a security perspective? 


KING-6430 with DISTILLER
72 

Mr. MAHANAND. You know, they go through the same controls as 

far as testing is concerned. So, you know, we look at their CNA 

packages; you know, we give it an ATO. So, you know, we have a 

part to play in of basically looking at the security profile of each 

one of these cloud vendors. So we are pretty confident the security 

is actually—I would say much better than, you know, having a system administrator in all these different places, not necessarily looking at what they’re doing. 

So within the cloud, there’s a single administrator. We control 

that administrator. So I think security is enhanced as well. 

Mr. GIANFORTE. Just to play back what I’ve heard, a 60 percent 

reduction in costs, increase—dramatic increase in reliability, better 

security; sounds like it’s a win. 

Mr. MAHANAND. We think so. 

Mr. GIANFORTE. Okay. Thank you. 

I yield back. 

Mr. HURD. Thank you. 

Now the gentleman from the Commonwealth of Virginia, you’re 

on the clock. 

Mr. CONNOLLY. Thank you. 

And congratulations to USAID. And I take a little bit of special 

interest. In my previous incarnation here on the Hill, before my 20 

years in private sector, I spent 10 years on the Senate Foreign Relations Committee. And my job was to write the foreign aid bill. 

And I helped write the very last one to become law in 1986. That’s 

how ancient I am. And it was so good, apparently, that we haven’t 

passed one since. 

In any event, congratulations. And I think—well, let me ask you, 

Mr. Warren. What happened? You were getting a D and you moved 

it up to an A. I’m talking process and political decisions here, not 

we moved the grommet to the widget and the widget to the—what 

happened inside A that changed it—changed the will to want to do 

it differently? 

Mr. WARREN. So two points to make, I think. The jump from the 

D to the A was largely from working with GAO to better report 

what we had been accomplishing over a longer period of time. So 

if you look at the scorecard, it looks like we had this quantum leap 

in 1 year. I think the quantum leap was really in better reporting. 

The changes to get from a D to an A took place over a longer period 

of time than that. 

But to answer the other part of your question, I think we were 

driven by the fact that we were having failures daily in the system 

as we were trying to manage it. And the fact that we have a worldwide workforce, and the only way we can communicate with our 

staff around the world and get our work done is through our IT 

systems. And if they are not working, we just can’t do our job. And 

so it was kind of out of necessity that we realized we needed to 

make big changes. And then as I said, the political and the career—— 

Mr. CONNOLLY. Well, I would just say you say that as if, of 

course, we had to, we had no choice. I’m looking at a really big 

neighbor of yours in the Federal family, maybe the biggest, and it 

hasn’t concluded that and it’s got a worldwide enterprise too. And 

they’re getting an F instead of an A. 


KING-6430 with DISTILLER
73 

So something happened in A that galvanized you to do it differently, to make different decisions, to set goals for yourself, that, 

unfortunately, our Defense Department has yet to do. And it could 

bat you person for person and then some in terms of overseas 

bases, operations, personnel and the like. Bigger, much bigger, and 

maybe you could argue more difficult, but it’s as far up along as 

you are, and it has yet to make the decisions or show the political 

will you’ve shown. 

And that’s what I’m trying to get it, what—because I think that’s 

how we all learn. You know, go talk to USAID in terms of how they 

did it, and I’m trying to get you on the record to get some of the 

elements of how did you do it. 

And, Mr. Powner, feel free to jump in here, because I know you 

had something to do with this as well. 

Mr. POWNER. Yeah. I think it’s a combination of both. I mean, 

clearly the data cleanup was a part, but also there was a focus on 

some of these areas, you know, going small and reporting more risk 

and that type of thing. We saw big improvements there. 

It was interesting, because a lot of this data’s been reported to 

OMB for quite a while. And honestly, most agencies don’t really 

focus on that adequately enough. This scorecard really helped. And 

this is important—this is important reporting because it’s savings. 

It’s things that we can use to reinvest in the Working Capital 

Funds. So this isn’t just for the sake of reporting. It’s real stuff 

that we need to actually get more efficient with our operational 

side of the house so that we can invest and modernize the government more. 

Mr. CONNOLLY. Yep. And by the way, Mr. Mitchell, I hope your 

answer to Mr. Gianforte about savings was only on that one, because it’s critical that the CFO understand what savings are being 

effectuated here because that’s how we incentivize other agencies 

to do it too, right? Here’s the—here’s the carrot, here’s the reward 

at the end of this process, and that’s reliability, savings, freeing up 

capital, really worthwhile investment, and a happier, more productive workforce. But some of that we can measure in actual dollars. 

And I commend to you that the CFO, as well as the CIO, has to 

be monitoring those savings. I assume you are. 

Mr. MITCHELL. Yes, I am. 

Mr. CONNOLLY. Okay. Okay. Let me just say—end by saying this, 

and maybe, Mr. Warren, you take the lead working with Mr. 

Powner at GAO, but all of you, I really think it’s important that 

this be written up electronically, but how did you do it? What were 

the key decision points? How low did you have to go before somebody said enough already? And show others that it’s doable and 

replicable. Because when we don’t really want to do something, 

we’re going to isolate you as saying USAID’s unique, no one else 

is like them, sure they can do it, but no one else can really—and 

we don’t want—that doesn’t serve our purpose at all and it’s not 

true. 

And Dave—Mr. Powner, I would urge that in your spare time we 

help do this. And hopefully, Mr. Hurd and Ms. Kelly would agree, 

there’s real value hearing your story, and we want to spread that 

good news to other agencies that it can be done in a reasonable 


KING-6430 with DISTILLER
74 

timeframe and there’s a reward at the end of the rainbow. So 

again, thank you, and congratulations. 

Mr. HURD. I’d just like the record to reflect that that is the least 

grumpy line of questioning I’ve ever seen from the gentleman from 

the Commonwealth of Virginia, which is a pretty significant feat. 

So, Mr. Warren, Mr. Mitchell, Mr. Mahanand, these don’t always 

go this way, and thank you for what you do and thank you for the 

support that you’re showing our men and women that are putting 

themselves in some very difficult and extraordinary circumstances. 

Thank you for being here. 

And again, the subcommittees will now briefly recess for a few 

minutes for a third panel. 

The subcommittee stands in recess, subject to the call of the 

chair. 

[Recess.] 

Mr. HURD. The subcommittees will come to order. 

I’m pleased to introduce our third panel. Mr. Powner, for the 

third time today, thank you for being here. Ms. Maria Roat, CIO 

for SBA; Mr. Tim Gribben, CFO for SBA; and Ms. Althea Coetzee 

Leslie, the deputy administrator at the Small Business Administration. Thank you all for being here. Welcome to you all. 

And pursuant to committee rules, all witnesses will be sworn in 

before they testify. Please rise and raise your right hand. 

Do you solemnly swear or affirm the testimony you’re about to 

give is the truth, the whole truth, and nothing but the truth, so 

help you God? 

Thank you. 

Please let the record reflect that all witnesses answered in the 

affirmative. 

Again, to allow time for discussion—and we’re racing against the 

clock, the votes are likely to be called soon—please limit your testimony to 5 minutes. The yellow light means you have 30 seconds; 

red, time is up. And please turn on the microphone. 

Mr. Powner, you’re recognized for an abbreviated time for your 

opening remarks on this panel. 

PANEL III: 

STATEMENT OF DAVE POWNER 

Mr. POWNER. Thank you, Mr. Chairman. 

SBA spends about $98 million on IT this year. About 80 percent 

of this is used for operational systems, leaving just over 20 million 

for new development. This new development includes important efforts, like its Disaster Credit Management Modernization, which 

automates processing and approval for disaster loan assistance. 

SBA reports having spent over $100 million—$150 million on this 

modernization in prior years. 

SBA’s grades have consistently been in the D range, but their 

current grade is a C-minus. They’re one of only three agencies 

whose grade went up. 

SBA scores best in incremental development, receiving an A in 

this area. Also, despite receiving a C in the data center area, SBA 

has plans to eventually close all but one of its 43 nontiered or 

smaller centers, and plans to install a necessary metering equipVerDate Nov 24 2008 11:29 May 01, 2018 Jkt 000000 PO 00000 Frm 00080 Fmt 6633 Sfmt 6633 H:\29502.TXT APRIL

KING-6430 with DISTILLER
75 

ment by 2018. SBA also plans to exceed OMB’s key server utilization metric of 65 percent. 

Turning to areas where SBA needs to improve, let’s start with 

CIO tenure. Since 2004, there have been 10 CIOs at SBA, and the 

average tenure has been only 1.4 years. This is a major issue in 

why IT has not been effectively managed. Their software license inventory is not complete. They have a plan to complete this in early 

2018. 

Finally, I’d like to note that our work for this committee on IT 

budgeting, contracting, and CIO authority shows additional areas 

where SBA CIO has challenges is in budget formulation and 

strengthening their IT workforce. However, regarding FITARA’s requirement for CIOs to review and improve IT contracts, SBA’s 

processes here are quite good. 

Mr. Chairman, this concludes my comments on the Small Business Administration. 

Mr. HURD. Thank you, sir. 

And I believe Ms. Althea Coetzee Leslie will do the opening remarks for the SBA panel. 

You’re now recognized for 5 minutes. 

STATEMENT OF ALTHEA COETZEE LESLIE 

Ms. COETZEE LESLIE. Thank you. 

Mr. Chairman, ranking members, and committee members, 

thank you for the opportunity to discuss the SBA’s implementation 

of FITARA. 

From July 2005 to October 2016, the SBA’s OCIO leadership 

team experienced significant disruption with high turnover: eight 

different CIOs during that period. Further, prior to the current 

CIOs arrival in October 2016, the CIO position was vacant for over 

a year, from July 2015 to October 2016. Consequently, key programs like the Data Center Consolidation Initiative did not receive 

OCIO leadership attention. 

Immediately upon her arrival, the SBA CIO engaged in frank 

and honest conversations about the state of IT at the agency. The 

CFO responded in kind, and with the administrators and CFO’s 

support, the CIO embarked on a fast-paced journey to change how 

the SBA builds, buys, and manages information technology to support small business entrepreneurs. 

Over the last 12 months, actions taken by the CIO, in close partnership with the CFO, are transforming SBA from an agency impeded by outdated technology and unstable infrastructure, stovepipes, duplication and significant gaps, no cybersecurity strategy or 

operational control, to a proactive and innovative provider of critical business technology services to the SBA program offices and 

small business entrepreneurs. 

SBA’s governance model is maturing with a focus on creating 

and expanding strong enterprise-shared services. Program governance requires that all stakeholders are represented, engaged, and 

aligned to achieve program success. For example, the CIO and CFO 

co-chair the SBA Investment Review Board that met six times in 

fiscal year 2017. The IRB reviewed every major investment at least 

once, and the board recommendations resulted in tangible program 

improvements. 


KING-6430 with DISTILLER
76 

Additionally, the CIO conducted four major investment deep 

dives to review milestones, technology capabilities, funding, and 

risks. During one of these deep dives, the CIO identified and provided direction to correct specific contractual and roadmap-related 

issues in time to prevent further complications. The SBA recognizes that transparency is critical for value creation, and the CIO 

promotes transparency in our IT procurements to prevent duplication, cybersecurity threats, and stovepiping. 

Last year, the CIO reviewed and approved all new IT contracts 

above $150,000. And this year, the threshold has been reduced to 

$50,000 to ensure we achieve our short and long-term modernization objectives. 

It is our responsibility to communicate our IT goals, vision, and 

strategy with acquisition professionals to ensure that the entire organization understands the technical ramifications of individual 

purchases. I am proud to report the SBA is leading innovation as 

the first agency to deploy DHS’s CDM system in the cloud. This 

has resulted in a significant cost avoided by not investing in hardware that would require future recapitalization. Further, it sets the 

stage and puts SBA ahead of other agencies for future DHS cloudbased CDM solutions that will further strengthen SBA’s 

cybersecurity posture. 

Along with our modernization efforts in technology, we are building our IT workforce and working to attract new IT staff to critical 

positions. We launched an IT strategic workforce plan to be able to 

support future technology initiatives. And thanks to congressional 

approval, we realigned our digital services team under the CIO to 

deliver improved mission-focused services and capabilities. 

Through the implementation of the authorities contained in 

FITARA, our CIO is leading the charge in the achievement of agencywide IT goals. The SBA’s actions taken over the last 13 months 

are laying the foundation for the agency’s transformation into future enterprise objectives. 

As we proceed in executing our enterprise IT plan, we will continue to strengthen information technology to ensure a reliable, secure, and high-performing computing environment necessary to enable the SBA to efficiently and effectively perform its mission. 

Thank you again for the opportunity to share SBA’s progress on 

FITARA implementation, and we are ready to answer any questions you may have. 

[Prepared statement of Ms. Coetzee Leslie follows:] 


KING-6430 with DISTILLER
77 


KING-6430 with DISTILLERInsert offset folio 46 here 29502.046

STATEMENT OF 

U.S. SMALL BUSINESS ADMINISTRATION 

BEFORE THE 

COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM 

SUBCOMMITTEES ON INFORMATION TECHNOLOGY AND GOVERNMENT OPERATIONS 

HEARING ON 

THE FEDERAL INFORMAITON TECHNOLOGY ACQUISTION REFORM ACT (FIT ARA) 

SCORECARD 5.0 

NOVEMBER 15,2017 

Chainnan Hurd, Chainnan Meadows and committee Members, thank you for the opportunity to discuss 

the Small Business Administration's (SBA) implementation of the Federal Infonnation Technology 

Refonn Act (FIT ARA). FITARA provides the tools for SBA to optimize and maintain SBA's IT 

infrastructure, identi.l'y areas for IT efficiency and innovation, and invest in the IT workforce. We would 

like to share with you today where SBA is in the process of implementing FITARA and how SBA is 

using FITARA to transfonn how IT is governed and managed. It is imperative that IT resources are 

aligned with the agency's mission, goals and priorities. 

SBA's Office of the Chieflnfonnation Officer (OCIO) leadership team experienced a high turnovernine CIO's since 2005 -and the CIO position was vacant from July 2015 until October 2016. Thus, 

initiatives like Data Center Consolidation Initiative did not get OCIO leadership attention until the arrival 

of our current CIO. This frequent turnover has had an impact on our IT positions "adversely affecting the 

ability for SBA to make lasting improvements in its IT investments and security in multiple areas" 1 as 

noted by the Office of the Inspector General's 2016 "Report on the Most Serious Management and 

Perfonnance Challenges in Fiscal Year 2017." 

1 Report on the Most Serious Management and performance Challenges in Fiscal Year 2017 

https://www.sba.gov/sites/default/files/oig/FY 2017 · Management Challenges - 10 14 16 7.pdf 

1 
78 


KING-6430 with DISTILLERInsert offset folio 47 here 29502.047

A new CIO on-boarded in October 2016, and took immediate action to hire key positions, including a 

Deputy CIO and Chief Technology Officer and reduced the OCIO vacancy rate by halt: The Chief 

Financial Officer began serving in his current capacity in November 20 16 and the Chief Human Capital 

Officer (CHCO) in June 2016. The CIO, CFO and CHCO began an open and honest conversation about 

the state of IT and the IT workforce at the agency. It was clear that FITARA provides the tools needed to 

transform how SBA manages IT, and imperative that the CIO, CFO, and CHCO work collaborative1y to 

understand SBA 's business needs to drive informed decisions. 

Actions taken by the CIO, in partnership with the CFO, over the last 12 months are transforming SBA 

from an agency with unstable technology and infrastructure, stovepipes, duplication and significant gaps, 

no cybersecurity strategy or operational control, to a more proactive and innovative services organization 

responsive to the business technology needs of SBA program offices. 

Transparency and Risk Management 

Under the CIO's leadership, the Office of the CIO (OCIO) moved aggressively to increase governance 

and oversight, stabilize and modernize SBA' s network, systems, data center and overall operations, 

address security deficiencies and improve its cybersecurity posture, and decrease OCIO's vacancy rate. 

The CIO is a strategic partner in shaping agency strategies, budgets and operations. 

SBA's governance model continues to mature. The CIO and CFO co-chair the SBA Investment Review 

Board (IRB) that met six (6) times in FYI7. Every major investment was reviewed at least once and 

resulted in tangible program improvements. The CIO held a TechStat on the Certify.gov investment to 

address program risk. The results of the TechStat surfaced specific contractual and technology roadmap 

related issues that were subsequently addressed and resulted in the IRB approving funding to proceed to 

the next phase. Further, the CIO conducted four (4) major investment deep dives to review milestones, 

technology capabilities, funding and risks. The CIO updates the IT Dashboard, as required by OMB's 

2 
79 


KING-6430 with DISTILLERInsert offset folio 48 here 29502.048

capital planning and investment control (CPlC) guidance, with relevant and timely data on program risks, 

performance metrics, project and activity data for all major investments. 

The CIO chairs a Business Technology Council that enables information sharing between the OCIO and 

SBA program offices regarding strategic IT transformation at SBA. Further, the CTO and Associate 

Administrator for the Office of Communications and Public Liaison co-chair a steering committee 

designed to provide oversight ofSBA's intranet and internet sites. The CTO is also a voting member of 

the Contract Review Board that plays a vital decision making role with acquisitions that are high dollar, 

high impact, high visibility and actions that impact the agency mission. These councils and steering 

committees are instrumental in maturing processes and procedures, and driving horizontal integration, and 

project and program awareness. 

Portfolio Review 

Transparency is critical for value creation. The CFO published an FY17 Acquisition Information Notice 

that specified CIO approvals for all new contracts above the simplified acquisition threshold of$150,000. 

Fourteen (14) IT acquisitions were reviewed and approved in FY17. The CFO also published an updated 

Acquisition SOP in FY17 requiring CIO approval for IT-related acquisitions. For FY 18, the CIO will 

review and approve all IT acquisitions and Interagency Agreements of $50,000 or greater. 

For the first time, the CFO and CIO performed joint reviews of the FY18 Advance Acquisition Strategy 

and budget for all program offices. As a result of the reviews, the CIO identified duplicative investments 

and re-aligned IT spend to SBA's technology standards and strategic direction. SBA is consolidating 

licensing and leveraging the Federal Strategic Sourcing Initiative and Category Management to eliminate 

redundancies, and delivery more value and savings from the government's acquisition programs. 

The CIO meets with the Office of Management and Budget to review SBA's PortfolioStat and progress in 

meeting OMB goals to drive value in to Federal IT investments. SBA demonstrated progress in 

3 
80 


KING-6430 with DISTILLERInsert offset folio 49 here 29502.049

cybersecurity as reflected in an improved security posture with the implementation of new processes and 

technologies, and closure of 60% of long-standing audit findings. 

The CIO initiated a Technology Business Management (TBM) framework pilot to create transparency 

into OCIO's IT costs, consumption, and performance; and, to establish collaboration and communications 

between OCIO and its stakeholders that is fact-based and customer-focused. The OCIO plans to use 

TBM to establish collaborative responsibility for making tradeoff decisions and delivering appropriate 

levels of service in a more cost-effective manner, thereby increasing the IT value proposition. 

IT and Acquisition Workforce 

In collaboration with the CHCO, the CIO identified funding and launched an IT Strategic Workforce Plan 

that will drive horizontal integration to ensure the proper level of involvement by all stakeholders in the 

development and use of IT workforce planning processes, competency models, and critical elements 

definition. The initiative is underway and the as-is analysis is nearing completion. 

The CIO and CHCO led the realignment of the OCIO and the transition of the SBA Digital Service team 

into the OCIO, and to deliver improved services and capabilities, and allow for more customer and 

mission focused capabilities. This realignment was socialized with our congressional committees of 

jurisdiction and later approved by our appropriations subcommittee. 

SBA conducted two training sessions in FYI? for contracting officers that supported best practices in the 

development, award and administration ofiT contracts. 

Federal Data Center Consolidation Initiative 

When OMB Memorandum M-16-192 was released, SBA was without a permanent CIO, and SBA was 

reporting on its data center plans and metrics without identifying or implementing specific consolidation 

migration, or optimization strategies. Previous plans were drafted, but not approved or implemented, and 

2 OMB Data Center Optimization Initiative Memorandum M-16-19, August 1, 2016, 

https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/memoranda/2016/m_16_19_l.pdf 

4 
81 


KING-6430 with DISTILLERInsert offset folio 50 here 29502.050

data previously reported was incomplete and contained some inaccuracies. SBA updated its Data Center 

Optimization Initiative Strategic Plan in October 2017 and identified ten tied data centers. 

SBA did not expend any funds or resources towards initiating or significantly expanding an existing data 

center. SBA has not expanded its data center footprint, and in fact, consolidated and reduced its 

headquarters data center footprint. Because of a CIO directive issued in November 2016 that no new 

hardware would be installed in its headquarters data center, SBA was the first agency to implement DHS' 

Continuous Diagnostic and Mitigation (CDM) system in the cloud. 

In FYI?, OCIO completed its cloud architecture and migration planning, and migrated 40 systems so far .. 

The OCJO consolidated and shutdown 200 servers, eliminated 50 end-of-life production servers, and 

consolidated existing virtual servers onto fewer physical servers significantly reducing energy 

consumption and reducing license and maintenance costs. Energy metering technologies are installed in 

its headquarters data center on all servers, and metering will be in place on all servers throughout the 

enterprise by the end of FY 18. SBA is on track to meet its cost savings and avoidance targets and 

planned closures. 

The CIO is approving IT budget requests, certifying that OMB's incremental development guidance is 

being implemented for IT investments, and reviewing and approving IT contracts. Because of the 

decade-long leadership and technology vacuum at OCIO, several program offices developed their own IT 

organizations that have operated largely independently of OCIO. With new OCIO leadership that is 

regularly convening agency-wide technology forums for all IT professionals, and SBA's implementation 

of FIT ARA and its governance requirements, a more collaborative partnership approach is in place. The 

CIO, in partnership with the CFO and OCHO, are executing a vision for the future of information 

technology that will result in a secure and high-performing computing environment necessary to enable 

the SBA to efficiently and effectively deliver on its goals. 

5 
82 

Mr. HURD. Thank you. 

And because votes have been called, we’re going to limit our 

questioning time to about 21⁄2 minutes. So, Mr. Gianforte, you’re up 

first. 

Mr. GIANFORTE. Thank you, Mr. Chairman. 

So, Ms. Roat, sounds like you walked into a mess. And I’m just 

curious, what advice would you have for other Federal CIOs, given 

the experience you’ve had in trying to get your arms around it? 

Ms. ROAT. Don’t plan to plan, execute. Walking into a failing 

data center, our primary data center, we move very quickly. We 

had failing HVAC systems. Last November, I said very clearly to 

the team, no new hardware, period. And that’s what embarked us 

moving forward on our data center, shutting down our primary 

data center, moving into the cloud very quickly, very fast. I brought 

in the right talent to do that, to be able to do that, and we executed. And it was driven by failing data centers, the gaps in technology, all of those things, and we executed. 

Mr. GIANFORTE. Okay. Just for my edification, where are you in 

the transformation to the cloud at this point, if you had to put a 

percentage on it? 

Ms. ROAT. So for our primary data center, we’ve moved about 40 

systems already. We are not doing a lift and shift. We modernized 

everything first. So we did a migration, an actual architecture. We 

did a migration planning session, and we started execution of the 

migration in July of this year. So the 200 systems that are in our 

primary data center, we’ve done about 40 right now. 

Mr. GIANFORTE. Okay. So what percentage would you say is in 

the cloud? 

Ms. ROAT. That’s roughly about 25 to 30 percent. 

Mr. GIANFORTE. Okay. And what success have you had in moving 

departments off of custom software compared onto commercial offthe-shelf software? 

Ms. ROAT. To the extent that we’re not building our own code, 

not doing our own coding, take advantage of commercial off-theshelf software is a service, platform is a service, we are doing it. 

For one of our program offices, you know, they needed some investigation software. We’re using a particular product, which is a software solution right in our cloud environment. So we are driving in 

that direction and getting away from actual hands-on coding. 

Mr. GIANFORTE. Okay. With that, Mr. Chairman, I yield back. 

Mr. HURD. Robin Kelly, you’re on the clock. 

Ms. KELLY. Mr. Powner, in GAO’s assessment, I am assuming 

that you gave recommendations to SBA to improve their grades 

and software licensing. Is that correct? 

Mr. POWNER. Yes. We’ve been working closely with SBA. 

Ms. KELLY. Okay. So, Ms. Roat and Mr. Gribben, do you believe 

you can implement these recommendations within the next year? 

And what do you think you can do? What do you think you can accomplish? 

Ms. ROAT. For the software licensing, specifically there’s three 

pieces to that we’re taking into account. One is reducing the footprint of duplicative software. So that’s the very first piece. We’re 

reducing the number of licenses and providing the right level of 

software licenses to the users that need it. 


KING-6430 with DISTILLER
83 

When you look at particular software platforms, you know there’s 

different levels. We’re making sure they’re assigned. So we’ve already embarked on getting our arms around our licensing. In particular is we’re moving into the cloud, getting our arms around 

that. We’ve put the monitoring tools in place. 

So we started a couple of months ago with this process in getting 

our arms around all of our software. And a year ago, I didn’t have 

visibility into the entire enterprise; I do now. So that way that 

gives me the capability to be able to see what licenses are out 

there, what’s deployed, not just on the cloud, but also on the desktop and the systems. 

Ms. KELLY. I don’t know if you have any comment. 

Mr. GRIBBEN. The only thing I would add to that is that as part 

of the budget execution process, the CIO has visibility into all of 

the IT requests of the program offices. And this year, we identified 

some offices that had some software licenses that would be better 

incorporated into an enterprise agreement that the CIO had already embarked on. So from that, we’re reducing the software licenses, the one offsetter in the program offices. 

Ms. KELLY. Okay. It sounds like you’re committed to making improvements, so we look forward to seeing your grades improve. 

I yield back. 

Mr. HURD. Mr. Connolly. 

Mr. CONNOLLY. I thank the chair. 

I just—gosh, at risk of destroying my reputation with the chairman, I think there’s a lot of good news here. And a lot of it has 

to do, though, with having a CIO who, A, has the political will herself, but also a direct tie to the heavy agency so that she is empowered. And I assume you concur with that? 

Ms. COETZEE LESLIE. Yes, we do. Our CIO has direct access to 

the administrator and myself as the deputy, and has also the authority to—or has control over authority to operate. And we have 

empowered her to do whatever is necessary to protect the agency 

and make sure that we are delivering the products as best we can. 

Mr. CONNOLLY. Sounds like you were—before this CIO, Ms. Roat, 

it sounds like you were handing out glasses of hemlock of something, given the turnover that was occurring. So I don’t know what 

you’ve done to make it a more pleasant and attractive place, but 

keep doing it. 

Ms. Roat, did you want to comment on that, not the hemlock so 

much? 

Ms. ROAT. It’s not the hemlock? 

Mr. CONNOLLY. But the turnover and—— 

Ms. ROAT. While I can’t speak to my predecessors, there were 

some very good people there. But I will say that I’ve got an incredible relationship with the CFO and then with access to the administrator and the deputy administrator. Myself and my deputy make 

the rounds informally about once a day in the front office. And we 

do have actual formal standard meetings and participate in many 

of the boards. 

Mr. CONNOLLY. Just a final point. You actually met the metrics 

set by OMB on data center consolidation in terms of savings, as I 

understand it. Keep doing it, double down on it. I think that’s really important, and that’s how we reinvest in ourselves once the 


KING-6430 with DISTILLER
84 

MGT legislation becomes law. Thank you, and congratulations on 

the progress you’ve achieved. Keep doing it. 

Ms. ROAT. Thank you. 

Mr. HURD. Thank you, Mr. Connolly. 

Mr. Powner, what do they need to do in order to get that N to 

a Y in the CIO reporting directly to the Secretary—— 

Mr. POWNER. It’s just a lot of formal reporting. There’s access, 

from what we understand, but in terms of the reporting, I don’t see 

the direct reporting there to the dep secretary, to the assistant—— 

Mr. HURD. Ms. Coetzee Leslie, do you have any opinion on making that a more formal structure to ensure the CIO reports directly 

to you or Administrator McMahon? 

Ms. COETZEE LESLIE. We have several changes that we’re looking 

at with agency reform, and this is certainly one that we are considering. 

Mr. HURD. That’s great. 

Mr. POWNER. And, Mr. Chairman, I would add, you know, I think 

what’s really important here is we’ve got this history of 1.4 years. 

Hopefully, Ms. Roat sticks around more than 1.4, but I think that 

change is important because, clearly, this is an executive team that 

we hear that is working well together and things are happening 

and there’s great plans. But I think that’s why that formality is important, the 1.4 history. 

Mr. HURD. Ms. Roat, I’m sure you are expecting my question on 

your ability to answer whether you have 100 percent visibility of 

what’s on your network. 

Ms. ROAT. I do today. I did not a year ago. 

Mr. HURD. And how are you deploying the CDM? 

Ms. ROAT. We deployed CDM in the cloud. Last November when 

I said no new hardware on our data center, my team went back 

and they said but, but, but. And I said, but I want to put it on the 

cloud. And I said, why not? And I ask them that frequently, why 

not? And they went back to DHS and proposed it. DHS said let’s 

go ahead and do it. And so we started small. Instead of buying 96 

cores, spending all that money and all that hardware, we started 

small in the cloud, spinning up the virtual servers, adding on as 

we needed. So phase one we completed this summer. So, again, 

we’re the first Federal agency to do it. 

Mr. HURD. Awesome. Mr. Gribben, I’m sure you can expect what 

my question is going to be. How are you going to help Ms. Roat create the Working Capital Fund that MGT is going to give her, hopefully as early as tomorrow? 

Mr. GRIBBEN. That is actually something that I’m going to have 

to work with the Office of Management and Budget and our appropriations committee. And how that would be implemented, currently what we do is any savings that are—— 

Mr. HURD. Let me stop you there. What conversations do you 

need to have with OPM—I mean OMB. Excuse me. 

Mr. GRIBBEN. Most of the money we spend on information technology is 1-year money. And even with the reprogramming request 

into a Working Capital Fund, we’d still remain as 1-year money. 

Mr. HURD. But that’s what the legislation is changing where the 

Working Capital Fund gives the ability to, once you program that 

money into a working capital fund, you have 3 years to gain access. 


KING-6430 with DISTILLER
85 

So what you’re going to ultimately need is guidance from OMB on 

the steps to making that happen. 

Mr. GRIBBEN. Exactly. 

Mr. HURD. I would welcome your suggestions on those kinds of 

guidance. We should be going to OPM in this—OMB, excuse me. 

And, Ms. Roat, your suggestions on how to do that would be very 

helpful as well to ensure that you have one more tool in your toolkit. 

Ms. Coetzee Leslie, do you have any final comments on creating 

a culture within the organization to ensure you have Ms. Roat 

staying there for more than 1.4 years? 

Ms. COETZEE LESLIE. Well, I’ve been telling everybody on my 

road trips and every forum that I attend and where I speak that, 

other than Disneyland, the SBA is the happiest place on Earth, 

and we intend to keep it that way. With the current administrator 

and the leadership team that’s there now, we have a very, very 

functional team, and look forward to continuing that relationship 

and keeping Ms. Roat happy. 

Mr. HURD. Excellent. 

Mr. Powner, you’re a prince. Your team is amazing. Thanks for 

all the effort and work that you do on the scorecard, the minority 

and majority staffs’ work on this. I really do think it is a tool that 

we are starting to see real changes across the Federal IT infrastructure. 

And for all of our witnesses, thank you for appearing here today. 

The hearing record will remain open for 2 weeks for any member 

to submit a written opening statement or questions for the record. 

If there’s no further business, without objection, the subcommittees stand adjourned. 

[Whereupon, at 4:29 p.m., the subcommittees adjourned.] 


KING-6430 with DISTILLER

KING-6430 with DISTILLER
(87) 

APPENDIX 

MATERIAL SUBMITTED FOR THE HEARING RECORD


KING-6430 with DISTILLER
88 


KING-6430 with DISTILLERInsert offset folio 51 here 29502.051

Opening Statement 

Ranking Member Gerald E. Connolly 

House Committee on Oversight and Government Reform 

Subcommittee on Government Operations 

Hearing on "The Federal Information Technology Acquisition Reform Act (FITARA) Scorecard 

S.O" 

Joint Subcommittee on Information Technology and Government Operations 

November 15, 2017 

Chairman Meadows, Chairman Hurd, and Ranking Member Kelly, it is great that we are back 

together for our fifth FIT ARA Scorecard hearing. I firmly believe that these hearings are critical to 

ensuring that agencies are properly implementing the Federal Information Technology Acquisition and 

Reform Act, which is better known as FIT ARA or Issa-Connolly. In addition to our year round work 

with the Office of Management and Budget (OMB) and the Government Accountability Office (GAO), 

these biannual hearings send a signal that our subcommittees are committed to the successful 

implementation of FIT ARA. 

Today's hearing is especially important as the FITARA Scorecard 5.0 indicates that agencies 

have stopped making progress in several key areas. On the latest scorecard, only three agencies had 

letter grades that improved, while six saw their grades decrease, and fifteen stayed the same. 

Additionally, the Department of Treasury joined our repeat offender, the Department of Defense (DoD), 

in receiving a failing grade ofF+. I believe that agencies with failing grades should testifY before 

Congress as to why they are still not adequately implementing FIT ARA, nearly three years after 

enactment. If agencies with C's and D's are required to testifY for subpar grades, then agencies with 

failing grades ought to testifY as well, even if they have testified at a previous hearing. 

The lack of progress in implementing FIT ARA is most notable in the grades of agencies on the 

Data Center Optimization Initiative (DCOI). Only three agencies the General Services Administration, 

the Department of Education, and the Department of Housing and Urban Development (HUD) 

received an A grade in this area. Under FITARA, OMB set a goal to close 4,477 data centers 

government-wide in Fiscal Year 2018. Government-wide, agencies have completed 65% of this goal. 

However, three agencies are responsible for the bulk of data center closures: DoD, Department of 

Agriculture, and the Treasury Department. Agencies such as the Department of Energy and the 
89 


KING-6430 with DISTILLERInsert offset folio 52 here 29502.052

Department of Veterans Affairs, have made very little progress. Under FIT ARA, OMB also set 

optimization metrics in order to improve the performance of federal data centers in areas such as facility 

utilization and power usage. In August, GAO released a report that found that as of April2017, 17 of22 

agencies with agency-owned data centers were not planning to meet the data center optimization metrics 

established by OMB. This is troubling because until agencies improve their optimization progress, 

OMB's $2.7 billion initiative-wide cost savings goal may not be achievable. 

Through August 2017, 20 agencies have reported achieving approximately $1 billion in cost 

savings through the Data Center Optimization Initiative for fiscal years 2016 and 2017. Additionally, 

agencies are planning an additional $988 million in savings through fiscal year 2018. That means the 

federal government is leaving a little under $670 million in savings on the table by not making strides in 

closing and optimizing their data centers. 

In July, Representative Issa and I introduced the FIT ARA Enhancement Act of2017. The bill, 

upon the recommendation of GAO, would extend the Data Center Optimization Initiative for another 

two years so that agencies can continue efforts to save money by closing, consolidating, and optimizing 

their data centers will remain a transparent process subject to close congressional scrutiny. Additionally, 

the IT Dashboard and PortfolioStat provisions ofFITARA allow OMB to evaluate the efficiencies and 

risk of IT investments and are central to the informing the FIT ARA Scorecard. The FIT ARA 

Enhancement Act permanently extends both the IT Dashboard and PorfolioStat, which were set to 

expire December 1, 2019. This will allow us to continue our oversight ofFITARA implementation and 

continue these hearings. I am pleased that both the House of Representatives and the Senate have passed 

the FIT ARA Enhancement Act and it is making its way to the President's desk. 

In August, the Administration released a plan to modernize federal IT systems with a goal of 

standardizing and consolidating IT acquisition which it believes will free up resources to pursue IT 

modernization. In order to achieve the Administration's goals, agencies should turn to FIT ARA's seven 

pillars which include enhanced CIO authorities, certification of incremental development, training the IT 

acquisition workforce, and maximizing tools such as the Federal Strategic Sourcing Initiative. The 

pillars of FIT ARA provide a foundation that better positions agencies to take advantage of new 

technologies that can help agencies secure their networks, retire their legacy IT systems, and better 

2 
90 


KING-6430 with DISTILLERInsert offset folio 53 here 29502.053

achieve their missions. And in order for the Administration to achieve the goals it has set for itself, it 

must have leadership in place at OMB enforcing the principles of FIT ARA-based IT modernization. 

Nearly II months into this Administration, we are still without a Federal CIO and six federal agencies 

are without a permanent CIO. It will be next to impossible to achieve our IT modernization goals and 

attain cost savings without permanent and sustained leadership. Federal IT cannot be improved by fiat. 

I look forward to hearing from our agency witnesses today. I welcome back USAID which has 

the highest grade in the FIT ARA Scorecard. I also welcome witnesses from the Small Business 

Administration, which has improved its score from a D- in the last Scorecard to a C- this time around, 

and the Department of Energy, which went from aC-to D+. I would like to hear from these two 

agencies what challenges they have had in implementing FIT ARA and any plans they have to improve 

their grade in the next Scorecard. 

3 
91 


KING-6430 with DISTILLERInsert offset folio 54 here 29502.054

Department of Energy 

Washington, DC 20585 

August 9, 2017 

EXEC-2017-006165 

MEMORANDUM FOR THE SECRETARY 

THROUGH: 

FROM: 

SUBJECT: 

MATIHEW B. MOURV 

ACTING UNDER SECR 

FOR MANAGEMENT AND PERFORMA CE 

STEPHEN (MAX) EVERffi 

CHIEF INFORMATION OFFICER 

ACTION: Designate the Chief Information Officer as a Direct 

Report to the Secretary and Deputy Secretary 

ISSUE: Whether to approve and sign the memorandum designating the Chief 

Information Officer (CIO) as a direct report to the Secretary and Deputy Secretary. 

BACKGROUND: The Department's CIO currently has dual reporting responsibilities. The 

CIO reports directly to the Secretary and Deputy Secretary for purposes of carrying out 

responsibilities under 44 U.S.C. §§ 3501-3521, while reporting to the Under Secretary 

for Management and Performance for all other responsibilities. This bifurcated 

reporting relationship subjects the Department's efforts to implement the Federal 

Information Technology Acquisition Reform Act (FITARA)1 to continued criticism from 

Congress, the Office of Management and Budget, and the Government Accountability 

Office; and is a departure from private sector best practices. 

In 2013 the Office of the CIO was realigned under the newly created Under Secretary for 

Management and Performance, thereby severing the CIO's historical direct reporting 

relationship with the Secretary and Deputy Secretary. In 2016, under the Department's 

FITARA implementation efforts and in recognition of a pre-existing statutory 

requirement, 2 the Department's organizational diagram was updated to reflect the CIO's 

responsibility to report directly to the Secretary but only for purposes of carrying out 

responsibilities under 44 U.S.C. §§ 3501-3521. The House Committee on Oversight and 

Government Reform does not recognize this change as compliant with FITARA, and, 

'Title VIII, Subtitle 0 ofthe National Defense Authorization Act for Fiscal Year 2015, Pub. L No. 113·291. 1 44 u.s.c. § 3506. 
92 


KING-6430 with DISTILLERInsert offset folio 55 here 29502.055

accordingly reduced the Department's overall implementation grade in its last two 

FITARA scorecards. The Department would be better served fn this regard if it were to 

reestablish a direct reporting relationship between the CIO and the Secretary and 

Deputy Secretary. This action is consistent with the President's focus on cyber security 

and attendant accountability for agency heads. 

A formal reorganization package would need to be prepared and reviewed by all 

appropriate offices within the Department if this direct reporting relationship were 

reestablished. In that process, all relevant delegations and designations would also 

have to be reviewed so that it is clear from and to whom the authority is being 

delegated. 

OPTIONS:. 

A. Designate the. CIO as a Direct Report to the Secr~tary and Deputy Secretary and 

direct the Under Secretary .for Management and Performance to move forward 

with a reo'rganization package , or 

B. Maintain the current bifurcated reporting relati<;ms!Jip. 

RECOMMENDATION: That you' design·;;~te the CIO as a Direct Report to the Secretary 

and Deputy Secretary and sign the rilemoraridum directing the Under Secretary for 

Management and Performance to move forward with a reorganization package to 

establish the CIO as a direct report to the Secretary and Deputy Secretary for all CIO 

functions. This change would further demonstrate the Department's commitment to 

best practices in .IT management and cyber security. 

2 

~ r;) . AUG 2 .4 2017 

APPROVI!\S,,;_:t:'61SAPPROVE: ___ NEEDS DISCUSSION: ___ ·DATE:_· __ 
93 

Æ 


KING-6430 with DISTILLERInsert offset folio 56 here 29502.056

The Secretary of Energy 

Washington, DC 20585 

August 24, 2017 

MEMORANDUM FOR THE UNDER SECRETARY FOR MANAGEMENT 

AND PERFORMANCE 

FROM: RICK PERRY ~I<.. ~e,RR. .)1 

SUBJECT: Chieflnfonnation Officer Reorganization Package 

This Memorandum directs the Under Secretary for Management and Perfonnance and the 

Chief Infonnation Officer (CIO) to work with the Deputy Secretary of Energy to 

effectuate the designation of the CIO as a direct report to the Secretary and Deputy 

Secretary for all CIO functions.