U.S. GOVERNMENT PUBLISHING OFFICE

33–875 WASHINGTON : 2019

THE STATE OF SOCIAL SECURITY’S 

INFORMATION TECHNOLOGY 

HEARING 

BEFORE THE

SUBCOMMITTEE ON SOCIAL SECURITY 

OF THE

COMMITTEE ON WAYS AND MEANS 

U.S. HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

SECOND SESSION 

SEPTEMBER 27, 2018 

Serial No. 115–SS12 

Printed for the use of the Committee on Ways and Means 

( 

ii 

COMMITTEE ON WAYS AND MEANS 

KEVIN BRADY, Texas, Chairman 

SAM JOHNSON, Texas 

DEVIN NUNES, California 

DAVID G. REICHERT, Washington 

PETER J. ROSKAM, Illinois 

VERN BUCHANAN, Florida 

ADRIAN SMITH, Nebraska 

LYNN JENKINS, Kansas 

ERIK PAULSEN, Minnesota 

KENNY MARCHANT, Texas 

DIANE BLACK, Tennessee 

TOM REED, New York 

MIKE KELLY, Pennsylvania 

JIM RENACCI, Ohio 

KRISTI NOEM, South Dakota 

GEORGE HOLDING, North Carolina 

JASON SMITH, Missouri 

TOM RICE, South Carolina 

DAVID SCHWEIKERT, Arizona 

JACKIE WALORSKI, Indiana 

CARLOS CURBELO, Florida 

MIKE BISHOP, Michigan 

DARIN LAHOOD, Illinois 

BRAD R. WENSTRUP, Ohio 

RICHARD E. NEAL, Massachusetts 

SANDER M. LEVIN, Michigan 

JOHN LEWIS, Georgia 

LLOYD DOGGETT, Texas 

MIKE THOMPSON, California 

JOHN B. LARSON, Connecticut 

EARL BLUMENAUER, Oregon 

RON KIND, Wisconsin 

BILL PASCRELL, JR., New Jersey 

JOSEPH CROWLEY, New York 

DANNY DAVIS, Illinois 

LINDA SA ́ NCHEZ, California 

BRIAN HIGGINS, New York 

TERRI SEWELL, Alabama 

SUZAN DELBENE, Washington 

JUDY CHU, California 

GARY J. ANDRES, Staff Director 

BRANDON CASEY, Minority Chief Counsel 

SUBCOMMITTEE ON SOCIAL SECURITY 

SAM JOHNSON, Texas, Chairman 

MIKE BISHOP, Michigan 

VERN BUCHANAN, Florida 

MIKE KELLY, Pennsylvania 

TOM RICE, South Carolina 

DAVID SCHWEIKERT, Arizona 

DARIN LAHOOD, Illinois 

JOHN B. LARSON, Connecticut 

BILL PASCRELL, JR., New Jersey 

JOSEPH CROWLEY, New York 

LINDA SA ́ NCHEZ, California 

iii 

C O N T E N T S 

Page 

Advisory of September 27, 2018, announcing the hearing ................................... 2 

WITNESSES 

Rajive Mathur, Chief Information Officer and Deputy Commissioner for Systems, Social Security Administration ................................................................. 6 

Gale Stallworth Stone, Acting Inspector General, Social Security Administration ........................................................................................................................ 18

Carol C. Harris, Director, Information Technology Management Issues, Government Accountability Office ............................................................................. 27 

QUESTIONS FOR THE RECORD 

Questions from Social Security Subcommittee Chairman Sam Johnson to 

Carol C. Harris, Director, Information Technology Management Issues, 

Government Accountability Office ...................................................................... 65 

Questions from Social Security Subcommittee Chairman Sam Johnson to 

Rajive Mathur, Chief Information Officer and Deputy Commissioner for 

Systems, Social Security Administration ........................................................... 70 

Question from Representative Mike Bishop to Rajive Mathur, Chief Information Officer and Deputy Commissioner for Systems, Social Security Administration ................................................................................................................. 71 

Questions from Representative Carlos Curbelo to Rajive Mathur, Chief Information Officer and Deputy Commissioner for Systems, Social Security Administration .......................................................................................................... 71 

Questions from Social Security Subcommittee Chairman Sam Johnson to 

Gale Stallworth Stone, Acting Inspector General, Social Security Administration ................................................................................................................... 76 

SUBMISSIONS FOR THE RECORD 

Domtar ...................................................................................................................... 78

Jacqueline Marie Merson, Attorney at Law .......................................................... 80 

Consumer First Coalition (CFC) ............................................................................. 81 

(1) 

THE STATE OF SOCIAL SECURITY’S 

INFORMATION TECHNOLOGY 

THURSDAY, SEPTEMBER 27, 2018 

U.S. HOUSE OF REPRESENTATIVES, 

COMMITTEE ON WAYS AND MEANS, 

SUBCOMMITTEE ON SOCIAL SECURITY, 

Washington, DC. 

The Subcommittee met, pursuant to notice, at 11:01 a.m., in 

Room 2020, Rayburn House Office Building, Hon. Sam Johnson 

[Chairman of the Subcommittee] presiding. 

[The advisory announcing the hearing follows:] 

2 

ADVISORY 

FROM THE COMMITTEE ON WAYS AND MEANS 

SUBCOMMITTEE ON SOCIAL SECURITY 

FOR IMMEDIATE RELEASE CONTACT: (202) 225–3625 

Thursday, September 27, 2018 

SS–12 

Chairman Johnson Announces Hearing on the 

State of Social Security’s Information Technology 

House Ways and Means Social Security Subcommittee Chairman Sam Johnson 

(R–TX), announced today that the Subcommittee will hold a hearing entitled ‘‘The 

State of Social Security’s Information Technology.’’ The hearing will focus on the Social Security Administration’s information technology, including modernization, 

management, and acquisitions. The hearing will take place on Thursday, September 27, 2018, in room 2020 of the Rayburn House Office Building, beginning at 11:00 a.m. 

In view of the limited time to hear witnesses, oral testimony at this hearing will 

be from invited witnesses only. However, any individual or organization may submit 

a written statement for consideration by the Committee and for inclusion in the 

printed record of the hearing. 

DETAILS FOR SUBMISSION OF WRITTEN COMMENTS: 

Please Note: Any person(s) and/or organization(s) wishing to submit written comments for the hearing record must follow the appropriate link on the hearing page 

of the Committee website and complete the informational forms. From the Committee homepage, http://waysandmeans.house.gov, select ‘‘Hearings.’’ Select the hearing for which you would like to make a submission, and click on the link entitled, 

‘‘Click here to provide a submission for the record.’’ Once you have followed the online instructions, submit all requested information. ATTACH your submission as a 

Word document, in compliance with the formatting requirements listed below, by 

the close of business on Thursday, October 11, 2018. For questions, or if you 

encounter technical problems, please call (202) 225–3625. 

FORMATTING REQUIREMENTS: 

The Committee relies on electronic submissions for printing the official hearing record. As always, submissions will be included in the record according to the discretion of the Committee. 

The Committee will not alter the content of your submission, but we reserve the right to format 

it according to our guidelines. Any submission provided to the Committee by a witness, any materials submitted for the printed record, and any written comments in response to a request for 

written comments must conform to the guidelines listed below. Any submission not in compliance with these guidelines will not be printed, but will be maintained in the Committee files 

for review and use by the Committee. 

All submissions and supplementary materials must be submitted in a single document via 

email, provided in Word format and must not exceed a total of 10 pages. Witnesses and submitters are advised that the Committee relies on electronic submissions for printing the official 

hearing record. 

All submissions must include a list of all clients, persons and/or organizations on whose behalf 

the witness appears. The name, company, address, telephone, and fax numbers of each witness 

must be included in the body of the email. Please exclude any personal identifiable information 

in the attached submission. 

Failure to follow the formatting requirements may result in the exclusion of a submission. All 

submissions for the record are final. 

3 

The Committee seeks to make its facilities accessible to persons with disabilities. 

If you are in need of special accommodations, please call 202–225–1721 or 202–226– 

3411 TDD/TTY in advance of the event (four business days’ notice is requested). 

Questions with regard to special accommodation needs in general (including availability of Committee materials in alternative formats) may be directed to the Committee as noted above. 

Note: All Committee advisories and news releases are available at 

http://www.waysandmeans.house.gov

f 

/ 

Chairman JOHNSON. Good morning. Welcome to today’s hearing on the state of Social Security’s information technology. 

Before we dive into this important subject, I would like to take 

a few words of thanks since this is the last hearing I plan to hold 

as the Subcommittee Chairman. 

As Chairman, I have focused on many challenges facing Social 

Security, including the need to modernize the disability program; 

combat fraud; protect Americans from identity theft; and make 

sure our children and grandchildren can count on Social Security, 

just like seniors and individuals with disabilities do today. 

And I thank my colleagues on the Social Security Subcommittee 

for the honor of serving with them on behalf of the American people. 

I also want to thank the Subcommittee staff who work behind 

the scenes to help make our successes possible. In particular, I 

want to recognize Amy Shuart, Kim Hildred, and Ted McCann, as 

well as Kathryn Olson. Some are behind us, by the way. 

I am proud to say that one of this Subcommittee’s recent successes is the bipartisan Representative Payee bill that became law 

earlier this year. 

John, we did this together, and I want to give you a copy of the 

bill. You have been a good friend, and it has been a pleasure to 

lead this Subcommittee with you. God bless you. I appreciate you, 

partner. 

Mr. LARSON. You too, partner. 

Chairman JOHNSON. Where is the bill? There it is. And I wrote 

a note on it. God bless you. 

[Laughter.] 

Mr. LARSON. Thank you, Mr. Chairman. I especially appreciate 

the handwritten note at the bottom. God bless you. 

Chairman JOHNSON. God bless you, sir. It has been a pleasure 

working with you. 

Mr. LARSON. An honor to work with you. 

Thank you, sir. 

Chairman JOHNSON. Now, back to the issue at hand: Social Security’s information technology. 

While Social Security faces many challenges, information technology is among the most critical to providing the exceptional service Americans expect and deserve. That is why, over the years, the 

Subcommittee has continued to focus on this important topic. In 

fact, the first hearing that I ever held as Chairman back in 2011 

was on replacing Social Security’s aging data center. 

Although Social Security now has modern hardware and modern 

data centers, its employees are still using software that is decades 

out of date. And about 30 percent of these legacy systems still use 

4 

COBOL codes, an ancient programming language that isn’t even 

taught in schools anymore. 

Maintaining systems that old isn’t easy. These outdated systems 

require extra training for employees. And these systems also make 

it hard for Social Security to respond, as needed, to changes, not 

to mention the simple fact that it is expensive to maintain old, custom-built systems. 

But I also have some good news to share. After releasing a modernization plan last October, Social Security has started to make 

some real progress in bringing the agency’s information technology 

into the 21st century. Social Security is undergoing a technology 

transformation that is long overdue. 

These changes will not only make sure Social Security can quickly respond to new challenges, but also that the agency is serving 

Americans in a modern way. Social Security is finally on the way 

to getting rid of outdated green-screen technology. 

But there is still a long way to go. It is going to take consistent 

leadership at Social Security, and it is going to take continued 

oversight from Congress to make sure Social Security isn’t just 

spinning its wheels. 

Social Security must learn from the mistakes of DCPS and other 

smaller projects, like ‘‘Click to Chat.’’ This latter project ended up 

costing more than double what Social Security’s original expectation was. Taxpayers cannot afford IT projects that unnecessarily 

drag on for years or that double in cost. Social Security must find 

a way to better use private-sector alternatives to keep costs down 

and projects on schedule. 

Having a modern IT infrastructure is going to be critical for Social Security’s future, and I look forward to hearing how Social Security can get there on time and on budget. Americans want, need, 

and deserve nothing less. 

I thank our witnesses for being here today, and I look forward 

to hearing their testimony. I now recognize Mr. Larson for his 

opening statement. 

Mr. LARSON. Thank you, Mr. Chairman. And it is with no small 

amount of sentiment that we gather today. And what a great honor 

it is to serve with you in the United States Congress, and even 

more of an honor to have been the Ranking Member and to have 

been able to work with you in a collaborative nature. 

In a time when solutions oftentimes elude the United States 

Congress, to work with somebody who has always put America 

first, who has always looked at the Social Security issues in a nonpartisan way, in a way in which—all he has ever done throughout 

his life is to try to make the country a little safer and a little better. 

As a freshman Member of Congress, one of the first bills I was 

able to get passed was a bill that created a history of the House 

of Representatives. Robert Remini, the historic figure, University of 

Chicago, authored that book. It is hard to imagine that one could 

sit in Congress on a committee and serve with Sam Johnson and 

John Lewis. But that is the nature of the Ways and Means Committee. 

And if you are not humbled by their service prior to ever coming 

to Congress, then you don’t know much about American history or 

5 

about the sacrifice and the character of this remarkable man. To 

watch him work with the staffs collectively, work well, and always 

do it in the fairest and the most considerate and—as I think everybody acknowledges—one of the grand gentlemen of the United 

States Congress. 

So to—as he pointed out, you know, to work on the payee bill together, but to work on so many other small initiatives. And just the 

cordiality and the camaraderie and the roll-up-your-sleeves and 

get-the-job-done attitude that he brings to Congress every day is 

pretty remarkable. 

It was also my great honor to create a medal in the United 

States Congress that is named after Sam Johnson and John Lewis 

for their incredible patriotism. Would it be there was more of that 

in Congress today, and more getting after solutions. But I can say 

this without hesitation: That has always been his goal, as the 

Chairman of this Committee. 

I so appreciate everything that he has been doing and, as he indicated, getting after fraud, getting after—working on behalf, especially, of children and families and disability issues that he knows 

better than most, because he has lived them. 

What an honor to serve with him, to serve alongside of him. And 

it is just—as I tell my children, it is just my hope that some of his 

true, genuine Americanism rubs off and helps you become a better 

person, having known and served with him. 

With that, we are excited to hear from our witnesses this afternoon. And, again, the Chairman has indicated the need for modernization and everything that we need to look at, you know, to 

combat synthetic identity theft to making sure the delivery system 

that we have at Social Security, and especially the continuity that 

we know is so vitally important to the citizens we are sworn to 

serve, remains in place. 

I look forward to the hearing. And, again, Mr. Chairman, a tremendous debt of gratitude to be afforded the honor of serving with 

you. 

Chairman JOHNSON. Thank you, sir. I appreciate those comments. God bless you. 

As is customary, any Member is welcome to submit a statement 

for the hearing record. 

Before we move to our testimony today I want to remind our witnesses to please limit your oral statements to 5 minutes. However, 

without objection, all of the written testimony will be made a part 

of the hearing record. 

We have three witnesses today. Seated at the table are Rajive 

Mathur, Chief Information Officer and Deputy Commissioner for 

Systems of the Social Security Administration; Gale Stallworth 

Stone, Acting Inspector General of the Social Security Administration; and Carol Harris, Director, Information Technology Management Issues, Government Accountability Office. 

I thank you all for being here today. 

Mr. Mathur, welcome. Again, thanks for being here. And please 

proceed. 

6 

STATEMENT OF RAJIVE MATHUR, CHIEF INFORMATION OFFICER AND DEPUTY COMMISSIONER FOR SYSTEMS, SOCIAL 

SECURITY ADMINISTRATION 

Mr. MATHUR. Thank you, Mr. Chairman. Chairman Johnson, 

Ranking Member Larson, and Members of the Subcommittee, 

thank you for the opportunity to discuss Social Security’s information technology. 

I am Rajive Mathur, Social Security’s Chief Information Officer 

and Deputy Commissioner for Systems. Prior to joining the SSA in 

2017, I worked in leadership roles in both the private and public 

sectors. 

Social Security touches the lives of nearly every person in America, whether at the birth of a child, after the loss of a loved one, 

at the onset of disability, or at the transition of work to retirement. 

In fiscal year 2018 we expect to pay over $1 trillion in benefits to 

an average of over 70 million monthly beneficiaries. 

Information technology is vital to nearly every aspect of the work 

we do to serve the public, from taking claims to protecting the sensitive personal information we maintain, to preventing fraud and 

improper payments in our programs across government. Most of 

our core systems are over 30 years old. Over the years we have expanded their capabilities to keep up with the changes in our programs and business processes. However, much of the underlying 

design was set when they were first built. 

For example, our core systems rely on COBOL, which is a programming language from the 1950s. While these systems have performed admirably and have allowed us to provide uninterrupted 

service for many years, their underlying design limits what we can 

accomplish and our ability to adapt to change. It also makes the 

systems expensive to maintain and, as more of our IT workforce 

approaches retirement, we risk losing the institutional knowledge 

needed to maintain them. 

Accordingly, we have begun a 5-year plan to modernize our software, our hardware, and our infrastructure, using modern code and 

architecture. And as we close our first year executing our IT modernization plan, I am happy to report that we are on schedule and 

on budget. 

Some of our accomplishments this year include eliminating the 

remaining green screens that our employees use to take SSI claims 

and replacing them with web-based interfaces, and converting our 

remaining master file to an industry standard format. Looking 

ahead, I am excited by what IT modernization has in store. 

In mid-fiscal year 2019 we will release the product that is the 

first release of software to provide front-line employees with a person-centric view of the individual that they are serving, including 

the person’s visits, the notices that they have received, and actions 

that may be pending in their case. This will eliminate the need for 

employees to access various systems for the information they need 

to provide great service, and it is one of the most commonly requested enhancements. 

In addition to modernizing systems, we also have been modernizing the structure of our organization, our IT organization, and the 

methods that we use to manage and develop IT. By strengthening 

internal collaboration and using Agile methodologies, we have foVerDate Sep 11 2014 08:37 Apr 24, 2019 Jkt 033875 PO 00000 Frm 00010 Fmt 6633 Sfmt 6602 I:\WAYS\OUT\33875.XXX 33875
7 

cused on delivering software capabilities early, and continuously 

enhancing them based on direct feedback from the users. 

For example, we have been using Agile to develop DCPS2, which 

is a national, common-case processing system for State DDSs. We 

have regularly added functionality to DCPS2 as we have expanded 

it to 10 States, with 4 more joining soon, and 34 others that are 

scheduled for deployment. 

We are delivering products on time. Our systems are available to 

users 99.96 percent of the time. And we have reduced the number 

of IT outages. 

As Chief Information Officer, one of my goals has been to build 

a modern IT organization for the next generation, one that is accountable, competent, transparent, and secure, one that is focused 

on understanding and meeting the needs of the public and our employees. 

We have a large IT enterprise and are working quickly to make 

big changes, even while we work to maintain the security and 

availability of our systems, and we continue to deploy needed software that, while it is not part of the modernization program, is still 

built on modern technology. IT modernization is a significant investment. We will invest $691 million over the next 5 years, including the $280 million that Congress appropriated in fiscal year 2018. 

We appreciate Congress’—and particularly this Subcommittee’s— 

support. 

I also want to take this opportunity to recognize Chairman Johnson. 

Mr. Chairman, you have long understood the direct connection 

between SSA’s IT and its ability to serve the people who count on 

its programs. Thank you for your leadership on this issue, and for 

being a champion of the Social Security program. 

On behalf of all of us at SSA, please accept my best wishes for 

your retirement. 

Thank you for the opportunity to appear before you today, and 

I would be happy to answer any questions. 

[The prepared statement of Mr. Mathur follows:] 

8 


33875A.001
9 


33875A.002
10 


33875A.003
11 


33875A.004
12 


33875A.005
13 


33875A.006
14 


33875A.007
15 


33875A.008
16 


33875A.009
17 

f 


33875A.010
18 

Chairman JOHNSON. Thank you, sir. I appreciate that comment. 

Ms. Stone, welcome. Please proceed. 

STATEMENT OF GALE STALLWORTH STONE, ACTING 

INSPECTOR GENERAL, SOCIAL SECURITY ADMINISTRATION 

Ms. STONE. Thank you. Good morning, Chairman Johnson, 

Ranking Member Larson, and Members of the Subcommittee. 

Thank you for the invitation to testify today. 

SSA administers programs that result in payments of more than $2.5 billion per day, and it holds sensitive data for more than 300 

million people. SSA continues to rely on legacy coding and applications that are decades old. This is an unsustainable path. 

To ensure that SSA meets its increasing service delivery demands, the agency must modernize its IT infrastructure. For many 

years the OIG has recommended that SSA commit to long-term 

strategic IT planning. 

Just last year the agency issued its IT modernization plan, which 

is a multi-year effort to update SSA’s major systems. The plan reflects investments of almost $700 million over 5 years to support 

various modernization efforts. This is a significant but necessary 

undertaking which will need close management and monitoring. 

We will review SSA’s progress on these plans as a part of our 2019 

audit work plan. 

One of SSA’s major IT modernization efforts is the disability case 

processing system, commonly known as DCPS. With DCPS, the 

agency envisions a national common-case processing system for the 

52 State disability determination services, or DDSs. 

SSA began planning this project in 2008. Seven years later, after spending about $350 million, the agency discontinued that effort 

and began developing a new version of DCPS. The agency delivered 

the first release of the new system to three DDSs at the end of 

2016. By November 2017 employees in 10 DDSs were using the 

new system to process selected workloads. Soon thereafter, SSA 

suspended deployment and shifted its focus to systems development to address user feedback. 

This year we received feedback from 120 users and found that 

they generally liked working with the new system, but they would 

like additional functionality. We also reported that participating 

DDSs used the new system to process about 4 percent of their total 

workloads. SSA plans to resume deploying DCPS soon, with a goal 

of delivering the system to the majority of the DDSs by the end of 

2019. 

SSA has spent $101 million on the new version of DCPS, and it 

anticipates spending an additional $76 million over the next 4 

years. To date, the new version has been implemented at more 

DDSs than the previous iteration, and its estimated cost is about 

half of what SSA invested in the prior effort. Nonetheless, the 

agency still needs to address risks that may undermine successful 

implementation of the new system. One such risk involves convincing DDSs to adopt this technology. 

For DCPS to be deployed and utilized nationwide, the project requires diligent oversight and continued user involvement. As the 

agency moves forward with its IT modernization, it is imperative 

19 

that it give proper attention to security. In our most recent annual 

audit of SSA’s information security program, we identified a number of control deficiencies that may limit SSA’s ability to adequately protect its systems. SSA needs to make addressing these 

deficiencies a priority. 

Thank you for the invitation to discuss these issues. We will continue to work with the agency and this Subcommittee to address 

these important issues. 

Finally, I want to commend the Chairman as he concludes a 

decorated and distinguished career in service to our country. On 

behalf of the OIG, thank you, Chairman Johnson, for your service, 

your sacrifice, and your leadership. 

This concludes my statement. I will be happy to answer any 

questions. 

[The prepared statement of Ms. Stone follows:] 

20 


33875A.011
21 


33875A.012
22 


33875A.013
23 


33875A.014
24 


33875A.015
25 


33875A.016
26 

f 


33875A.017
27 

Chairman JOHNSON. Thank you so much. I appreciate that 

comment. And thank you for your statement. 

Ms. Harris, welcome. Please proceed. 

STATEMENT OF CAROL C. HARRIS, DIRECTOR, INFORMATION 

TECHNOLOGY MANAGEMENT ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE 

Ms. HARRIS. Chairman Johnson, Ranking Member Larson, and 

Members of the Subcommittee, thank you for inviting us to testify 

today on the Social Security Administration’s management of IT. 

As requested, I will briefly summarize our work on the agency’s 

management of IT acquisitions and operations, and the authorities 

of its Chief Information Officer. 

As you know, SSA is responsible for delivering services that impact almost every American. And the agency extensively relies on 

IT resources to do so. Its computerized information systems support a wide range of activities, such as calculating and withholding 

Medicare premiums, and issuing Social Security numbers and 

cards. 

For fiscal year 2018 the agency plans to spend approximately $1.6 billion on hardware, software, computer maintenance, and 

contractor support. 

SSA has long been challenged in its management of IT. Our past 

reports from 2004 to 2012 have highlighted various weaknesses in 

the agency’s systems development practices, governance, and requirements management. As such, we stress the need for SSA to 

strengthen its IT management controls. 

Between 2011 and 2018 we made 15 recommendations to SSA, 

aimed at improving IT management and operations in the areas of 

data center consolidation, incremental software development, IT acquisition strategies, and software licenses. I am pleased to report 

that, as of today, Social Security Administration has fully addressed 14 of the 15 recommendations. Accordingly, SSA is better 

positioned to more effectively manage its IT. 

For example, in May 2014 we reported that SSA was one of 22 

agencies lacking a robust software license management policy, as 

well as a comprehensive inventory of software licenses. Without 

these tools, agencies would not be able to systematically identify 

unused software and achieve savings. SSA has since established 

both a comprehensive policy and inventory, and is equipped to 

more effectively manage its software licenses. 

Additionally, last year, we reported the agency lacked a complete 

data center optimization plan. We emphasized that without such a 

plan SSA might not achieve OMB’s data center optimization targets or realize its expected savings. The agency implemented the 

related recommendation, and in May of this year we found that 

SSA reported the most progress among 22 applicable agencies in 

meeting OMB’s targets. 

While SSA has made noteworthy progress to improve its management of IT, more work is needed to fully address the role of its 

Chief Information Officer (CIO) and its policies. Various laws and 

related guidance assign IT management responsibilities to CIOs in 

six key areas. And in August 2018 we reported that, of the six 

areas, SSA’s policies only fully address one. 

28 

Specifically, the agency’s policies fully addressed the CIO’s role 

in IT leadership and accountability by requiring the CIO to report 

directly to the agency head. In contrast, the agency’s policies do not 

address the IT workforce area at all, including requirements for the 

CIO to assess agency IT workforce needs and develop strategies 

and plans for meeting those needs. 

In addition, the agency’s policies only minimally address the area 

of IT strategic planning, lacking requirements for the CIO to measure how well IT supports agency programs, and to report annually 

on progress in achieving goals for improving agency operations. 

Accordingly, we made a recommendation to SSA to address the 

policy weaknesses in five management areas. In response, the 

agency agreed, and indicated it planned to implement the recommendation by the end of this month. 

It would be especially important for SSA to ensure that the policies for its CIO responsibilities are robust, given its high turnover 

of CIOs. Since 2004, the average tenure of SSA’s CIO is 1.8 years. 

Our work has shown that a CIO should stay in office for 3 to 5 

years to be effective, and 5 to 7 years to fully implement major 

change initiatives in large, public-sector organizations. If SSA fully 

implements our recommendation, it will be better positioned to attract and retain high-quality CIOs when there is a leadership vacancy, while also maintaining continuity of IT operations when 

leadership changes occur. 

That concludes my statement, and I look forward to addressing 

your questions. 

[The prepared statement of Ms. Harris follows:] 

29 


33875A.018
30 


33875A.019
31 


33875A.020
32 


33875A.021
33 


33875A.022
34 


33875A.023
35 


33875A.024
36 


33875A.025
37 


33875A.026
38 


33875A.027
39 


33875A.028
40 


33875A.029
41 


33875A.030
42 


33875A.031
43 


33875A.032
44 


33875A.033
45 


33875A.034
46 

f 


33875A.035
47 

Chairman JOHNSON. Thank you. Thank you so much. 

As is customary for each round of questions, I will limit my time 

to 5 minutes and will ask my colleagues to also limit their questioning time to 5 minutes, as well. 

Mr. Mathur, modernizing Social Security’s IT is a huge challenge. How are you making sure that this project is done on time 

and does not have cost overruns? 

Mr. MATHUR. Chairman Johnson, thank you for that question. 

Our IT modernization plan, as you noted, we published in October 

of last year. As I noted in my opening remarks, we are on schedule 

and we are on budget. 

We have an accountable executive for the IT modernization plan, 

he is sitting right here, behind me. And we have accountable executives for every initiative within the IT modernization plan. 

We have a number of controls and governance in place with oversight, and this really is a management effort for us to make sure 

that we are constantly delivering values. 

I will close with the following point when it comes to modernization and what we are doing: Our approach to this is to make sure 

that whatever we are working on within the modernization effort 

is very focused on the customer, whether it is the front-line employee or a member of the public. And being able to deliver that 

value early and often, and then making sure we have that feedback 

loop, is an important way to make sure you are on track. That is 

the way, that is the private-sector industry standard to be able to 

have that quick feedback loop. 

Chairman JOHNSON. Have you had any complaints so far? 

Mr. MATHUR. I would say that our users, especially our business customers, have been pleased with the progress we have been 

making. And the complaint, if there is one in that regard, is go 

faster. How do we go faster? How do we deliver more value? So 

that has been the focus for us. 

Chairman JOHNSON. Well, in your testimony you stated the estimated cost for the disability case processing system was $177 million. Isn’t that an increase from the previous estimates that you 

gave us? And why did they increase? 

Mr. MATHUR. Sir, as you may know, DCPS2 is currently in 10 

DDSs, and it is soon to be 14. We are talking with another 34, in 

terms of rollout to those 34 DDSs. 

The DCPS2 project is grounded in making sure it is delivering 

value, and working with these DDSs that are already using it. And 

so we have a DCPS steering committee, which consists of State administrators and many of the States that currently use this DCPS2 

product. As we get feedback, and as we have already received feedback on what additional functionality was needed in the product, 

we have rolled that into the road map. And that was the basis for 

that increase in cost. 

Chairman JOHNSON. Do you expect any more increases, or are 

you going to stay on target? 

Mr. MATHUR. We are staying on target, sir. We are always 

managing that road map, and what that product lineup looks like. 

Chairman JOHNSON. And you don’t expect any more increases 

in the future? 

48 

Mr. MATHUR. We are managing that product very closely. I am 

personally involved, as well as agency leadership. And I will say 

that, in constantly talking with the users, we are managing what 

we deliver and when we deliver it early and often, as I mentioned. 

If the user requirements end up changing, we will modify the road 

map. At this point I think we have a road map that I am very comfortable with, and that is what we will deliver on. 

Chairman JOHNSON. The modern approach to IT development 

can make it hard to tell if a project is on track, because requirements change as development progresses. As CIO, how do you 

make sure that the modern development projects you oversee are 

going to stay on track? 

Mr. MATHUR. I would refer to my private-sector experience, 

which is that we are looking for value. That has been the mantra 

that we have been following when it comes to DCPS2 or our IT 

modernization efforts. So, as long as we are having the conversation on a regular basis with our end users, that is how we make 

sure we are delivering value and we stay on track. 

There is a quick example I would give you, if I could, sir. If you 

were remodeling your kitchen, and your contractor said, ‘‘Come 

back to me in a year and I will let you know what it looks like,’’ 

you are probably not going to get what you want. But if you were 

able to look at it every day, every week, you can probably tweak 

the direction. That is the model we are using when it comes to 

modernization. 

Chairman JOHNSON. So what you are telling me is you are 

staying on top of it. 

Mr. MATHUR. We are. 

Chairman JOHNSON. Thank you. 

And, Ms. Harris, what are your thoughts on the project? 

Ms. HARRIS. Well, I think, regardless of the approach that you 

take, whether it is a more modern, agile approach, or the more traditional waterfall approach to software development, you are always going to need sound project management. And that management is just going to look different in this more modern, agile approach. 

Agile essentially means you take these traditional, monolithic, 

large-scoped projects, and you break them out into these small increments, so that you are delivering software every 6 to 12 months. 

I am glad to hear Rajive talking about a road map, because in 

this modern approach that is your baseline for measuring progress, 

from a cost and schedule perspective as well as the performance 

and the delivery of what is being planned for. 

And so, as long as Rajive and his accountable executive are 

measuring against this road map, that is how we are going to be 

able to tell whether progress is being made as planned. 

Chairman JOHNSON. Well, are we on track? 

Ms. HARRIS. Well, I can’t speak specifically to DCPS, but I—you 

know, he is using at least the right words, in terms of what you 

would expect in a well-managed program, particularly that road 

map. 

Chairman JOHNSON. That is what we all have to do, is use the 

right words, right? 

[Laughter.] 

49 

Well, I recognize you, sir. 

Mr. LARSON. Thank you, Mr. Chairman. 

Mr. Mathur, you used the term ‘‘person-centric’’ in your opening 

remarks, and I couldn’t agree with you more, especially with 

10,000 baby boomers a day becoming eligible for Social Security. 

How do you carry that out from an IT perspective for both the citizens we serve, as well as the employees that, you know, have to 

make sure that, as they deal with their day-to-day work with delivering Social Security, this transpires? 

Mr. MATHUR. Congressman, person-centric is an important 

term among a number of other terms that we use. It is a philosophy. And I will describe it in the following way. 

Today, when a member of the public walks into a field office, 

they will get great service, and we know that. But the representative on the other side of the desk is looking through multiple systems, multiple screens, making sure that they get the right information to serve that customer. That takes time. There is a possibility for errors. And it is confusing, right? 

This person-centric approach and the example I will use is that 

next fiscal year—this fiscal year we are looking to deploy the first 

version of the universal customer view, which is a single portal for 

everything that a technician may need to know about a member of 

the public that is coming in. So you can see your transactions, you 

can see your history with the SSA. That is the—that is where the 

ideal is, correct? That is person-centric. 

So if you are—if we are engineering that experience, that business process for that end user customer and the front-line employee, we will then be able to make sure that process works and 

the technology underlying the process works. 

Mr. LARSON. I had a number of conversations on the Committee, but specifically with Representative Schweikert, and I 

wanted to get your opinion on block chain as a technology, and how 

you see—if you do see—that as having an impact as we move forward, in terms of the delivery of service, and how that might be 

utilized, and if Social Security is considering that. 

Mr. MATHUR. That is a great question. I would say block chain, 

as well as other technologies, these are things that I am tracking, 

we are tracking. We are not using it yet. We are in the early stages 

of looking at it. 

JPMorgan Chase, for example, is using some version of it, again, 

relatively early. It has promise. It has promise in various applications. I can certainly give you some examples. But it is something 

we are tracking. 

Mr. LARSON. Well, could you get me some examples? Because 

this is a conversation that is ongoing. And certainly, we want to 

do everything that we can to try to both look forward and streamline our process, make it more person-centric, but also hopefully 

utilize the technology that is at our disposal. We wouldn’t want to 

overlook something that could be a game-changer and also, from a 

cost-effective and efficient standpoint, be helpful to us. 

Mr. MATHUR. Sure. One example is a provider directory. So we 

are using—today the medical providers that are—the directories or 

the classification of medical providers all over the Nation is always 

changing, it is always in flux, there is always a chance for error, 

50 

whether it is contact info, whether they are still licensed or not licensed. These are—that is a changing piece of information that our 

technicians rely on to be able to contact these providers for records, 

et cetera. 

Using block chain, which would distribute the information and 

let the local providers in a secure way still be able to update their 

provider records, that we would then be allowed to use, would be 

an example to have the most up-to-date information about providers at any given time. If we are responsible for it, you know, we 

have enough to do, and it is tough to get it all right, in that regard. 

But if the people who are responsible for that data can update it 

when they need to do it securely, then we can get that information. 

That is one example. 

Mr. LARSON. One of the over-arching—this is for all the panelists—one of the over-arching concerns that this Chairman has always been focused on is certainly identity theft, as it is related to 

Social Security. What does Congress need to do, in terms of assisting you, and what is the SSA doing with respect to making sure 

that people’s identity is protected? 

Mr. MATHUR. Congressman, protecting individuals’ identifiable 

information is integral to what SSA does. It is part of what the 

agency started when first assigning the SSNs. We take it very seriously, when it comes to protection of Personally Identifiable Information (PII). We have a plan in place to execute on NIST Special 

Publication 800–63–3 guidelines, which are guidelines for digital 

identity. And that will allow us to be able to protect—continue to 

protect the public’s PII. We have a number of controls in place now, 

but we always have to stay ahead of this issue. 

Mr. LARSON. Ms. Harris, what do you think about that? 

Ms. HARRIS. I can’t speak specifically to SSA, but certainly 

cyber security and the protection of personally identifiable information is one of the key high-risk areas on GAO’s top high-risk list. 

And that is certainly something that our Comptroller General has 

spoken quite a bit about, as, you know, one of the top priorities 

that the Federal Government should be focused in on. 

Mr. LARSON. Ms. Stone. 

Ms. STONE. I will take a slightly different angle on this and say 

that there have been security breaches where personally identifiable information has been confiscated by guys who want to commit 

fraud. The focus at SSA has to be on authenticating the individuals 

that want to come in and do business with the agency to make sure 

that the person applying for those benefits is actually the real 

number-holder. 

Mr. LARSON. Thank you. 

You wanted to respond further? 

Mr. MATHUR. I would add that identity theft and knowing who 

you do business with, as we do more and more digital services, this 

is a very important problem, certainly—it is a societal problem. 

And we are working with other Federal agencies, as well, so that 

there is a way to be able to counter this across Federal Government and, frankly, with the private sector, as well. We all have the 

same needs when it comes to identifying that individual. 

Chairman JOHNSON. Thank you. 

Mr. Bishop, you are recognized. 

51 

Mr. BISHOP. Thank you, Mr. Chairman. And if I could, I would 

like to begin by building on the words of gratitude and reverence 

for your service to this country and for all that you have done: Your 

service to Congress, your service to this Subcommittee, and all that 

you have done for those who depend on Social Security in this 

country, for your service to country as a hero in the United States 

Air Force. 

I got into this job 11⁄2 years ago, not—a little bit more than that, 

actually, but it seems like yesterday, and I did it because—I left 

the private sector because I believed in my country. I am a student 

of history and government. I felt as though I had to do something 

for my country, and I believe in my country, I love my country. And 

I am so grateful to be able to serve here, so honored to serve here, 

but it really blows my mind to think that I have the opportunity 

to serve with someone like you. And the honor to know you, to be 

a part of this Committee has been just incredible for me. 

So, sir, I—your country thanks you, I—we all thank you for all 

that you have done. And thank you for making this experience 

something I will never forget. 

I just wanted, if I could, then, to build on the theme that we 

have been talking about with regard to customer-centric and end 

user customer and front-line employee. I have said this before, and 

we have been talking about it before, because I had the opportunity 

to introduce, with Ranking Member Larson, the Improving Social 

Security’s Service to Victims of Identity Theft Act, which I think 

is so very important. We—all of our constituents talk about identity theft and ways that we can improve that. 

I am encouraged to hear what you have been talking about with 

regard to your IT projects. Mr. Mathur, I was wondering if you 

could just share with me. When it comes to IT projects like this at 

SSA, how do you determine who is responsible for the project’s success or failure, and how do you hold them accountable? 

Mr. MATHUR. Thank you for that question. As I mentioned, we 

do have accountable executives, starting at the top and then 

laddering down for the IT projects that we have. 

When it comes to modernization projects, for example, we have 

a business and IT lead that are jointly responsible for that effort. 

Regardless of what kind of effort it is, there is always a business 

owner that we need to make sure we are catering to, and there is 

an IT executive that is managing that effort. 

Accountability is an important part of our approach. I continue 

to meet with all the major investments that we make, and my leadership team does, as well. We have direct oversight over the efforts 

that we have, when it comes to these major projects. 

It is a continuous management need to be able to hold people accountable, to make sure executives are meeting those dates, and 

delivering value. 

I think the key thing that I would say is that the focus on value 

is what helps ground me and what I would like to see in every IT 

project. One of the things I have said internally to our teams is we 

are going to be communicating horizontally, as opposed to up the 

chain of command, across, and down. In a large organization that 

happens frequently, so you have to have the business customer in 

52 

the room so they can hold each other accountable, so that they are 

accountable to each other and to us. 

Mr. BISHOP. So that road map you are working on, and the organization chart of the folks that are working on that road map, 

you are all aware, you are all working together on that same road 

map. Are you—do they have a direct line of communication with 

you? Is that how that works? And is this process kind of a Gantt 

chart within the road map, where you have certain tasks to finish 

within a certain amount of time? 

I am just interested to know what the management process is. 

Mr. MATHUR. So the road map is—it is a multi-year road map. 

The road map is developed with the business and IT owners together, not just one group or the other, focusing on multiple 

deliverables early and often, always delivering a piece of capability—the software, whether you buy it or whether you build it. 

The level of dialogue that we have—we have introduced a function called product management that is—as part of our—it is a 

product orientation for how we look at anything. It is customerdriven. Whenever you are delivering a capability, you are looking 

at it as a product and service. 

So that role, plus the project manager, are managing the day-today, and then making sure that the business and IT users and the 

leadership is also apprised of it. 

Mr. BISHOP. Mr. Mathur, thank you. And I have several other 

questions. 

I know that we have limited time, so I will yield back the time, 

Mr. Chairman. 

Chairman JOHNSON. Thank you. 

Mr. BISHOP. Thank you. 

Chairman JOHNSON. Mr. LaHood, you are recognized. 

Mr. LAHOOD. Thank you, Mr. Chairman. And I would also like 

to thank you for your sacrifice in Vietnam, thank you for your service in the Congress here. Your examples of humility and sacrifice 

will stay with all of us. And while you may be returning and moving on, your legacy will live on because we will be back here in the 

Sam Johnson room many times, and we will be thinking about you 

often and the example that you left for all of us. 

So thank you, sir. It is an honor to serve with you. 

Chairman JOHNSON. Thank you. 

Mr. LAHOOD. Mr. Mathur, during the original rollout of the 

DCPS beta, my State of Illinois had some challenges with 

functionality. Since the success of DCPS2 depends on States voluntarily adopting the system, what steps has SSA taken to encourage 

adoption, particularly to States like mine who had challenges last 

time? 

Mr. MATHUR. Congressman, DCPS2, as you mentioned, has had 

a successful rollout to 10 States, with 4 to come, as I had mentioned earlier. We are developing the capabilities for DCPS2 in lock 

step with what the steering committee and the business users are 

looking for, the DDSs are looking for, including the State of Illinois. 

And I would say that, over time, as more and more capabilities 

get developed, I can’t imagine why a State wouldn’t want—or a 

DDS wouldn’t want to use that capability, since they helped design 

it. The system is being designed by users for users. 

53 

So my hope is that—and my goal is a nationwide, common-case 

processing system, and that is where we think DCPS2 can get us. 

Mr. LAHOOD. And what happens—or what are the consequences 

if a State doesn’t use the new system? 

Mr. MATHUR. Well, I think we would have to address that when 

and if that time comes. My hope is that it wouldn’t come, because 

the product is going to meet their needs. 

Mr. LAHOOD. Thank you. Let me switch to another subject, Mr. 

Mathur. 

Federal laws and regulations have been pretty clear that agencies should first look to the private sector for solutions to their IT 

needs. But communication between the SSA and industry hasn’t always been easy. How does SSA engage with industry to identify potential IT solutions? 

And as a followup to that, can you expound or comment a little 

bit upon the IT Transformation Industry Day that I know you recently hosted? 

Mr. MATHUR. My bias is toward buying and not building. As 

part of our investment process, whenever we are looking at any 

sort of need that we are trying to fulfill with technology, we must 

look at external solutions, other government agencies, shared solutions, and then, of course, the internal solution. 

So we have to have a bias toward finding out what we can buy 

externally, and then use it internally. That is the way I am wired, 

that is what I would like to continue to do, and that is part of our 

process, it is part of the policy that we have in place. 

The IT Industry Day that we had back in June, we had over 200 

members of industry that were part of the session. We had five different topics. It was great—it was a virtual industry day. It was 

a great model, the first time we had ever done it, where we presented some ideas on what we were looking for. We received some 

good questions, some good feedback, some followup from industry. 

We hope to repeat that process. 

Recently we also met with Johns Hopkins for block chain and for 

AI, as another example of outreach. I mean, this is something that 

we need, we continue to do and get better at, but we need to do 

more of it. 

Mr. LAHOOD. Well, thank you. We look forward to working with 

you on that. 

Those are all of my questions, Mr. Chairman. 

Chairman JOHNSON. Thank you. 

Ms. Sa ́nchez—— 

Ms. SA ́ NCHEZ. Thank you, Mr. Chairman. And before I begin I 

just want to add my voice to those who have already thanked you 

for the many years of your service to the Congress and on this 

Committee. 

Chairman JOHNSON. Thank you. 

Ms. SA ́ NCHEZ. We are sad to see you go. 

I want to thank our witnesses for being here today. It kind of 

baffles me that one of the richest countries in the world that is at 

the forefront of technological innovation has inadequate and outdated technology operating within the walls of its government. So 

I am particularly pleased that the Social Security Administration 

is making such progress with its IT modernization plan. 

54 

I know that you are investing several hundred million dollars to 

update the existing operating system and, clearly, it is long overdue if you guys have equipment that you are using that dates back 

to the 1950s. No doubt, just having that older technology is tough 

to maintain and slow to operate. And obviously, it can be very inefficient, I guess, and wasteful, even. 

For example, I know that SSA spent about $1.6 billion on IT in 

fiscal year 2018. That is over 10 percent of its total operating budget. And that is $1 billion that went into just maintaining an outof-date operating system. So I think it is high time that we make 

an investment in our technological infrastructure that will, hopefully, improve service and security, as well. 

My question is for Deputy Commissioner Mathur. What sort of 

efficiencies do you think are going to be realized through IT modernization? And most specifically, is it going to help in terms of 

being able to get faster decisions and processing of benefits for constituents? 

Mr. MATHUR. Thank you for that question. The efficiencies that 

we are—let me give you one example of one efficiency that we 

think we can get to. 

I talked earlier about the universal customer view, which is a 

single portal which allows our technicians to see interactions that 

a member of the public has had with SSA, any communications 

they have had, and it allows them to do this by not having to 

thumb through many different screens, but to just get to everything all in one place. 

In fiscal year 2019 we are also going to be coming up with a 

minimal viable product for a pre-claim system. And what that is 

is a single claims path, regardless of the type of benefit that you 

are looking for. 

Today, when you walk into a field office or are interacting with 

a technician, they are figuring out what they need to—what you 

may be eligible for. The pre-claim system is a single way for them 

to be able to ask the right questions and be able to determine, in 

an efficient way, with appropriate branching and logic, what you 

may be eligible for, as a member of the public. 

So that is one small example, but an important one. 

Ms. SA ́ NCHEZ. So I am assuming it will result in faster processing times and, you know—— 

Mr. MATHUR. It will be more efficient. 

Ms. SA ́ NCHEZ [continuing]. More efficient, you know, processing 

of benefits. 

Mr. MATHUR. Yes. 

Ms. SA ́ NCHEZ. Okay, excellent. I know that the Social Security 

Administration keeps records of people’s personally identifiable information. And obviously, in this increasingly high-tech world, a 

concern that we all share is the safety of protecting that information. 

I am guessing—but I would like to hear from you—that older 

technology probably is more vulnerable to breaches in the system. 

So is the IT modernization going to help strengthen the agency’s 

ability to safeguard that personal information? Will that make our 

information safer, as well? 

55 

Mr. MATHUR. We are always staying ahead and staying on top 

of the security of the systems. As someone mentioned earlier, the 

continuity of operations is paramount for the agency, in making 

sure that they are secure. It is certainly important. 

In terms of IT modernization, security is built in. It is not retrofitted after the fact. So as we are going through the development 

of these various efforts—cyber, needs, authentication—assuming 

that somebody is going to be interacting with us on the Internet, 

which is different than 20, 30 years ago, where they might be calling in, those assumptions of the Internet and better security needs 

are now built into the process. 

Ms. SA ́ NCHEZ. So will that result in—— 

Mr. MATHUR. That will result in—— 

Ms. SA ́ NCHEZ. Better safeguards for the—— 

Mr. MATHUR. Better, more flexible safeguards, yes. 

Ms. SA ́ NCHEZ. Perfect. Those are all the questions I have. I 

yield back. 

Chairman JOHNSON. Thank you. 

Mr. Schweikert, you are recognized. 

Mr. SCHWEIKERT. Thank you, Mr. Chairman. You know, it is 

hard to think of this room without you sitting in that chair, 

chairing a hearing. For those of us who hope to stay on this Subcommittee in the future, you know, we will always look up and see 

your name there. 

Thank you for your incredible service to all of us—as the phone 

goes off. But thank you. You know, my wife, this summer, actually 

read your book and you brought her to both tears and joy. So it 

is a recommendation for everyone. 

Ms. Harris, simple question, and just conceptually, should the 

IRS actually even own its own servers? In a world where encrypted 

cloud is becoming ubiquitous, is that a vision for you? 

Ms. HARRIS. I am sorry, sir. We have—I have personally not 

done work at the IRS, so I am not in a—I am not the best expert 

to weigh in on that. 

Mr. SCHWEIKERT. Okay. But then how about for Social Security? 

Ms. HARRIS. Within the Social Security Administration I also 

have not done that specific level of work. So, unfortunately, I—— 

Mr. SCHWEIKERT. Okay, I was—— 

Ms. HARRIS [continuing]. That is outside of the scope of the 

work that I have done. 

Mr. SCHWEIKERT. All right, sorry. I was going to sort of go 

through the larger agencies. 

For anyone, has there been studies for Social Security, Medicare, 

or others to actually make the decision is maintaining their own 

server farms still appropriate? 

Mr. MATHUR. I will take a crack at it. We have a Cloud Smart 

policy when it comes to any capabilities that are being developed. 

So as we are considering what the hosting is going to be for a particular software application, it makes sense, by default, to think 

about the cloud, but making sure that it is the right application, 

that it has the right profile for safety, for security, and that you 

are not just putting something on the cloud because—— 

56 

Mr. SCHWEIKERT. But I thought most of the safety and security concerns have—I mean, they are now a few years old. And the 

ability to encrypt and split and collocate—— 

Mr. MATHUR. It is a fair point. It is the application, but it is 

also the data behind the scenes that need to be—that these applications sometimes need to access. So the location of the data may 

help drive where the application gets hosted, whether it gets 

hosted on the cloud or not. 

The point I would make is that it doesn’t—it is not, by default, 

hosted within our data center—it shouldn’t be hosted by default by 

the government. It could be hosted in a private cloud, or it could 

be hosted in a public cloud. I mean, there are a number of different 

stages of decisionmaking that it could and should have, and that 

is how we are approaching it. 

Mr. SCHWEIKERT. Okay. All right. If you have something I can 

read, or something I—— 

Mr. MATHUR. Sure. 

Mr. SCHWEIKERT. Because it is not a particularly satisfying 

answer. 

Could we actually sort of do a quick walkthrough of the legacy 

systems? And when will there be the last day that you will be running, you know, functionally, COBOL with a—in front of it—you 

know, when will those legacy systems be gone, that legacy code? 

Mr. MATHUR. Congressman, our IT modernization plan substantially will make a dent in and remove legacy technology, legacy 

code. Not just COBOL, but other legacy codes, code types—we have 

assembler, and others. 

Here is the challenge we are facing, which is we—continuity of 

operations, making sure that you can deliver those services when 

somebody walks into the field office or calls the tele-service center, 

that has to always be on and operational—— 

Mr. SCHWEIKERT. But wasn’t the original plan to run parallels 

and then do the transfer over? 

Mr. MATHUR. That is exactly right. 

Mr. SCHWEIKERT. And so shouldn’t that actually mean there 

is a target switch date, if you are running parallels? 

Mr. MATHUR. So the plan is to have a parallel operation, and 

once we have launched, once we have put something in the market 

and it works, at that point we start retiring, right? 

It is not—it doesn’t—and it happens—it is rolling thunder. So we 

will be developing capabilities, launching it, launching them, having frontline employees use them, have members use them and 

then do the migration. So it is not that we will be retiring at one 

specific date. It will be happening throughout the plan. 

Mr. SCHWEIKERT. So back to the original question. When do 

you see, in your Utopian—techno-Utopian future, when, you know, 

the legacy codes and the bolt-on are gone? 

Mr. MATHUR. So I see that the modernization plan will substantially remove that. That is a 5-year plan—— 

Mr. SCHWEIKERT. Okay, so is the goal in 5 years to no longer 

have legacy code, or is it 25 years? 

Mr. MATHUR. I—— 

Mr. SCHWEIKERT. I mean, what is your best guess? 

57 

Mr. MATHUR. I think it is going to be substantially gone in 5 

years, but it won’t be 100 percent gone in 5 years. 

Mr. SCHWEIKERT. Okay. 

Mr. MATHUR. Because in some cases it may not make sense for 

us to migrate an old legacy technology to the modern—it may not 

make business sense. And that analysis, to be able to look at—excuse me. 

Mr. SCHWEIKERT. Okay, and I am so sorry. We are in the last 

few seconds. 

My friend actually spoke about my fixation on block chain and 

distributive ledger, you know, and that future for when everyone 

who is a potential beneficiary can pick this up and basically track 

their own files, see who has looked at their files, when did they actually move any paper, and yet have levels of permission and 

encryption and security. 

And where I was going to go before is my sort of techno-Utopian 

fantasy of being able to see my benefits, I could see my IRS tax 

records, I could actually see my military discharge, I could see everything sort of in a common portal. And I fear a lot of my big 

agencies with massive data haven’t really begun to talk to each 

other about ever sort of unifying a platform, probably on a distributive ledger, with the proper encryption, and providing those services to the American public. 

So that is sort of a last—and, Mr. Chairman, thank you for your 

tolerance. 

Chairman JOHNSON. Thank you. 

And, Mr. Rice, you are recognized. 

Mr. RICE. Thank you, Mr. Chairman, and thank you for the 

years of being able to learn from you, and your mentorship. And 

I appreciate so much your service to our country. 

I am just frustrated with the progress on the technology improvement at Social Security. I think one of the big problems is maybe 

we haven’t done a great job of holding people accountable. But, Ms. 

Harris, you mentioned the road map, and that a road map is a 

good start, and that—but you also said you weren’t familiar with 

it. So you don’t work with Social Security? 

Ms. HARRIS. No, we do audits of their IT management and operations. We have received their IT modernization plan, and we have 

taken a look at it. On the surface, it looks very good, but we have 

not done the detailed dive into it to look at the meat of it, at least 

not at—at least not yet. 

Mr. RICE. Why? I mean, you are the Government Accountability 

Office. You are supposed to hold people accountable. They send you 

the road map, it seems to me like you would have somebody watching them every month, right? Why don’t—you haven’t done a detailed dive into it? 

Ms. HARRIS. Well, we do have limited resources, and the work 

that we do is driven by congressional request and mandates. And 

because we have not been mandated to do that detailed dive, we 

simply cannot do that work. 

Mr. RICE. So you are the Government Accountability Office, but 

you are not going to hold them accountable. 

Ms. HARRIS. Well, we do hold them accountable in terms of the 

recommendations that we have made. We do, over a 4-year period 

58 

after the recommendation is made, ensure that we—you know, we 

continue to monitor them to determine to what extent they have 

implemented our recommendations. 

Mr. RICE. Ms. Stone, you said that you are trying to migrate to 

a single case management system, right? 

Ms. STONE. The agency is. 

Mr. RICE. Yes, ma’am. 

Ms. STONE. I apologize. The agency is. 

Mr. RICE. Yes, ma’am. How many case management systems do 

they have now? 

Ms. STONE. Each of the 52 DDSs previously had their own individual systems, which gave rise to the need for DCPS. 

Mr. RICE. And they don’t talk to each other, and you can’t move 

cases back and forth between them. So it is remarkably and 

horrifically inefficient, right? 

Ms. STONE. It is complicated. 

Mr. RICE. So you said you tried to roll one in 2008. You did that 

for 7 years, but it didn’t work. You pulled it and you started a new 

one, right? And you spent $300 million along the way. Isn’t that 

what you said? 

Ms. STONE. Yes, sir. But just as a clarification, OIG itself did 

not do that, but those were decisions of the agency. 

Mr. RICE. Yes. 

Ms. STONE. And, as a part of our audit work, we identified 

those scenarios. 

Mr. RICE. Okay. So you are supposed to be holding them accountable, too, right? 

Ms. STONE. Yes, sir. 

Mr. RICE. You are there, right? You are in Social Security. So 

what is the timeline? Okay, you said you put this new case management system in place in 2016 in—what did you say, three offices? 

Ms. STONE. In three DDSs, yes. 

Mr. RICE. How many DDSs do you have? 

Ms. STONE. Fifty-two. 

Mr. RICE. You have fifty-two DDSs. So you put it in place in 

three. Which three were those? 

Ms. STONE. I don’t have those. 

Mr. RICE. Okay. All right. So you tried it in three for a little 

while. How long? 

Ms. STONE. I will defer to—— 

Mr. RICE. How long? 

Ms. STONE [continuing]. The agency. 

Mr. MATHUR. How long did we—— 

Mr. RICE. How long did you try it in those three DDSs? 

Mr. MATHUR. We are trying and continue to try them, and 

then—they are using them now. 

Mr. RICE. Okay. 

Mr. MATHUR. In fact, now it is 10, soon to be 14. 

Mr. RICE. I thought you said you stopped using it. I thought you 

said you tried it, you pulled back, you asked for feedback, and then 

you were going to go in again. That is what you said. That is what 

you said. 

Ms. STONE. May I clarify? 

59 

Mr. RICE. Yes, ma’am. 

Ms. STONE. In 2016 SSA rolled out to three. In 2017 SSA rolled 

out to ten. And instead of deploying DCPS to additional DDSs, SSA 

stopped further deployment so that they could look at modifying 

the software based on feedback from those DDSs that were currently using DCPS. 

Mr. RICE. Okay. I have about a million questions—— 

Ms. STONE. Is that a correct—— 

Mr. RICE [continuing]. And I have 1 minute. But this case management software that you are using, is it off the shelf or is it 

something you are developing? 

Mr. MATHUR. We looked at market options, Congressman. This 

is an in-house developed—the requirements for the DDSs and our 

business process in general is a very complex—there is nothing out 

there that is going to be plug-and-play, in terms of off-the-shelf. So 

we have looked at market options, we are doing market research 

right now, as well. 

Mr. RICE. I really don’t think that what you are doing is all that 

unique. I really don’t. And I don’t know why in the world you 

couldn’t find something off the shelf. 

Who is developing this? Is it the IT department that is overseeing the COBOL systems? 

Mr. MATHUR. It is our—it is a combination of our—it is our 

business partner, internal business partner, as well as our IT 

group. 

Mr. RICE. What does that mean, ‘‘business partner’’? 

Mr. MATHUR. The user that will eventually use the software. 

They are like—— 

Mr. RICE. So—— 

Mr. MATHUR. They are hand-in-hand—— 

Mr. RICE. You are talking about one of the DDSs? 

Mr. MATHUR. No, it is an internal organization that is working 

with the DDSs and the—— 

Mr. RICE. Okay, what is the name of that—— 

Mr. MATHUR. Operations. 

Mr. RICE. Operations. So they are not a business partner, they 

are part of the government. 

Mr. MATHUR. They are part of the government, yes. 

Mr. RICE. Yes, okay. And one last question, Mr. Chairman. I 

know I am going over, but who is making these decisions? I mean, 

do you have any kind of outside consultant, or do you guys just do 

this in-house? Are you all making these decisions about if you are 

going to design it yourself or if you are going to buy off-the-shelf? 

And if you are going to buy off-the-shelf, who the vendor is going 

to be? 

Are you all just doing that in-house, or do you have somebody 

who really, you know, is in this business of IT trying to help you 

with this? 

I hope, please, God. Tell me you do. 

Mr. MATHUR. We have—we do have expertise that we use. 

Mr. RICE. In-house is what you are—— 

Mr. MATHUR. It is in-house. 

Mr. RICE. Okay. 

Mr. MATHUR. It is in-house experts. 

60 

Mr. RICE. Okay. 

Mr. MATHUR. It is private-sector expertise that—as well as government expertise. 

Part of our process is to look at these options. That is part of 

what we have to do, and that is one of the things that I have made 

sure is part of our policy. 

Mr. RICE. Okay. I would like to see a list of the major systems 

that you have, that you want to replace, and I would like to see 

a timeline for that. 

I mean, I heard Mr. Schweikert trying to pin you down on when 

you thought you would be rid of COBOL, and I heard you dance 

for a minute-and-a-half on not answering his question, because you 

don’t want to pin yourself down. 

But part of our job—and I am not trying to be a smart aleck— 

part of our job is to hold you accountable. I don’t hear her holding 

you accountable. I am not sure I hear her holding you accountable. 

Part of our job is to hold you accountable. And I want you to tell 

me what your problems are, how you are going to fix them, and 

what the timeline is going to be to get that done. 

And I don’t expect you to give yourself unreasonable timelines, 

but it has to be something that we can hold you to, rather than 

this fuzzy dancing around, ‘‘Well, we are not sure,’’ and ‘‘We will 

get rid of most of it by this date.’’ 

Mr. MATHUR. May I respond? We have a plan. I think the—in 

your opening remarks, a big need is, in fact, having a strategy, 

having a plan. We have a plan and a road map that is 5 years. 

That is a substantial amount of time that will get us substantially 

there to removing a lot of this legacy software. 

And the removal of the software, the removal of the technology, 

the legacy technology, is going to happen as we go through the 

plan. It is not going to be at the—there is no one final end date, 

but there is an important—there are many wins that are happening all the way through. Every time we roll something out, we 

retire. Roll something out, we retire. That repeated phenomenon is 

what you are going to see, and that is what we are holding ourselves accountable for, as well. 

Mr. RICE. I am so sorry. One last yes-or-no question. Are you 

still using any magnetic media? 

Mr. MATHUR. I believe we may be, but it is not part of our core. 

But I can get you an answer for the record, sir. 

[The submission of Mr. Mathur follows:] 

61 

f 


33875A.036
62 

Chairman JOHNSON. Is he done? 

Mr. LARSON. He is done. 

Chairman JOHNSON. Well, that was a good line of questions. 

Thank you for them. 

You know, Social Security’s IT is critical to providing Americans 

with the service they expect and deserve. And while Social Security 

has taken steps to modernize its IT programs, there is still work 

to be done, which is obvious after those questions. 

Social Security also needs to do a better job using the private 

sector to keep costs down and projects on schedule. Social Security’s IT is too important not to get it right. Americans want, need, 

and deserve no less. 

I want to thank our witnesses for their testimony. Thank you for 

being here. Thank you also to our Members for being here, and 

thank you to everybody who has helped this Subcommittee accomplish so much over the years. 

With that, the Subcommittee stands adjourned. 

[Applause.] 

[Whereupon, at 12:16 p.m., the Subcommittee was adjourned.] 

[Questions for the Record follow:] 

63 


33875A.037
64 


33875A.038
65 


33875A.039
66 

f 


33875A.040
67 


33875A.041
68 


33875A.042
69 


33875A.043
70 


33875A.044
71 


33875A.045
72 


33875A.046
73 

f 


33875A.047
74 


33875A.048
75 


33875A.049
76 


33875A.050
77 

[Submissions for the Record follow:] 


33875A.051
78 


33875A.052
79 

f 


33875A.053
80 

f 


33875A.054
81 


33875A.055
82 

Æ 


33875A.056