IG-00-038

AUDIT

REPORT NASA’S ORGANIZATIONAL STRUCTURE FOR

IMPLEMENTING THE CLINGER-COHEN ACT

July 17, 2000

National Aeronautics and

 Space Administration

OFFICE OF INSPECTOR GENERAL
Additional Copies

To obtain additional copies of this report, contact the Assistant Inspector General for Auditing at (202)

358-1232 or visit http://www.hq.nasa.gov/office/oig/hq/issuedaudits.html.

 Suggestions for Future Audits

To suggest ideas for or to request future audits, contact the Assistant Inspector General for Auditing.

Ideas and requests can also be mailed to:

Assistant Inspector General for Auditing

Code W

NASA Headquarters

Washington, DC 20546-0001

 NASA Hotline

To report fraud, waste, abuse, or mismanagement, contact the NASA OIG Hotline at (800) 424-9183,

(800) 535-8134 (TDD), or at www.hq.nasa.gov/office/oig/hq/hotline.html#form; or write to the NASA

Inspector General, P.O. Box 23089, L’Enfant Plaza Station, Washington, DC 20026. The identity of

each writer and caller can be kept confidential, upon request, to the extent permitted by law.

 Reader Survey

Please complete the reader survey at the end of this report or at

http://www.hq.nasa.gov/office/oig/hq/audits.html.

Acronyms

CIO Chief Information Officer

GAO General Accounting Office

IRM Information Resources Management

IT Information Technology

NPG NASA Procedures and Guidelines

OMB Office of Management and Budget

PMC Program Management Council
W July 17, 2000

TO: A/Administrator

FROM: Inspector General

SUBJECT: INFORMATION: NASA's Organizational Structure for

Implementing the Clinger-Cohen Act

Report Number IG-00-038

The NASA Office of Inspector General has completed an audit of the Agency’s Organizational

Structure for Implementing the Clinger-Cohen Act.1 We found that NASA can improve its Chief

Information Officer (CIO) organization to more effectively implement the requirements of the Act.

The NASA CIO is not a full member of the Capital Investment Council (the Council). By

appointing the CIO to the Council, the Agency can better comply with the Clinger-Cohen Act and

related guidance regarding the intended authority of the CIO position. In addition, most Center

CIO Representatives are not full members of Center-level Program Management Councils

(PMC’s).2 As a result, NASA lacks assurance that information technology (IT)3 will receive

appropriate emphasis in Center-level program oversight activities. Finally, the NASA CIO has not

met the Clinger-Cohen requirement to annually assess the knowledge and skill of senior managers in

information resources management (IRM)4 and has not developed specific plans to remedy possible

deficiencies in meeting established knowledge and skill requirements. Consequently, the Agency

has not yet complied with statutory requirements and lacks assurance that executive-level personnel

are appropriately qualified in IRM.

 

1

 The Clinger-Cohen Act was formerly titled the Information Technology Management Reform Act.

2

 NASA has established a hierarchy of PMC’s that are responsible for assessing program and project formulation and

implementation and for providing oversight and direction. PMC’s exist at the Agency, Lead Center, and Center levels.

3

 The Clinger-Cohen Act defines "information technology" as any equipment or interconnected system or subsystem of

equipment, that is used in the automatic acquisition, storage, manipulation, management, movement, control, display,

switching, interchange, transmission, or reception of data or information by the executive agency.

4

 U.S. Code 44, as referenced from the Clinger-Cohen Act, defines "information resources management" as the process of

managing information resources to accomplish agency missions and to improve agency performance, including reducing

information collection burdens on the public.
2

Background

In February 1996, Congress enacted the Clinger-Cohen Act to improve the way Federal agencies

acquire and manage IT resources. To assure clear accountability for IT management activities, the

Clinger-Cohen Act specified that each agency establish a CIO with the following responsibilities:

• Provide advice and other assistance to the head of the executive agency and other senior

management personnel to ensure that IT is acquired and information resources5 are

managed in a manner that implements the specific requirements of the Act.

• Develop, maintain, and facilitate the implementation of a sound and integrated IT

architecture.

• Promote the effective and efficient design and operation of all major IRM processes for the

executive agency, including improvement to work processes.

Additionally, a CIO is responsible for annually assessing the extent to which senior management

personnel meet the requirements established for knowledge and skill in IRM. To meet these

responsibilities, each agency head must involve the CIO in IT decision-making at the highest level of

the agency.

Recommendations

We recommended that the Associate Deputy Administrator strengthen the role of the NASA CIO

by appointing the CIO as a full member of the NASA Capital Investment Council. Similarly, we

recommended that the NASA CIO strengthen the role of Center CIO Representatives in program

oversight by revising policies, procedures, and guidelines to require Center Directors to appoint

their Center CIO Representatives as full members of Center-level PMC’s. Lastly, we

recommended that the NASA CIO reprioritize the Agency’s approach to assessing the IT

knowledge and skill of the workforce to initially focus on executive-level managers.

Management Response

Management concurred with the findings and recommendations. The Associate Deputy

Administrator appointed the NASA CIO to the Capital Investment Council on June 1, 2000. In

addition, the NASA CIO issued a letter to Center Directors, requesting that they appoint Center

CIO Representatives to Center-level PMC’s. Finally, the NASA CIO restructured the Agency’s

approach to assessing NASA’s workforce IT knowledge and skills to focus on NASA’s executiveand senior-level managers.

 

5

 U.S. Code 44, as referenced from the Clinger-Cohen Act, defines "information resources" as information and related

resources, such as personnel, equipment, funds, and information technology.
3

The details on the status of the recommendations are in the Executive Summary.

[original signed by]

Roberta L. Gross

Enclosure

Final Report on Audit of NASA’s Organizational Structure

 for Implementing the Clinger-Cohen Act
NASA'S ORGANIZATIONAL STRUCTURE FOR

IMPLEMENTING THE CLINGER-COHEN ACT
W July 17, 2000

TO: AE/Chief Engineer

AI/Associate Deputy Administrator

AO/Chief Information Officer

FROM: Assistant Inspector General for Auditing

SUBJECT: Final Report on the Audit of NASA’s Organizational

Structure for Implementing the Clinger-Cohen Act

Assignment Number A9903400

Report Number IG-00-038

The subject final report is provided for your information and use. Please refer to the Executive

Summary for the overall audit results. Our evaluation of your response is incorporated into the

body of the report. Your comments on a draft of this report were responsive, and actions are

sufficient to close recommendation 1 for reporting purposes. For recommendations 2 and 3,

we request that you notify us of the actions taken, including the extent of testing performed to

ensure corrective actions are effective. Recommendations 2 and 3 will remain open for

reporting purposes.

If you have questions concerning the report, please contact Mr. David L. Gandrud, Program

Director, Information Technology Program Audits, at (650) 604-2672, or Mr. Roger W. Flann,

Program Manager, at (818) 354-9755. We appreciate the courtesies extended to the audit

staff. The report distribution is in Appendix E.

[original signed by]

Russell A. Rau

Enclosure

cc:

B/Chief Financial Officer

B/Comptroller

BF/Director, Financial Management Division
G/General Counsel

JM/Director, Management Assessment Division
Contents

Executive Summary, i

Introduction, 1

Findings and Recommendations, 3

Finding A. Role of the NASA CIO in Capital Investment

Decision-Making, 3

Finding B. Role of Center CIO Representatives in Program

Oversight, 7

Finding C. Assessing IT Knowledge and Skill, 11

Appendix A – Objectives, Scope, and Methodology, 13

Appendix B – Summary of Prior Coverage, 15

Appendix C – NASA Programs and Projects, 16

Appendix D – Management’s Response, 19

Appendix E – Report Distribution, 28
NASA Office of Inspector General

IG-00-038 July 17, 2000

 A9903400

NASA’s Organizational Structure for Implementing

the Clinger-Cohen Act

Executive Summary

Background. Congress enacted the Clinger-Cohen Act to improve the way Federal agencies

acquire and manage IT resources. The Clinger-Cohen Act requires that each agency establish a

CIO with clear accountability for IT management activities.

Objectives. The overall objective was to determine whether NASA has established a CIO

organization that can effectively implement the requirements of the Clinger-Cohen Act.

Specifically, we examined selected duties, responsibilities, and authority of the NASA CIO and

his representatives. Details on our objectives, scope, and methodology are in Appendix A.

Details on a prior report we issued on the Clinger-Cohen Act are in Appendix B.

Results of Audit. NASA can improve its CIO organization to more effectively implement the

requirements of the Clinger-Cohen Act.

• The NASA CIO is not a full member of the Capital Investment Council (the Council).

By appointing the CIO to the Council, the Agency can better comply with the

Clinger-Cohen Act and related guidance regarding the intended authority of the CIO

position.

• Most Center CIO Representatives are not full members of Center-level PMC’s. As a

result, NASA lacks assurance that IT will receive appropriate emphasis in Center-level

program oversight activities.

• The NASA CIO has not met the Clinger-Cohen requirement to annually assess the

knowledge and skill of senior managers in IRM and has not developed specific plans to

remedy possible deficiencies in meeting established knowledge and skill requirements.

Consequently, the Agency has not yet complied with statutory requirements and lacks

assurance that executive-level personnel are appropriately qualified in IRM.

Recommendations. NASA should strengthen the role of the NASA CIO by appointing the

CIO as a full member of the NASA Capital Investment Council. Similarly, the Agency should

strengthen the role of Center CIO Representatives in program oversight by revising policies,
ii

procedures, and guidelines to require Center Directors to appoint their Center CIO

Representatives as full members of Center-level PMC’s. Lastly, the NASA CIO should

reprioritize the Agency’s approach to assessing the IT knowledge and skill of the workforce to

initially focus on executive-level managers.

Management’s Response. Management concurred with all recommendations. On June 1,

2000, management appointed the NASA CIO to the Capital Investment Council. Also, the

NASA CIO asked the Center Directors to appoint Center CIO Representatives to Centerlevel PMC’s. Lastly, the Agency will initially focus on NASA’s executive- and senior-level

managers in assessing NASA’s workforce IT knowledge and skill. The complete text of

management’s comments is in Appendix D.

Evaluation of Management’s Response. The actions taken or planned by management are

responsive to the recommendations. We consider the recommendation related to appointing the

NASA CIO to full membership on the Capital Investment Council closed for reporting

purposes. The recommendations related to appointing Center CIO Representatives as full

members of Center-level PMC’s and reprioritizing the Agency’s approach to the “IT

completed.
Introduction

In February 1996, Congress enacted the Clinger-Cohen Act to reform and improve the way

Federal agencies acquire and manage IT resources. Central to implementing these reforms is

the need to establish effective IT leadership within each agency. The law requires each agency

head to establish clear accountability for IT management activities by appointing an agency CIO

with the visibility and management responsibilities necessary to carry out the specific provisions

of the Act. The CIO plays a critical leadership role in driving reforms to (1) help control system

development risks; (2) better manage technology spending; and (3) succeed in achieving real,

measurable improvements in agency performance.

In February 1995, prior to enactment of the Clinger-Cohen Act, NASA established the CIO

position as an executive-level manager within the Office of the Administrator. The NASA CIO

is the principal advisor to the Administrator and other senior officials on matters pertaining to IT.

NASA Procedures and Guidelines (NPG) 2800.1, “Managing Information Technology,”

September 1998, states that the CIO is responsible for establishing IT policies and for

promoting standards and a secure architecture to support scientific, engineering, and

administrative data requirements.

Since establishing the CIO position, the Agency has developed and refined a CIO organization

to support the CIO in carrying out his responsibilities. This organization includes a Center CIO

Representative at each NASA Center. Center Directors appoint Center CIO Representatives

who remain accountable to Center management while working on a collaborative basis with the

NASA CIO. Center CIO Representatives are responsible for ensuring that Agency IT policy,

plans, architectures, standards, procedures, practices, and guidance are implemented for their

respective organizations.

The Agency has also incorporated IT as a key focus area in capital investment and program

management processes. Within NASA’s capital investment process, IT is designated as a key

investment area for consideration by the Capital Investment Council. The Council is the

principal advisory group to the Administrator in prioritizing capital investments and balancing

resources among the Agency’s Strategic Enterprises.6 Within NASA’s program management

process, IT requirements are integrated into the planning and technical management effort

throughout a program’s life cycle and are reviewed by the cognizant PMC. PMC’s exist at the

Agency, Lead Center, and Center levels to oversee the formulation, approval, implementation,

and evaluation of Agency programs and projects.

In August 1996, the General Accounting Office (GAO) issued an audit report on “NASA Chief

Information Officer: Opportunities to Strengthen Information Resources Management.” GAO

reported that although NASA was one of the first Federal agencies to appoint a CIO and had

 

6

 The Agency’s four Strategic Enterprises are (1) Aero-Space Technology, (2) Earth Science, (3) Human Exploration

and Development of Space, and (4) Space Science.
2

taken some good first steps toward improving its information resources management,

opportunities still existed to enhance the CIO’s authority. GAO concluded that more authority

for the CIO could result in improved economies and efficiencies in information technology. In

responding to GAO’s audit observations, NASA disagreed that the authority and responsibility

of the CIO should be significantly strengthened. Further, the Agency described several

revisions to the CIO management structure that addressed some of the challenges discussed in

the GAO report. GAO acknowledged that the revisions may ameliorate its concerns over time,

but stated that it was still too early to determine the effectiveness of the revised management

structure.
3

Findings and Recommendations

Finding A. Role of the NASA CIO in Capital Investment

Decision-Making

The NASA CIO is not a full member of the Capital Investment Council because the Agency has

limited Council membership to managers having direct budget authority.7 By appointing the

CIO to the Council, the Agency can better comply with the Clinger-Cohen Act and related

guidance regarding the intended authority of the CIO position. Further, the Agency can also

better assure that IT will be given appropriate consideration in Council deliberations.

Requirements and Related Guidance

The Clinger-Cohen Act requires that each Federal agency create a CIO to help ensure that IT

is acquired and information resources are managed in a manner that implements the specific

policies and procedures of the Act. Further, the Act requires that each agency design and

implement a capital planning and investment control process for maximizing the value and

assessing and managing the risks of IT acquisitions. This process must be integrated with the

process for making budget, financial, and program management decisions.

In July 1996, the President issued Executive Order 13011, “Federal Information Technology.”

The Order required executive agencies to provide clear accountability for information resources

management activities by establishing CIO’s with the visibility and management responsibilities

necessary to advise the agency head on the design, development, and implementation of

information systems.

In November 1995, the Office of Management and Budget (OMB) issued guidance8 identifying

three overall organizational attributes that are critical to the success of an IT investment

evaluation process. The first of these critical attributes is senior management attention. The

OMB guidance states that a key mechanism in achieving accountability for the success of IT

projects is to routinely involve program management, financial management, and IT management

in operational decisions. Similarly, a GAO report9 states:

An agency should place its CIO at a senior management level, making the CIO an equal partner with

other senior officials in decision-making with regard to IRM issues, and supporting the position

with an effective organizational framework for leading agency-wide IRM initiatives.

 

7

 The former Executive Secretary of the Capital Investment Council told us that, at the time the Council was formed,

the NASA Administrator and Deputy Administrator limited Council membership to managers with direct budget

authority.

8

 The guidance was in OMB report, “Evaluating Information Technology Investments: A Practical Guide.”

9

 GAO report, GAO/AIMD-96-78, “NASA Chief Information Officer: Opportunities to Strengthen Information

Resources Management,” was issued in August 1996.
4

In March 2000, GAO issued an Executive Guide10 on implementing effective CIO

organizations. The guide identifies critical success factors for effective information management

in leading organizations. One of these success factors focuses on the role of the organization’s

senior executive managers in developing a culture that includes the CIO in senior-level decisionmaking. The guide states that an agency’s executive-level managers, “...must embrace the

central role of technology, and the CIO must be at the table with them as business strategy is

discussed.” Although leading organizations generally include their CIO’s in executive business

decision-making, in the Federal Government, information management is often managed as a

support function.

NPG 1000.2, “NASA Strategic Management Handbook,” February 2000, defines the

strategic management roles and relationships of NASA’s organizational elements. Major

operational and investment decisions are made at several levels. The Administrator is the

highest level decision-maker, providing overall strategic direction, internal policies, and budget

priorities. The Council makes recommendations regarding significant Agency-wide capital

investments and infrastructure initiatives, including IT programs, projects, and investments. The

Council plays a critical role in the Agency’s capital planning process. The Council is the

principal advisory group to the NASA Administrator in resolving issues, prioritizing activities,

and balancing resources among the Agency’s Strategic Enterprises. The Handbook identifies

IT as a key investment area for Council consideration.

NPG 2800.1, “Managing Information Technology,” September 17, 1998, defines the role of

the NASA CIO and the IT Investment Council. The CIO is the principal advisor to the

Administrator and other senior officials on matters pertaining to IT. The CIO is also the primary

advocate for the Agency’s IT investment strategy. Additionally, the CIO chairs the IT

Investment Council. This council establishes Agency-level IT policies and provides a forum for

addressing Agency-level initiatives and issues. The IT Investment Council sets the IT investment

strategy for the Agency and serves as the IT capital investment advisory group to the Capital

Investment Council.

Role of the NASA CIO

Thirteen senior NASA managers are full members of the Capital Investment Council – the CIO

is not. Although IT is an important element in capital investment decision-making,11 the NASA

CIO’s responsibilities with respect to the Capital Investment Council are limited to providing

 

10 The exposure draft of GAO Executive Guide, GAO/AIMD-00-83, is titled, “Maximizing the Success of Chief

Information Officers: Learning from Leading Organizations.”

11 The NASA IT budget for fiscal year 2000 is approximately $1.7 billion and supports more than 40 Agency

programs.
5

support for Council deliberations. Agency membership in the Capital Investment Council12

consists of the following:

• Associate Deputy Administrator (Chair)

• Chief Financial Officer

• Chief Engineer

• Chief Scientist

• Enterprise Associate Administrators13

• Center Directors (two, 2-year rotational terms)

• Associate Administrator for Human Resources and Education

• Associate Administrator for Management Systems and Facilities

• Associate Administrator for Life and Microgravity Sciences and Applications

Influential IT leadership is crucial in accomplishing NASA’s missions and programs efficiently,

effectively, and securely. In this regard, Executive Order 13011 requires the Agency to give its

senior IT decision-maker the visibility and management responsibilities necessary to fully

implement the requirements of the Clinger-Cohen Act. Although NASA has given the CIO

significant authority by establishing him as chair of the NASA IT Investment Council, the

Agency has not given the CIO the level of authority needed to help provide sufficient, direct

influence in capital investment decision-making.

The NASA CIO is not a full member of the Capital Investment Council because the Agency

limited Council membership to managers having budget authority. When the CIO position was

initially formulated, NASA decided the CIO would not have direct budget authority over IT

investments. According to GAO report GAO/AIMD-96-78 (see footnote 9), NASA

concluded that, “The CIO would not take part in individual program decisions and would not

have responsibility for setting priorities, making trade-offs, or forming investment decisions

among NASA-wide IT systems14 and programs.”

Because the CIO is not a member of the Capital Investment Council, the Agency has not fully

complied with the Clinger-Cohen Act and related guidance regarding the CIO’s intended

authority and influence. The CIO should be an equal partner with other senior-level officials in

the Agency’s capital investment decision-making. Because the Capital Investment Council is

the Agency’s highest-level council for such decision-making, the CIO should participate as a full

member. Until the CIO becomes a member of the Capital Investment Council, the Agency also

 

12 In addition to the full members of the Council, the NASA General Counsel and Associate Administrator for

Legislative Affairs serve as ex officio advisors.

13 NASA has four Strategic Enterprises (see footnote 6). The senior official in each Enterprise is the Associate

Administrator having principal responsibility for developing long-term strategy and ensuring that the necessary

capabilities are in place to meet near-term program objectives and long-term goals.

14 U.S. Code 44, as referenced from the Clinger-Cohen Act, defines an "information system" as a discrete set of

information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition

of information.
6

lacks assurance that IT will be given appropriate consideration in Council deliberations. To

assess the extent to which IT issues were considered in Capital Investment Council meetings,

we examined minutes of Council meetings in 1999.15 The minutes showed no clear indication

that IT had been discussed or considered.

The Agency can ensure that IT is given due consideration in major capital investment decisionmaking by elevating the role of the CIO from “advisor” to “full member” of the Capital

Investment Council. CIO membership would help give IT full consideration in the Council’s key

investment decisions and help the Agency in satisfying the intent of the Clinger-Cohen Act.

Recommendation, Management’s Response, and Evaluation of

Response

1. The Associate Deputy Administrator should appoint the NASA CIO to full

membership on the Capital Investment Council.

Management’s Response. Concur. Management appointed the NASA CIO to the Capital

Investment Council on June 1, 2000. The full text of management’s response and a copy of the

memorandum on the appointment are in Appendix D.

Evaluation of Response. Management action is responsive to the recommendation. The

action take by management is sufficient to disposition the recommendation and close it for

reporting purposes.

 

15 The Capital Investment Council conducted 18 meetings in 1999; however, minutes exist only for those 6 meetings

that did not focus on budgetary issues.
7

Finding B. Role of Center CIO Representatives in Program Oversight

Most Center CIO Representatives are not full members of Center-level16 PMC’s. This

condition exists because NASA has no policy that requires Center Directors to appoint CIO

Representatives as full PMC members and that ensures the representatives are fully involved in

the PMC oversight process. As a result, the Agency lacks assurance that IT will receive

appropriate emphasis in Center-level program and project oversight activities.

Requirements and Related Guidance

The Clinger-Cohen Act, section 5122, requires agencies to design and implement an IT capital

planning and investment control process that shall be, “...integrated with the processes for

making ... program management decisions within the executive agency.”

NPG 7120.5A, “NASA Program and Project Management Processes and Requirements,”

April 3, 1998, identifies IT as a critical management area applicable to all programs and

projects and specifies that IT requirements be integrated throughout the program and project

management process. Also, NPG 7120.5A describes a hierarchy of PMC’s to ensure that

programs and projects receive an appropriate level of management oversight. At the highest

level of the hierarchy, the Agency PMC is responsible for evaluating proposals for new

programs; providing recommendations to the Administrator; and evaluating existing programs

for cost, schedule, and technical content. The hierarchy also includes PMC’s at the Center

level. Similar to the Agency PMC, Center-level PMC’s evaluate cost, schedule, and technical

content to ensure that Center-level programs and projects meet their commitments.

The NASA CIO is the senior IT official at the Agency level. NPG 2800.1, “Managing

Information Technology,” September 17, 1998, identifies the CIO as a full member of the

Agency PMC, “...to assure that the IT investments which enable mission-focused programs

and projects are given appropriate visibility and review.” Center CIO Representatives are the

senior IT officials at their respective Centers and are responsible for:

• Implementing an effective IT investment plan consistent with Agency, Enterprise, and

Center policies, goals, and standards.

• Concurring on all Center major IT investments to assure policy and procedural

compliance with standards.

• Advising and counseling Center senior managers, including program managers, on IT

investments.

 

16 The report uses the term “Center-level PMC’s” to refer to both Lead Center and Center-level PMC’s. NASA

assigns to a Lead Center PMC all multi-Center programs and projects that do not require review by the Agency PMC.

Also, NASA assigns to a Center-level PMC all single-Center programs and projects not reviewed by a higher level

PMC.
8

• Ensuring that implementation procedures and Center standards are established in

compliance with Agency and Enterprise policies and standards.

• Reporting to an individual who has management and budgetary authority to implement

Center IT investment decisions.

• Coordinating the Center IT budgets, requirements, and investments with Enterprise CIO

Representatives.

• Representing and, as necessary, committing the Center at Agency management

meetings.

• Assuring a secure IT environment, resolving areas of duplication, and encouraging IT

training for Center personnel.

Role of Center CIO Representatives

Of nine Center CIO Representatives,17 seven are not full members of Center-level PMC’s.

Center Directors had not granted full membership to the Center CIO Representatives even

though:

• The NASA CIO is a full member of the Agency PMC.

• NASA policy acknowledges that IT is a “critical management area” that is universally

applicable to all NASA programs.

• Center-level PMC’s exist to oversee the formulation, approval, implementation, and

evaluation of all NASA programs and projects that are not reviewed by the Agency

PMC. Center-level PMC’s were responsible for reviewing 18 NASA programs and

200 projects. Of those, 17 programs and 157 projects were managed by Centers that

did not assign Center CIO Representatives to the Center-level PMC’s (see Appendix

C).

At Goddard Space Flight Center (Goddard), the Center Director plans to change the

membership of the Center-level PMC to include the Center CIO Representative as a full

Council member. A Goddard CIO official stated that Center management intends to elevate the

authority of the Center CIO Representative because Goddard wants to send a signal to both the

Goddard community and external colleagues that information science and IT are strategic

assets.

At John F. Kennedy Space Center (Kennedy), the CIO Representative is a PMC member and

has made valuable contributions to Council oversight activities. During a Kennedy PMC

meeting, a manager discussed plans to purchase a commercial off-the-shelf software package

that would link computers and allow users to view the same information at the same time. The

 

17 CIO Representatives are members of Center-level PMC’s at Lyndon B. Johnson Space Center and

John F. Kennedy Space Center. CIO Representatives are not members of Center-level PMC’s at the following Centers:

Ames Research Center, Dryden Flight Research Center, John H. Glenn Research Center at Lewis Field, Goddard Space

Flight Center, Langley Research Center, George C. Marshall Space Flight Center, and John C. Stennis Space Center.
9

Center CIO Representative identified the package as having an IT security vulnerability and

began working with the manager to identify a more secure software package. At another PMC

meeting held to discuss the status of a joint-base operations support contract between NASA

and the Air Force, the Air Force requested that its security standards be applied to the contract.

The Center CIO Representative noted that the Air Force policies would limit Kennedy's

communication with the other NASA Centers and began working with the Air Force to resolve

the issue. These examples illustrate how Center CIO Representatives can provide influential IT

management through full Council membership.

Most Center CIO Representatives are not full members of Center-level PMC’s because

NASA has no policy requiring Center Directors to appoint CIO Representatives as full PMC

members. Absent such a policy, only two of nine Center Directors have appointed Center CIO

Representatives to Center-level PMC’s. Agency policy should be revised to ensure that all

Center Directors emphasize influential and effective IT management by appointing Center CIO

Representatives to full Council membership. Further, Center Directors should ensure that

Center CIO Representatives are fully involved in all aspects of the PMC oversight process

Because most Center CIO Representatives are not full members of Center-level PMC’s, they

do not have the visibility and authority possible through full Council membership. Consequently,

the Agency lacks assurance that IT will receive appropriate emphasis in program and project

oversight activities. Just as membership on the Agency PMC provides needed visibility and

authority for the NASA CIO, membership on Center-level PMC’s would provide needed

visibility and authority for Center CIO Representatives.

Recommendation, Management’s Response, and Evaluation of

Response

2. The NASA CIO should coordinate with cognizant Agency officials to revise

appropriate policies, procedures, and guidelines to require Center Directors to

appoint Center CIO Representatives as full members of Center-level PMC’s.

Management’s Response. Concur. In May 2000, the NASA CIO began regular

teleconferences with Center Directors to discuss CIO issues including the appointment of

Center CIO Representatives to Center-level PMC’s. Additionally, the NASA CIO sent a

letter to the Center Directors, requesting that they appoint Center CIO Representatives to

Center-level PMC’s (see Appendix D). The NASA CIO anticipates that all appointments will

be made by September 30, 2000.

Management stated that the audit report should acknowledge that the Goddard CIO

Representative has been a full voting member of the Center PMC since November 1999.

However, Goddard procedures and guidelines have not yet been modified to reflect this change.
10

Evaluation of Response. The initial actions taken by management are responsive to the

recommendation. However, the recommendation will remain undispositioned and open pending

evidence of Center CIO Representative appointments as full members to Center-level PMC’s

and evidence of related changes to Center-level policies, procedures, and guidelines. The

report does not reflect the Goddard CIO Representative’s appointment to the Center-level

PMC because Goddard’s policies and procedures do not yet reflect this change.
11

Finding C. Assessing IT Knowledge and Skill

The NASA CIO has not met the Clinger-Cohen Act requirement to annually assess the

knowledge and skill of senior managers in IRM. Further, the CIO has not met the Act’s

requirement to develop specific plans to remedy possible deficiencies in meeting established

knowledge and skill requirements. These conditions exist because the CIO’s office has instead

undertaken a broad and time-consuming effort to assess the IT knowledge and skill of NASA’s

entire workforce. As a result, the Agency has not yet complied with statutory requirements and

lacks assurance that personnel in executive-level positions are appropriately qualified in IRM.

Clinger-Cohen Act Requirement

The Clinger-Cohen Act, Section 5125, states that the CIO shall annually:

• assess the extent to which the positions and personnel at the executive level of the agency and

the positions and personnel at management level of the agency below the executive level meet .

. . [established knowledge and skill] requirements; and

• in order to rectify any deficiency in meeting those requirements, develop strategies and specific

plans for hiring, training, and professional development.

Assessments of IRM Knowledge and Skill

The NASA CIO has neither assessed the IRM knowledge and skill of senior managers as

required by the Clinger-Cohen Act nor developed specific plans to remedy possible deficiencies

in meeting established requirements. These conditions exist because the CIO has undertaken a

much broader effort, called the “IT Workforce Challenge,” that will assess the IT knowledge

and skill of virtually all NASA employees.

The CIO’s efforts regarding knowledge and skill levels began in June 1999 with establishment

of an Agency-wide team to address the “IT Workforce Challenge.” Since then, the team has:

• Developed a model depicting the overall IT knowledge of NASA’s workforce.

• Begun to develop a Strategic Plan for addressing IT workforce issues (the team plans to

publish the plan in spring 2000).

• Conducted a survey to obtain a high-level insight into current and desired IT skill levels,

future skill needs, and the loss of IT skills due to personnel turnover and future

retirements.

In addition, the team has developed a survey that will be issued to all NASA Centers as a

special focus area in the fiscal year 2002 Program Operating Plan cycle. The goal of the survey
12

is to obtain Center-level information about strategies and specific plans for hiring, training, and

retaining the appropriate IT skills to meet the Center missions. To date, the

efforts of the CIO and the “IT Workforce Challenge” team have been directed toward

assessing the aggregate IT workforce rather than assessing knowledge and skill on an individual

basis.

The CIO’s approach to the “IT Workforce Challenge” goes beyond the Clinger-Cohen Act

requirement to assess senior management. The CIO’s plans are commendable, but the

additional time required to complete this broader effort will substantially delay the Agency’s

ability to fully comply with the Act. The Clinger-Cohen Act became effective 3 years ago, yet

CIO personnel are still unable to estimate when the Agency will fully comply with the

knowledge and skill requirements of the Act.

The Department of the Treasury (Treasury) has adopted an incremental approach to assessing

the knowledge and skill of its workforce in IRM. Treasury’s approach initially addressed the

knowledge and skill of its senior decision-makers and is now addressing the knowledge and

skill of its entire workforce. Treasury CIO officials concluded that an incremental approach will

permit the Department to comply in a timely manner with the specific requirements of the

Clinger-Cohen Act and, more important, to help assure that Treasury senior managers possess

the appropriate IRM knowledge and skill. By incorporating the incremental approach into the

“IT Workforce Challenge” initiative, NASA can more readily comply with statutory

requirements and assure that executive-level managers are suitably qualified in IRM. Further,

the Agency can develop timely training plans that more closely relate to the training needs of its

senior managers.

Recommendation, Management’s Response, and Evaluation of

Response

3. The NASA CIO should reprioritize the Agency’s approach to the “IT Workforce

Challenge” to initially focus on assessing the IRM knowledge and skill of

executive-level managers and to develop specific training plans to address possible

deficiencies in meeting established IRM requirements.

Management’s Response. Concur. The IT Workforce Challenge Program has initiated an

activity to assess the IT knowledge and skill of NASA’s executive- and senior-level managers

using a Web-based assessment instrument (see Appendix D). Management will analyze the

assessment results and make appropriate recommendations for training and developmental

activities. The NASA CIO anticipates that corrective actions will be completed by December

31, 2000.
13

Evaluation of Response. Management’s planned and completed actions are responsive to

the recommendation. However, the recommendation will remain undispositioned and open

until agreed-to corrective actions are completed.
14

Appendix A. Objectives, Scope, and Methodology

Objective

The overall objective was to determine whether NASA has established a CIO organization that

can effectively implement the requirements of the Clinger-Cohen Act. Specifically, we

examined selected duties, responsibilities, and authority of the NASA CIO and his

representatives.

Scope

We limited the scope of this audit to those sections of the Clinger-Cohen Act directly related to

the announced audit objectives. Other important aspects of the Act were not addressed. For

example, section 5123 of the Act requires the head of an executive agency to ensure that

information security policies, procedures, and practices are adequate. Review of information

security was beyond the scope of this audit. Similarly, section 5113 requires that agencies

establish effective and efficient capital planning processes for selecting, managing, and evaluating

the results of its major investments in information systems. NASA’s capital planning and

investment control processes were also beyond the scope of this audit; however, we addressed

those processes in a previous audit report (see Appendix B for details).

Methodology

To assess the duties and responsibilities of the NASA CIO, we held discussions with the

NASA CIO, members of the CIO’s staff, CIO Representatives, and other NASA personnel

associated with program and project management. We reviewed organization charts, PMC

charters, position descriptions, Capital Investment Council minutes, and other relevant

documentation. We submitted questionnaires to CIO Representatives and analyzed their

responses.

To assess compliance with Clinger-Cohen Act knowledge and skill requirements, we held

discussions with the NASA CIO and members of the CIO’s staff charged with leading the “IT

Workforce Challenge.” We learned that the CIO at the Department of the Treasury had

assessed the knowledge and skill of Treasury’s senior IT managers. Accordingly, we reviewed

related Treasury reports and held discussions with cognizant officials. We compared Treasury’s

approach for meeting the knowledge and skill requirements with the NASA CIO approach.
15

Appendix A

Management Controls Reviewed

We reviewed management controls relating to NASA’s organizational structure for implementing the

Clinger-Cohen Act. We considered the management controls to be adequate except that the role

of the NASA CIO and Center CIO Representatives should be strengthened (see Findings A and

B). We also reviewed controls relating to management’s assessment of IT knowledge and skill

within the NASA workforce. We considered the management controls to be adequate except that

the assessment process should be reprioritized to comply in a timely manner with the Clinger-Cohen

Act (see Finding C).

Audit Field Work

We performed the audit field work from July 1999 through March 2000 at NASA Headquarters,

John H. Glenn Research Center, John F. Kennedy Space Center, and Langley Research Center.

We conducted the audit in accordance with generally accepted government auditing standards.
16

Appendix B. Summary of Prior Coverage

The NASA Office of Inspector General has issued another report related to the Clinger-Cohen

Act. See www.hq.nasa.gov/office/oig/hq/issuedaudits.html for a copy of the report.

“Audit of Information Technology Capital Planning and Investment Control,” Report

Number IG-98-034, September 25, 1998. The NASA IT investment process does not

satisfy the Clinger-Cohen Act or OMB requirements for postimplementation reviews of major

new IT investments. Although NASA has established a program and project evaluation

process, it differs from that required by both the Clinger-Cohen Act and OMB requirements in

that NASA has focused on assessing systems in the selection and control phases of the IT

investment process rather than on assessing fully operational systems. In addition, the Agency’s

existing evaluation process results in conclusions regarding one specific program or project,

whereas a postimplementation review should result in improvements in the overall capital

planning and investment control process. We made recommendations to ensure that NASA’s

process for evaluating IT investments is fully compliant with Clinger-Cohen and OMB

requirements. Management concurred with the recommendations and agreed that the CIO

would submit a change proposal to NPG 7120.5A , “NASA Program and Project

Management Processes and Requirements,” April 3, 1998. In an April 5, 2000, memorandum

to the Assistant Inspector General for Auditing, the CIO stated that NPG 7120.5A had been

revised to address planning and investment requirements throughout the entire information

technology lifecycle. The Office of Inspector General will review the applicable revisions to the

draft document.
17

Appendix C. NASA Programs and Projects

The NASA programs and projects listed below were subject to review by seven Center-level

PMC's during the period from December 5, 1999, through February 10, 2000. These Centers

did not assign Center CIO Representatives to the Center-level PMC’s.

Ames Research Center

Computational AeroSciences Rotorcraft

NASA Research and Education Network Design for Efficient and Affordable Rotorcraft

Learning Technologies Safe All-weather Flight Operations for Rotorcraft

Advanced Air Transportation Technologies Fast Response for Industry Assistance Requests

Terminal Area Productivity Information Technology

Short-Haul Civil Tiltrotor Analytical Tools and Environments for Design

Intelligent Propulsion Systems Controls Intelligent System Controls and Operations

Aviation Systems Monitoring and Modeling Advanced Computing, Networking and Storage

System-Wide Accident Prevention Software Integrity, Productivity and Security

Aerospace Operations Systems Integrated Vehicle Health Management

Human-Automation Integration Research Stratospheric Observatory for Infrared Astronomy

Human Error and Countermeasures Lunar Prospector

Psychological/Physiological Stressors and Factors Gravitational Biology and Ecology

Dryden Flight Research Center

Revolutionary Concepts Advanced System Concepts

Advanced Airplane Flight Research Atmospheric Flight of Space Systems

Innovative Transport and Testbed Experiments Flight Research Productivity

Flight Research Environmental Research Aircraft Sensor

 Technology

Glenn Research Center

System Integration and Assessment Emissions Reduction

Highly Loaded Turbomachinery Materials and Structures for High Performance

Weather Accident Prevention Accident Mitigation

Aircraft Icing Breakthrough Propulsion Physics

Propulsion Research and Technology Propulsion and Power

Ultra-Safe Propulsion Zero CO2 Research

Higher Operating Temperature Propulsion Turbomachinery and Combustion Technology

Oil Free Turbine Engine Technology General Aviation Propulsion

Aerospace Propulsion for High Survivability Emerging Survivable Aeropropulsion Technology

Propulsion Fundamental Research Hybrid Hyperspeed Propulsion

Pulse Detonation Engine Technology Propulsion Research and Technology
18

Appendix C

Goddard Space Flight Center

Tracking and Data Relay Satellite System

 Spacecraft Replenishment

Operations and Ground Systems for Hubble Space

 Telescope

Research Carriers Sounding Rockets

Balloons Spartan Mission

Explorers in Development High Energy Solar Spectroscopic Imager Mission

Galaxy Evolution Explorer Mission Microwave Anisotropy Probe

Imager for Magnetopause-to-Aurora Global

 Exploration Mission

Flight Systems and Servicing for Hubble Space

 Telescope

Full-sky Astrometric Mapping Explorer Mission High Energy Transient Experiment II Mission

Cooperative Astrophysics and Technology Satellite

 Mission

Cosmic Hot Interstellar Plasma Spectometer

 Mission

Inner Magnetosphere Explorer Mission International Collaborations at Goddard

Earth and Space Sciences Swift Gamma Ray Burst Explorer Mission

Astro-E Mission Solar Terrestrial Relations Observatory Mission

X-Ray Multi-Mirror Mission Spectrum-X-Gamma Mission

Thermosphere, Ionosphere, Mesosphere Energetics

 and Dynamics Mission

International Gamma-Ray Astrophysics Laboratory

 Mission

Cluster II Mission Solar Terrestrial Probes

Algorithm Development at Goddard CloudSat Mission

Solar B Mission Space Technology 5

Terra Mission Aqua Mission

Chemistry Mission Ice, Clouds and Land Elevation Satellite Mission

Solar Radiation and Climate Experiment Mission Landsat-7 Mission

Earth Observing System Data and Information

 System

Pathfinder Instruments for Cloud and Aerosol

 Spaceborne Observations Mission

Vegetation Canopy Lidar Mission Gravity Recovery and Climate Experiment Mission

Geostationary Operational Environmental Satellites Polar Operational Environmental Satellites

Volcam Mission Experiments of Opportunity

University Earth System Science Total Ozone Mapping Spectrometer-5

Triana Mission Instrument Incubator Project

Advanced Technology Initiative Advanced Information Systems Technology

Geostationary Operational Environmental Satellite

 Missions N-Q

Geostationary Operational Environmental Satellite

 Missions I-M

National Oceanic and Atmospheric Administration

 Missions A-N

Earth Observing-1 Mission (Advanced Land

 Imager)

Two Wide-Angle Imaging Neutral-Atom

 Spectrometers Mission

Tomographic Experiment Using Radiative

 Recombinative Ionospheric Expendable Ultralite

 Vehicle and Radio Sources Mission
19

Appendix C

Langley Research Center

Propulsion-Airframe Integration Single Aircraft Accident Prevention

Synthetic Vision Select Integrated Low-Noise Technologies

Integrated Instrumentation and Testing Systems Airframe Technology

Vehicle Systems Technology Inherently Reliable Systems

Super Lightweight Multi-Functional Systems

 Technology

Revolutionary Airframe Concepts Research and

 Systems Studies

Aerospace Systems Concept to Test Morphing

Survivability Advances Through Cooperative Efforts

Noise Reduction General Aviation

Small Aircraft Transportation System Reduced Seat Cost

Hyper-X Airframe Technology

Stratospheric Aerosol and Gas Experiment III –

 Meteor Mission

Stratospheric Aerosol and Gas Experiment III -

 Flight of Opportunity Mission

Algorithm Development at Langley

Marshall Space Flight Center

X-33 Advanced Technology Demonstrator Future-X Pathfinder

X-34 Advanced Technology Demonstrator X-37 Advanced Technology Demonstrator

Flight Experiments Space Transfer and Launch Technologies

Reusable Launch Vehicle – Focused Fastrac Engine

Upperstage Space Transfer Technology

Interstellar Precursor Propulsion Technology and Integration

Launch Technology Advanced Propulsion Research

Microgravity Research Microgravity Smoldering Combustion

Spread Across Liquids Candle Flames in Microgravity-2

Extensional Rheology Experiment Collisions Into Dust Experiment-2

Space Product Development Shear History Extensional Rheology Experiment J

Colloidal Disorder-Order Transition Internal Fluid Flows Demonstration

Critical Velocity of Xenon-2 Middeck Glovebox

Investigations of the Structure of Paramagnetic

 Aggregates From Colloidal Emulsions

Stennis Space Center

Affiliated Research Centers Verification and Validation

Mississippi Space Commerce Initiative Joint Sponsored Research

Science Data Purchase Regional Earth Science Application Center

Earth Observing Commercial Application Program

 – Synthetic Aperture Radar

Earth Observing Commercial Application Program

 - Applications

Food and Fiber Applications of Remote Sensing Earth Observing Commercial Application Program

 - Hyperspectral
20

Appendix D. Management’s Response
21

Appendix D

See Evaluation

of Response

Page 10

See Evaluation

of Response

Page 10
22

Appendix D

See Evaluation of

Response Page

10
23

Appendix D
24

Appendix D
25

Appendix D
26

Appendix D
27

Appendix D
28

Appendix D
29

Appendix E. Report Distribution

National Aeronautics and Space Administration (NASA) Headquarters

A/Administrator

AE/Chief Engineer

AI/Associate Deputy Administrator

AO/Chief Information Officer

B/Chief Financial Officer

B/Comptroller

BF/Director, Financial Management Division

C/Associate Administrator for Headquarters Operations

G/General Counsel

H/Associate Administrator for Procurement

HK/Director, Contract Management Division

HS/Director, Program Operations Division

J/Associate Administrator for Management Systems

JM/Acting Director, Management Assessment Division

L/Associate Administrator for Legislative Affairs

M/Associate Administrator for Space Flight

Q/Associate Administrator for Safety and Mission Assurance

R/Associate Administrator for Aerospace Technology

R/Chief Information Officer Representative

S/Associate Administrator for Space Science

U/Associate Administrator for Life and Microgravity Sciences and Applications

Y/Associate Administrator for Earth Science

Z/Associate Administrator for Policy and Plans

NASA Centers

Director, Goddard Space Flight Center

Chief Counsel, John F. Kennedy Space Center

Director, Lyndon B. Johnson Space Center

Director, George C. Marshall Space Flight Center

 Head, Program Management Council Working Group

Non-NASA Federal Organizations and Individuals

Assistant to the President for Science and Technology Policy

Director, Office of Management and Budget

Deputy Director of Management, Office of Management and Budget
30

Appendix E

Non-NASA Federal Organizations and Individuals (Cont.)

Deputy Associate Director, Energy and Science Division, Office of Management and

 Budget

Branch Chief, Science and Space Programs Branch, Energy and Science Division, Office

 of Management and Budget

Associate Director, National Security and International Affairs Division, Defense

 Acquisition Issues, General Accounting Office

Professional Assistant, Senate Subcommittee on Science, Technology, and Space

Chairman and Ranking Minority Member – Congressional Committees and

Subcommittees

Senate Committee on Appropriations

Senate Subcommittee on VA, HUD, and Independent Agencies

Senate Committee on Commerce, Science, and Transportation

Senate Subcommittee on Science, Technology, and Space

Senate Committee on Governmental Affairs

House Committee on Appropriations

House Subcommittee on VA, HUD, and Independent Agencies

House Committee on Government Reform

House Subcommittee on Government Management, Information, and Technology

House Subcommittee on National Security, Veterans Affairs, and International Relations

House Committee on Science

House Subcommittee on Space and Aeronautics

Congressional Member

Honorable Pete Sessions, U.S. House of Representatives
NASA Assistant Inspector General for Auditing

Reader Survey

The NASA Office of Inspector General has a continuing interest in improving the usefulness of

our reports. We wish to make our reports responsive to our customers’ interests, consistent

with our statutory responsibility. Could you help us by completing our reader survey? For your

convenience, the questionnaire can be completed electronically through our homepage at

http://www.hq.nasa.gov/office/oig/hq/audits.html or can be mailed to the Assistant Inspector

General for Auditing; NASA Headquarters, Code W, Washington, DC 20546-0001.

Report Title: NASA's Organizational Structure for Implementing the

Clinger-Cohen Act

Report Number: Report Date:

Circle the appropriate rating for the following statements.

Strongl

y

Agree

Agree Neutra

l

Disagre

e

Strongl

y

Disagre

e

N/A

1. The report was clear, readable, and

logically organized.

5 4 3 2 1 N/A

2. The report was concise and to the point. 5 4 3 2 1 N/A

3. We effectively communicated the audit

objectives, scope, and methodology.

5 4 3 2 1 N/A

4. The report contained sufficient

information to support the finding(s) in a

balanced and objective manner.

5 4 3 2 1 N/A

Overall, how would you rate the report?

Excellent Fair

Very Good Poor

Good
If you have any additional comments or wish to elaborate on any of the above

responses, please write them here. Use additional paper if necessary. 

 

 

 

 

 

How did you use the report? 

 

 

 

 

 

How could we improve our report? 

 

 

 

 

How would you identify yourself? (Select one)

Congressional Staff Media

NASA Employee Public Interest

Private Citizen Other: 

Government: Federal: State: Local: 

May we contact you about your comments?

Yes: _____ No: _____

Name: ____________________________

Telephone: ________________________
Thank you for your cooperation in completing this survey.
Major Contributors to the Report

David L. Gandrud, Program Director, Information Technology Program Audits

Roger W. Flann, Program Manager

James H. Pearce, Auditor-in-Charge

Clara Lyons, Auditor

Nancy C. Cipolla, Report Process Manager

Barbara J. Smith, Program Assistant