Audit Report 

U.S. Department of Energy 

Office of Inspector General 

Office of Audit Services 

Resolution of Significant Finding 

Investigation Recommendations 

DOE/IG- November 2002 

Facility Contractor Acquisition and 

Management of Information 

Technology Hardware 

DOE/IG-0768 June 2007 
Department of Energy 

Washington, DC 20585 

June 22, 2007 

MEMORANDUM FOR THE SECRETARY 

FROM: +e Greg ry . ne man 

Inspector General 

SUBJECT: INFORMATION: Audit Report on "Facility Contractor 

Acquisition and Management of Information Technology 

Hardware" 

BACKGROUND 

The Department of Energy relies heavily on information technology (IT) to accomplish 

its science, weapons, energy supply and environmental mission objectives. In the past 

three years, the Department has spent more than $400 million on IT hardware to facilitate 

these efforts. Items routinely acquired by the Department included desktop and laptop 

computers and associated peripherals, personal digital assistants, and network 

infrastructure equipment. 

Prior Office of Inspector General audits have disclosed nunlerous problems with the 

Department's n~anagement of IT resources. For example, our report on Management of 

the Department's Desktop Computer Software Enterprise License Agreements (DOEIIG071 8, January 2006) found that the Department spent more than necessary to acquire and 

maintain software due to the lack of a complex-wide acquisition and maintenance 

strategy. Similarly, our review of Information Technology Support Services at the 

Depurtment of Energy's Opemting Contrirctors (DOEIIG-0725, April 2006) determined 

that, had a complex-wide acquisition strategy been used to obtain support services, the 

Department could have achieved significant savings. Because of its sizeable investment 

in this area, we initiated this audit to determine whether the Department had effectively 

managed its acquisition and control of IT hardware. 

RESULTS OF AUDIT 

Our review established that certain Department of Energy facility contractors had not 

adequately managed the acquisition and control of IT hardware. A nun~ber of contractors 

had not consistently taken advantage of opportunities to reduce acquisition and support 

costs, addressed security concerns related to certain aging systems, or ensured that 

accountability was maintained over sensitive computers and devices. In particular, we 

observed that: 

Five of the seven sites we reviewed had not developed or fully implemented 

hardware specifications and brand standards for computers and related 

peripherals, directly contributing to unnecessary expenditures of at least 

$4.7 million over a three-year period; 
Widely divergent hardware replacement cycles contributed to problems ranging 

from supporting outdated computers to replacing equipnient before the end of its 

service life; 

Sites had not always taken advantage of opportunities to achieve volume 

purchase discounts. For example, one contractor acquired computers from 96 

different vendors - many without competition; and, 

Several sites did not track certain sensitive IT equipment, including laptop 

computers and personal digital assistants. 

These problems occurred because the Department had not developed a coordinated 

approach to IT hardware acquisition, nianagenient, and control. In particular, the 

Department had not implemented corporate-level standards for hardware nor had it 

required contractors to adopt or adhere to locally-developed standards. Acquisition 

strategies for IT hardware, designed to take advantage of savings available through 

volume purchases or consolidated buying opportunities, had not been deployed. In 

addition, the sites reviewed had not established centralized mechanisms for approving 

purchases or adopted a consistent and effective approach for maintaining accountability 

over IT hardware. 

Without improvenients in the acquisition and control of IT hardware, issues such as those 

identified during our review could result in the unnecessary expenditure of funds to the 

detriment of program operations. The failure to maintain accountability over computers 

and other sensitive assets could also increase the risk of misuse, theft, or other diversion 

of Government property. Proper inventory controls are critical to maintaining effective 

accountability over information technology hardware, particularly in light of the recent 

disclos~~re that the Department could not account for over 1,400 laptops either lost, stolen 

or misplaced over the past six years. 

To its credit, the Department had taken action to establish hardware standards at 

Headquarters through its Department of Energy Common Operating Environment. In 

addition, we noted that certain contractors have worked together to establish purchasing 

agreements for selected items of IT hardware. These are positive steps, but additional 

action is required. As such, we made several recommendations designed to increase the 

efficiency and effectiveness of the Department's hardware acquisition and management 

process. 

MANAGEMENT REACTION 

Management concurred that action is necessary to improve the Department's practices for 

acquiring commodity-type IT hardware and indicated that it pIans to take certain actions 

relative to the recommendations in our report. In particular, management indicated that 

one of the actions to be taken in response to our report will be to develop guidance that 

encourages aggregation of requirements for IT hardware intended to lead to cost savings. 
In addition, a review will be performed to determine the need for strengthened 

requirements over IT asset management. 

In separate comments, the National Nuclear Security Administration (NNSA) indicated 

that it did not concur with several of our recommendations; however, it provided details 

of alternative actions that will be taken which are consistent with our recommendations. 

For example, NNSA management noted that its facility contractors recently agreed to 

work cooperatively using common procurement tools in the development of complexwide acquisition vehicles for comnion commodities. In addition, minimum hardware 

configurations developed by the Department will be made available to contractors for 

their consideration. Management's comments are included in Appendix 4. 

Attachment 

cc: Deputy Secretary 

Acting Administrator, National Nuclear Security Administration 

Acting Under Secretary for Energy 

Under Secretary for Science 

Chief Information Officer 

Chief of Staff 
REPORT ON FACILITY CONTRACTOR ACQUISITION AND 

MANAGEMENT OF INFORMATION TECHNOLOGY HARDWARE 

TABLE OF 

CONTENTS 

Acquisition and Manaqement of IT Hardware 

Details of Finding .................................................................................................... 1 

Recommendations and Comments .............................................................................. 7 

Appendices 

I . Objective, Scope, and Methodology ...................................................................... 9 

2. Potential Savings .................................................................................................. 1 1 

3. Prior Reports ....................................................................................................... 12 

4. Management Comments ...................................................................................... 13 
Acquisition and Manaqernent of IT Hardware 

Hardware Acquisition The Department of Energy's (Department) facility 

and Control contractors had not always adequately managed the 

acquisition and accountability of its infornlation technology 

(IT) hardware. Although critical to controlling acquisition 

and support costs, we noted that standards for hardware 

specifications and brands, acquisition practices, and 

equipment replacement rates had not been developed or 

were not completely effective. Controls over 

accountability for certain conlputers and other sensitive 

equipment were also inadequate. 

Hardware Standards 

Facility contractors at the seven sites reviewed had not 

always developed or fully implemented standard hardware 

specifications - such as brand, processing speed, and 

memory capacity - for computers and related peripherals. 

As demonstrated by a recent Department of Defense 

(DOD) initiative, decreasing the number of hardware 

brands and configurations can result in significant 

reductions in acquisition and support costs (cost avoidance 

at DOD of $53 nillion in 2004 and 2005). 

At five of seven sites, brand standards had not been fully 

developed for conlputers and peripherals. Absent such 

standards - based on our review of purchases made during 

Fiscal Years (FY) 2003 through 2005 - we found that 

desktop and laptop computers were acquired from at least 

70 different manufacturers at the seven sites reviewed. For 

example, although Lawrence Berkeley National Laboratory 

(Berkeley) established recommended brands for desktop 

and laptop conlputers, purchasers did not follow the 

recommendation for about 62 percent of the computers 

acquired during FY 2005. As generally accepted by 

industry officials, elimination of multiple brands of IT 

hardware has the potential to significantly reduce annual 

support costs. 

We also noted that despite having similar missions, 

standard configurations and the ultimate price paid for 

computers for the three National Nuclear Security 

Administration (NNSA) national laboratories reviewed - 

Sandia, Lawrence Livermore National Laboratory 

(Livermore), and Los Alamos National Laboratory (Los 

Alamos) - varied widely. For example, the price of the 

Page 1 Details of Finding 
high-end standard configuration of one brand of computer 

ranged from $1,825 at Livermore to $3,743 at Sandia. 

Absent firm standards, average desktop acquisition costs - 

when applied to the approximately 32,000 desktops 

purchased over a recent three-year period - amounted to an 

overall variance of about $3.4 million in acquisition costs. 

Problems with adhering to standards were not limited to 

NNSA sites, but also affected organizations managed by 

the Office of Science (Science). For example, while the 

Oak Ridge National Laboratory (ORNL) had established 

configuration standards for desktops and laptops, we 

observed that these standards were rarely used. Even 

though the site Chief Information Officer (CIO) estimated 

that one-half of the employees were candidates for 

standardized computers, we found that nearly all of the 522 

desktop and laptop computers that we reviewed at ORNL 

exceeded current locally established standards. While the 

price of standardized laptops at the site ranged from $1,2 16 

to $1,499, the average price paid was actually $2,246, or 50 

percent more than permitted by ORNL standards. 

Purchases of non-standard computers and devices at ORNL 

resulted in the unnecessary expenditure of about $1.2 

million. Similarly, we noted that the average price paid for 

the recommended brand of desktop at Berkeley was $1,656 

- about 33 percent more than the site's suggested cost for a 

standard computer. 

Additionally, four of the sites reviewed had not developed 

standards for peripherals and acquired a wide range of 

devices, often at disparate prices. For example, Los 

Alamos acquired at least 60 different types of portable 

storage devices, including various flash drives and portable 

music players. The site acquired various types of flash 

drives in FY 2005 with the same storage capacity, but with 

prices that ranged from $68 to $252 per unit, contributing 

to unnecessary expenditures of about $93,000 at the sites 

reviewed in just that one year. At Livermore, brand 

standards for peripherals had not been developed and the 

site acquired at least 17 different brands of printers. In 

contrast, a similar site only utilized four different printer 

brands. 

Page 2 Details of Finding 
Acquisition Practices 

Sites reviewed had not always developed and implen~ented 

acquisition standards or centralized mechanisms designed 

to minimize the cost associated with acquiring IT hardware. 

For example, Berkeley officials stated that organizational 

units were not required to compete purchases under 

$10,000, and that they used that authority to acquire 

computers from a variety of different vendors. During the 

three-year period we reviewed, Berkeley purchased desktop 

and laptop computers from at least 96 different vendors - a 

practice that effectively prevented it from taking advantage 

of volume discounts. While ORIVL had established a 

hardware acquisition program, numerous hardware 

purchases were made outside of the system. In particular, 

the site acquired hardware through separate purchase 

agreements and by using credit cards, acquisition 

techniques that were not governed by agreed-upon 

standards and which did not permit the buyer to obtain 

quantity purchase discounts. In contrast, the Y-12 National 

Security Complex (Y-12) required that the CIO review all 

hardware acquisitions to ensure compatibility with existing 

standards and purchase agreements. 

The lack of common acquisition standards or negotiated 

buying opportunities for peripheral devices also contributed 

to unnecessary expenditures. For example, sites reviewed 

spent $1 million more than necessary for computer 

monitors in FY 2005 by paying varying prices for the same 

or similar monitors. We also observed that two sites paid 

between $1 00 and $460 for the same portable storage 

device obtained within a three-month period. These issues, 

similar to those described in several information 

technology-related Office of Inspector General reports, 

highlight the fact that the Department's limited use of bulk 

purchase agreements for IT products and services 

negatively impacts its ability to leverage buying power and 

reduce costs. 

Hardware Replacenlent 

Despite a FY 2000 Department-sponsored study and 

industry best practices, six of the seven facility contractors 

included in our review had not established standard cycles 

for replacing IT hardware and had widely varying 

frequencies of hardware replacements that frequently 

differed from industry standards. At Y-12, for example, the 

Page 3 Details of Finding 
current computer replacement frequency was almost 10 

years, more than double the recommended industry 

standard. Site officials estimated that this resulted in 16 

percent of the computers being obsolete, a situation that 

made it difficult for them to control maintenance costs and 

eliminate or reduce security vulnerabilities. In contrast, the 

average replacement rate of a computer at Sandia was three 

years. 

Additionally, the Savannah River Site (Savannah River) 

was the only site reviewed that chose to lease IT hardware. 

While this may be a cost-effective approach to maintaining 

desktop and laptop computers, the approach is not cost 

effective for peripherals such as monitors. In particular, the 

site incurred up to $2 million in excess expenditures over 

the last three years by replacing its computer monitors 

more frequently than necessary. Although industry experts 

estimate a seven year useful life for monitors, Savannah 

River's replacement under the current lease agreement 

occurred every three years, well short of the expected life. 

As noted in the Department-sponsored study, establishing a 

standard technology replacement rate can enhance 

standardization and help optimize costs. 

Inventory Control 

Despite a number of past problen~s and recommendations 

for corrective actions, our review disclosed that contractors 

were not consistently or effectively maintaining 

accountability over assets. Specifically, not all of the sites 

reviewed tracked computers until disposition. Rather, 

Berkeley and Sandia officials stated that equipment is 

generally removed from their inventory systems after five 

years regardless of whether the hardware was still in use 

and with no consideration for the type of information 

contained on the computers. Such practices increase the 

risk that lost or stolen systems containing sensitive or 

personal information will not be identified during the 

inventory process. 

Thresholds for tracking hardware also varied widely at the 

sites reviewed, including the requirements for tracking 

equipment which could potentially contain sensitive 

information such as desktops, laptops, and personal digital 

assistants. For example, even though Sandia reported 

losses of 249 computers and other high risk devices 

between FYs 2003 and 2005, the Department permitted the 

Page 4 Details of Finding 
site to track only those items costing over $1,000. Setting 

this threshold effectively excluded more than 500 

con~puters and 3,100 personal digital assistants from 

inventory tracking. This practice was especially troubling 

given that the site reported the highest percentage of 

missing items of any site reviewed and the recent emphasis 

by the Office of Management and Budget for ensuring 

security over mobile devices. In addition, at Savannah 

River, contractors were also not required to account for 

certain sensitive peripheral equipment if the value was less 

than $5,000 - more than 10 times the threshold used at 

most sites. 

Hardware Acquisition These problems occurred because the Department had not 

and Control Approach developed a coordinated approach to facility contractor IT 

hardware acquisition and control. In particular, corporatelevel standards for hardware had not been developed and 

contractors were not always required to adopt or adhere to 

locally-developed standards. Additionally, contractors 

were not required to coordinate hardware purchases, utilize 

centralized authorities to approve IT purchases, or adopt a 

consistent approach to maintaining accountability over IT 

hardware. 

The Department had not required the development and 

implementation of either complex-wide or site-specific IT 

hardware standards. Although standards were developed as 

part of the Department of Energy Common Operating 

Environment at Headquarters, they had not been expanded 

to facility contractors in the field - organizations that 

account for about 87 percent of the Department's 

workforce. Similarly, users were not always required to 

con~ply with existing site standards. For instance, hardware 

standards were routinely not enforced at ORNL. 

Furthermore, the Department had not developed and 

implemented polices requiring coordination of IT hardware 

purchases both within sites and across the complex to take 

advantage of opport~inities for volun~e discounts. 

Specifically, acquisition authority, including IT approval 

and funding authority, remained decentralized at most of 

the sites reviewed. For instance, neither the site CIO's nor 

acquisition officials were generally responsible for 

monitoring purchases to allow them to identify the types 

and costs of hardware being acquired. The impact of such 

practices was observed at ORNL and Berkeley where 

Page 5 Details of Finding 
organizations regularly acquired various hardware using 

purchase cards and other methods that did not permit 

buyers to obtain available discounts. 

Although facility contractors had negotiated agreements for 

certain products through the Integrated Contractor 

Purchasing Team (ICPT), sites were not required to use 

them. For instance, the primary official responsible for 

overseeing the lCPT stated that it was difficult to obtain the 

lowest prices from vendors without mandatory participation 

from all sites because a consistent volunle of purchases 

could not be ensured. We also noted that the ICPT had not 

established a complex-wide agreement for a particular 

brand of hardware despite expenditures of more than 

$27 million over the past three years. Similar opportunities 

also existed for establishing agreements for other brands of 

IT hardware used by the Department. As noted in our 

recent report on Information Technology Support Services 

at the Department of Energy's Operating Contractors 

(DOEIIG-0725, April 2006), significant savings can be 

realized if the Department develops and implements a 

complex-wide IT acquisition strategy. 

Also, inconsistent implementation of inventory control 

procedures contributed to sensitive equipment not being 

effectiveIy tracked throughout its lifecycle. Despite the 

findings and recomnlendations included in our report on 

Marzugement of Sensitive Equipment at Selecterl Locations 

(DOEIIG-0606, June 2003), the Department permitted field 

sites to set their own thresholds for the type of hardware 

being inventoried. Although Department policy stresses 

the importance of controlling sensitive items such as 

desktops, laptops, and personal digitaI assistants regardless 

of value, the policy also permits local officials to exclude 

such highly attractive items from inventory procedures, 

even though these items can be easily pilfered and have the 

capability to contain significant amounts of sensitive 

information. Conflicting policy such as this makes it 

difficult to ensure that sites are maintaining effective 

control over attractive hardware 

Opportunities for Without improvenlents, the Department will continue to 

Savings spend more than necessary acquiring IT hardware and face 

difficulty ensuring accountability over certain high-risk 

equipment. Specifically, the Department could potentially 

Page 6 Details of Finding 
realize savings of about $16.6 million over the next five 

years at the sites reviewed by better controlling hardware 

costs and implementing standards for certain equipment 

(see Appendix 2 for details). The Department also had an 

increased risk of unidentified theft of hardware and 

infornlation by not requiring accountability for all highly 

attractive items, such as less expensive desktops and 

laptops, personal digital assistants, and certain other IT 

hardware. With the potential for significant cost savings 

and improved accountability, we believe it is vital that the 

Department act to more effectively manage its hardware 

acquisition and control processes across the complex. 

RECOMMENDATIONS To address the issues identified in this report, we 

recommend that the Administrator, NNSA, and the Under 

Secretaries for Energy and Science, coordinate with the 

Department's and NNSA's Chief Information Officers to: 

1. Develop and implement hardware standards and 

related replacement policies, as appropriate, and 

utilize such standards as a basis for streamlining 

acquisitions; 

2. Ensure that hardware purchases are coordinated 

between Headquarters and field sites, to include 

consideration of enterprise agreements, where 

appropriate; 

3. Develop and implement consistent asset 

management policies for maintaining accountability 

over IT hardware; and, 

4. Implenlent mechanisms to effectively monitor and 

control the cost of IT hardware purchases. 

MANAGEMENT 

REACTION 

Management concurred that action is necessary to improve 

the Department's practices for acquiring commodity-type 

IT hardware and indicated that it plans to take certain 

actions relative to the recommendations in our report. 

Specifically, the Department plans to develop guidance that 

encourages aggregation of requirements for IT hardware 

intended to lead to cost savings through economies of scale. 

Management also plans to explore the estabIishment of 

Page 7 Recommendations and Comments 
AUDITOR 

COMMENTS 

enterprise agreements for IT hardware that can be utilized 

by facility contractors. In addition, management agreed 

that accountability must be maintained over IT hardware 

through consistent asset management and noted that a 

review will be performed to determine the need for 

additional policy developn~ent and implementation relevant 

to this area. 

The NNSA indicated that the Department's CIO established 

a desktop minimum hardware configuration that will be 

made available to contractors for their consideration. 

However, NNSA officials did not agree that implementing 

universal hardware standards complex-wide will 

necessarily result in cost benefits. NNSA management also 

noted that its facility contractors recently agreed to work 

cooperatively using common procurement tools in the 

development of complex-wide acquisition vehicles for 

common commodities. Officials believed that this effort 

will assist in monitoring and controlling the costs of IT 

hardware. In addition, management indicated that 

consistent policies are in place for maintaining 

accountability over IT hardware. 

Management's comments are generally responsive to our 

recommendations. We are encouraged that the Department 

plans to explore opportunities for establishing IT hardware 

enterprise agreements, as we continue to believe that such 

agreements with certain vendors will assist in reducing the 

overall cost of acquisition. 

We are hopeful that the NNSA's new strategic sourcing 

effort could, when completely implemented, reduce overall 

costs of IT hardware acquisition. We disagree, however, 

with the NNSA's assertion that developing and 

implementing hardware standards will not necessarily lead 

to cost savings. As noted in the body of the report, we 

identified several examples of cost savings that could be 

achieved through the development and application of 

common standards. We also disagree with the NNSA's 

assertion that it has implemented consistent policies for 

maintaining accountability over IT hardware. Specifically, 

as noted in the report, Sandia was permitted to exclude 

certain sensitive equipment from its inventory process, a 

practice that is inconsistent with other NNSA sites 

reviewed. 

Management's comments are included in their entirety in 

Appendix 4. 

Page 8 Comments 
Appendix 1 

OBJECTIVE 

SCOPE 

METHODOLOGY 

To determine whether the Department of Energy (Department) 

had effectively managed its acquisition and control of 

information technology hardware. 

The audit was performed between December 2005 and March 

2007 at Department Headquarters in Washington, DC, and 

Germantown, MD; the Lawrence Livermore National 

Laboratory, Livermore, CA; the Lawrence Berkeley National 

Laboratory, Berkeley, CA; the Oak Ridge National Laboratory 

and the Y-12 National Security Complex, Oak Ridge, TN; the 

Sandia National Laboratories and the National Nuclear 

Security Administration (NNSA) Service Center, Albuquerque, 

NM; and the Savannah River Site, Aiken, SC. We also 

obtained information from the Los Alanios National 

Laboratory, Los Alamos, NM. 

To accomplish our objective, we: 

Reviewed applicable laws and regulations pertaining to 

acquisition and maintenance of information technology 

hardware, as well as guidance issued by the Office of 

Management and Budget; 

Reviewed reports issued by the Office of Inspector 

General ; 

Reviewed numerous documents related to the 

Department's management of hardware acquisition and 

maintenance activities: 

Held discussions with program officials and personnel 

from Department Headquarters and field sites reviewed, 

including representatives from the Offices of the Chief 

Information Officer, Environmental Management, 

Office of Science, and Fossil Energy, as well as NNSA; 

and, 

Reviewed the Government Performance and Results 

Act of 1993 and determined if performance measures 

had been established for managing hardware 

acquisition. 

Page 9 Objective, Scope, and Methodology 
Appendix I (continued) 

The audit was conducted in accordance with generally accepted 

Government auditing standards for performance audits and 

included tests of internal controls and compliance with laws 

and regulations to the extent necessary to satisfy the audit 

objective. Accordingly, we assessed intemal controls 

regarding the acquisition and maintenance of hardware across 

the Department. Because our review was limited, it would not 

necessarily have disclosed all internal control deficiencies that 

may have existed at the time of our audit. We also assessed 

perfomlance measures in accordance with the Governnzent 

Performance and Results Act of 1993 regarding acquisition and 

maintenance of software. We found that none of the seven 

field sites visited had established measures specific to 

achieving cost savings associated with hardware acquisition. 

While we did not rely solely on con~puter-processed data to 

satisfy our audit objective, we confirmed the validity of such 

data, when appropriate, by reviewing supporting source 

docun~ents such as contracts and invoices. 

The Office of the Chief Infornlation Officer and the NNSA 

elected to waive the exit conference. 

Page 10 Objective, Scope, and Methodology 
Appendix 2 

POTENTIAL SAVINGS 

To determine potential savings relevant to standardizing information technology (IT) 

hardware across the Department of Energy (Department), we compared the average costs 

paid for desktops and laptops at the three National Nuclear Security Administration 

laboratories reviewed, as well as the two Office of Science laboratories reviewed. Based on 

our calculations, we determined that the sites could save about $7.9 million over the next five 

years if hardware standards are implemented at sites with similar operational functions. In 

addition, had the Oak Ridge National Laboratory enforced standards for desktops and laptops 

for only one-half of its users, we determined that savings of $2 million could be realized. 

Further, we found that the development and implementation of standards for certain portable 

storage devices could result in savings of $464,275. 

In addition, we calculated the savings that could be realized from effectively managing 

acquisition of 1T hardware. Specifically, we reviewed information provided by Savannah 

River Site and compared this to industry estimates relevant to monitor life-cycles. Based on 

our review, we determined that the site could save about $1.1 million over the next five years 

by purchasing computer monitors rather than leasing new ones every three years. 

Additionally, we detennined that the sites reviewed could save about $5 million over the next 

five years acquiring computer monitors at the lowest prices available through other existing 

agreements. 

The table below details the possible savings the Department could realize over the next five 

years. 

Product 

L -- Portable storage devices I $92,855 1 $464,2751 ppppp - 

Hardware Standards Savings , 

Subtotal 

bent-Rited savingsp 1 Savannah River Monitor Lease -- 

Identified Annual 

Savings 

- -- $1,583,659 

~NL Standardization $409,457 

1 Monitor Purchases $5,000,045 1 

-- 

Subtotal $6,143,737 

1 TOTAL -- 1 $3,314,718 1- * 16,573,593 * Reflc~cts only potentic11 .sc~vitlg.s c~t (I limitr(1 nurt~ber of the sites reviewed. We \$'ere unc~hle to calciilate 

Depc~rtmrnt-wide snving.~. 

Potential Savings 

(5 years) I 

-- 

$2,047 

Page 11 Potential savings 
Appendix 3 

PRIOR REPORTS 

Office of Inspector General Reports 

Information Technology Support Senices at the Department of Energy's Operating 

Contractors (DOEJIG-0725, April 2006). The Department of Energy (Department) 

continues to face challel~ges related to contractor procured or fumishcd infom~ation 

technology (IT) support services. The Department had not established a comprehensive 

framework to provide a corporate approach to providing IT support services that included 

contractor-managed sites. Furthermore, the Department did not require contractors to 

adopt other available methods for reducing costs such as coordinating with established 

consortium buying groups to consolidate demand and obtain volume discounts. Without 

improvements, the Department will be unable to realize potential cost savings at 

numerous contractor-managed sites. 

hfunugentent of the Departmetzt's Desktop Compilter Softwure Enterprise License 

Agreements (DOEJIG-0718, January 2006). The Department had not adequately 

managed the acquisition and maintenance of desktop computer software licenses. While 

it did establish several enterprise agreements, it had not developed a complex-wide 

desktop software acquisition and maintenance strategy. Without improvements focused 

on increasing software management effectiveness, the Department may be unable to 

realize savings of at least $3.2 million over the next five years. 

Munagement Ch~lllenges at the Department of Energy (DOEIIG-0748, December 2006). 

The Office of Inspector General (OIG) identified seven significant management 

challenges facing the Department, including cyber security. In addition, the OIG 

identified a "watch list" of emerging issues that warrant continued attention. The report 

noted that although the Department had taken a number of positive actions in Fiscal Year 

2006 relevant to cyber security, weaknesses still existed relating to establishing a 

complex-wide inventory of information systems and implementation of an effective 

certification and accreditation process. 

Developmetzt and Implementation of the Department's Enterprise Architecture (DOEIIG0686, April 2005). The Department had not completely defined its current or future 

information technology requirements, such as desired systems, supporting applications 

and hardware, and technology standards. Without improvements, the Department may be 

unable to implement an effective corporate approach for managing ill formalion 

technology investments. 

M~~ttugemetlt of Sensitive Eyuiprnet~t at Selected Locutiotts (DOEJIG-0606, June 2003). 

Management at specific sites was able to locate virtually all sensitive equipment selected 

during the review. However, Department officials had not ensured compliance with local 

guidance and best practices pertaining to control, tracking, and protection of sensitive 

property by contractors. Without improvements sites remain susceptible to misuse, theft, 

or other diversion of Government property. 

Page 12 Prior Reports 
Appendix 4 

Department of Energy 

Washington. DC 20585 

May 3 1.2007 

MEMORANDUM POR RICKEY R. HASS 

ASSISTANT INSPECTOR GENERAL 

FOR FINANCIAL, TECHNOLOGY AND 

FROM: 

SOBJ EC'I': 

CORPORATE AUDITS 

THOMAS N. PYKE. JR. .>- .- 

CHIEF INFORMATION OFFICER 

Itesponse to lnspector Gewral's DraR Report, A06TG072, Facility 

Contractor Acquisition and Management of Infornution Technology 

Hardware 

The Department of Energy has reviewed the Inspector General's Draft Report, A06TCiO22, 

Facility Contractor Acquisition a~d Managerncnt of Infornlat ion Technology Hardware, dated 

March 23. 2007. 

According to the Office of the Inspector General's (OIG) audit results stated in this Drafl Repo~t. 

certain facility contractors have not adcquately managcd the acquisition and control of IT 

hardware. The OIG concluded that the Department has not developed a coordinated approach to 

IT hardware acquisition, managenlent and control. We appreciate the OIG's recognition that the 

Departnlent has taken actions to establish hardware standards for headquarters, through the 

Department of Encrgy Common Opcrating Environment, DOECOE. 

We concur that action is necessary to guidc the Department to improve its practices for acquiring 

commodity-type IT hardware, such as personal computers and monitors. The Office of the Chicf 

Information Officer (OCIO) plans to develop guidance for the Department that encourages 

aggregation of requirements for such quipment, for each site and across sites whcre possible. 

The guidance will focus on steps that can be taken to benefit fiom an economy of scale, where 

practical, whilc meeting user requirements. In addition, thc guidancc will provide input to the 

acquisition process that will assist in making IT hardware refresh decisions based on a ill 

understanding of the life cycle factors that should be considered to ensure acceptable long-term 

performance at lowest long-term cost of ownership. In developing this guidance. OClO intends 

to work closely with the National Nuclear Security Administration (NNSA) Administrator, the 

Under Stxretaries for Encryy and Sciencc, and the Office of Management. 

Page 13 Management Comments 
Appendix 4 (continued) 

REC'OMMENDATIONS 

Recommendatio~~ 1: 'The OIG recommends that the Administrator. National Nuclear Security 

Administration (NNSA) and the Under Secretaries for Energy and Scicnce. coordinate with thc 

I)epa~.tnlent's CIO and tl~e NNSA CIO to develop hardware standards and related refresh 

policies. as appropriate. 

.Management 1)ecision: 0C10 will develop guidance for the Department that encourages 

aggregation of requireme~~ts for such equipment, intended to lead to cost savings through 

economies of scale wliere practical. 

'The Ollice of the Chief Information Officer (OCIO) plans to develop guidance, working closcly 

with the NNSA Administrator, the Under Secretaries for Energy and Science, and the Office of 

Management that encourages aggregation of requirements for commodity-type IT l~ardware 

equipnlent, for each site and across sites, where possible, so steps can be taken to benefit from 

economies of scale in acquisition and support, where practical, while meeting user requirements. 

In addition, the guidance will address IT hardware refresh decisions based on a full 

understanding of the life cycle factors that should be considered to ensure acceptable long-term 

performance at lowest long-term cost ofownership. The guidance will be prepared in thc 

contcxt of the Department's Enterprise Architecture management process. OClO's intent is to 

completc preparation ofthis guidance within the next six months. 

Reconln~e~~dation 2: The 01G recommends that the Administrator, NNSA and the Under 

Secretaries for Energy and Scicncc, coordinate with the Director, Office of Management; the 

NNSA Scnior Procure~ncnt Executive; and the Department's and NNSA's Chief Infor~ilation 

Officers to iniplcment hardware standards and related rcfrcsh policies, and utilize such standards 

as a basis for streamlining acquisitions 

Management Decision: OCIO will develop guidance for the Department that encourages 

aggregation of requirements for such equipment, intended to lead to cost savings through 

economies of scale where practical. 

I'ha planncd guidance is intended to support streamlined acquisition ofcommodity-type IT 

hardware, especially in the field, without unnecessarily constraining such acquisitions by spcc~fic 

standards that could quickly becon~c obsolctc in such a fast-moving technological area. Special 

consideration will also be given to the dynamics of marketplace pricing for acquisition of 

comnlodity-type IT hardware products to ensure that the Government is able to take advantage of 

marketplace reduc~ions in price that sometimes occur in a relativcly short time period for these 

types of products. Using this guidance, the NNSA Administrator and the Undcr Sccretariss for 

Energy and Science would be in a better position to provide direction through appropriate 

contractual means to improve acquisition of such equipment by their field organizations. 

Recon~rnendation 3: .l'hc 01G recommends that the Adniinistrator, NNSA and thc Undcr 

Secretaries lor Energy and Science. coordinate with the Director, OVfice of Management; the 

NNSA Senior Procurement Executive; and the l)epartment's and NNSA's Chief Information 

Page 14 Management Comments 
Appendix 4 (continued) 

Otficer to ensure that hardware purchases are coordinated between Headquarters and field sitcs, 

to include consideration of enterprise agreements, where appropriate. 

Mar~ngcrncnt Decision: OClO will develop guidance for the Department that encourages 

aggrcgatiun of requirements for such equipn~ent. intended to lead to cost savings through 

economics of' scale where practical. 

We believe that the developn~ent and use ofappropriate guidance will motivate improved 

acquisition practices at headquarters and at field sites for con~modity-twe IT hardware, but that 

it is unlikcly that enterprise agreements will have the same positive effect on reducing 

commodity-type 17- hardware costs as do enterprise software agreements, including Sn~artBuy. 

This conccrn is raised because of expected practical problenls of establishing and maintaining 

effective agreements in thc face of Vast-changing technology and resulting continual 

improvenicnts in performance/cost in this marketplace. OClO will. however. explore the 

possible use of enterprise agreements for commodity-type IT hardware similar to those in place 

lor sofiwarc, in which the cntcrprise agrcc~nents would be available for consideration by DOE 

licility contractors, as appropriate, to meet their requirements. 

Rccon~n~er~dation 4: The 01G recommends that the Administrator, NNSA and thc Under 

Secretaries for Energy and Science, coordinate with the Director, Office of Management; the 

NNSA Senior Procure~ncnt Executive; and the Department's and NNSA's Chieflnformation 

Officer to develop and implement consistent asset management policies for maintaining 

accountability over IT hardware 

~Managenlcnt Decisior~: Concur 

The Department agrees it must nwintain accountability over IT hardware through consistent asset 

management policies. The Draft Report indicates that several sites have not maintained 

accountability Ibr a substantial volume of IT hardware through consistent asset management, in 

con~pliance with Departmental policy. 

The Dcpartment agrccs that an asset management challenge exists arising from a failure to 

comply with existing policy. The Depart nrent believes that its asset management policies for 

maintaining accountability ovcr IT hardware are adequate, based upon the results of'thc (llG 

audit. However, compliance remains an issue. The NNSA Admillistrator and the Under 

Sccretaries for Energy and Science in coordination with the Department's and NNSA's Chief 

Intormation Officers. in consultation with the NNSA and DOE Senior Procurement Executives, 

will perform a review to determine any need for additional policy developnrent and 

implementation, and take neccssary corrective actions to ensure compliance with DO]; Property 

Management policy. 

llccomnrendatior~ 5: The O1G recommends that the Administrator, NNSA and the Lndcr 

Secretaries for Energy and Science, coordinate with the Director, Offlce ot' Management; the 

NNSA Senior Procurement Executive; and the Department's and NNSA's Chief Information 

Ofiicers to implemenl mechanisnrs to effectively monitor and control the cost of IT hardware. 

Page 15 Management Comments 
Appendix 4 (continued) 

;Managenlent 1)ccision: Concur 

'l'he development and application of the planned guidance that encourages aggregation of 

requirenlents Ibr commodity-type 1'1' hardware equipment is intended to provide cost savings 

through economies of scale where practical. The NNSA Adrninislrator and lhe Under 

Secretaries for Energy and Science will coordinate with the Deparlment's and NNSA's Chief 

Information Officers in consultation with the NNSA and DOE Senior Procurement Executives. 

to review current policies, processes, and procedures for acquisition of comrnodiry-type 11' 

hardware, as well as best practices within the D0b:COE Program and other 1.1. support programs, 

to determine if additional actions are indicated. 

Page 16 Managenlent Comments 
Appendix 4 (continued) 

Department of Energy 

National Nuclear Securlty Administration 

Washington, DC 20585 

May 7, 2007 

.MEMORANDUM FOR Rickey R. Hass 

Assistant Inspector Gencial 

FROM: 

SUBJECT: 

for ~inancial, Technology, and Corporate Audi~s 

Michael Associate c. Administrator KFUI&@&- 

For Management and~drninistration 

Comments to Drat? Report on Contractor 

Acquisition and Management of Momation 

Technology Hardware, A06TG022 

The National Nuclear Security Administration (NNSA) appreciates the 

opportunity to review the Inspector General's (IG) draft report, "Facility 

Contractm Acquisition and Management of Information Technology 

E3ardwarc." We understand that the IG conducted this audit to determine 

whether we had effectively managad our acquisition and control of 

Information Technology (IT) hardware. 

NNSA offers the following comments to the report and the corresponding 

recommendations: 

To address the issues identified In this report, we recommend that the 

Administrator, NNSA and the Under Secretaries for Energy and 

Science, coordinate with the Department's CIO and the NNSA CIO 

to: 

1. Develop hardware standards md related refresh policies, as 

appropriate. 

NNSA does not concur with the recommendation. If the rccornmendation 

is directed towards tl~e Federal establishment, then the Department's Chief 

Information Officer is already taking the actions that are being 

recommended. A complex-wide desktop minimum hardware standard 

configuration is established. The documentation of the Federal standard 

desktop hardware standard configuration will be made available to 

contractors as a tool for their consideration in determining the most 

efficient and effective method in determining the overall Teast cost 

approach for that part of the contractor's operations that support 

Page 17 Management Comments 
Appendix 4 (continued) 

performance objectives. NNSA does expect our contractors to perfonn 

sound procurement practices including the assessment of commodities for 

the best procurement method. In fact, NNSA M&O contractors recently 

signed a~mernorandum of understanding whereby they agreed to work 

cooperatively using common procurement tools in the development of 

complex-wide acquisition vehicles for common commodities. 

We also recommend that the Administrator, NNSA and the Under 

Secretaries for Energy and Science coordinate with the Director, 

Office of Management; the NNSA Senior Procurement Executive; and 

the Department's and NNSA's Cbief Information Officers to: 

While the wording of the recommendation is correct, NNSA believes that 

the recommendation, in this case. should be directed towards the major 

program elements so that the desires of the major program elements are 

not discounted. The references to the Office of Management, Senior 

Procurement Executive and Chief Information Officers can, therefore, be 

deleted. It is the major program elements that have the budgetary 

authority and management and oversight of the contract instruments. 

2. Implement hardware stsndards and related refresh policies, as 

appropriate, and utilize such standards as a basis for 

streamlining acquisitions; 

NNSA has taken the approach that a performance measure in NNSA 

contracts that rewards the contractor for good business practices will lead 

to more efficient, effective acquisitions regardless of the establishment of 

standards. The establishment of standards has to be written at such a level 

to allow individual sites the latitude to exercise IT procurements with 

small businesses or participate in strategic sourcing. To establish 

standards with any less flexibility means that cost benefits may not be a 

reality. NNSA does not agree that implementing universal hardware 

standards complex-wide will necessarily result in cost benefits or even act 

as a basis for streamlined acquisitions. Adherence to sound business 

practices following the concepts of strategic sourcing as outlined in our 

contractor's memorandum of understanding certainly will realize cost 

benefits 

3. Ensure that hardware purchases are coordinated between 

Headquarters and field sites, to include consideration of 

enterprise agreements, where appropriate; 

M&O subcontract consents are performed by each NNSA Site Office if 

the specific acquisition meets the established thresholds for subcontract 

reviews. HCA subcontract consent is required for larger subcontracts. 

NNSA expects each M&O to utilize strategic vehicles wherever possible. 

The memorandum of understanding between all NNSA M&O's will 

Page 18 Management Comments 
Appendix 4 (continued) 

facilitate the creation and utilization of complex-wide acquisition vehicles 

in addition to those developed by the ICPT and all M&07s have the 

requirement to participate in complex-wide strategic sourcing as part of 

their performance evaluation. Further wordination and review at the 

Headquarters level is not necessary. 

4. Develop and implement consistent asset management policies 

for maintaining accountability over IT hardware; and, 

NNSA has consistent policies in place for maintaining accountability over 

IT hardware. Since asset management is an integral step of Supply Chain 

Management, each of NNSA's contractors have approved acquisition and 

management (which includes disposition)-systems. These 

systems are amroved bv the Federal estabhshrnent and are reviewed. 

wdited, and&; tested on a scheduled basis. 

5. Implement mechanlums to effectively monitor and control the 

cost of IT hardware purchases. 

This recommendation gives the reader the impression that control of costs 

must occur centrally. That would put NNSA's contractors into a 

'compliance' environment when we are, in fact, moving into a Contractor 

Assurance Systdmanagcment of risk environment. We believe that 

there will be a logical progression into cost effectiveness, cost eficiency 

as long as our contractors realize that it is beneficial to them to implement 

good business practices even if it means working with other laboratories 

and production facilities. NNSA has developed visibility into subcontract 

spend data and has begun to utilize the data to work hand-in-hand with the 

M&O contractors to identify commodities for strategic sourcing. 

Should you have any questions related to this response, please contact 

Richard Speidel. Director, Policy and Internal Controls Management. 

cc: David Boyd, Senior Procurement Executive 

Linda Wilbanks, Chief Information Officer 

Karen .Boardman, Director, Service Center 

Page 19 Management Comments 
IG Report No. DOEIIG-0768 

CUSTOMER RESPONSE FORM 

The Office of Inspector Gencl-al has a continuing interest in improving the usefulness of 

its products. We wish to make o11r reports as responsive as possible to our customers' 

requirements, and, thcreforc. ask that you consider sharing your thoughts with us. On the 

back of this form, you may suggest improvements to enhance the effectiveness of future 

rcports. Plcase include answers to the following questions if they are applicable to you: 

1. What additional background information about the selection, scheduling, scope, or 

procedures of the inspection would have been helpful to the reader in understanding 

this rcpoi-t'? 

2. What additional information related to findings and recommendations could have 

been included in the report to assist management in implementing correct; ve actions? 

3. What format. stylistic, or organizational changes might have made this report's 

overall messagc more clear to the reader? 

4. What additional actions could the Office of Inspector General have taken on the 

issues discussed in this report which would have been helpful? 

5. Please include your name and telephone number so that we may contact you should 

we have any questions about your comments. 

Name Date 

Telephone Organization 

When you have completed this form, you may telefax it to the Office of Inspector 

General at (202) 586-0948, or you may mail it to: 

Office of Inspector General (IG- I) 

Department of Energy 

Washington, DC 20585 

ATTN: Customer Relations 

If you wish to discuss this report or your comments with a staff member of the Office of 

Inspector General, please contact Judy Garland-Smith (202) 586-7828. 

The Office of Inspector General wants to make the distribution of its reports as customer friendly 

and cost effective as possible. Therefore, this report will be available electronically through the 

Internet at the following address: 

U.S. Department of Energy Office of Inspector General Home Page 

http://www.ig.ener~y.gov 

Your comments ~lould be appreciated and can be provided on the Customer Response Form.