AUDIT REPORT 

Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform 

Federal Information Technology Management‖

OIG-13-A-09 January 23, 2013

All publicly available OIG reports (including this report) are accessible through

NRC‘s Web site at: 

http:/www.nrc.gov/reading-rm/doc-collections/insp-gen/
UNITED STATES

NUCLEAR REGULATORY COMMISSION

WASHINGTON, D.C. 20555-0001

OFFICE OF THE

INSPECTOR GENERAL

January 23, 2013

MEMORANDUM TO: R. William Borchardt

Executive Director for Operations

FROM: Stephen D. Dingbaum /RA/

Assistant Inspector General for Audits

SUBJECT: AUDIT OF NRC’S PROGRESS IN CARRYING OUT THE 

“25 POINT IMPLEMENTATION PLAN TO REFORM 

FEDERAL INFORMATION TECHNOLOGY MANAGEMENT”

(OIG-13-A-09)

Attached is the Office of the Inspector General’s (OIG) audit report titled, Audit of NRC’s 

Progress in Carrying Out the “25 Point Implementation Plan to Reform Federal 

Information Technology Management.”

The report presents the results of the subject audit. Following the December 18, 2012,

exit conference, agency staff indicated that they had no formal comments for inclusion

in this report.

Please provide information on actions taken or planned on each of the 

recommendations within 30 days of the date of this memorandum. Actions taken or 

planned are subject to OIG followup as stated in Management Directive 6.1.

We appreciate the cooperation extended to us by members of your staff during the 

audit. If you have any questions or comments about our report, please contact me at 

415-5915 or Beth Serepca, Team Leader, Security and Information Management Team, 

at 415-5911.3

Attachment: As stated 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

i

Executive Summary

Background

The U.S. Nuclear Regulatory Commission (NRC) invests in a broad range 

of information technology (IT) products and services to perform its 

mission. Some IT investments support business activities such as 

financial, administrative, and human resource management. Others 

support core regulatory activities related to nuclear security, reactor 

safety, and nuclear materials and waste safety. In addition, investments 

such as IT security and infrastructure services support activities across 

NRC‘s organizational lines. Despite rapidly changing IT security threats 

and increased reliance on IT to accomplish the agency‘s mission, NRC 

faces the Governmentwide challenge of declining budgets. For example, 

NRC spent $164.7 million on IT in Fiscal Year (FY) 2011, but has 

budgeted $151.4 million for IT in FY 2013—a decline of approximately 8 

percent.

As a representative of the Office of Management and Budget (OMB), the 

U.S. Chief Information Officer (CIO) has encouraged NRC and other 

Federal agencies to ―do more with less.‖ In December 2010, the U.S. CIO 

promulgated the ―25 Point Implementation Plan to Reform Federal 

Information Technology Management‖ (25-Point Plan).1 The 25-Point 

Plan tasked NRC and other agencies with undertaking specific 

management reforms and policy changes within 6-, 12-, and 18-month 

timeframes.2 NRC—by itself or in conjunction with other Federal agencies 

and OMB—was responsible for carrying out the following 10 action items:

Action Item 1: Complete detailed implementation plans to 

consolidate 800 data centers by 2015.

 

1

For a complete list and indepth discussion of these initiatives, reference the ―25 Point Implementation 

Plan to Reform Federal Information Technology Management,‖ U.S. Chief Information Officer, December 

9, 2010. 

2

The 25-Point Plan assigns responsibility for some initiatives to the General Services Administration, 

Small Business Administration, Office of Personnel Management, and OMB.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

ii

Action Item 3: Shift to a ―Cloud First‖3policy.

Action Item 8: Scale IT program management career path.

Action Item 13: Design and develop a cadre of specialized IT 

acquisition professionals.

Action Item 17: Work with Congress to create IT budget models 

that align with modular development.

Action Item 19: Work with Congress to scale flexible IT budget

models more broadly.

Action Item 20: Work with Congress to consolidate commodity IT4

spending under the agency CIO.

Action Item 21: Reform and strengthen Investment Review Boards.

Action Item 22: Redefine the role of agency CIO and the Federal 

CIO Council.

Action Item 23: Roll out ―TechStat‖5 model at the bureau level.

NRC Organizations Responsible for Carrying Out the 25-Point Plan

Several offices have participated in responding to 25-Point Plan action 

items. NRC‘s Office of Information Services has played an active role, 

particularly in response to action items focused on IT infrastructure 

planning and budgeting. The Office of Administration has played a role in 

action items pertaining to contracting and acquisitions. Lastly, NRC‘s 

 

3

―Cloud‖ computing aims to enable convenient, on-demand access to a shared pool of computing 

resources such as networks, servers, applications, storage, and services. The National Institute of 

Standards and Technology identifies the following essential cloud features: on-demand service, broad 

network access, resource pooling, rapid elasticity, and measured service. 

4

―Commodity IT‖ refers to generic products and services such as e-mail, content management systems, 

and Web infrastructure. 

5

―TechStat‖ reviews are evidence-based evaluations designed to identify IT program weaknesses and 

develop plans for improvement. TechStat reviews can also help identify failed IT programs for early 

termination. 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

iii

Deputy Executive Director for Corporate Management serves as the 

agency‘s Chief Information Officer, and oversees the agency‘s IT strategic 

planning. 

Objective

The audit objective was to evaluate NRC‘s progress in carrying out the ―25 

Point Implementation Plan to Reform Federal Information Technology 

Management.‖ Appendix A contains information on the audit scope and 

methodology.

Results in Brief

OIG auditors evaluated NRC‘s performance in carrying out the 10 action 

items for which the agency was responsible. Based on this work, auditors 

concluded that NRC had met its obligations for these action items, but 

developed findings and recommendations to improve the agency‘s IT 

management in areas related to the following three action items:

Action Item 21 (IT Investment Review Boards) Finding:

 NRC does not review performance of non-major IT investments, 

as defined by OMB.

Action Item 13 (IT acquisition cadres) Finding:

 NRC has specialized IT acquisition professionals, but has not 

institutionalized current training and retention best practices.

Action Item 1 (Data center consolidation) Findings:

 NRC does not include all data centers in consolidation plans.

 NRC did not perform alternatives analysis for the 3WFN data 

center.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

iv

NRC Does Not Review Performance of Non-Major IT Investments, as 

Defined by OMB

OMB has directed Federal agencies to apply the TechStat model to review 

performance of IT investments. NRC has implemented TechStat, but only 

uses it to review major IT investments as defined by OMB. NRC does not 

apply the TechStat model to non-major IT investments because the 

agency has recently restructured its Investment Review Boards, and the 

initial TechStat focus has been placed on major IT investments, which are 

fewer in number and higher in total value than non-major IT investments. 

Consequently, without reviewing non-major IT investments, NRC may 

miss opportunities to improve performance and cost-effectiveness of these 

investments.

NRC Has Specialized IT Acquisition Professionals, but Has Not 

Institutionalized Current Training and Retention Best Practices

OMB has directed Federal agencies to design and develop a cadre of 

specialized IT acquisition professionals by providing specific training, onthe-job experience, and mentoring. Although NRC has a branch of IT 

acquisition specialists who are encouraged to pursue training in this field, 

NRC has not institutionalized current training and retention best practices 

for these staff. This occurs because OMB approved NRC‘s 2012 

acquisition human capital plan,6 which did not include details about staff 

training. Without institutionalized best practices, NRC faces challenges in 

training and retaining specialized IT acquisition professionals.

NRC Does Not Include All Data Centers in Consolidation Plans

Action Item 1 of the 25-Point Plan directs Federal agencies to comply with

the Consolidation Initiative, which requires Federal agencies to inventory 

their data center assets and develop data center consolidation plans. 

However, NRC has limited its data center count to three headquarters 

facilities, excluding data centers in its regional offices and Technical 

 

6

 Each Federal agency covered by the Chief Financial Officers Act is required to develop an annual 

Acquisition Human Capital Plan as a means to improve the strategic management of the agency‘s 

acquisition workforce. A template developed by OMB‘s Office of Federal Procurement Policy and the 

Federal Acquisition Institute is used to gather information about each agency‘s acquisition workforce.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

v

Training Center. This has occurred because OMB has promulgated 

different definitions of ―data center,‖ and NRC has interpreted OMB 

guidance to exclude regional data centers. Without a complete data 

center count, NRC may miss opportunities to identify potential cost 

savings that could be realized through expanding its data center 

consolidation efforts.

NRC Did Not Perform Alternatives Analysis for the 3WFN Data Center

Federal guidance instructs agencies to consider alternatives to in-house 

data hosting when formulating data center consolidation plans. NRC built

a new data center in the Three White Flint North building (3WFN) to 

consolidate some headquarters data centers, but did not perform an 

alternatives analysis prior to undertaking the project. NRC staff did not 

perform an alternatives analysis to include external hosting for the 3WFN 

data center because senior management had committed to moving 

existing data centers to 3WFN early in the planning phase. As result, the 

3WFN data center was built with extra capacity that may not be used.

Recommendations

This report makes four recommendations to improve the agency‘s plan to 

reform its information technology management. A consolidated list of 

these recommendations appears in Section IV of this report.

AGENCY COMMENTS

An exit conference was held with the agency on December 18, 2012. At 

this meeting, agency management stated their general agreement with the 

findings and recommendations in this report and opted not to provide 

formal comments for inclusion in this report.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

vi

ABBREVIATIONS AND ACRONYMS

CIO Chief Information Officer

FY Fiscal Year

IT Information Technology

IT Board Information Technology/Information Management Board

NRC Nuclear Regulatory Commission

OIG Office of the Inspector General

OIS Office of Information Services

OMB Office of Management and Budget

3WFN Three White Flint North
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

vii

TABLE OF CONTENTS

EXECUTIVE SUMMARY.................................................................................................. i

ABBREVIATIONS AND ACRONYMS .............................................................................vi

I. BACKGROUND.................................................................................................... 1

II. OBJECTIVE ......................................................................................................... 3

III. FINDINGS ............................................................................................................ 3

A. NRC DOES NOT REVIEW PERFORMANCE OF NON-MAJOR IT

INVESTMENTS, AS DEFINED BY OMB ........................................................ 4

B. NRC HAS SPECIALIZED IT ACQUISITION PROFESSIONALS, BUT

HAS NOT INSTITUTIONALIZED CURRENT TRAINING AND RETENTION

BEST PRACTICES ......................................................................................... 7

C. NRC DOES NOT INCLUDE ALL DATA CENTERS IN

CONSOLIDATION PLANS............................................................................ 11

D. NRC DID NOT PERFORM ALTERNATIVES ANALYSIS FOR THE

3WFN DATA CENTER.................................................................................. 13

IV. CONSOLIDATED LIST OF RECOMMENDATIONS........................................... 16

V. AGENCY COMMENTS ...................................................................................... 17

APPENDIX

A. OBJECTIVE, SCOPE AND METHODOLOGY.............................................. 18
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

1

I. BACKGROUND

The U.S. Nuclear Regulatory Commission (NRC) invests in a broad range 

of information technology (IT) products and services to perform its 

mission. Some IT investments support business activities such as 

financial, administrative, and human resource management. Others 

support core regulatory activities related to nuclear security, reactor

safety, and nuclear materials and waste safety. In addition, investments 

such as IT security and infrastructure services support activities across 

NRC‘s organizational lines. Despite rapidly changing IT security threats 

and increased reliance on IT to accomplish the agency‘s mission, NRC 

faces the Governmentwide challenge of declining budgets. For example, 

NRC spent $164.7 million on IT in Fiscal Year (FY) 2011, but has 

budgeted $151.4 million for IT in FY 2013—a decline of approximately 8

percent.

As a representative of the Office of Management and Budget (OMB), the 

U.S. Chief Information Officer (CIO) has encouraged NRC and other 

Federal agencies to ―do more with less.‖ In December 2010, the U.S. CIO 

promulgated the ―25 Point Implementation Plan to Reform Federal 

Information Technology Management‖ (25-Point Plan).7 The 25-Point

Plan tasked NRC and other agencies with undertaking specific 

management reforms and policy changes within 6-, 12-, and 18-month 

timeframes.8 NRC—by itself or in conjunction with other Federal agencies 

and OMB—was responsible for carrying out the following 10 action items:

Action Item 1: Complete detailed implementation plans to 

consolidate 800 data centers by 2015.

Action Item 3: Shift to a ―Cloud First‖9policy.

 

7

For a complete list and indepth discussion of these initiatives, reference the ―25 Point Implementation 

Plan to Reform Federal Information Technology Management,‖ U.S. Chief Information Officer, December 

9, 2010. 

8

The 25-Point Plan assigns responsibility for some initiatives to the General Services Administration, 

Small Business Administration, Office of Personnel Management, and OMB.

9

―Cloud‖ computing aims to enable convenient, on-demand access to a shared pool of computing 

resources such as networks, servers, applications, storage, and services. The National Institute of 

Standards and Technology identifies the following essential cloud features: on-demand service, broad 

network access, resource pooling, rapid elasticity, and measured service. 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

2

Action Item 8: Scale IT program management career path.

Action Item 13: Design and develop a cadre of specialized IT 

acquisition professionals.

Action Item 17: Work with Congress to create IT budget models 

that align with modular development.

Action Item 19: Work with Congress to scale flexible IT budget 

models more broadly.

Action Item 20: Work with Congress to consolidate commodity IT10

spending under the agency CIO.

Action Item 21: Reform and strengthen Investment Review Boards.

Action Item 22: Redefine the role of agency CIO and the Federal 

CIO Council.

Action Item 23: Roll out ―TechStat‖11 model at the bureau level.

NRC Organizations Responsible for Carrying Out the 25-Point Plan

Several offices have participated in responding to 25-Point Plan action 

items. NRC‘s Office of Information Services (OIS) has played an active 

role, particularly in response to action items focused on IT infrastructure 

planning and budgeting. The Office of Administration has played a role in 

action items pertaining to contracting and acquisitions. Lastly, NRC‘s 

Deputy Executive Director for Corporate Management serves as the 

agency‘s Chief Information Officer, and oversees the agency‘s IT strategic 

planning. 

 

10 ―Commodity IT‖ refers to generic products and services such as e-mail, content management systems, 

and Web infrastructure. 

11 ―TechStat‖ reviews are evidence-based evaluations designed to identify IT program weaknesses and 

develop plans for improvement. TechStat reviews can also help identify failed IT programs for early 

termination. 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

3

II. OBJECTIVE

The audit objective was to evaluate NRC‘s progress in carrying out the ―25 

Point Implementation Plan to Reform Federal Information Technology 

Management.‖ Appendix A contains information on the audit scope and 

methodology.

III. FINDINGS

OIG auditors evaluated NRC‘s performance in carrying out the 10 action 

items for which the agency was responsible. Based on this work, auditors

concluded that NRC had met its obligations for these action items, but 

developed findings and recommendations to improve the agency‘s IT 

management in areas related to the following three action items:

Action Item 21 (IT Investment Review Boards) Finding:

 NRC Does Not Review Performance of Non-Major IT 

Investments, as Defined by OMB.

Action Item 13 (IT acquisition cadres) Finding:

 NRC Has Specialized IT Acquisition Professionals, but Has Not 

Institutionalized Current Training and Retention Best Practices.

Action Item 1 (Data center consolidation) Findings:

 NRC Does Not Include All Data Centers in Consolidation Plans.

 NRC Did Not Perform Alternatives Analysis for the 3WFN Data 

Center.

Background information explaining each action item appears at the start of 

each action item finding section of this report.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

4

Background for Action Item 21 Finding: IT Investment Review Boards

Action Item 21 of the 25-Point Plan directs Federal agencies to reform and 

strengthen IT Investment Review Boards, which were created to control 

and evaluate the results of major IT investments. However, according to 

OMB, Investment Review Boards have failed to establish successful IT 

programs and correct unsuccessful ones because the review process has 

focused on short, broad-based reviews of each Federal agency‘s entire IT 

investment portfolio. To remedy this, OMB has required Federal agencies 

to implement the ―TechStat‖ model at the agency level. TechStat reviews 

entail indepth analysis of IT investments to measure their performance 

and identify corrective actions if needed. OMB expects this approach to 

improve agencies‘ IT performance management, expedite intervention in 

failing IT programs, and focus OMB‘s attention on a limited number of 

highest-priority cases. 

NRC has two Investment Review Boards that help the agency manage IT 

investment. The Information Technology Executive Portfolio Council 

(Portfolio Council) includes seven NRC office directors and is co-chaired 

by NRC‘s Chief Information Officer and Chief Financial Officer. The 

Information Technology/Information Management Board (IT Board)

includes representatives from OIS, the Computer Security Office, and 

NRC program offices. 

A. NRC Does Not Review Performance of Non-Major IT Investments, 

as Defined by OMB

OMB has directed Federal agencies to apply the TechStat model to review

performance of IT investments. NRC has implemented TechStat, but only 

uses it to review major IT investments as defined by OMB. NRC does not 

apply the TechStat model to non-major IT investments because the 

agency has recently restructured its Investment Review Boards, and the 

initial TechStat focus has been placed on major IT investments, which are 

fewer in number and higher in total value than non-major IT investments. 

Consequently, without reviewing non-major IT investments, NRC may 

miss opportunities to improve performance and cost-effectiveness of these 

investments.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

5

Federal Agencies Are To Apply the TechStat Model to Review 

Performance of IT Investments

OMB has directed Federal agencies to apply the TechStat model to review 

performance of IT investments. To facilitate this, OMB has provided 

guidance for conducting TechStat reviews. Federal agencies have some 

flexibility in selecting IT investments for review, but OMB guidance states 

that agencies should select investments for review based on data from 

agency performance management systems, congressional testimony, and 

other information sources. 

NRC Has Implemented TechStat, but Only Reviews Major IT Investments

NRC has implemented TechStat, but only reviews major IT investments. 

OMB defines a major investment as follows:

Major IT Investment means a program requiring

special management attention because of its 

importance to the mission or function of the agency,

a component of the agency, or another organization;

has significant program or policy implications; has high

executive visibility; has high development, operating,

or maintenance costs; is funded through other than

direct appropriations; or is defined as major by the 

agency‘s capital planning and investment control

process. OMB may work with the agency to declare

other investments as major investments...Investments

not considered  ̳major‘ are  ̳non-major.‘

NRC considers nine of its IT systems as major investments, and these 

investments account for approximately 72 percent of NRC‘s estimated 

$151 million FY 2013 IT budget. Not included in NRC‘s TechStat reviews 

are 23 non-major investments, which account for approximately 28 

percent of the agency‘s IT spending.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

6

NRC Has Restructured Investment Review Boards, and Initial Focus Has 

Been on Major IT Investments

NRC does not apply the TechStat model to non-major IT investments 

because the agency has recently restructured its Investment Review 

Boards, and the initial TechStat focus has been placed on major IT 

investments, which are fewer in number and higher in total value than 

non-major IT investments. NRC created a Portfolio Council and an IT

Board in early 2012 to replace existing IT governance organizations, and 

each was created with new charters. The Portfolio Council is tasked with

approving major IT investments. The IT Board, which is composed of 

representatives from OIS and other NRC offices, supports the Portfolio 

Council and reviews the performance of major IT investments. Non-major 

IT investments do not fall under the purview of these new organizations as 

described in their charters. 

Without Reviewing Non-Major IT Investments, NRC May Miss 

Opportunities To Improve Performance

Without reviewing non-major IT investments, NRC may miss opportunities 

to improve the performance and cost-effectiveness of these investments. 

Though it is prudent to scrutinize high-dollar-value programs, NRC‘s 23

non-major investments collectively compose approximately one-quarter of 

NRC‘s IT spending. NRC staff who are responsible for IT planning

expressed concern to OIG about the lack of management visibility over 

non-major IT investments. Given the fiscal constraints NRC faces and the 

resulting pressure on IT budgets, NRC could benefit significantly from

cost-effectiveness improvements in multiple non-major investments. 

Savings from improved or terminated non-major IT investments could be 

used to support higher priority IT investments.

Recommendation

OIG recommends that the Executive Director for Operations:

1. Review non-major IT investments in applying the TechStat 

model.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

7

Background for Action Item 13 Finding: Development of Specialized 

IT Acquisition Cadres

Action Item13 of the 25-Point Plan calls for Federal agencies to design 

and develop cadres of specialized IT acquisition professionals. According 

to OMB, the lag time between when the Federal Government defines its IT

requirements and when the contractor actually delivers the required IT 

product may allow technology to change substantially. Consequently, 

Federal IT acquisitions may become outdated by the time they are 

implemented. To address this problem, OMB directed Federal agencies 

to design and develop a cadre of specialized IT acquisition professionals

by strengthening staff IT acquisition skills through classroom training, onthe-job experience, and mentorship. By strengthening skills of IT

acquisition staff, OMB expects Federal agencies to expedite complex IT 

acquisitions. 

In July 2011, OMB released guidance on designing and developing a 

cadre of specialized IT acquisition professionals. The guidance describes

how agencies can design and organize a cadre of contracting 

professionals, program managers, and contracting officer representatives 

to ensure their functions work closely together throughout the contracting

process to achieve program goals. The OMB guidance also describes 

how agencies can strengthen the skills and capabilities of staff in their 

specialized acquisition cadres. Furthermore, the guidance requires senior 

agency managers to work with each other to create strategies and best 

practices in recruiting and retaining IT acquisition professionals.

B. NRC Has Specialized IT Acquisition Professionals, but Has Not 

Institutionalized Current Training and Retention Best Practices

OMB has directed Federal agencies to design and develop a cadre of 

specialized IT acquisition professionals by providing specific training, on 

the job experience, and mentoring. Although NRC has a branch of IT 

acquisition specialists who are encouraged to pursue training in this field, 

NRC has not institutionalized current training and retention best practices 

for these staff. This occurs because OMB approved NRC‘s 2012 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

8

acquisition human capital plan,12 which did not include details about staff 

training. Without institutionalized best practices, NRC faces challenges in 

training and retaining specialized IT acquisition professionals.

Federal Agencies Are To Design and Develop a Cadre of IT Acquisition 

Professionals

OMB has directed Federal agencies to design and develop a cadre of IT 

acquisition professionals by providing specific training, on the job 

experience, and mentoring. Additional guidance released by OMB in July 

2011 specifically required that agencies‘ senior managers13 work with 

each other in developing strategies and best practices for recruiting and 

retaining IT acquisition professionals.

NRC Has a Cadre of IT Acquisition Professionals, but Has Not 

Institutionalized Training and Retention Best Practices

Although NRC has a branch of IT acquisition specialists who are 

encouraged to pursue training in this field, NRC has not institutionalized 

current training and retention best practices for these staff. Contract 

specialists rotate within their division to gain exposure to different types of 

contracting, while taking contracting coursework to obtain Federal 

acquisition certification in contracting.

14 The first level of certification does 

not require specialization such as IT acquisition. Additionally, contract 

specialists working in IT acquisition can take elective coursework and 

attend IT conferences that are geared towards IT acquisition 

specialization, yet this training is not required. Although NRC has 

implemented mentoring, on-the-job training, and other human resource 

practices to develop IT acquisition staff, NRC officials acknowledged that 

these best practices have not been formalized in their office policy.

 

12 Each Federal agency covered by the Chief Financial Officers Act is required to develop an annual 

Acquisition Human Capital Plan as a means to improve the strategic management of the agency‘s 

acquisition workforce. A template developed by OMB‘s Office of Federal Procurement Policy and the 

Federal Acquisition Institute is used to gather information about each agency‘s acquisition workforce.

13 These senior managers include the Chief Acquisition Officer, Chief Information Officer, and Chief 

Human Capital Officer.

14 Federal Acquisition Certification – Contracting (FAC – C) has three levels. Each level is attainable 

through educational content and work experience in Government contracting. 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

9

OMB Approved NRC‘s Human Capital Plan, Which Did Not Include Details 

About Staff Training

NRC has not institutionalized training and retention best practices 

because OMB approved NRC‘s human capital plan, which did not include 

details about staff training. In March 2012, NRC submitted its annual

Acquisition Human Capital Plan for 2012 to OMB, but the document had 

no specific description of plans to train and retain IT acquisition 

professionals. NRC staff stated that guidance from OMB did not specify 

requirements for formalized training of IT acquisition staff, and that nothing

in OMB guidance implicitly or explicitly suggested it. OIG auditors did not 

find any information suggesting that OMB provided feedback or followup 

guidance for cultivating cadres of dedicated IT acquisition professionals.

Without Institutionalizing Current Best Practices, NRC Faces Challenges 

in Training and Retaining IT Acquisition Staff

NRC is pursuing an aggressive strategic acquisition initiative, and will 

need highly skilled acquisition professionals to support its efforts. Without 

an institutionalized development program for IT acquisition professionals, 

NRC faces challenges in training and retaining qualified personnel to 

provide these services. It would be prudent to formalize current best 

practices for staff training so that best practices can be sustained in the 

face of potential pressure from management changes or resource 

constraints. Additionally, developing and retaining staff with expertise in 

IT acquisition is especially important as NRC relies increasingly on IT to 

carry out its mission.

Recommendation

OIG recommends that the Executive Director for Operations:

2. Incorporate into existing policy procedures for developing IT 

acquisition professionals, to include training courses, on-the-jobexperience, and mentoring based on OMB guidance.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

10

Background for Action Item 1 Findings: Data Center Consolidation

Action Item 1 of the 25-Point Plan calls for agencies to complete detailed 

data center consolidation plans in accordance with the Federal Data 

Center Consolidation Initiative (the Consolidation Initiative). In February 

2010, OMB launched the Consolidation Initiative and issued guidance for 

Federal CIO Council15 agencies. The guidance called for agencies to 

inventory their data center assets, develop consolidation plans throughout 

FY 2010, and integrate those plans into their FY 2012 budget 

submissions.

The Consolidation Initiative is aimed at assisting agencies in identifying 

their existing data center assets and formulating detailed consolidation 

plans that include a technical roadmap and clear consolidation targets.

This effort aims to reduce the number of data centers across the Federal 

Government and assist agencies in applying best practices from the public 

and private sector, with goals to: 

• Promote the use of ―Green IT‖ by reducing the overall energy and 

real estate footprint of Federal Government data centers.

• Reduce the cost of data center hardware, software, and 

operations.

• Increase the overall IT security posture of the Government.

• Shift IT investments to more efficient computing platforms and 

technologies.

In its reports to OMB, NRC counts three data centers located in the 

agency‘s headquarters complex. NRC has built an additional data center 

inside a new headquarters building, which the agency will use to 

consolidate offices that are spread across multiple facilities. The new data 

center includes controls to monitor and adjust temperature, lighting, and 

 

15 The Federal CIO Council is the principal interagency forum to improve agency practices

on such matters as the design, modernization, use, sharing, and performance of agency

information resources.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

11

electricity use. In addition to building a more energy efficient data center,

NRC is working to reduce data center power consumption through server 

virtualization.16 

One alternative to hosting data centers at an agency‘s facilities is external

hosting. The 25-Point Plan directs Federal agencies to explore external

hosting options through ―Cloud First‖ policies,

17 according to which 

agencies outsource data processing to a commercial service provider or to 

another Federal agency with the capability to act as a ―cloud‖ service 

provider.

C. NRC Does Not Include All Data Centers in Consolidation Plans

Action Item 1 of the 25-Point Plan directs Federal agencies to comply with

the Consolidation Initiative, which requires Federal agencies to inventory 

their data center assets and develop data center consolidation plans. 

However, NRC has limited its data center count to three headquarters 

facilities, excluding data centers in its regional offices and Technical 

Training Center. This has occurred because OMB has promulgated 

different definitions of ―data center,‖ and NRC has interpreted OMB 

guidance to exclude regional data centers. Without a complete data 

center count, NRC may miss opportunities to identify potential cost 

savings that could be realized through expanding its data center 

consolidation efforts.

OMB‘s Data Center Consolidation Initiative Requires Federal Agencies To 

Provide a Count of All Data Centers They Host

Action Item 1 of the 25-Point Plan directs Federal agencies to comply with 

the Consolidation Initiative, which requires Federal agencies to inventory 

their data center assets and develop data center consolidation plans. The 

Consolidation Initiative‘s first data center definition in October 2010 was 

―any room greater than 500 square feet in area devoted to data

processing, and meeting a tier (I, II, III, & IV) classification defined by the 

 

16 Virtualization is a technology that uses software to run multiple virtual machines with different operating 

systems on a single physical server.

17 Adopting ―Cloud First‖ policies is Action Item 3 of the 25-Point Plan. To comply with this action item, 

NRC has adopted cloud-based capital planning software, teleconferencing service, and emergency 

notification service. 
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

12

Uptime Institute.‖18 This guidance was supplemented by data center 

consolidation planning guides and templates, as well as a ―Frequently 

Asked Questions‖ document that expanded the data center definition to 

include server closets greater than 200 square feet, scientific and test lab 

servers, and field office data centers. OMB updated its data center 

inventory guidance March 2012 to eliminate the square footage metric, 

and include any ―closet, room, floor or building for the storage, 

management, and dissemination of data and information.‖19

NRC Has Limited Its Data Center Count to Headquarters Facilities

In NRC‘s annual reports to OMB on Consolidation Initiative compliance, 

NRC has limited its data center count to three headquarters facilities. 

NRC has not counted data centers located at its regional offices and its 

Technical Training Center.

NRC Interpretation of OMB Guidance Has Limited NRC‘s Data Center 

Count

NRC has counted only three headquarters data centers in its reports to 

OMB because OMB has promulgated different definitions of ―data center,‖ 

and NRC has interpreted OMB guidance to exclude regional data centers. 

As noted above, OMB has defined ―data center‖ at least two different 

ways, and initial 2010 criteria were supplemented by multiple guidance 

documents that added more detail to these criteria. In their interpretation 

of OMB‘s guidance, NRC staff told OIG auditors that OMB‘s intent was 

presumed to include only three main headquarters data centers that run 

―enterprise-wide‖ applications.

Without Complete Data Center Count, NRC May Not Identify Potential 

Cost Savings

Without a complete data center count, NRC may miss opportunities to 

identify potential cost savings that could be realized through expanding its 

 

18 The Uptime Institute is an organization that develops technical standards for data center operations. 

Tier I-IV ratings reflect various elements of a data center‘s infrastructure that allow it to maintain 

operations. Tier IV—the highest rating—refers to data centers with capabilities to withstand unplanned, 

worst-case infrastructure failure with no critical load impact. 

19 This definition excludes spaces devoted exclusively to communications and network equipment, such 

as telecommunications rooms.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

13

data center consolidation efforts. Indeed, one of the main objectives of 

the Consolidation Initiative is to reduce the number of data centers 

operated by Federal agencies as means to reduce costs and adopt more 

efficient computing platforms. Facility consolidation and server 

virtualization offer potential efficiencies, but NRC staff cannot measure the 

costs and benefits of these alternatives—and make well-informed plans 

for the future—without an accurate analysis of its data center inventory. 

Recommendation

OIG recommends that the Executive Director for Operations:

3. Include all NRC data center infrastructure as currently defined 

by OMB in data center consolidation planning and reporting to 

OMB.

D. NRC Did Not Perform Alternatives Analysis for the 3WFN Data 

Center

Federal guidance instructs agencies to consider alternatives to in-house 

data hosting when formulating data center consolidation plans. NRC built

a new data center in the Three White Flint North building (3WFN) to 

consolidate some headquarters data centers, but did not perform an 

alternatives analysis prior to undertaking the project. NRC staff did not 

perform an alternatives analysis to include external hosting for the 3WFN 

data center because senior management had committed to moving 

existing data centers to 3WFN early in the planning phase. As result, the 

3WFN data center was built with extra capacity that may not be used.

Agencies Should Consider Alternatives to In-House Data Hosting When 

Formulating Data Center Consolidation Plans

Federal guidance instructs agencies to consider alternatives to in-house 

data hosting when formulating data center consolidation plans. 

Consolidation Initiative implementation guidance20 issued by the Federal 

CIO Council explicitly states this principle, and adds that agencies should 

 

20 In February 2010, the Administration launched the Federal Data Center Consolidation Initiative 

(FDCCI) and issued guidance for Federal CIO Council agencies. The guidance called for agencies to 

inventory their data center assets, develop consolidation plans throughout fiscal year 2010, and integrate 

those plans into agency fiscal year 2012 budget submissions.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

14

maximize departmentwide services, interagency sharing, co-location and 

virtualization if ―in-house‖ solutions are deemed necessary for 

performance or security reasons. Moreover, the Clinger-Cohen Act of 

1996 requires Federal agencies to analyze IT investments to help 

maximize the value and manage the risk of these investments.

NRC Did Not Perform Alternatives Analysis for New Data Center

NRC built a new data center in 3WFN to consolidate some headquarters 

data centers, but did not perform an alternatives analysis prior to 

undertaking the project. In 2010, NRC staff provided the Commission with 

a cost estimate for including a data center in the 3WFN office building, and 

a contractor performed a data center construction cost estimate before 

3WFN building plans were available. However, neither of these estimates 

were based upon actual building plans, nor did they examine alternatives 

to in-house data hosting. Then, in early 2012—more than 2 years after 

NRC had committed to moving its data center to 3WFN—NRC undertook

an alternatives analysis that included market research of various data 

hosting options. Figure 3 shows a section of the 3WFN data center at one 

point during construction.

Figure 3: New Data Center Construction in Progress

Source: NRC.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

15

NRC Senior Management Committed to New Data Center Without 

Alternatives Analysis

NRC staff did not perform an alternatives analysis that included external 

hosting for the 3WFN data center because senior management had 

committed to moving existing data centers to 3WFN early in the project

planning phase. NRC signed a lease with the General Services 

Administration in October 2009 for the new 3WFN building,21 and NRC 

staff subsequently analyzed costs of building a data center in 3WFN. 

Based on this analysis, the Commission approved $12.5 million for design 

and construction of a new data center in 3WFN, and directed staff to 

complete NRC‘s move into the new data center in FY 2013. 

NRC 3WFN Data Center Was Built With Spare Capacity

The 3WFN data center was built with spare capacity that may not be used.

The new data center was built with infrastructure to accommodate up to 

184 server racks if needed,

22 which includes additional electrical and 

cooling systems. NRC currently plans to use 90 server racks, and is 

considering alternatives to in-house data hosting that would eliminate the 

need to nearly double its physical server count. Emerging budget and 

space usage constraints bear heavily on NRC‘s data center consolidation 

plans, so careful analysis of alternatives to in-house data hosting will be 

particularly important in adopting the most cost-effective solution to NRC‘s

data center needs. 

Recommendation

OIG recommends that the Executive Director for Operations:

4. Create short- and long-term plans for the 3WFN data center, to 

include review of external hosting options and cloud computing 

service providers per OMB guidance.

 

21 This lease calls for construction of an office building with infrastructure such as heating, plumbing, 

electricity, and fire suppression. NRC was responsible for additional ―tenant improvements‖ such as a 

data center. 

22 NRC built additional server infrastructure into the 3WFN data center to avoid renovation costs in case 

extra server capacity became necessary at some point in the future.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

16

IV. Consolidated List of Recommendations

OIG recommends that the Executive Director for Operations:

1. Review non-major IT investments in applying the TechStat 

model.

2. Incorporate into existing policy procedures for developing IT 

acquisition professionals, to include training courses, on-the-jobexperience, and mentoring based on OMB guidance.

3. Include all NRC data center infrastructure as currently defined 

by OMB in data center consolidation planning and reporting to 

OMB.

4. Create short- and long-term plans for the 3WFN data center, to 

include review of external hosting options and cloud computing 

service providers per OMB guidance.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

17

V. AGENCY COMMENTS

An exit conference was held with the agency on December 18, 2012. At this meeting, 

agency management stated their general agreement with the findings and 

recommendations in this report and opted not to provide formal comments for inclusion 

in this report.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

18

Appendix A

OBJECTIVE, SCOPE, AND METHODOLOGY

OBJECTIVE

The audit objective was to evaluate NRC‘s progress in carrying out the ―25 

Point Implementation Plan to Reform Federal Information Technology 

Management.‖

SCOPE

The audit reviewed NRC‘s activities related to 25-Point Plan action items 

for which the agency was responsible, with special emphasis on IT 

investment review boards, IT acquisition cadres, and data center 

consolidation. OIG conducted this performance audit from April 2012 

through October 2012 at NRC headquarters in Rockville, MD. To address 

the audit objective, OIG auditors conducted multiple interviews of NRC 

staff representing the Office of Information Services, Computer Security 

Office, and Office of Administration. Auditors also conducted interviews 

with staff representing NRC‘s regional offices.

METHODOLOGY

OIG reviewed the ―25 Point Implementation Plan to Reform Federal 

Information Technology Management,‖ and other pertinent NRC and 

Federal Government guidance including:

NRC IT Investment Review Board charters and TechStat 

documentation.

OMB cloud computing guidance.

OMB Office of Federal Procurement Policy guidance.

OMB Federal Data Center Consolidation Initiative guidance.

OMB Chief Information Officer authorities guidance.

OMB Circular A-130.

Federal CIO Council best practice and lessons learned 

documents.

OIG also analyzed documents used in planning and budgeting for NRC‘s 

3WFN data center, and a data center services alternative analysis study.
Audit of NRC‘s Progress in Carrying Out the ―25 Point Implementation Plan to Reform Federal Information Technology Management

19

We conducted this performance audit in accordance with generally 

accepted government auditing standards. Those standards require that 

we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our 

audit objective. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit 

objective. 

The audit work was conducted by Beth Serepca, Team Leader; Paul 

Rades, Audit Manager; Melissa Schermerhorn, Senior Analyst; and 

Avinash Jaigobind, Analyst.