HOMELAND 

SECURITY

Progress Made to 

Implement IT Reform, 

but Additional Chief 

Information Officer 

Involvement Needed

Report to Congressional Requesters

May 2017

GAO-17-284

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-17-284, a report to 

congressional requesters 

May 2017

HOMELAND SECURITY

Progress Made to Implement IT Reform, but 

Additional Chief Information Officer Involvement 

Needed

What GAO Found

The Department of Homeland Security (DHS) has fully implemented 28 of the 31 

selected Federal Information Technology (IT) Acquisition Reform Act (FITARA) 

action plans; however, as of December 2016, DHS did not fulfill all aspects of 3 

action plans. For example, one action plan is to use an updated process for 

reviewing troubled programs to provide support to such programs; however,

DHS has not finalized its policy for this process. Until DHS ensures that these 3 

plans are implemented, it will lack assurance that it is fulfilling FITARA’s goals.

DHS faces challenges in implementing certain FITARA provisions:

Chief Information Officer (CIO) approval of contracts and agreements.

FITARA requires, among other things, the agency CIO to review and approve IT

contracts and agreements associated with major investments (e.g., high cost) 

prior to award. However, the CIO did not participate in the approval of any of the 

48 contracts in GAO’s sample associated with major investments. While DHS 

has made improvements to its review process, until the Office of the CIO 

determines how to increase its review of contracts and agreements, the CIO will 

continue to have limited visibility into planned IT expenditures.

CIO evaluation of risk. DHS’s Office of the CIO was conducting risk evaluations

of major IT investments and updating the ratings on the Office of Management 

and Budget’s (OMB) public website known as the IT Dashboard, as required by 

FITARA. However, in October 2016, DHS changed its process for evaluating 30 

of DHS’s 93 major IT investments and, as a result, the CIO is no longer primarily 

responsible for the evaluations or associated risk ratings that are publicly 

reported for these investments. Instead, multiple DHS organizations and officials 

are to evaluate these investments and the CIO’s assessment only accounts for 

about 18 percent of the total score. Further, while under the old process, DHS’s 

CIO was responsible for assessing these 30 investments against criteria that 

OMB guidance stated CIOs may use, under the new process, the CIO is only to 

assess these investments against one of OMB’s criteria (see table below). This 

process change challenges the CIO’s ability to publicly report risk ratings.

Change in Responsibility for Conducting Chief Information Officer (CIO) Risk Evaluations that 

Are Reported to the Information Technology (IT) Dashboard for 30 Major IT Investments

Office of Management 

and Budget evaluation 

criteria

Primary office

responsible under 

old process

Primary organization or official responsible 

under new process 

Risk management CIO

Program Accountability and Risk Management, 

CIO, Chief Financial Officer, and Director of Test 

and Evaluation

Requirements 

management CIO

Joint Requirements Council; Office of Systems 

Engineering; Director of Test and Evaluation

Contractor oversight CIO Chief Procurement Officer

Historical performance CIO Not assessed by DHS under new process

Human capital CIO Program Accountability and Risk Management

Other factors CIO

CIO and any organization or official responsible 

for assessing any other factor in the evaluation

Source: GAO analysis of DHS documentation. | GAO-17-284.

Until DHS addresses these challenges, the goal of FITARA to elevate the role of 

the department CIO in acquisition management will not be fully realized.

View GAO-17-284. For more information, 

contact Carol C. Harris at (202) 512-4456 or 

HarrisCC@gao.gov.

Why GAO Did This Study

In 2014, Congress enacted IT reform 

legislation, referred to as FITARA, 

which includes provisions related to 

seven areas of IT acquisition

management. In 2015, OMB released 

FITARA implementation guidance that

outlined agency CIO responsibilities 

and required agencies to develop 

action plans for implementing the

guidance.

This report examines, among other 

things, the extent to which DHS has 

implemented selected action plans and 

the key challenges that DHS has faced

in implementing selected FITARA 

provisions.

To do so, GAO analyzed DHS’s efforts 

to implement a sample of 31 of 109 

action plans that DHS had reported as 

complete and that described laterstage implementation steps. To 

determine challenges, GAO analyzed 

and compared DHS documentation, 

including a random sample of ITrelated contracts and agreements, to 

selected FITARA provisions to identify

gaps between what was required by 

FITARA and what DHS had 

implemented. These provisions 

required, among other things,

significant coordination between DHS 

headquarters and five components.

What GAO Recommends

GAO is making 7 recommendations to 

DHS to ensure that it fully and 

effectively implements FITARA. Among 

other things, GAO recommends that 

DHS fully implement the action plans 

and address challenges related to CIO 

contract approval and evaluation of 

risk. DHS concurred with all 7 

recommendations and provided 

estimated completion dates for 

implementing each of them.
Page i GAO-17-284 Homeland Security IT Reform

Letter 1

Background 9

DHS’s Plans Addressed FITARA and Most, but Not All, Selected 

Plans Have Been Fully Implemented 16

DHS Faces Several Challenges in Implementing FITARA 22

Conclusions 35

Recommendations for Executive Action 37

Agency Comments and Our Evaluation 38

Appendix I The Department of Homeland Security’s (DHS) Action Plans to 

Implement Information Technology Acquisition Reform 40

Appendix II Comments from the Department of Homeland Security 49

Appendix III GAO Contact and Staff Acknowledgments 53

Tables

Table 1: Office of Management and Budget’s (OMB) 17 Common 

Baseline Sections for Implementing the Federal 

Information Technology (IT) Acquisition Reform Act 12

Table 2: Status of 31 Selected Department of Homeland Security 

(DHS) Federal Information Technology (IT) Acquisition 

Reform Act (FITARA) Action Plans, as of December 2016 18

Table 3: Number of Selected Contracts and Interagency 

Agreements Reviewed by the Department of Homeland 

Security (DHS) Chief Information Officer (CIO) or 

Appropriately Delegated Official Prior to Award 25

Table 4: Change in Responsibility for Conducting Department of 

Homeland Security (DHS) Chief Information Officer (CIO) 

Risk Evaluations that Are Reported to the Information 

Technology (IT) Dashboard for 30 Major IT Investments 31

Table 5: The Department of Homeland Security’s (DHS) Action 

Plans to Implement the Federal Information Technology 

Acquisition Reform Act (FITARA) and Their Associated 

Office of Management and Budget (OMB) Common 

Baseline Sections and Planned Implementation Dates 40

Contents
Page ii GAO-17-284 Homeland Security IT Reform

Figures

Figure 1: Key Department of Homeland Security Department-level 

Organizations with Information Technology Acquisition 

Management Responsibilities 15

Abbreviations

CIO chief information officer 

DHS Department of Homeland Security 

EBMO Enterprise Business Management Office 

FITARA Federal Information Technology Acquisition Reform Act 

IT information technology 

OCIO Office of the Chief Information Officer 

OMB Office of Management and Budget

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-17-284 Homeland Security IT Reform

441 G St. N.W.

Washington, DC 20548

May 18, 2017

The Honorable Ron Johnson

Chairman

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Michael McCaul

Chairman

Committee on Homeland Security

House of Representatives

The federal government plans to spend more than $89 billion on 

information technology (IT) in fiscal year 2017. However, prior IT 

expenditures too often have failed to meet cost and schedule 

expectations or make significant contributions to mission-related 

outcomes. To address these concerns, in December 2014, Congress 

enacted IT reform legislation, commonly referred to as the Federal 

Information Technology Acquisition Reform Act or FITARA. In June 2015, 

the Office of Management and Budget (OMB) released FITARA 

implementation guidance that, among other things, outlined 

responsibilities and authorities of federal agency chief information officers 

(CIO); it also required agencies to develop action plans needed to 

implement the FITARA guidance.

The Department of Homeland Security (DHS) relies heavily on IT to carry 

out its mission. In fiscal year 2016, the department’s IT budget of 

approximately $6.2 billion was the third largest in the federal government. 

Given the importance of implementing FITARA and the size of its budget, 

we reviewed the progress that this department has made in addressing 

the act. Specifically, our objectives were to (1) determine the extent to 

which DHS has developed action plans that address FITARA,1 and the 

extent to which DHS has implemented selected action plans; and (2) 

 1

FITARA contains seven sections and, as a covered agency, DHS has responsibilities for 

implementing five of the sections (agency CIO authority enhancements, enhanced 

transparency and improved risk management, portfolio reviews, federal data center 

consolidation, and the expansion of training and use of IT acquisition cadres). The 

remaining two sections (related to the federal strategic sourcing initiative and governmentwide software purchasing program) are only applicable to OMB or the General Services 

Administration. 

Letter
Page 2 GAO-17-284 Homeland Security IT Reform

determine the key challenges that DHS is facing in implementing selected 

FITARA provisions.

To address the initial part of the first objective—determine the extent to 

which DHS has developed action plans that address FITARA—we 

identified and reviewed each of the 131 action plans2 which DHS 

developed in accordance with OMB’s FITARA implementation guidance 

that identified 17 topic areas of agency CIOs’ roles and responsibilities, 

referred to as common baseline sections. OMB’s 17 baseline areas and 

DHS’s 131 supporting action plans are related to three of the five FITARA 

sections applicable to DHS: agency CIO authority enhancements, 

portfolio reviews, and the expansion of training and use of IT acquisition 

cadres.

In addition, we reviewed the department’s IT acquisition human capital 

plan and its data center consolidation plan, which were intended to 

address FITARA’s fourth and fifth applicable sections on the expansion of 

training and use of IT acquisition cadres, and data center consolidation, 

respectively. Further, we reviewed the department’s plan for assessing IT 

program risks, which was developed prior to the enactment of FITARA, 

but is consistent with the act’s provisions on enhanced transparency and 

improved risk management. We compared the information in each of 

these plans to the five applicable sections in FITARA. We did not assess 

whether DHS would be in full compliance with FITARA if the plans were 

implemented.

To address the second part of the first objective—determine the extent to 

which DHS has implemented selected FITARA action plans—we first 

identified those action plans (of the 131 total plans) that DHS reported it 

had fully implemented as of April 2016. This resulted in the identification 

of 109 action plans. (The remaining 22 of the 131 total plans were 

identified by DHS as not yet fully implemented and, thus, were not 

included in our selection pool.)

From the 109 plans that the department identified as fully implemented, 

we then selected a sample of the plans for review. To create the sample, 

we selected only those action plans that (1) were included in the 11 

common baseline sections that DHS identified as fully implemented (out 

of the 17 total sections) and (2) described later-stage implementation 

 2

DHS refers to these as action items. 
Page 3 GAO-17-284 Homeland Security IT Reform

steps; we did not include plans that described earlier-stage, or preliminary 

steps which the department said had been implemented. For example, 

we included in our sample action plans that focused on the 

implementation of an updated process, rather than action plans that 

focused on the preliminary identification of how a process needs to be 

updated. Based on these criteria, we selected a sample of 31 action 

plans.

We then obtained and analyzed available DHS documentation supporting 

the implemented actions, such as DHS policy documents, guidance 

documents, concepts of operations, process models, program 

management briefings, meeting minutes, memorandums, committee 

charters, and relevant e-mails to and from staff in DHS’s Office of the 

Chief Information Officer (OCIO) and OMB. We compared the 

documentation to the selected action plans to determine the extent to 

which DHS had implemented the plans. We also interviewed cognizant 

officials from across the department, including from the OCIO, the 

Enterprise Business Management Office (EBMO), the Office of the Chief 

Human Capital Officer, the Office of Program Accountability and Risk 

Management, and the Office of the Chief Procurement Officer. We 

discussed with these officials the steps that DHS had taken to implement 

the selected action plans.

Regarding our assessments of the sample of DHS’s FITARA action plans, 

we determined an action plan to be fully implemented when the evidence 

provided by DHS officials fulfilled all aspects of the action plan’s 

description. We assessed an action plan as being partially implemented 

when the evidence fulfilled some, but not all, aspects of the action plan’s 

description. For action plans that we determined to be partially 

implemented (although the department had identified them as being fully 

implemented), we reviewed documentation and met with department 

officials to identify the causes for why those action plans were not yet fully 

implemented.

To address the second objective, we identified the five sections within 

FITARA that were applicable to DHS as a covered agency. These 

sections related to agency CIO authority enhancements, enhanced 

transparency and improved risk management, portfolio reviews, federal 

data center consolidation, and the expansion of training and use of IT 

acquisition cadres. We then selected and reviewed provisions for three of 

those sections—agency CIO authority enhancements, enhanced 

transparency and improved risk management, and the expansion of 

training and use of IT acquisition cadres. (We did not select provisions 
Page 4 GAO-17-284 Homeland Security IT Reform

from the sections on portfolio reviews and federal data center 

consolidation because we had recently completed work that addressed 

these sections.3

)

To select the provisions from within the three sections, we first identified 

those that would require significant coordination between DHS 

headquarters and its components—since such coordination is especially 

important to the department’s decentralized structure. We also identified 

those that should have already been implemented by the department 

based on the time that had passed since FITARA was enacted in 

December 2014.

Based on the criteria, we selected provisions that require:

• the DHS CIO to review and approve IT contracts and agreements 

before the department enters into them (part of the agency CIO 

authority enhancements section);

• the department CIO to evaluate each major IT investment4 according 

to risk, in accordance with guidance issued by the Director of OMB 

(part of the enhanced transparency and improved risk management 

section); and

• the department to develop and strengthen its IT acquisition cadre, to 

include having highly skilled program and project managers (part of 

the expansion of training and use of IT acquisition cadres section).5

 3

See, for example, GAO, Information Technology Reform: Billions of Dollars in Savings 

Have Been Realized, but Agencies Need to Complete Reinvestment Plans, GAO-15-617 

(Washington, D.C.: Sept. 15, 2015); and Information Technology: Additional OMB and 

Agency Actions Needed to Ensure Portfolio Savings Are Realized and Effectively Tracked, 

GAO-15-296 (Washington, D.C.: Apr. 16, 2015). 

4

OMB defines a major IT investment as a system or an acquisition requiring additional 

management attention because it has significant importance to the mission or function of 

the government; significant program or policy implications; high executive visibility; high 

development, operating, or maintenance costs; an unusual funding mechanism; or is 

defined as major by the agency’s capital planning and investment control process.

5

The 31 reportedly implemented action plans that we reviewed in our first objective did not 

address these FITARA provisions; as such, we did not review any of DHS’s action plans 

associated with these provisions.
Page 5 GAO-17-284 Homeland Security IT Reform

We examined the implementation of these provisions by DHS 

headquarters6 and the department’s five operational components with the 

largest planned fiscal year 2016 IT budgets, as reported on OMB’s IT 

Dashboard. These components were the Transportation Security 

Administration, U.S. Citizenship and Immigration Services, U.S. Coast 

Guard, U.S. Customs and Border Protection, and U.S. Immigration and 

Customs Enforcement.

Further, to address the contract approval provision within this objective, 

we selected a random sample of contracts and interagency agreements 

from each of the five selected components and headquarters. To do so, 

we first asked DHS to provide us with a list of contracts for IT or IT 

services that met the following criteria:

• must have been awarded between October 1, 2015 and May 31, 

2016;

• must have been unclassified; and

• must not have been identified as a contract modification.

From the list of contracts provided by DHS, we then selected a subset of 

contracts from each of the five selected components and headquarters to 

review. Specifically, based on the total value of each contract, we 

randomly selected 17 contracts from each of the components and 

headquarters using the following cost ranges:

• $100,000 to less than $1 million (7 contracts),

• $1 million to less than $2.5 million (7 contracts), and

• $2.5 million and above (3 contracts).

Two of the selected components—U.S. Citizenship and Immigration 

Services and U.S. Immigration and Customs Enforcement—did not have 

enough contracts in each cost range for us to assess the total number of 

contracts we had planned. In instances where this occurred, we reviewed 

these components’ available, applicable contracts within those particular 

cost ranges.

 6

DHS headquarters includes the Office of the Secretary, the Office of the Under Secretary 

for Management, and the Office of the Under Secretary for Science and Technology.
Page 6 GAO-17-284 Homeland Security IT Reform

As a result, our sample consisted of a total of 92 contracts. Of the 92 

contracts, DHS officials from headquarters and the five selected 

components associated 48 contracts with major investments and 21 with 

non-major investments.7 Officials from headquarters, Customs and 

Border Protection, and the U.S. Coast Guard were unable to map 23 

contracts in our sample to an IT investment.

To select the sample of agreements for review, we first asked DHS to 

provide us with a list of agreements for IT or IT services that met the 

following criteria:

• must have been classified by DHS as interagency acquisitions8

(rather than financial transactions);

• must have been entered into between October 1, 2015 and May 31, 

2016;

• must have had a total value of greater than $100,000; and

• must have been unclassified.

Based on the above criteria, DHS provided a list of 24 interagency 

agreements from headquarters and the five selected components. We 

included all of those agreements in our review. Of the 24 interagency

agreements, DHS officials associated 8 agreements with major 

investments and 5 with non-major investments. The officials were unable 

to map 11 interagency agreements in our sample to an IT investment.

To determine whether each contract or interagency agreement was 

approved prior to DHS entering into them, we obtained and analyzed 

each of the contracts and agreements, as well as associated approval 

documentation, such as acquisition review decision documents. We then 

compared the contracts, agreements, and associated approval 

documentation to the FITARA provisions to identify gaps between what 

FITARA required and what DHS had implemented. Specifically, we 

compared the: (1) signature date on the contract or agreement to the date 

that was identified on the associated approval documentation and (2) 

amount approved to the amount awarded.

 7

A non-major IT investment is an investment that, among other things, does not meet the 

criteria for a major IT investment.

8

DHS defines an interagency acquisition as a procedure by which an agency needing 

supplies or services obtains them from another agency.
Page 7 GAO-17-284 Homeland Security IT Reform

Additionally, because DHS used its governance process—referred to as 

the IT Acquisition Review process—to approve contracts and 

agreements, we assessed whether the DHS CIO (for contracts and 

agreements associated with major investments) or a delegate who 

reports directly to the CIO (for contracts and agreements associated with 

non-major investments) was a full participant in that process, as required 

by FITARA. Specifically, for contracts and agreements associated with 

major investments, we analyzed the contract or agreement and 

associated approval documentation to determine whether the CIO signed 

off on the contract or agreement, attended a meeting where it was 

discussed, or provided written comments regarding it.

For contracts and agreements associated with non-major investments, we 

analyzed the contract or agreement and associated approval 

documentation to determine the position title of the official who approved 

the proposed contract or agreement. We then asked officials from DHS 

headquarters and the five components to identify whether the approving 

official reported directly to the DHS CIO, as required by FITARA. If that 

person did not directly report to the DHS CIO, we asked for 

documentation demonstrating whether the DHS CIO or an official who 

reports directly to the CIO was involved as a full participant in the 

approval process (i.e., attended a meeting where the specific contract or 

agreement was discussed, or provided written comments regarding it).

We also interviewed cognizant DHS officials from headquarters and the 

five selected components to discuss DHS’s IT Acquisition Review 

process, the steps DHS had taken to review and approve IT contracts 

and agreements prior to award, and the reasons for any gaps we 

identified to determine their challenges in fully implementing this FITARA 

provision.

Within our second objective, to address the provision of FITARA that 

requires the DHS CIO to evaluate each major IT investment according to 

risk and update the associated CIO ratings on OMB’s IT Dashboard in 

accordance with OMB guidance, we analyzed DHS’s policy for updating 

the CIO ratings on the Dashboard. We also analyzed DHS’s assessment 

template that was used for developing the ratings reported on the 

Dashboard. We then compared these documents to the FITARA provision 

to identify gaps between what FITARA required and what DHS had 

implemented. Further, we interviewed officials from EBMO and the Office 

of Program Accountability and Risk Management to discuss the steps 

DHS had taken to evaluate its major IT investments and update the 

associated CIO ratings on OMB’s IT Dashboard. We also discussed with 
Page 8 GAO-17-284 Homeland Security IT Reform

these officials the reasons for the gaps we identified to determine their 

challenges in addressing these gaps and fully implementing the provision.

To identify any challenges associated with implementing the FITARA 

provision that required DHS to develop and strengthen its IT acquisition 

cadre, we obtained and analyzed documentation on DHS headquarters’ 

and the five selected components’ efforts to develop and deploy a skilled 

IT acquisition cadre. Specifically, we assessed the department’s 

acquisition human capital plan and IT strategic plan, and compared them 

to the FITARA provision to identify gaps between what FITARA required 

and what DHS had implemented. We also interviewed cognizant DHS 

officials from headquarters and the five selected components to discuss 

the steps DHS had taken to implement an IT acquisition cadre. In 

addition, we discussed with these officials the reasons for the gaps we 

identified to determine what, if any, challenges they encountered in 

addressing these gaps and fully implementing the provision.

To assess the reliability of the data that we used to support the findings in 

this report, we reviewed relevant program documentation to substantiate 

evidence obtained through interviews with agency officials. We 

determined that the data used in this report were sufficiently reliable for 

the purposes of our reporting objectives. We made appropriate attribution 

indicating the sources of the data.

We conducted this performance audit from March 2016 to May 2017 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.
Page 9 GAO-17-284 Homeland Security IT Reform

Information systems are critical to the health, economy, and security of 

the nation. To support these systems, the federal government plans to 

invest more than $89 billion on IT in fiscal year 2017. However, prior IT 

expenditures too often have produced failed projects—that is, projects 

with multimillion dollar cost overruns, schedule delays measured in years, 

and questionable mission-related achievements.

These failed projects often suffered from a lack of disciplined and 

effective management, such as project planning, requirements definition, 

and program oversight and governance. In many instances, agencies had 

not consistently applied best practices that are critical to successfully 

acquiring IT investments. Based on these issues, in 2015, we designated 

the management of IT acquisitions and operations across the federal 

government as high risk.9

DHS has been challenged in improving the management of its IT projects. 

We have reported on these challenges since shortly after the department 

was created in 2002. In particular, we have reported on DHS’s need to 

improve its executive oversight of IT investments and its use of key 

program management practices.

In 2003, we also designated the transformation of DHS as high risk 

because it had to transform 22 agencies—several with major 

management challenges—into one department.10 The department 

subsequently made important progress in implementing its range of 

missions and in strengthening and integrating its management functions 

(e.g., acquisition, financial, and IT). However, in 2015 we reported that, 

among other things, additional work was needed for DHS to continue to 

improve its IT management.11 We have made numerous 

recommendations to help the department address these challenges.12

 9

GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: Feb. 11, 2015).

10GAO, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.: Jan. 1, 2003).

11GAO-15-290.

12See, for example, GAO, Homeland Security: Oversight of Neglected Human Resources 

Information Technology Investment Is Needed, GAO-16-253 (Washington, D.C.: Feb. 11, 

2016); and Immigration Benefits System: Better Informed Decision Making Needed on 

Transformation Program, GAO-15-415 (Washington, D.C.: May 18, 2015).

Background
Page 10 GAO-17-284 Homeland Security IT Reform

Over the last three decades, Congress has enacted several laws to assist 

the federal government in managing IT investments. For example, the 

Paperwork Reduction Act of 1995 required OMB to develop and oversee 

policies, principles, standards, and guidelines for federal agency IT 

functions. It also required individual agencies to establish processes for 

maximizing the value and managing the risk of major information system 

initiatives.13

The following year, in 1996, Congress enacted the Clinger-Cohen Act to 

strengthen those requirements by, among other things, mandating the 

appointment of agency CIOs.14 Under these two laws, CIO responsibilities 

for IT management include implementing and enforcing applicable 

government-wide and agency IT management principles, standards, and 

guidelines; assuming responsibility and accountability for IT investments; 

and monitoring the performance of IT programs and advising the agency 

head on whether to continue, modify, or terminate such programs.15

More recently, in December 2014, Congress passed IT reform legislation 

(commonly referred to as the Federal Information Technology Acquisition 

Reform Act or FITARA). This law holds promise for improving agencies’ 

acquisitions of IT and enabling Congress to monitor agencies’ progress 

and hold them accountable for reducing duplication and achieving cost 

savings.

FITARA includes provisions related to seven areas of management—

referred to as FITARA sections. Five of these sections are applicable to

DHS as a covered agency; six are applicable to OMB in its executive 

branch budget and policy role; and six are applicable to the General 

Services Administration, both as a covered agency and in its governmentwide acquisition role:

• Agency CIO authority enhancements. Agency CIOs are required to 

(1) approve the IT budget requests of their respective agencies, (2) 

certify that IT investments are adequately implementing OMB’s 

incremental development guidance, (3) review and approve contracts 

 1344 U.S.C. § 3504(h) & 3506(h).

1444 U.S.C. § 3506(a)(2)(A), as amended by sec. 5125(a), Pub. L. No. 104-106 (Feb. 10, 

1996).

1540 U.S.C. § 11315(c) and 44 U.S.C. § 3506(h).

IT Management and 

Reform Legislation
Page 11 GAO-17-284 Homeland Security IT Reform

for IT prior to award, and (4) approve the appointment of other agency 

employees with the title or functions of component CIO.16

• Enhanced transparency and improved risk management. OMB 

and agencies are to make publicly available detailed information on 

federal IT investments, and agency CIOs are to categorize their 

investments by risk. In addition, in the case of major investments 

rated as high risk for 4 consecutive quarters, the law requires that the 

agency CIO and the investment’s program manager conduct a review 

aimed at identifying and addressing the causes of the risk.

• Portfolio review. Agencies are to annually review their IT investment 

portfolios in order to, among other things, increase efficiency and 

effectiveness, and identify potential waste and duplication.

• Federal data center consolidation initiative. Agencies are required 

to provide OMB with a data center inventory, a strategy for 

consolidating and optimizing the data centers (to include planned cost 

savings), and quarterly updates on progress made.

• Expansion of training and use of IT acquisition cadres. Agencies 

are to update their acquisition human capital plans to address 

supporting the timely and effective acquisition of IT. In doing so, the 

law calls for agencies to consider, among other things, establishing IT 

acquisition cadres or developing agreements with other agencies that 

have such cadres.

• Maximizing the benefit of the federal strategic sourcing initiative.

OMB is to issue regulations requiring that federal agencies compare 

their purchases of services and supplies to what is offered under the 

federal strategic sourcing initiative.

• Government-wide software purchasing program. The General 

Services Administration is to develop a strategic sourcing initiative to 

enhance government-wide acquisition and management of software.

Most of these FITARA sections relate to our high-risk topic on the 

government-wide management of IT acquisitions and operations.17 With 

regard to this topic, for example, we focus on the need for CIO authority 

enhancements, portfolio reviews, and federal data center consolidation.

 16FITARA’s provisions generally apply to Chief Financial Officers Act (31 U.S.C. § 901(b)) 

agencies with limited application to the Department of Defense.

17GAO-15-290.
Page 12 GAO-17-284 Homeland Security IT Reform

In June 2015, OMB released guidance that describes how agencies are 

to implement FITARA.18 Among other things, this guidance outlined topic 

areas related to agency CIOs’ roles and responsibilities—referred to as 

OMB’s common baseline sections. For example, the CIO is responsible 

for engaging with program managers, reviewing and approving the IT 

budget request, and developing the IT workforce. Table 1 identifies 

OMB’s 17 common baseline sections and associated topics.

Table 1: Office of Management and Budget’s (OMB) 17 Common Baseline Sections 

for Implementing the Federal Information Technology (IT) Acquisition Reform Act

OMB common baseline section

A. Visibility of IT resource plans/decisions to Chief Information Officer (CIO)

B. CIO role in pre-budget submission for programs that include IT and overall portfolio

C. CIO role in planning program management

D. CIO review and approval of major IT investment portion of budget request

E. Ongoing CIO engagement with program managers

F. Visibility of IT planned expenditure reporting to CIO

G. CIO defines IT processes and policies

H. CIO role on program governance boards

I. Shared acquisition and procurement responsibilities with the Chief Acquisition Officer 

and Chief Financial Officer

J. CIO role in recommending modification, termination, or pause of IT projects or 

initiatives

K. CIO review and approval of acquisition strategy and acquisition plan

L. CIO approval of reprogramming

M. CIO approval of the appointment of new bureau CIOs

N. CIO participation in bureau CIOs’ evaluations

O. CIO and Chief Human Capital Officer develop bureau IT leadership directory

P. CIO develops and strengthens IT workforce

Q. CIO reports to agency head (or Deputy/Chief Operating Officer)

Source: GAO analysis of data from OMB. | GAO-17-284.

OMB also developed an assessment template for agencies to use to 

assess their current practices against the common baseline sections—

referred to as a self-assessment. Based on OMB’s guidance, agencies 

 18OMB, Management and Oversight of Federal Information Technology, M-15-14 

(Washington, D.C.: June 10, 2015).

OMB’s FITARA 

Implementation Guidance
Page 13 GAO-17-284 Homeland Security IT Reform

are expected to use the template to document areas where they are not 

in conformance with the baseline sections. The guidance also directed 

the agencies to develop action plans describing the changes they needed 

to make in order to conform to the baseline sections. The guidance 

further directed agencies to conduct an annual review and to update the 

self-assessment, with the first update to be completed by the end of April 

2016.

In response to the guidance, in November 2015, DHS submitted to OMB 

a self-assessment of its conformance with the common baseline. As a 

result of the assessment, DHS identified 130 action plans that it intended 

to implement to ensure that the department would meet all baseline 

responsibilities. According to the assessment, the department originally 

planned to implement all of the action plans by the end of May 2016. 

However, the department updated its assessment in April 2016 and 

revised the number of action plans to 131. It also deferred the 

implementation of certain action plans and revised the final time frame by 

which it expected to implement all of the plans to the second quarter of 

fiscal year 2018. As of April 2016, the department reported to OMB that it 

had fully implemented 109 of its 131 action plans. Appendix I lists the 

department’s 131 action plans and the respective OMB common baseline 

sections with which they are associated.

DHS acquires IT and other capabilities that are intended to improve its 

ability to execute its mission to prevent and deter terrorist attacks, and 

protect against and respond to threats and hazards to the nation. In 

accordance with OMB guidance,19 the department classifies its IT 

investments as major and non-major investments.

DHS’s capital planning guidance states that the department’s major 

investments are those that are expected to cost $50 million or more over 

their life cycles, while non-major investments are those expected to cost 

less than $50 million over their life cycles.20 According to data that DHS 

reported to OMB’s IT Dashboard,21 the department had 92 major IT 

 19OMB, Fiscal Year 2018 IT Budget – Capital Planning Guidance (June 24, 2016).

20DHS Instruction 102-02-001, Capital Planning and Investment Control Guidebook

(March 24, 2016).

21OMB’s IT Dashboard is a public website that provides detailed information on major IT 

investments at 27 federal agencies, including ratings of their performance against cost 

and schedule targets.

Oversight of DHS’s IT 

Investments
Page 14 GAO-17-284 Homeland Security IT Reform

investments in fiscal year 2016 and planned to spend about $5.1 billion 

on them during that year.

DHS’s Under Secretary for Management is designated as the 

department’s Chief Acquisition Officer and, as such, is responsible for 

managing the implementation of department-wide acquisition policies. To 

help manage and oversee the department’s investments, DHS’s Office of 

Program Accountability and Risk Management is responsible for the 

department’s overall acquisition governance process and is to report 

directly to the Under Secretary for Management. Specifically, this office 

has the responsibility to develop and update program management 

policies and practices, facilitate and assist in the review of major 

programs, provide guidance for workforce planning activities, provide 

support to program managers, and collect program performance data.

Further, per the department’s policy, DHS’s CIO, who also reports to the 

Under Secretary for Management, is responsible for setting departmental 

IT policies, processes, and standards. This official also is to ensure that 

IT acquisitions comply with the department’s IT management processes, 

technical requirements, and approved enterprise architecture, among 

other things. Within the OCIO, EBMO has been given primary 

responsibility for administering the CIO’s responsibilities and, as such, for 

ensuring that the department’s IT investments align with its missions and 

objectives. EBMO is also responsible for leading the implementation of 

DHS’s FITARA action plans. Figure 1 shows the key department-level 

organizations with IT acquisition management responsibilities at DHS.
Page 15 GAO-17-284 Homeland Security IT Reform

Figure 1: Key Department of Homeland Security Department-level Organizations 

with Information Technology Acquisition Management Responsibilities

To help manage the department’s IT acquisitions, DHS implemented a 

governance process—referred to as the IT Acquisition Review process—

which is managed by EBMO. This governance process is intended to 

ensure IT acquisitions align with DHS’s missions and policies. As part of 

this process, the CIO is responsible for reviewing, prior to award, 

contracts and agreements that have planned values of $2.5 million or 

more, among other criteria. In addition, DHS’s components that have a 

CIO are to review, for their respective component, contracts and 

agreements with planned values of less than $2.5 million, among other 

criteria.
Page 16 GAO-17-284 Homeland Security IT Reform

DHS developed plans, including 131 action plans, that addressed the five 

sections of FITARA that were applicable to the department.22 Further, as 

of December 2016, DHS fully implemented 28 of the 31 action plans we 

selected for review. However, we identified 3 action plans that the 

department has not fully implemented because specific actions called for 

in these plans had not been undertaken. Ensuring that its action plans are 

fully implemented will better position DHS to effectively manage the 

department’s IT acquisitions, consistent with FITARA.

DHS developed 131 action plans that, collectively, addressed three of the 

five applicable FITARA sections: (1) agency CIO authority enhancements, 

(2) portfolio reviews, and (3) development and deployment of an IT 

acquisition cadre. For example, related to the agency CIO authority 

enhancements section—which requires DHS to, among other things, 

approve the department’s IT budget requests—the department developed 

action plans for identifying and reviewing relevant policies that impact the 

processes, roles, and responsibilities within DHS’s budget phases; 

documenting and modeling the current processes; identifying gaps and 

opportunities in those current processes; and documenting and 

implementing updated policies to ensure the DHS CIO is involved in the 

department’s IT budgeting decisions and the management of IT 

programs.

In addition, DHS developed action plans that relate to the portfolio review 

section of FITARA. This section requires the department to annually 

review its portfolios of IT investments in order to, among other things, 

identify potential duplication in similar investments within the portfolios. 

DHS’s action plans to address this section included, among other things, 

identifying gaps in the department’s current processes where OMB’s 

common baseline requirements were not satisfied; updating relevant 

policies and guidance to collect the necessary information related to 

executing the IT budget; and ensuring policy updates are approved by 

relevant parties.

 22These five FITARA sections are: agency CIO authority enhancements, enhanced 

transparency and improved risk management, portfolio reviews, federal data center 

consolidation, and the expansion of training and use of IT acquisition cadres. The 

remaining two sections of FITARA are only applicable to OMB or the General Services 

Administration.

DHS’s Plans 

Addressed FITARA 

and Most, but Not All, 

Selected Plans Have 

Been Fully 

Implemented

DHS Developed Plans that 

Addressed FITARA
Page 17 GAO-17-284 Homeland Security IT Reform

The department also created action plans to address the section of 

FITARA related to IT acquisition cadres. Specifically, this section requires 

the department to consider developing and implementing a crossfunctional group trained in IT program management and acquisition. For 

example, DHS created action plans for identifying training opportunities 

that will enhance staff development at multiple levels, developing a 

workforce planning process for assessing the department’s current 

technology skills, identifying existing employee skillsets related to 

acquisition and IT, and aligning the department’s existing course 

inventory to acquisition certifications and specializations in IT.

Beyond the 131 FITARA action plans, the department developed a 

separate plan that addressed the FITARA section that requires DHS to 

consolidate its data centers. Specifically, DHS developed a strategic plan 

that describes how it intends to implement OMB’s data center 

consolidation guidance.23

In addition, the department previously developed a plan that is consistent 

with the remaining section of FITARA that is applicable to DHS—

enhanced transparency and improved risk management. This section 

requires the department to make publicly available detailed information on 

its federal IT investments, and the CIO to categorize the department’s 

investments by risk. Related to the requirements in this section, in 2013, 

DHS issued a plan which stated that IT programs’ risks were to be 

assessed on a regular basis and that the assessments would serve as 

the basis for the ratings to be regularly published on OMB’s IT 

Dashboard. (This plan is discussed in more detail later in the report.)

As a result of the department developing these plans to implement 

FITARA, it should be better positioned to implement the act. Further, 

doing so has more effectively positioned the department to take steps to 

elevate the role of its CIO and improve the oversight of its IT acquisition 

and management.

 23We have future work planned that will assess the completeness of this plan.
Page 18 GAO-17-284 Homeland Security IT Reform

Of the 31 selected action plans that we reviewed,24 28 of them (about 90 

percent) have been fully implemented as of December 2016 (that is, the 

evidence provided by DHS fulfilled all aspects of the action plan’s 

description), as the department reported. However, 3 action plans (about 

10 percent) have not been fully implemented, even though the 

department reported them as fully implemented. In these instances, the 

evidence of the actions taken by the department fulfilled some, but not all, 

aspects of the action plan’s description. Table 2 provides the 

implementation status of the 31 selected action plans and the OMB 

common baseline sections associated with each of these action plans.

Table 2: Status of 31 Selected Department of Homeland Security (DHS) Federal Information Technology (IT) Acquisition 

Reform Act (FITARA) Action Plans, as of December 2016 

Office of 

Management 

and Budget 

(OMB) common 

baseline section

DHS action plana Fully 

implementedb Partially implementedc

A. Visibility of IT 

resource 

plans/decisions 

to Chief 

Information 

Officer (CIO)

1. Ensure updates to policies are approved by relevant parties and submit 

updated/approved policies to OMB.

X

2. Document and implement the updated and agreed upon processes for the 

planning, programming, and budgeting phases to ensure CIO has visibility into IT 

resource plans and decisions.

X

B. CIO role in 

pre-budget 

submission for 

programs that 

include IT and 

overall portfolio

3. Ensure content updates to policies are approved by all relevant parties and 

submit updated/approved policies to OMB.

X

4. Document and implement the updated processes for the planning, 

programming, and budgeting phases to ensure CIO has a role in pre-budget 

submission.

X

5. Document and update the DHS IT portfolio management processes to align 

with the updated planning, programming, and budgeting phases to assess the 

use of IT-related resources.

X

 24Of the 131 total plans, DHS reported that it had fully implemented 109, as of April 2016. 

DHS planned to fully implement the remaining 22 action plans later and, thus, we did not 

include them in our selection pool. Therefore, we selected a sample of 31 plans to review 

from the selection pool of 109. To create the sample, we selected only those action plans 

that, among other things, were included in the 11 common baseline sections that DHS 

identified as fully implemented. As such, we did not select action plans from sections F, H, 

I, J, K, or P, which the department had indicated were partially implemented. Additionally, 

while DHS reported that it fully implemented sections M and Q, DHS did not have any 

action items related to these sections. As such, we did not select any action plans from 

them. 

DHS Has Taken Steps that 

Fully Implemented Most, 

but Not All, of the Selected 

FITARA Action Plans
Page 19 GAO-17-284 Homeland Security IT Reform

Office of 

Management 

and Budget 

(OMB) common 

baseline section

DHS action plana Fully 

implementedb Partially implementedc

C. CIO role in 

planning program 

management

6. Formalize the endorsement or approval process to incorporate CIO review, 

assessment, and acknowledgement of appropriate artifacts in the Acquisition 

Lifecycle Framework.

X

7. Update language within DHS’s acquisition management directive to fully align 

with FITARA and OMB’s common baseline.

X

8. Complete an analysis of the current state of activities during the first phase of 

the acquisition life-cycle (when a capability need is identified).

X

9. Develop a proposed framework for streamlining activities in the first phase of 

the acquisition life-cycle.

X

10. Complete an implementation recommendation plan for streamlining and 

reporting on activities that occur in the first phase of the acquisition life-cycle.

X

11. Document and model current processes and supporting requirements for the 

planning, programming, and budgeting phases.

X

12. Document and implement the updated and agreed upon processes for 

planning, programming, and budgeting phases to ensure CIO has a role in 

program planning.

X

13. Ensure content updates to policies are approved by all relevant parties and 

submit updated policies to OMB.

X

D. CIO review 

and approval of 

major IT 

investment 

portion of budget 

request

14. Ensure content updates to policies are approved by all relevant parties and 

submit updated policies to OMB.

X

15. Document and implement the updated and agreed upon processes for 

planning, programming, and budgeting phases to ensure the CIO has approval 

of agency IT budget submission.d

X

E. Ongoing CIO 

engagement with 

program 

managers

16. The IT Program/Project Manager Center of Excellencee will be established 

as a cross-functional team to gather appropriate best practices, determine pain 

points, and address these pain points.

X

17. The IT Program/Project Manager Center of Excellence will develop IT 

performance metrics to ensure programs are meeting objectives.

X

18. Develop requirements to validate the IT performance metrics. X

19. Leverage the updated DHS TechStatfprocess to provide support to failing or 

troubled programs.g X

20. Update the process to ensure the IT Program/Project Manager Center of 

Excellence reviews IT performance metrics and strategies.

X

21. Create IT Program/Project Manager standard operating procedures and best 

practices guides.

X

G. CIO defines IT 

processes and 

policies

22. Develop process models and list of requirements for CIO certification of 

reviews related to IT initiatives.

X

23. Submit approved process models and supporting guidance. X

24. Incorporate CIO certification of incremental development or scope of the 

systems engineering life-cycle reviews to ensure that the process sufficiently 

addresses various IT resource categories.

X
Page 20 GAO-17-284 Homeland Security IT Reform

Office of 

Management 

and Budget 

(OMB) common 

baseline section

DHS action plana Fully 

implementedb Partially implementedc

25. Incorporate the agile and systems engineering life-cycle guidebooks and 

instructions into DHS’s acquisition management directive.

X

L. CIO approval 

of 

reprogramming

26. Ensure content updates to policies are reviewed by all stakeholders and 

submit updated policies to OMB.

X

27. Revise relevant documentation and processes to reflect CIO approval of 

component’s requests for reprogramming and transfer requests of IT resources.

X

N. CIO 

participation in 

bureau CIOs’ 

evaluations

28. Develop an executive-level leadership competency applicable to CIO 

employees in certain performance plans.h X

29. Incorporate this competency in certain CIO performance plans, amend 

performance system descriptions as necessary, and submit these amendments 

to the Office of Personnel Management.h 

X

30. Provide guidance during the performance appraisal cycle that will provide 

component Line of Businessi(e.g., CIO) input into the assessments.

X

O. CIO and Chief 

Human Capital 

Officer develop 

bureau IT 

leadership 

directory

31. Include evaluating rating officials and reviewing officials in the provided 

survey report.

Xj

Total 28 3

Source: GAO analysis of data provided by DHS. | GAO-17-284.

a

For the purposes of this report, we slightly modified and/or condensed the wording of certain DHS 

action plans. 

b

We determined an action plan to be fully implemented when the evidence provided by DHS officials 

fulfilled all aspects of the action plan’s description.

c

We determined an action plan to be partially implemented when the evidence fulfilled some, but not 

all, aspects of the action plan’s description.

d

In accordance with OMB’s FITARA implementation guidance, the DHS CIO reviewed and approved 

the major IT investments portion of the department’s fiscal year 2017 budget request, which 

accounted for about 83 percent of its IT budget.

e

DHS’s IT Program/Project Manager Center of Excellence is a cross-functional team created to 

provide guidance and assistance in the management of IT programs and projects.

f

A TechStat is a face-to-face, evidence-based review of an IT program with DHS headquarters, 

component leadership, and OMB, as appropriate.

g

In December 2016, Enterprise Business Management Office (EBMO) officials reported that they had 

begun implementing the new TechStat process, but they were still in the process of finalizing the 

policy on that new process.

h

According to EBMO officials, the action plans associated with the executive-level leadership 

competency were focused only on the component CIOs that were part of the Senior Executive 

Service pay plan, not those that were part of the General Schedule pay plan.

i

A Line of Business is a specific operating unit or shared service within DHS, such as financial 

management or human resources. DHS’s Line of Business chiefs include, among others, the CIO and 

chief financial officer.

j

While DHS had developed an IT leadership directory that identified evaluating rating officials, this 

directory did not initially include the reviewing officials, as stated in the action plan. EBMO officials 
Page 21 GAO-17-284 Homeland Security IT Reform

stated that this was because OMB’s instructions for creating the directory identified the reviewing 

official field as optional. In response to us asking about it during our review, DHS subsequently 

updated the directory to include the reviewing officials.

For the 28 selected action plans that the department fully implemented, 

DHS officials had, for example, updated multiple policies related to the 

department’s planning, programming, and budgeting phases; ensured 

that the updated policies were approved by relevant parties; and 

submitted the updated policies to OMB. In addition, the department 

documented and implemented updated processes for the planning, 

programming, and budgeting phases to ensure that the CIO has, among 

other things, visibility into IT resource plans and decisions. Further, the 

department revised relevant documentation and processes to reflect the 

CIO’s responsibility to approve components’ requests for reprogramming 

or transferring IT resources.

However, the remaining 3 selected action plans were not yet fully 

implemented due to two factors: (1) the steps taken did not address all 

planned actions and (2) DHS updated its policies with conflicting 

guidance. Specifically, DHS’s steps to implement action plans 19 and 20 

addressed part, but not all, of these plans. Related to action 19—to 

leverage the updated DHS TechStat25 process to provide support to 

failing or troubled programs—OCIO officials were in the process of 

updating the department’s TechStat policy to comply with FITARA, but

had not completed the update. As of December 2016, the officials stated 

that they could not provide a date for when the policy would be finalized. 

Until the CIO, who is responsible for establishing departmental IT policies, 

finalizes the TechStat policy, the department will be limited in its ability to 

ensure that DHS is meeting FITARA’s IT acquisition reform goals, as well 

as consistently providing support to failing or troubled programs.

With regard to action 20—to ensure the IT Program/Project Manager 

Center of Excellence26 reviews IT performance metrics and strategies—

DHS developed IT performance metrics. However, as of December 2016, 

EBMO officials stated that the Center of Excellence had not begun using 

these metrics across all programs to identify poorly performing programs. 

 25A TechStat is a face-to-face, evidence-based review of an IT program with DHS 

headquarters, component leadership, and OMB, as appropriate.

26DHS’s IT Program/Project Manager Center of Excellence is a cross-functional team 

created to provide guidance and assistance in the management of IT programs and 

projects.
Page 22 GAO-17-284 Homeland Security IT Reform

These officials told us that they expected the Center of Excellence to 

begin using these metrics across all programs to identify those needing 

assistance in the second quarter of fiscal year 2017. Use of these metrics 

by the center will be vital to its ability to proactively identify poorly 

performing programs and help them to improve their performance.

With regards to action 24, which required that the DHS CIO certify 

investments’ incremental development activities, the department updated 

its multiple systems engineering life-cycle policies and guidance 

documents with conflicting information regarding who was to certify these 

development activities. While one of the policies was updated to specify 

that the DHS CIO was the certifier, another policy and a guidance 

document was updated to specify that the component CIO was the 

certifier.

Officials from EBMO and the Office of Program Accountability and Risk 

Management stated that these documents were not written at the same 

time and, as a result, reflected conflicting policies and guidance that 

needed further clarification. However, the officials did not state when they 

intended to make the clarifications and updates to the policies and 

guidance. Until the Under Secretary for Management, who is responsible 

for managing the implementation of department-wide acquisition policies, 

updates DHS’s relevant policies and guidance in a consistent manner to 

identify that the DHS CIO is to certify investments’ incremental 

development activities, the department is at risk of excluding the CIO from 

important investment oversight activities.

DHS currently faces a number of important challenges in implementing 

several selected FITARA provisions. These provisions relate to (1) the 

CIO’s approval of IT contracts and agreements before award, (2) the 

CIO’s evaluation of each major IT investment according to risk, and (3) 

the development and deployment of an IT acquisition cadre.27 While the 

department has taken steps aimed at addressing these challenges, more 

work remains. Moreover, until the department takes actions that fully 

address these challenges, the goal of FITARA to elevate the role of the 

department CIO may not be fully realized.

 27The 31 reportedly implemented action plans that we reviewed in our first objective did 

not address these FITARA provisions; as such, we did not review any of DHS’s action 

plans associated with these provisions.

DHS Faces Several 

Challenges in 

Implementing FITARA
Page 23 GAO-17-284 Homeland Security IT Reform

FITARA prohibits a covered agency (such as DHS) from entering into a 

contract or agreement for IT or IT services (associated with major and 

non-major investments), unless the contract or agreement has been 

reviewed and approved by the agency CIO.28 FITARA allows the CIO to 

delegate these review and approval duties if a contract or agreement is to 

support a non-major IT investment.29 In such cases, the delegated official 

must report directly to the agency CIO. Accordingly, in order to properly 

distinguish the appropriate approving official, per FITARA, it is necessary 

for an agency to determine whether each IT contract and agreement is 

associated with a major or non-major investment.

Alternatively, FITARA states that an agency may use its governance 

processes to approve any contract or agreement (associated with major 

investments), if the agency CIO is a full participant in the governance 

processes. Further, when governance processes are used for review of 

contracts or agreements associated with non-major IT investments, the 

CIO or an individual who reports directly to the agency CIO must be a full 

participant in the governance processes.

While DHS used its governance process (e.g., the CIO’s IT Acquisition 

Review process, discussed earlier) to approve contracts and interagency 

agreements associated with major and non-major investments, the DHS 

CIO did not directly review or approve any of the contracts or interagency 

agreements that we examined. Furthermore, the CIO or an appropriate 

delegate was not always a full participant in the department’s use of its 

governance process to approve the contracts and interagency 

agreements that we reviewed, as required by FITARA. Specifically,

 28This does not apply to the Department of Defense.

29FITARA’s contract approval provision is related to OMB’s common baseline section K on 

the review and approval of acquisition strategies and plans.

CIO Review of Certain 

Contracts and Agreements 

Is a Challenge for DHS
Page 24 GAO-17-284 Homeland Security IT Reform

• Of the 48 contracts and 8 interagency agreements in our sample30

that department officials associated with major investments (i.e., those 

requiring additional management attention because of, among other 

things, their significance to the department’s mission or high costs, as 

defined by OMB), the DHS CIO neither directly reviewed, nor 

participated in the governance process to review, any of those 

contracts or agreements, as required by FITARA. Instead, all of the 

contracts and interagency agreements were reviewed by either the 

Executive Director or Deputy Executive Director of EBMO, or a 

component official, which was not in compliance with FITARA.

• While an appropriate delegate who reported directly to the department 

CIO participated in the review of 5 of the 21 selected contracts that 

DHS officials associated with non-major investments, the department 

CIO or an appropriate delegate did not participate in the review of the 

remaining 16 contracts (about 76 percent). In addition, neither the 

DHS CIO nor an appropriate delegate participated in the review of any 

of the 5 interagency agreements in our sample that were associated 

with non-major investments. Instead, these contracts and interagency 

agreements were reviewed and approved, as part of the governance 

process, by someone who did not report directly to the DHS CIO, 

such as a deputy assistant commissioner or a management analyst. 

Such review and approval was not consistent with FITARA.

Table 3 summarizes the number of selected contracts and interagency 

agreements that were and were not reviewed by the appropriate official 

prior to award, as required by FITARA.

 30Of the 92 contracts and 24 interagency agreements in our sample, DHS officials from 

headquarters and the five selected components associated 48 contracts and 8 

interagency agreements with major investments. Additionally, these officials associated 21 

contracts and 5 interagency agreements in our sample with non-major investments. 

Officials from headquarters, Customs and Border Protection, and the U.S. Coast Guard 

were unable to map 23 contracts and 11 interagency agreements in our sample to IT 

investments, as discussed later. 
Page 25 GAO-17-284 Homeland Security IT Reform

Table 3: Number of Selected Contracts and Interagency Agreements Reviewed by the Department of Homeland Security 

(DHS) Chief Information Officer (CIO) or Appropriately Delegated Official Prior to Award

Contracts and 

interagency 

agreements 

associated with major 

information 

technology (IT) 

investment

Total value of 

contracts and 

interagency 

agreements 

associated with major 

IT investmentsa

Contracts and 

interagency 

agreements 

associated with

non-major

IT investment

Total value of 

contracts and 

interagency 

agreements 

associated with nonmajor IT investmentsa

Contracts and interagency 

agreements approved by 

appropriate reviewer (DHS CIO 

or direct report, as 

appropriate),b consistent with 

the Federal IT Acquisition 

Reform Act (FITARA)

0 $0 5

(5 contracts,

0 agreements)

$79 million

Contracts and interagency 

agreements not approved by 

appropriate reviewer (DHS CIO 

or direct report, as 

appropriate),b inconsistent

with FITARA

56

(48 contracts,

8 agreements)

$287 million 21

(16 contracts,

5 agreements)

$104 million

Source: GAO analysis of DHS-provided data. | GAO-17-284.

a

The total value of each contract and interagency agreement refers to the entire amount of the 

expected award, including the total value of the base period and any option periods.

b

DHS was unable to map 23 contracts and 11 interagency agreements included in our sample to an 

IT investment. The total value of these contracts and agreements was about $40 million.

Further, the department CIO did not prioritize the reviews of contracts 

associated with major IT investments, even for those with known 

performance problems. For example, three of the contracts in our sample 

were associated with two major DHS IT investments with past or existing 

performance issues: Customs and Border Protection’s Automated 

Commercial Environment investment and United States Citizenship and 

Immigration Services’ Transformation investment. We have previously 

reported on significant performance problems with these investments.31

However, the DHS CIO did not directly review and approve the contracts 

for these troubled investments, as required by FITARA for contracts 

associated with major investments. Instead, the Customs and Border 

 31GAO, Immigration Benefits System: U.S. Citizenship and Immigration Services Can 

Improve Program Management, GAO-16-467 (Washington, D.C.: July 7, 2016); Homeland 

Security Acquisitions: DHS Has Strengthened Management, but Execution and 

Affordability Concerns Endure, GAO-16-338SP (Washington, D.C.: Mar. 31, 2016); and 

GAO-15-415.
Page 26 GAO-17-284 Homeland Security IT Reform

Protection CIO and the Executive Director of EBMO reviewed the 

contracts for these investments, respectively.

According to OCIO officials, the reason why the department CIO 

delegated the approval of contracts and agreements in a way that was 

inconsistent with FITARA was that DHS had a large volume of contracts, 

which made it challenging for the department CIO and those who 

reported to the CIO to review every contract and agreement. Specifically, 

data provided by DHS showed that, in fiscal year 2016, the department 

awarded approximately 5,100 contracts for IT or IT services. According to 

DHS officials, as a work around to this resource constraint, the 

department CIO delegated the review and approval of contracts and 

agreements to EBMO or component officials.

OCIO officials recognized that the department needs to make 

improvements to better meet the intent of FITARA’s contract and 

agreement approval section and they have begun taking steps to do so. 

For example, in May 2016, the department updated its department-wide 

acquisition procedures to require greater participation in the acquisition 

planning process by the DHS CIO and component CIOs. Specifically, the 

updated procedures specify that the DHS CIO is required to review and 

sign the acquisition plans32—which are developed early in the 

procurement planning process and provide top-level plans for the overall 

acquisition approach—associated with major IT acquisitions that have 

estimated life-cycle costs of greater than $50 million or service 

acquisitions with an annual expenditure of $100 million or more.

Additionally, the updated procedures specify that the component CIOs 

are to review and sign the acquisition plans for all acquisitions involving 

sensitive information. Further, in October 2016, OCIO updated its

associated IT Acquisition Review governance process to implement these 

new procedures.

Nevertheless, while these updates to the department-wide acquisition 

procedures and governance process represent improvements by allowing 

the CIO and component CIOs insight into early procurement planning, the 

CIO’s visibility into contracts is limited because these top-level acquisition 

plans do not include important details (e.g., the full scope of the work to 

be performed) that are contained in specific contracts.

 32An acquisition plan is to address all of the technical, business, management, and other 

significant considerations that will control the acquisition, and is to include costs related to 

contractual requirements, as well as the rationale for the contract type selection.
Page 27 GAO-17-284 Homeland Security IT Reform

Additionally, the department’s governance process requires contracts or 

agreements that are associated with major investments and that have 

total estimated procurement values of at least $2.5 million to be submitted 

to the DHS OCIO for review.33 However, these processes still do not 

require contracts and agreements that are associated with major 

investments and are under this threshold to be submitted for CIO review, 

which is inconsistent with FITARA.

In response to our concerns, in April 2017, OCIO officials stated that they 

had begun to analyze how they could best increase the CIO’s and 

appropriate delegates’ reviews of contracts and agreements, while 

considering the department’s staffing constraints. The officials also stated 

that, once this analysis is complete, they plan to update their governance 

process accordingly; however, they did not know when these actions 

would be completed. Until the governance process is updated in a way 

that increases the CIO’s and appropriate delegates’ reviews of contracts 

and agreements associated with major and non-major investments, the 

DHS CIO will continue to have limited visibility into the department’s

planned IT expenditures. Additionally, the CIO may lack critical data to 

make investment decisions and may not be able to use the increased 

authority that FITARA’s contract and agreement approval provision is 

intended to provide.

Further exacerbating this issue, FITARA does not allow agency CIOs to 

delegate the review and approval of contracts and agreements 

associated with major investments, but there were many contracts and 

interagency agreements in our sample for which DHS officials were 

unable to map to a major or non-major IT investment; as such, they could 

not ensure that these contracts and agreements were reviewed by the 

appropriate officials. Specifically, officials from DHS headquarters, 

Customs and Border Protection, and the U.S. Coast Guard were unable 

to map 23 of the 92 contracts (about 25 percent) and 11 of the 24 

interagency agreements (about 46 percent) in our sample to a major or 

non-major IT investment.

The officials cited various reasons for why they could not map these 

contracts and interagency agreements to a major or non-major IT

investment. Specifically,

 33DHS’s threshold for determining, along with other criteria, whether a contract will be 

reviewed at the headquarters OCIO level is $2.5 million; contracts under $2.5 million are 

to be reviewed by the component CIO (if the component has a CIO).
Page 28 GAO-17-284 Homeland Security IT Reform

• OCIO officials stated that only contracts and agreements that go 

through the department’s headquarters-level contract approval 

process (i.e., defined by DHS as those valued at $2.5 million or over 

and are associated with major investments) are required to identify 

the associated investments. These officials stated that, at the 

headquarters level, the department does not ask about the 

investments associated with contracts and agreements that do not go 

through this headquarters-level contract approval process.

• While Customs and Border Protection officials were able to identify 

the IT investments associated with the majority of their contracts and 

interagency agreements in our sample, these officials stated that 

certain contracts were not associated with planned IT investments. 

Rather, according to the officials, these contracts were to address 

emerging needs (e.g., a need for new laptops) that Customs and 

Border Protection offices had identified that were not originally 

planned as part of an investment.

• U.S. Coast Guard officials stated that their process for accounting for 

all IT costs does not include a mapping of every contract or 

agreement to a major or non-major IT investment. These officials said 

they were working with DHS headquarters to improve their process for 

tracking contracts and agreements associated with IT investments, 

but did not specify a time frame for completing this effort.

Until the Under Secretary for Management updates DHS headquarters’, 

Customs and Border Protection’s, and U.S. Coast Guard’s processes to 

track, for all contracts and agreements, the IT investment with which each 

is associated (as applicable), the department will be challenged in its 

ability to ensure that the contracts and agreements that are associated 

with these investments receive the appropriate level of oversight.
Page 29 GAO-17-284 Homeland Security IT Reform

FITARA requires each agency CIO to categorize its major IT investments 

according to risk, in accordance with guidance issued by the Director of 

OMB.34 In this regard, OMB issued guidance in June 2015 that directed 

agency CIOs to evaluate and categorize (i.e., rate) the risk of each major 

IT investment. In addition, OMB’s guidance directs agencies to report 

their CIO risk ratings on OMB’s public website known as the IT 

Dashboard.35

Prior to October 2016, DHS’s OCIO, on behalf of the CIO, was 

conducting such evaluations on the department’s major IT investments in 

accordance with OMB’s six criteria. The office was also regularly updating 

the associated CIO risk ratings on the IT Dashboard, as required by 

FITARA and OMB.36

However, as of October 2016, the CIO was no longer directly responsible 

for the full evaluations or the associated risk ratings that are publicly 

reported on the IT Dashboard for approximately one-third of the 

department’s major IT investments. This was due to DHS’s Under 

Secretary for Management issuing a new policy in October 2016 that 

assigned responsibility for collecting the appropriate acquisition program 

data for evaluating the health of all level one and level two major 

acquisition programs37 (both IT and non-IT) that are on the department’s 

Master Acquisition Oversight List38 to the Office of Program Accountability 

 34This FITARA provision is not related to a specific OMB common baseline section, but is 

addressed separately in OMB’s FITARA implementation guidance.

35OMB’s IT Dashboard is a public website that provides detailed information on major IT 

investments at 27 federal agencies, including ratings of their performance against cost 

and schedule targets.

36Prior to the enactment of FITARA, in 2009 OMB had issued guidance requiring agencies 

to update CIO ratings on the IT Dashboard. As such, the CIO had been updating ratings 

on the IT Dashboard during prior years. For the purposes of this review, we looked at the 

process and regularity of these updates during 2016. 

37DHS’s level one major acquisition programs are those with planned life-cycle costs of 

greater than or equal to $1 billion. The department’s level two major acquisition programs 

have planned life-cycle costs of $300 million or more, but less than $1 billion.

38DHS’s Master Acquisition Oversight List is created by the Office of Program 

Accountability and Risk Management and is used to identify the programs for which that 

office has oversight responsibility. These include both major and non-major acquisition 

programs, among others, that meet certain criteria determined by DHS, such as programs 

that have planned life-cycle costs of more than $300 million and are included in DHS’s 5-

year funding plans that are reported to Congress.

DHS’s Recent Change in 

Its Risk Rating Process 

Creates a Barrier to 

Reporting the CIO’s 

Assessment to OMB’s IT 

Dashboard
Page 30 GAO-17-284 Homeland Security IT Reform

and Risk Management. According to EBMO officials, as of December 

2016, these level one and level two investments that the Office of 

Program Accountability and Risk Management was to facilitate the 

evaluation of included 30 of DHS’s 93 major IT investments. DHS’s policy 

further states that the department CIO is to report the ratings that are 

facilitated by the Office of Program Accountability and Risk Management

on these 30 IT investments to OMB’s IT Dashboard. The officials also 

stated that OCIO is to continue to have responsibility for the evaluations 

of the 63 other IT investments not on that oversight list, and for reporting 

the associated risk ratings of these investments to the IT Dashboard.

According to the Office of Program Accountability and Risk 

Management’s evaluation template, 39 factors, each with an associated 

weight, are to be considered in conducting the evaluations, and each 

factor is to be assessed by different organizations and officials within the 

department. These organizations and officials include, among others, the 

Offices of Program Accountability and Risk Management, the Chief 

Procurement Officer, the Chief Information Officer, Systems Engineering, 

and the Chief Financial Officer; as well as the Director of Operational Test 

and Evaluation, and the Joint Requirements Council. After all of the 

offices prepare their parts of the assessment, the Office of Program 

Accountability and Risk Management is to calculate a final evaluation 

rating based on the 39 factors and their weights.

For its part, the CIO is responsible for assessing the 30 IT investments 

against 1039 of the 39 factors, which accounts for about 18 percent of the 

total assessment score. Thus, over 80 percent of the evaluation and final 

assessment score for the investments included in the evaluation 

facilitated by the Office of Program Accountability and Risk Management 

does not involve the key IT management executive—the CIO.

Moreover, DHS’s CIO was previously responsible for evaluating and 

reporting the associated risk ratings of the department’s 30 major IT 

investments on the Master Acquisition Oversight List against the criteria 

that OMB’s 2015 guidance stated CIOs may use to evaluate and report 

the risk of their programs. However, as shown in table 4, under the new 

process facilitated by the Office of Program Accountability and Risk 

 39In addition to the 10 factors that the CIO is directly responsible for assessing, the CIO 

may also assess major IT investments against 1 additional factor related to geo-political 

impacts on the investment. This factor may be assessed by any DHS office and it 

accounts for less than 1 percent of the total assessment score.
Page 31 GAO-17-284 Homeland Security IT Reform

Management, the CIO is only responsible for assessing these 

investments against one of OMB’s criteria.

Table 4: Change in Responsibility for Conducting Department of Homeland Security (DHS) Chief Information Officer (CIO) 

Risk Evaluations that Are Reported to the Information Technology (IT) Dashboard for 30 Major IT Investments 

Office of Management and 

Budget’s CIO evaluation criteria

Office primarily responsible for evaluation 

under old process (before October 2016)

Organization or official primarily 

responsible for evaluation under new 

process (after October 2016)

Risk management CIO Program Accountability and Risk Management, 

CIO, Chief Financial Officer, and Director of 

Operational Test and Evaluation 

Requirements management CIO Joint Requirements Council, Office of Systems 

Engineering, and Director of Operational Test 

and Evaluation

Contractor oversight CIO Chief Procurement Officer

Historical performance CIO Not assessed by DHS under this process

Human capital CIO Program Accountability and Risk Management

Other factors CIO CIO and any organization or official 

responsible for assessing any other factor in 

the evaluation

Source: GAO analysis of DHS documentation. | GAO-17-284.

Further, while the Office of Program Accountability and Risk Management 

is responsible for facilitating the development of the risk ratings that are 

reported to the IT Dashboard for these 30 IT investments, as of 

December 2016, according to DHS officials, OCIO was also conducting a 

separate evaluation on these investments. Specifically, OCIO officials 

stated that they have continued to conduct their own evaluations in order 

to meet OCIO’s other investment oversight responsibilities.

As such, the Under Secretary for Management’s October 2016 

assignment of responsibility for facilitating the assessment of these 

investments to the Office of Program Accountability and Risk 

Management is not only in conflict with FITARA, but also in conflict with 

guidance the Acting Deputy Under Secretary for Management issued in 

April 2015 in response to our prior recommendation to the department. 

Specifically, in March 2015,40 we reported that there were overlapping 

responsibilities and duplicative efforts between the Office of Program 

Accountability and Risk Management and the OCIO in the oversight and 

 40GAO, Homeland Security Acquisitions: DHS Should Better Define Oversight Roles and 

Improve Program Reporting to Congress, GAO-15-292 (Washington, D.C.: Mar. 12, 

2015).
Page 32 GAO-17-284 Homeland Security IT Reform

management of IT investments on the Master Acquisition Oversight List. 

We recommended in our 2015 report that DHS develop written guidance 

to clarify the roles and responsibilities of the Office of Program 

Accountability and Risk Management and OCIO for conducting oversight 

of major acquisition programs.

In response to our recommendation, in April 2015, the Acting Deputy 

Under Secretary for Management issued guidance that clarified that the 

CIO is responsible for performing the program assessments for the IT 

investments on the Master Acquisition Oversight List, which then are to 

be reported on the IT Dashboard. Accordingly, the Under Secretary for 

Management’s recent change suggests that the issue of overlapping 

responsibilities and duplicative efforts between the Office of Program 

Accountability and Risk Management and the OCIO in the oversight and 

management of certain IT investments that we raised 2 years ago has not 

yet been adequately addressed within the department.

Thus, rather than elevating the CIO’s role per the goal of FITARA, the 

recent change in DHS’s evaluation of these IT investments is achieving 

the opposite effect by reducing the CIO’s role and creating a barrier for 

this official to appropriately report investment risk ratings to the 

Dashboard. According to EBMO officials, the department’s goal is to use 

one evaluation process that covers all major IT investments in order to 

ensure consistency across all evaluations reported on the Dashboard. 

However, as of December 2016, DHS officials did not know when the 

department would begin using only one evaluation process for its major IT 

investments, or who would be responsible for those reviews under that 

single process. Until the Under Secretary for Management updates and 

implements the process that the department uses for assessing the risks 

of major IT investments to ensure that the ratings reported fully reflect the 

CIO’s assessment of each major IT investment, Congress’ and the 

public’s insight into the assessment of each major investment’s risk and 

performance will be limited.
Page 33 GAO-17-284 Homeland Security IT Reform

FITARA requires agencies to update their acquisition human capital plans 

to address how the agencies are meeting their human capital 

requirements. In particular, the act requires agencies to consider, among 

other things, establishing cross-functional groups trained in IT program 

management and IT acquisition—referred to as IT acquisition cadres.41 In 

July 2011 (prior to the enactment of FITARA), OMB’s Office of Federal 

Procurement Policy issued guidance that identified key knowledge areas 

essential for such a cadre, including, among other things, IT strategic 

planning, acquisition planning, information security requirements, risk 

management, requirements definition, and contract management.42 We 

have also previously issued a human capital guide that stresses the 

importance of federal agencies ensuring that their employees have the 

skills needed to perform effectively and achieve agency goals.43 Our 

guidance states that, among other things, federal agencies need to 

determine what skills and competencies are necessary in order to meet 

current and future challenges, assess any gaps in current skills and 

competencies, and address those gaps.

Although DHS has taken certain actions toward implementing an IT 

acquisition cadre and developing an acquisition human capital plan, the 

department has experienced challenges in fully implementing this 

FITARA provision. Specifically,

• DHS has not defined its IT acquisition cadre. While DHS updated 

its acquisition human capital plan in April 2016 to address its use of 

the procedures required by FITARA, the department faces challenges 

in strengthening its IT acquisition cadre because it has not yet 

identified the specific positions or personnel that are to be included in 

the cadre. To its credit, the department identified the number of 

acquisition personnel that it has in multiple functional areas, such as 

its project/program managers, contracting officers, and system 

engineering staff. However, it has not determined how many of those 

 41FITARA’s IT acquisition cadre provision is related to OMB’s common baseline section P, 

to develop and strengthen the IT workforce.

42OMB, Office of Federal Procurement Policy, Guidance for Specialized Information 

Technology Acquisition Cadres (Washington, D.C.: July 13, 2011).

43GAO, Human Capital: A Guide for Assessing Strategic Training and Development 

Efforts in the Federal Government, GAO-04-546G (Washington, D.C.: Mar. 1, 2004).

DHS Faces Challenges in 

Developing and 

Strengthening Its IT 

Acquisition Cadre
Page 34 GAO-17-284 Homeland Security IT Reform

staff are knowledgeable in IT investment management and whether 

they should be considered a part of the IT acquisition cadre.

The department also reported in its April 2016 acquisition human 

capital plan that directors and project/program managers within OCIO 

are required to maintain appropriate certifications to oversee IT 

acquisitions. However, it has not determined whether this group of 

workforce professionals has the specialized skills and knowledge 

needed in all of the areas outlined in OMB’s Office of Federal 

Procurement Policy’s guidance.

EBMO officials told us that they hope to define the entire IT 

acquisition cadre through a survey and/or skills assessment during 

fiscal year 2017; however, specific plans for doing so had not been 

established.44 Until the CIO establishes time frames and implements a 

plan for (1) identifying the specific staff or positions currently within its 

IT acquisition cadre; and (2) assessing whether these staff and 

positions address all of the specialized skills needed, as outlined in 

the Office of Federal Procurement Policy’s cadre guidance, the 

department risks not having the critical skills needed to effectively 

acquire IT services. In addition, the department will continue to be 

challenged in its ability to meet FITARA’s intent of making timely 

progress toward developing and strengthening its IT acquisition cadre.

• DHS lacks clarity on the acquisition skills needed to support its 

new IT delivery model. DHS’s IT Strategic Plan for fiscal years 2015 

through 2018 calls for a paradigm shift in the department’s IT delivery 

model—from acquiring IT assets to acquiring services, and acting as 

a service broker (e.g., an intermediary between the purchaser of a 

service and the seller of that service). According to OCIO officials, this 

shift will require a significant change in the skillsets of DHS’s 

employees.

However, the department has faced challenges in implementing this 

new IT delivery model because it has not identified its future skillset 

needs or determined the gaps, if any, between its employees’ current 

skillsets and its future needs. DHS awarded a workforce management 

 44In December 2016, DHS approved an instruction that will require major acquisition 

programs, which include both IT and non-IT programs, to develop and annually update 

acquisition program management staffing plans. These plans are intended to identify 

sufficient numbers of trained and qualified acquisition program management staff to 

effectively manage the department’s level one and two major acquisition programs. We 

recently reported on this new process. See Homeland Security Acquisitions: Earlier 

Requirements Definition and Clear Documentation of Key Decisions Could Facilitate 

Ongoing Progress, GAO-17-346SP (Washington, D.C.: Apr. 6, 2017).
Page 35 GAO-17-284 Homeland Security IT Reform

contract in July 2016 to, among other things, assist with the 

implementation of the new IT delivery model at headquarters, 

including defining future IT skill sets needed and conducting a skills 

gap analysis. However, while EBMO officials stated in December 

2016 that they would conduct these activities by the end of fiscal year 

2017, the department did not have a specific plan for when it would 

identify its future IT skillset needs, or analyze and address the skills 

gaps resulting from the new delivery model.

Until the CIO establishes time frames and implements a plan for (1) 

identifying future IT skillset needs to support DHS’s new delivery 

model, (2) conducting a skills gap analysis, and (3) resolving any skills 

gaps identified, the department will continue to be challenged in its 

ability to ensure that it has the skillsets necessary to perform the new 

responsibilities associated with the shift.

In response to FITARA, DHS has taken several key steps toward 

improving the department-level CIO’s role in IT acquisitions, including 

updating the department’s acquisition governance process and 

associated guidance to require greater participation by the CIO. However, 

additional actions are needed by the CIO. Specifically, related to the 

department’s incomplete implementation of its action plan to use the 

updated DHS TechStat process to provide support to failing or troubled 

programs, until the CIO finalizes the department’s TechStat policy, DHS 

will be limited in its ability to help such programs. In addition, the DHS 

CIO’s lack of review of certain contracts and agreements puts the 

department at risk of awarding duplicative or unnecessary contracts and 

agreements. As such, until the CIO updates the department’s IT 

Acquisition Review governance process to increase the number of 

contracts and agreements (associated with both major and non-major 

investments) that are reviewed by the CIO and appropriate delegates, the 

CIO will continue to have limited visibility into the department’s planned IT 

expenditures.

Further, the department’s lack of knowledge about the specific staff or 

positions in its IT acquisition cadre; the skillsets it currently has; and the 

skills it needs to implement its new IT delivery model, reduces OCIO’s 

ability to ensure that it has all of the skillsets required. Without the CIO 

establishing time frames and implementing a plan for (1) identifying the 

specific staff or positions currently within its IT acquisition cadre; and (2) 

assessing whether these staff and positions address all of the specialized 

skills needed, as outlined in the Office of Federal Procurement Policy’s 

Conclusions
Page 36 GAO-17-284 Homeland Security IT Reform

cadre guidance, the department risks not having the critical skills needed 

to effectively acquire IT services. Moreover, without the CIO establishing 

time frames and implementing a plan for (1) identifying future IT skillset 

needs to support DHS’s new delivery model, (2) conducting a skills gap 

analysis, and (3) resolving any skills gaps identified, the department will 

continue to be challenged in its ability to ensure that it has the skillsets 

necessary to perform the new responsibilities associated with the shift.

DHS’s Under Secretary for Management has also taken actions aimed at 

implementing FITARA by updating the department’s acquisition policies 

and guidance documents. However, until the Under Secretary for 

Management makes additional updates to these acquisition policies and 

guidance documents to be consistent in identifying that the DHS CIO is to 

certify investments’ incremental development activities (as required by 

one of the department’s FITARA action plans), the CIO is at risk of not 

being included in important investment oversight activities.

In addition, the contracts and interagency agreements for which DHS 

officials could not determine whether they were associated with a major 

investment is concerning. Until the Under Secretary for Management 

updates DHS headquarters’, Customs and Border Protection’s, and the 

U.S. Coast Guard’s processes to track, for all contracts and agreements, 

the IT investment with which each is associated (as applicable), the 

Under Secretary has limited assurances that these contracts and 

agreements will be reviewed by the appropriate officials. Lastly, the Under 

Secretary for Management’s recent policy change that limited the CIO’s 

input into risk ratings for certain major IT investments has devalued the 

CIO’s role. Until the Under Secretary updates and implements the 

process that the department uses for assessing the risks of major IT 

investments to ensure that the ratings reported to the IT Dashboard fully 

reflect the CIO’s assessment of each major IT investment, Congress’ and 

the public’s insight into the assessment of each major investment’s risk 

and performance will be limited.
Page 37 GAO-17-284 Homeland Security IT Reform

To ensure that DHS effectively implements FITARA, we are making 

seven recommendations to the Secretary of Homeland Security.

Specifically, we are recommending that the Secretary of Homeland 

Security direct the Under Secretary for Management to direct the Chief 

Information Officer to take the following actions:

• finalize the department’s TechStat policy;

• update the department’s IT Acquisition Review governance process to 

increase the number of contracts and agreements (associated with 

both major and non-major investments) that are reviewed by the CIO 

and appropriate delegates;

• establish time frames and implement a plan for (1) identifying the 

specific staff or positions currently within the department’s IT 

acquisition cadre; and (2) assessing whether these staff and positions 

address all of the specialized skills and knowledge needed, as 

outlined in OMB’s Office of Federal Procurement Policy’s guidance for 

developing an IT acquisition cadre; and

• establish time frames and implement a plan for (1) identifying the 

department’s future IT skillset needs as a result of DHS’s new delivery 

model, (2) conducting a skills gap analysis, and (3) resolving any skills 

gaps identified.

Further, we are recommending that the Secretary of Homeland Security 

direct the Under Secretary for Management to

• update the department’s acquisition policies and guidance to be 

consistent in identifying that the DHS CIO is to certify investments’ 

incremental development activities;

• update DHS headquarters’, Customs and Border Protection’s, and 

U.S. Coast Guard’s processes to track, for all contracts and 

agreements, the IT investment with which each is associated (as 

applicable); and

• update and implement the process DHS uses for assessing the risks 

of major IT investments to ensure that the CIO rating reported to the 

Dashboard fully reflects the CIO’s assessment of each major IT 

investment.

Recommendations for 

Executive Action
Page 38 GAO-17-284 Homeland Security IT Reform

DHS provided written comments on a draft of this report, which are 

reprinted in appendix II. In its comments, the department concurred with 

all seven of our recommendations and provided estimated completion 

dates for implementing each of them. For example, the department stated 

that, by June 30, 2017, its headquarters OCIO intends to develop a 

department-level plan for identifying the staff included in DHS’s IT 

acquisition cadre. Further, it said the DHS OCIO plans to require the 

components to develop associated component-level plans for identifying 

their IT acquisition cadres. 

In response to our recommendation that the Under Secretary for 

Management update DHS headquarters’ processes to track, for all 

contracts and agreements, the IT investment with which each is 

associated (as applicable), the department described recent actions that it 

had taken to implement this recommendation. Specifically, it stated that 

OCIO had updated the tool used as part of the IT Acquisition Review 

governance process to require that the contract number be provided for 

all acquisitions reviewed by headquarters OCIO. The department further 

noted that the tool also links each acquisition to the associated funding 

investment. The department reported that these updates were completed 

on January 31, 2017. We will follow-up with the department to obtain 

documentation demonstrating that the tool tracks this information.

In response to oral comments that were also provided by DHS officials on 

a draft of this report, we clarified one of our recommendations. The 

department concurred with this clarified recommendation in its written 

comments.

In addition, we received technical comments from DHS headquarters and 

component officials, which we have incorporated, as appropriate.

We are sending copies of this report to the appropriate congressional 

committees, the Secretary of Homeland Security, and other interested 

parties. In addition, this report is available at no charge on the GAO 

website at http://www.gao.gov.

Agency Comments 

and Our Evaluation
Page 39 GAO-17-284 Homeland Security IT Reform

Should you or your staffs have any questions on information discussed in 

this report, please contact Carol Harris at (202) 512-4456 or 

Harriscc@gao.gov. Contact points for our Offices of Congressional 

Relations and Public Affairs may be found on the last page of this report. 

GAO staff who made major contributions to this report are listed in 

appendix III.

Carol C. Harris

Director, Information Technology Acquisition Management Issues
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 40 GAO-17-284 Homeland Security IT Reform

The table below lists DHS’s 131 Federal Information Technology 

Acquisition Reform Act (FITARA) action plans and the respective Office of 

Management and Budget (OMB) common baseline sections1 with which 

they are associated. Additionally, the table lists DHS’s planned 

implementation dates for each of the department’s FITARA action plans, 

as of April 2016, and identifies the 31 action plans that were included in 

GAO’s review.

Table 5: The Department of Homeland Security’s (DHS) Action Plans to Implement the Federal Information Technology 

Acquisition Reform Act (FITARA) and Their Associated Office of Management and Budget (OMB) Common Baseline Sections 

and Planned Implementation Dates

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

A. Visibility of 

information 

technology (IT) 

resource 

plans/decisions 

to Chief 

Information 

Officer (CIO)

1. Document and model current processes and supporting requirements for planning, 

programming, and budget phases.

November 2015

2. Identify and review relevant policies that impact processes, roles, and 

responsibilities within DHS’s planning, programming, and budget phases.

November 2015

3. Identify gaps and opportunities in current processes to address OMB common 

baseline requirements.

November 2015

4. Collaborate with appropriate stakeholders to develop process models and 

supporting list of requirements for the target planning, programming, and budget 

phases.

December 2015

5. Draft content updates to ensure relevant policies are compliant with OMB common 

baseline requirements.

March 2016

6. Ensure updates to policies are approved by relevant parties and submit 

updated/approved policies to OMB.

March 2016 X

(1)

7. Document and implement the updated and agreed upon processes for the planning, 

programming, and budgeting phases to ensure the CIO has visibility into IT resource 

plans and decisions.

March 2016 X

(2)

B. CIO role in 

pre-budget 

submission for 

programs that 

include IT and 

overall portfolio

8. Document and model current processes and supporting requirements for the 

planning, programming, and budget phases.

November 2015

9. Identify and review relevant policies that impact processes, roles, and 

responsibilities within each planning, programming, and budget phase.

November 2015

10. Identify gaps and opportunities in current processes to address OMB common 

baseline requirements.

November 2015

 1

OMB’s FITARA implementation guidance outlined roles and responsibilities of agency 

Chief Information Officers and other senior agency officials related to 17 topic areas, 

referred to as common baseline sections.

Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform 
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 41 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

11. Collaborate with appropriate stakeholders to develop process models and 

supporting list of requirements for the target planning, programming, and budget 

phases.

December 2015

12. Document and update the DHS IT portfolio management processes to align with 

the updated planning, programming, and budgeting phases to assess the use of ITrelated resources.

February 2016 X

(3)

13. Document and implement the updated processes for the planning, programming, 

and budgeting phases to ensure CIO has a role in pre-budget submission.

March 2016 X

(4)

14. Draft content updates to ensure relevant policies are compliant with OMB common 

baseline requirements.

March 2016

15. Ensure content updates to policies are approved by all relevant parties and submit 

updated/approved policies to OMB.

March 2016 X

(5)

C. CIO role in 

planning 

program 

management

16. Document and model current processes and supporting requirements for the 

planning, programming, and budgeting phases.

November 2015 X

(6)

17. Identify and review relevant policies that impact processes, roles, and 

responsibilities within each planning, programming, and budgeting phase.

November 2015

18. Complete an analysis of the current state of activities during the first phase of the 

acquisition life-cycle (when a capability need is identified).

November 2015 X

(7)

19. Identify gaps and opportunities in current processes to address OMB common 

baseline requirements.

November 2015

20. Formalize the endorsement or approval process to incorporate CIO review, 

assessment, and acknowledgement of appropriate artifacts in the Acquisition Lifecycle 

Framework.

December 2015 X

(8)

21. Collaborate with appropriate stakeholders to develop process models and 

supporting list of requirements for the target planning, programming, and budgeting 

phases.

December 2015

22. Update language within DHS’s acquisition management directive to fully align with 

FITARA and OMB’s common baseline.

December 2015 X

(9)

23. Develop a proposed framework for streamlining activities in the first phase of the 

acquisition life-cycle.

December 2015 X

(10)

24. Conduct a survey to assess the appropriate level of agile adoption across DHS. January 2016

25. Complete an implementation recommendation plan for streamlining and reporting 

on activities that occur in the first phase of the acquisition life-cycle.

February 2016 X

(11)

26. Draft content updates to ensure relevant policies are compliant with OMB common 

baseline requirements.

March 2016

27. Ensure content updates to policies are approved by all relevant parties and submit 

updated policies to OMB.

March 2016 X

(12)
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 42 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

28. Document and implement the updated and agreed upon processes for planning, 

programming, and budgeting phases to ensure CIO has a role in program planning.

May 2016 X

(13)

29. DHS will pilot with selected programs a streamlined approach to the process for the 

first phase of the acquisition life-cycle (when a capability need is identified).

May 2016

D. CIO review 

and approval of 

major IT 

investment 

portion of 

budget request

30. Document and model current processes and supporting requirements for the 

planning, programming, and budgeting phases.

November 2015

31. Identify and review relevant policies that impact process steps, roles, and 

responsibilities of the planning, programming, and budgeting phases to better support 

analysis and approval of the IT funding portion of the budget.

November 2015

32. Develop appropriate processes to support the review and approval of the IT 

investment portion of the budget request, resulting in a joint affirmation statement by 

the CIO and Chief Financial Officer.

November 2015

33. Identify gaps and opportunities in current processes to address OMB common 

baseline requirements.

November 2015

34. Collaborate with appropriate stakeholders to develop process models and 

supporting list of requirements for the target planning, programming, and budgeting 

phases.

December 2015

35. Work with the Joint Requirements Council to determine how to leverage the intake 

for capability requirements to identify new major IT requests.

January 2016

36. Coordinate the integration points between the offices of the CIO and Chief 

Financial Officer to ensure that CIO has appropriate review and approval of the IT 

investment portion of the budget request.

March 2016

37. Document and implement the updated and agreed upon processes for planning, 

programming, and budgeting phases to ensure the CIO has approval of agency IT 

budget submission.

March 2016 X

(14)

38. Draft content updates to ensure relevant policies are compliant with OMB common 

baseline requirements.

March 2016

39. Ensure content updates to policies are approved by all relevant parties and submit 

updated policies to OMB.

March 2016 X

(15)

40. Vet program health status and the relationship of budgets under consideration to a 

plan to resolve unsatisfactory status that has been similarly vetted and approved at the 

Component level.

March 2016

41. Validate processes for approval of major IT investment requests. March 2016

E. Ongoing CIO 

engagement 

with program 

managers

42. The IT Program/Project Manager Center of Excellenceb will be established as a 

cross-functional team to gather appropriate best practices, determine pain points, and 

address these pain points.

November 2015 X

(16)

43. The IT Program/Project Manager Center of Excellence will develop IT performance 

metrics to ensure programs are meeting objectives.

November 2015 X

(17)

44. Leverage the updated DHS TechStatc process to provide support to failing or 

troubled programs.

November 2015 X

(18)
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 43 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

45. Update the process to ensure the IT Program/Project Manager Center of 

Excellence reviews IT performance metrics and strategies.

December 2015 X

(19)

46. Develop requirements to validate the IT performance metrics. December 2015 X

(20)

47. Initiate process to update the policy on IT Integration and Management to reflect 

the CIO’s roles and responsibilities for IT performance metric.

December 2015

48. Coordinate and harmonize the IT program assessment and engagement functions 

between the office of the CIO and the office of Program Accountability and Risk 

Management.

December 2015

49. Create IT program management standard operating procedures and best practices 

guides.

March 2016 X

(21)

F. Visibility of IT 

planned 

expenditure 

reporting to 

CIO

50. Identify gaps in current process where OMB common baseline requirements are 

not satisfied and/or do not align with overarching PortfolioStat policy and guidance.

November 2015

51. Collaborate with stakeholders to develop process models and supporting list of 

requirements for the target review and reporting of IT budget execution to support 

PortfolioStat reporting requirements.

December 2015

52. Identify relevant policies that impact process steps, roles, and responsibilities for 

Chief Financial Officer budget execution reporting and PortfolioStat budget execution 

reporting requirements.

January 2016

53. Document current capabilities for collecting and validating planned expenditure 

reporting for IT investments.

February 2016

54. Document proposed methods to capture planned expenditures for IT investments. February 2016

55. Document requirements for collecting and validating planned expenditure reporting 

for IT investments.

February 2016

56. Identify gaps in current capabilities where OMB common baseline requirements are 

not satisfied.

February 2016

57. Update policy, guidance, and documentation to collect the appropriate amount of 

information needed to better support analysis, planning, and recommendations related 

to IT budget execution.

March 2016

58. Ensure content updates to policies are approved by all relevant parties and submit 

updated policies to OMB.

March 2016

59. Update guidance and documentation to collect the appropriate amount of 

information needed to better support analysis, planning, and recommendations related 

to planned IT expenditures.

March 2016

60. Implement the updated and agreed upon processes and methods for planned 

expenditure reporting for IT investments.

April 2016

61. Implement the updated and agreed upon processes for IT budget execution 

reporting.

April 2016
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 44 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

G. CIO defines 

IT processes 

and policies

62. Identify relevant process steps, roles, and responsibilities within each review phase 

of the systems engineering life-cycle for CIO certification.

November 2015

63. Review the Technical Review Guide to ensure it includes the CIO’s certification of 

incremental development or scope of the systems engineering life-cycle reviews to 

ensure that the process sufficiently addresses various IT resource categories.

November 2015

64. Develop process models and list of requirements for CIO certification of reviews 

related to IT initiatives.

November 2015 X

(22)

65. Verify that changes in process models reflect updates to relevant policies. November 2015

66. Submit approved process models and supporting guidance. December 2015 X

(23)

67. Incorporate the agile and systems engineering life-cycle guidebooks and 

instructions into DHS’s acquisition management directive.

December 2015 X

(24)

68. Incorporate CIO certification of incremental development or scope of the systems

engineering life-cycle reviews to ensure that the process sufficiently addresses various 

IT resource categories.

December 2015 X

(25)

69. Conduct survey of programs to assess level of agile adoption across DHS. March 2016

H. CIO role on 

program 

governance 

boards

70. Augment the list of IT governance boards on which the CIO participates with a 

description of the authority, scope, and chief “X” officerd membership of those boards.

November 2015

71. Identify all IT governance boards on which the CIO should participate in 

accordance with FITARA.

March 2016

72. Update existing processes and approved policies to ensure CIO reviews major 

program acquisition plans for programs that include IT resources.

March 2016

73. Recommend charter amendments to non-compliant boards to make the CIO a 

voting member.

May 2016

I. Shared 

acquisition and 

procurement 

responsibilities 

with the Chief 

Acquisition 

Officer and 

Chief Financial 

Officer

74. Identify where supplemental guidance is needed for federal acquisition certification. November 2015

75. Document existing process model to ensure that IT acquisitions are led by 

personnel with appropriate federal acquisition certification, including specialized IT 

certification, as appropriate.

November 2015

76. Ensure that DHS’s acquisition management directive is updated as appropriate to 

reflect changes in the CIO roles and responsibilities and aligns with FITARA guidelines.

November 2015

77. Identify gaps in current process for acquisition strategy plans where OMB common 

baseline requirements are not satisfied.

December 2015

78. Identify relevant policies that impact process steps, roles, and responsibilities for 

life-cycle cost estimate review board process.

December 2015

79. Develop procurement innovator designation/recognition program to recognize 

individuals choosing to fulfill certain learning events.

March 2016

80. Ensure content updates to policies for acquisition strategy plans are approved by 

stakeholders and in compliance with related OMB policy.

March 2016
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 45 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

81. Ensure content updates to policies for the life-cycle cost estimate review board 

process are approved by all stakeholders and submit updated policies to OMB.

March 2016

82. Identify relevant policies that impact process steps, roles, and responsibilities for 

acquisition plans.

March 2016

83. Determine and amend/issue procurement policy and oversight guidance and 

procedures.

March 2016

84. Provide training to IT project and program managers in support of the achievement 

of program manager-IT specialization.

March 2016

85. Further establish the commodity manager structure, consistent with the 

government-wide category management and strategic sourcing initiatives.

March 2016

86. Develop and deploy more learning cafe events. March 2016

87. Identify gaps in current process for life-cycle cost estimate review board process 

where OMB common baseline requirements are not satisfied.

May 2016

88. Update existing processes to include the office of the CIO through a life-cycle cost 

estimate review board process. 

May 2016

89. Document existing process models and supporting list of requirements for life-cycle 

cost estimates.

May 2016

90. Implement the updated and agreed upon processes to ensure CIO review of 

strategy and acquisition plans, including incremental acquisition and development 

principles.

June 2016

91. Update DHS’s investment management system to identify IT specialization. December 2016

92. Enhance acquisition and systems engineering life-cycle guidance to determine 

appropriate visibility and analysis of IT cost elements, strategy and acquisition plans, 

and strategy to determine that the CIO has appropriate review, governance, and 

oversight of IT spending and implementation of IT policy.

May 2016

93. Establish a draft tailored version of a systems engineering life-cycle path for nonmajor IT acquisitions for components and headquarters that do not have a published 

systems engineering life-cycle or equivalent.

May 2016
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 46 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

I. Shared 

acquisition and 

procurement 

responsibilities 

with the Chief 

Acquisition 

Officer and 

Chief Financial 

Officer, and

K. CIO review 

and approval of 

acquisition 

strategy and 

acquisition 

plan)e

94. Ensure content updates to policies for acquisition plan review board process are 

approved by all stakeholders and submit updated policies to OMB for review. 

March 2016

J. CIO role in 

recommending 

modification, 

termination, or 

pause of IT 

projects or

initiatives

95. Identify gaps in current TechStat process where OMB common baseline 

requirements are not satisfied.

November 2015

96. Identify relevant policies that impact process steps, roles, and responsibilities within 

TechStat.

November 2015

97. The CIO will initiate TechStat reviews for chronically red programs and as a 

member of the acquisition review board, will make recommendations to modify, 

terminate, or pause IT based on criteria identified in FITARA.

February 2016

98. Ensure content updates to policies are approved by all stakeholders and submit 

updated policies to OMB.

March 2016

99. Initiate updates to the TechStat policy to reflect FITARA requirements and 

corresponding process documentation to properly align with all business controls and 

responsibilities for every relevant role included within the TechStat process.

March 2016

100. Develop specific criteria and concept of operations, and train component CIO 

staff, to conduct TechStat accountability sessions.

September 2016

K. CIO review 

and approval of 

acquisition 

strategy and 

acquisition plan

101. Review and document the existing chief procurement officer process for 

acquisition plan reviews.

November 2015

102. Determine what procurement policy/oversight changes, if any, need to be made. November 2015

103. Perform a threshold analysis to identify and define “substantial change” and 

“significant contract.”

February 2016

104. Identify processes to reflect CIO participation in the review of acquisition plans of 

any investments that include IT resources and incorporate CIO signature authority for 

IT strategy/acquisition plans. The offices of the CIO and Chief Procurement Officer will 

update relevant policies to ensure compliance with OMB common baseline.

March 2016

105. Develop specific criteria, concept of operations, and training documents to support 

the CIO review and signatory requirements for acquisition plans.

June 2016

106. Components’ heads of contracting activity will include component CIO review and 

approval as part of the approval procedures for acquisition plans below the chief 

procurement officer review thresholds.

June 2016
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 47 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

L. CIO approval 

of 

reprogramming

107. The office of the CIO will coordinate with office of the Chief Financial Officer’s 

budget division to develop and document an approval process for coordination for 

reprogramming.

November 2015

108. Identify relevant policies that impact process steps, roles, and responsibilities 

within IT reprogramming and transfer request process.

December 2015

109. Revise relevant documentation and processes to reflect CIO approval of 

components’ requests for reprogramming and transfer requests of IT resources.

March 2016 X

(26)

110. Ensure content updates to policies are reviewed by all stakeholders and submit 

updated policies to OMB.

March 2016 X

(27)

M. CIO 

approval of the 

appointment of 

new bureau 

CIOs

DHS rated itself as fully meeting this common baseline area and did not identify any 

action plans for it.

N. CIO 

participation in 

bureau CIOs’ 

evaluations

111. Provide guidance during the performance appraisal cycle that will provide 

component Line of Businessf(e.g., CIO) input into the assessments.

November 2015 X

(28)

112. The offices of the CIO and chief human capital officer will collaborate to include 

evaluating rating officials and reviewing officials in the provided survey report.

November 2015

113. Develop an executive-level leadership competency applicable to CIO employees 

in certain performance plans.g November 2015 X

(29)

114. Incorporate this competency in certain CIO performance plans, amend 

performance system descriptions as necessary, and submit these amendments to the 

Office of Personnel Management.g

January 2016 X

(30)

115. Develop a scorecard to evaluate the effectiveness of the IT competency in 

performance plans.

March 2016

116. Conduct a survey to determine the effectiveness of the IT competency. June 2016

O. CIO and 

Chief Human 

Capital Officer 

develop bureau 

IT leadership 

directory

117. Include evaluating rating officials and reviewing officials in the provided survey 

report.

November 2015 X

(31)

P. CIO 

develops and 

strengthens IT 

workforce

118. Identify existing course and training inventory (i.e., sponsors and course 

offerings).

November 2015

119. Work collaboratively with stakeholders to provide commercial off-the-shelf training 

targeted to IT acquisitions.

December 2015

120. Identify course gaps for employee skillsets enhancement. February 2016

121. Identify existing employee skillsets (acquisition and IT specialization) per FITARA 

guidance and policies.

February 2016
Appendix I: The Department of Homeland 

Security’s (DHS) Action Plans to Implement 

Information Technology Acquisition Reform

Page 48 GAO-17-284 Homeland Security IT Reform

OMB common 

baseline 

section

DHS action plana DHS’s planned 

implementation 

date, as of 

April 2016

Included 

in GAO’s 

review 

(number 

in GAO’s 

review)

122. The office of the CIO will continue to collaborate with the office of the chief 

procurement officer on the IT Supplement to the DHS annual acquisition human capital

plan

March 2016

123. Align existing course inventory to acquisition certifications and IT specialization. May 2016

124. Identify agency mission training needs per FITARA guidance and policies. May 2016

125. Identify strategy, roadmaps, and metrics to improve training and employee 

skillsets and fulfill gaps.

September 2016

126. Report out on metrics. 2nd quarter of 

fiscal year 2018

127. Execute strategy and roadmap. 4th quarter of 

fiscal year 2017

128. Develop a workforce planning process for assessment of current IT skills. 4th quarter of 

fiscal year 2017

129. Further refine the DHS IT competency model and identify training opportunities 

that will enhance IT staff development at multiple levels.

4th quarter of 

fiscal year 2017

130. Further develop self-assessment tools used to streamline acquisition of Federal 

Acquisition Certification for Program and Project Managers IT competencies.

4th quarter of 

fiscal year 2017

131. Utilize the workforce planning process to assess skills and employ Digital 

Services staff.

4th quarter of 

fiscal year 2017

Q. CIO reports 

to agency head 

(or Deputy/ 

Chief Operating 

Officer)

DHS rated itself as fully meeting this common baseline area and did not identify any 

action plans for it.

Total 131 31

Source: GAO based on DHS’s April 2016 update to its FITARA implementation self -assessment. | GAO-17-284.

a

For the purposes of this report, we slightly modified and/or condensed the wording of certain DHS 

action plans.

b

DHS’s IT Program/Project Manager Center of Excellence is a cross-functional team created to 

provide guidance and assistance in the management of IT programs and projects.

c

A TechStat is a face-to-face, evidence-based review of an IT program with DHS headquarters, 

component leadership, and OMB, as appropriate.

d

Chief “X” officer is a generic term for job titles where “X” represents a specific specialized position 

that serves the entire organization, such as the chief information officer, chief financial officer, or chief 

human capital officer.

e

DHS documentation stated that this action plan was applicable to both sections I and K of OMB’s 

common baseline.

f

A Line of Business is a specific operating unit or shared service within DHS, such as financial 

management or human resources. DHS’s Line of Business chiefs include, among others, the CIO and 

chief financial officer.

g

According to Enterprise Business Management Office officials, the action plans associated with the 

executive-level leadership competency were focused only on the component CIOs that were part of 

the Senior Executive Service pay plan, not those that were part of the General Schedule pay plan.
Appendix II: Comments from the Department 

of Homeland Security

Page 49 GAO-17-284 Homeland Security IT Reform

Appendix II: Comments from the Department 

of Homeland Security
Appendix II: Comments from the Department 

of Homeland Security

Page 50 GAO-17-284 Homeland Security IT Reform
Appendix II: Comments from the Department 

of Homeland Security

Page 51 GAO-17-284 Homeland Security IT Reform
Appendix II: Comments from the Department 

of Homeland Security

Page 52 GAO-17-284 Homeland Security IT Reform
Appendix III: GAO Contact and Staff 

Acknowledgments

Page 53 GAO-17-284 Homeland Security IT Reform

Carol C. Harris at (202) 512-4456 or HarrisCC@gao.gov

In addition to the contacts named above, the following staff also made 

key contributions to this report: Shannin O’Neill (Assistant Director); Emily 

Kuhn (Analyst-in-Charge); Mathew Bader; Ronalynn (Lynn) Espedido; 

Rebecca Eyler; Javier Irizarry; and Corey Rodriguez.

Appendix III: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(100707)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.