United States Government Accountability Office

GAO Report to Congressional Committees

INFORMATION 

TECHNOLOGY 

Immigration and 

Customs Enforcement 

Is Beginning to 

Address Infrastructure 

Modernization 

Program Weaknesses 

but Key Improvements 

Still Needed 

July 2006 

 

GAO-06-823 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

July 2006

INFORMATION TECHNOLOGY 

Immigration and Customs Enforcement Is 

Beginning to Address Infrastructure 

Modernization Program Weaknesses but 

Key Improvements Still Needed 

Highlights of GAO-06-823, a report to 

congressional committees 

The Department of Homeland

Security’s (DHS) fiscal year 2005

appropriations act provided $39.6

million for Immigration and 

Customs Enforcement’s (ICE) 

program to modernize its 

information technology (IT)

infrastructure. The goals of the 

program—which consists of seven 

projects and is referred to as 

Atlas—include improving

information sharing and 

strengthening security. As 

mandated by the appropriations 

act, the department is to develop 

and submit for approval an

expenditure plan for Atlas that

satisfies certain legislative 

conditions, including a review by

GAO. In performing its review of

the Atlas plan, GAO was asked to

(1) determine whether the plan 

satisfies certain legislative 

conditions, (2) determine the status

of our prior recommendations, and 

(3) provide any other observations

about the plan and management of

the program.

What GAO Recommends

GAO is recommending that DHS 

minimize Atlas program risks by, 

among other things, developing and 

implementing project plans

consistent with elements of

effective project planning. DHS did

not provide additional substantive 

comments on this report

recognizing that ICE had already 

agreed with the briefing contained 

in this report. 

DHS’s fiscal year 2005 expenditure plan, related documentation, and 

program officials’ statements and commitments, satisfy or partially satisfy 

the legislative conditions set forth by Congress, including (1) meeting the 

capital planning and investment control review requirements established by

the Office of Management and Budget (OMB); (2) complying with the DHS 

enterprise architecture; (3) complying with the acquisition rules,

requirements, guidelines, and system acquisition management practices of 

the federal government; and (4) being reviewed and approved by DHS’s 

Investment Review Board, the Secretary of DHS, and OMB. 

A number of steps to address prior GAO recommendations are in progress or 

have been partially implemented (see table). For example, ICE issued a 

revised cost-benefit analysis in December 2005. However, this analysis did 

not address all key ICE mission requirements, such as sharing law 

enforcement and immigration information with external partners. In 

addition, it issued an updated security plan in April 2006, but the plan was 

missing important security management practices, or only partially 

addressed them. 

Status of Actions to Implement GAO’s Open Recommendations for Atlas 

GAO recommendation Status 

1. Revise and update cost-benefit analysis. Partially complete 

2. Ensure program office is operational. In progress 

3. Develop and implement updated security plan and privacy impact 

assessment. 

Partially complete 

4. Develop and implement rigorous performance management 

practices. 

In progress 

5. Ensure that future expenditure plans fully disclose Atlas 

capabilities, schedule, cost and benefits to be delivered, as well as

the acquisition strategy. 

In progress 

Source: GAO.

GAO also observed that current Atlas project plans do not include essential 

elements, such as a work breakdown structure of tasks to be performed, 

identification of project costs, analysis of constraints and risks, and review 

and approval by management and key stakeholders. 

Thus, there is much that remains to be accomplished to minimize the risks 

associated with the Atlas program’s capacity to deliver promised IT 

infrastructure capabilities and benefits on time and within budget. Given that 

hundreds of millions of dollars are to be invested, it is essential that DHS 

follow through on commitments to build the capacity to effectively manage 

the program. Moreover, expenditure plans need to relay reliable information 

about program commitments, including the benefits to be produced, the 

capabilities to be delivered, and the cost and schedule estimates to be met. 

By not providing this information in its fiscal year 2005 expenditure plan, the 

department is impeding congressional oversight and not providing a 

meaningful basis for measuring performance and ensuring accountability. 

www.gao.gov/cgi-bin/getrpt?GAO-06-823.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact Randolph C. 

Hite at (202) 512-3439 or hiter@gao.gov. 
Contents 

Letter 1

Compliance with Legislative Conditions 2

Status of Open Recommendations 2 

Other Observations on the Expenditure Plan and Management of 

Atlas 5

Conclusions 6

Recommendations for Executive Action 6 

Agency Comments and Our Evaluation 6 

Appendix I Briefing to Staffs Subcommittees on Homeland 

Security, Senate and House Committees on 

Appropriations 8 

Appendix II GAO Contact and Staff Acknowledgments 73 

Abbreviations 

CIO Chief Information Officer 

DHS Department of Homeland Security 

EA Enterprise Architecture 

ICE Immigration and Customs Enforcement 

INS Immigration and Naturalization Service 

IRB Investment Review Board 

IT information technology 

OMB Office of Management and Budget 

PART Program Assessment Rating Tool 

SEI Software Engineering Institute 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 

Page i GAO-06-823 Information Technology
United States Government Accountability Office

Washington, DC 20548 

July 27, 2006

The Honorable Judd Gregg 

Chairman 

The Honorable Robert C. Byrd 

Ranking Member 

Subcommittee on Homeland Security 

Committee on Appropriations 

United States Senate 

The Honorable Harold Rogers 

Chairman 

The Honorable Martin Olav Sabo 

Ranking Member 

Subcommittee on Homeland Security 

Committee on Appropriations 

House of Representatives 

The 2005 Department of Homeland Security Appropriations Act1

 provided 

$39.6 million for Immigration and Customs Enforcement’s (ICE) program 

to modernize its information technology (IT) infrastructure. The goals of

the program—which consists of seven related IT projects and is referred 

to by ICE as Atlas—include improving information sharing, strengthening 

information security, and improving workforce productivity. The act 

prohibited the Department of Homeland Security (DHS) from obligating 

the $39.6 million until the department developed a plan that satisfied 

certain legislative conditions for how the funds are to be spent. The 

conditions included, among other things, having us review the plan. On 

March 15, 2006, DHS submitted its fiscal year 2005 expenditure plan to the

Senate and House Appropriations Subcommittees on Homeland Security. 

Pursuant to the act, we reviewed the plan; our objectives were to (1) 

determine whether the plan satisfies legislative conditions specified in the 

act, (2) determine the status of prior recommendations, and (3) provide 

any other observations about the plan and management of the program. 

On April 27, 2006, we provided DHS officials, including ICE’s Deputy Chief 

Information Officer (CIO), a written briefing on our findings, conclusions, 

 1

Pub. L. No. 108-334 (Oct. 18, 2004). 

Page 1 GAO-06-823 Information Technology 
and recommendations. These officials agreed with our briefing. On May 1,

2006, we provided this briefing to the Senate and House Homeland 

Security Subcommittee staffs.2

 This report provides the presentation slides 

used to brief the staffs and summarizes our findings, conclusions, and 

recommendations. The full briefing, including our scope and methodology, 

is reprinted in appendix I.

DHS has taken actions to address each of the applicable legislative 

conditions specified in the appropriations act. In particular, the plan,

including related program documentation and program officials’ stated 

commitments, satisfied or partially satisfied key aspects of (1) meeting the

capital planning and investment control review requirements of the Office

of Management and Budget (OMB);3

 (2) complying with the DHS 

enterprise architecture;4

 (3) complying with acquisition rules, 

requirements, guidelines, and systems acquisition management practices 

of the federal government; and (4) having the plan reviewed and approved

by DHS’s Investment Review Board, the Secretary of Homeland Security, 

and OMB. 

ICE is taking steps to address our open recommendations. Each 

recommendation, along with the status of actions to address it, is 

summarized as follows: 

Compliance with 

Legislative Conditions 

Status of Open 

Recommendations 

• Recommendation: Revise and update the cost-benefit analysis to identify 

current mission requirements, determine how they will be met, and 

develop an estimate of the program’s incremental and life- cycle costs, 

benefits, schedule, and return on investment. 

 2

We transmitted the briefing to the staffs on April 28, 2006. 

3

OMB Circular A-11, part 7, establishes policy for planning, budgeting, acquiring, and

managing federal capital assets. 

4

An enterprise architecture provides a clear and comprehensive picture of an organization’s

operations and its supporting systems and infrastructure. It is an essential tool for

effectively and efficiently engineering business processes and for implementing and

evolving supporting systems in a manner that maximizes interoperability, minimizes 

overlap and duplication, and optimizes performance. 

Page 2 GAO-06-823 Information Technology 
Status: ICE has partially completed5 implementation of this 

recommendation. A revised cost-benefit analysis was issued in December 

2005 as part of a business case justification for Atlas mission requirements. 

The analysis included three alternative solutions for how requirements 

would be met, as well as each alternative’s estimated life-cycle costs, 

benefits, schedule, and return on investment. However, the analysis does 

not fully adhere to our recommendation and key federal practices.6

 For 

example, it does not address all key mission requirements, such as sharing 

law enforcement and immigration information with external partners 

(such as the Departments of Justice and State, state and local law 

enforcement). According to the program manager, a long-range strategic 

plan for information sharing will be developed to identify requirements, 

and it will be used to update the analysis of costs and benefits related to 

information sharing and other requirements. 

• Recommendation: Make the program office operational by (1) developing 

a staffing needs assessment to determine the positions and the level of 

staffing needed for all projects to adequately manage the program, 

including a human capital strategy for acquiring staff and a timetable for 

bringing them on board; (2) finalizing the roles and responsibilities for the 

positions identified in the staffing assessment and for the projects; and (3) 

implementing and institutionalizing key acquisition management controls, 

including risk management processes where relevant responsibilities are 

assigned and key risks and their status are reported to an executive body. 

Status: ICE’s implementation of this recommendation is in progress.

7

 First, 

in April 2006, program officials completed an organizational and staffing 

assessment. The assessment identified an organizational structure, 

functions, and associated positions for the program office as well as the 

staff needed to fill the positions. To date, ICE has filled most of the 

positions (and is in the process of filling the others). Second, as part of the 

aforementioned assessment, program officials finalized staff roles and 

responsibilities and assigned high-level tasks for each staff member. Third, 

program officials have begun to implement key acquisition management 

controls. For example, the Atlas program completed a risk management 

 5

Partially complete means actions are under way to implement the recommendation. 

6

OMB, Guidelines and Discount Rates for Benefits-Cost Analysis of Federal Programs,

Circular A-94. (Washington, D.C.: Oct. 29, 1992). 

7

In progress means that actions have been initiated to implement the recommendation. 

Page 3 GAO-06-823 Information Technology 
plan in January 2006 and hired an analyst to manage the risks. However, a

complete inventory of risks has not been prepared. 

• Recommendation: Develop and implement an updated security plan and 

privacy impact assessment. 

Status: ICE has partially completed implementing this recommendation. 

The program issued an updated security plan in April 2006, but it is 

missing important IT security management practices or only partially 

addresses them. For example, the program did not have a complete 

inventory of all information systems or a complete description of the 

systems. In addition, the program did not define common and systemspecific security controls. Regarding privacy, the program issued a draft 

privacy impact assessment in August 2005, which is being reviewed by the 

department’s Privacy Office. This office has requested additional 

documentation from ICE but did not provide a date for when its review 

would be finalized. 

• Recommendation: Develop and implement rigorous performance 

management practices for the program that include properly aligned goals, 

benefits, achievements, and anticipated achievements that are defined in 

measurable terms. 

Status: ICE implementation of this recommendation is in progress. The 

program has taken steps to align its goals and other indicators and is 

beginning to implement them. For example, as part of the business case 

(December 2005), the program mapped Atlas’s mission and goals to ICE’s 

mission and goals. The program also developed seven performance goals

and associated measures for the projects. However, three Atlas projects 

did not have performance goals and measures; the program manager plans 

to develop them by June 2006. In addition, the program has yet to 

implement the seven measures. 

• Recommendation: Ensure that future expenditure plans fully disclose the 

system capabilities, schedule, cost, and benefits to be delivered, as well as 

the acquisition strategy.

Status: ICE implementation of this recommendation is in progress. The 

fiscal year 2005 expenditure plan does not show the level of detail and

program scope for congressional stakeholders to understand its plans and

commitments relative to system capabilities, cost, benefits, and schedule. 

In addition, it does not sufficiently describe progress made against 

program commitment (e.g., expected benefits). Instead, the plan and 

Page 4 GAO-06-823 Information Technology 
supporting documentation describe, for example, high-level system 

capabilities to be delivered under each project. Our prior experience 

shows that these plans need to disclose a sufficient level and scope of 

information for Congress to understand what the system capabilities are to 

be delivered, by when, at what cost, and what progress is being made 

against the commitments. The program manager stated that the program 

planned to include this information in future plans. 

Our observations address (1) Atlas project management planning and (2) 

an OMB assessment of the program. An overview of these observations 

follows: 

• Project management planning does not include key elements. Atlas 

project plans, which are a key aspect of effective project planning, are not 

fully consistent with relevant guidance. For example, the plans are at a 

high level and are not based on a detailed work breakdown structure of 

tasks to be performed, do not include information on project cost or 

budget, and do not identify constraints or risks. Further, the plans have 

not been reviewed and approved by management and key stakeholders. 

According to the program manager, missing elements will be incorporated 

as the plans are reviewed and made final. 

Other Observations 

on the Expenditure 

Plan and Management 

of Atlas

• Efforts are under way to address OMB concerns that Atlas was not 

demonstrating results. An August 2005 OMB assessment found that Atlas 

was not demonstrating expected results.8

 In response, ICE developed an 

action plan (dated April 2006) to address the concerns. Examples of steps 

planned and under way include establishing an Atlas program 

management office to manage and oversee the program and developing

goals and measures that are to be finalized by the end of June 2006. 

Program officials told us that the program will not be ready to be 

reassessed (i.e., agency management does not believe that significant 

improvement could be shown) by OMB until—at the earliest—October 

2006. Citing this assessment, the administration’s fiscal year 2007 budget 

stated that no funds were being provided for Atlas until the program 

weaknesses are addressed. 

 8

OMB made this assessment using its Program Assessment Rating Tool, which is used to 

assess how well government programs are performing.

Page 5 GAO-06-823 Information Technology 
The fiscal year 2005 Atlas expenditure plan, in combination with related 

program documentation and program officials’ statements, satisfies or 

partially satisfies the legislative conditions set forth by Congress. 

However, this satisfaction is based on plans and commitments that 

provide for meeting these conditions, rather than on completed actions to

satisfy the conditions. In addition, while steps are being initiated that are 

intended to address program management weaknesses, a number of 

improvements, including those recommended in our past report, have yet

to be implemented. 

Thus, there is much that still needs to be accomplished to minimize the 

risks associated with the program’s capacity to deliver promised IT 

infrastructure capabilities and benefits on time and within budget. Given 

that hundreds of millions of dollars are to be invested, it is essential that 

DHS follow through on its commitments to build the capacity to 

effectively manage the program. Proceeding without this capacity 

introduces unnecessary risks to the program and potentially jeopardizes 

its viability for future investment. 

Moreover, congressional decision makers need reliable information about 

program commitments that are to be met with the expenditure plan funds, 

including the benefits to be produced, the capabilities to be delivered, and 

the cost and schedule estimates to be met. By not providing this 

information in its fiscal year 2005 expenditure plan, DHS is impeding 

congressional oversight by not providing a meaningful basis for measuring 

performance and ensuring accountability. 

To minimize risks to the Atlas program, we recommend that the Secretary 

of Homeland Security direct the Assistant Secretary for Immigration and 

Customs Enforcement to take the following two actions: 

• Report periodically to Senate and House appropriations subcommittees 

regarding the program’s progress in implementing our recommendations. 

• Develop and implement Atlas project plans consistent with elements of 

effective project planning. 

On June 14, 2006, we provided a draft of this report to DHS for comment. 

On July 10, 2006, DHS’s GAO audit liaison told us that the department did 

not intend to provide comments, recognizing that DHS officials, including

the ICE Deputy CIO, had previously agreed with the briefing that this 

Conclusions 

Recommendations for 

Executive Action 

Agency Comments 

and Our Evaluation 

Page 6 GAO-06-823 Information Technology 
report summarizes. In addition, the liaison e-mailed us technical 

comments updating the status of Atlas-related activities of the 

department’s Privacy Office and ICE. We incorporated the comments in 

the report and briefing as appropriate. 

We are sending copies of this report to the Chairmen and Ranking 

Members of other Senate and House committees and subcommittees that 

have authorization and oversight responsibilities for homeland security. 

We are also sending copies to the Secretary of Homeland Security, 

Assistant Secretary for Immigration and Customs Enforcement, and the

Director of OMB. Copies of this report will also be available at no charge 

on our Web site at www.gao.gov. 

Should you or your offices have any questions on matters discussed in this

report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact 

points for our Offices of Congressional Relations and Public Affairs may 

be found on the last page of this report. Key contributions to this report 

are listed in appendix II.

Randolph C. Hite 

Director, Information Technology Architecture 

 and Systems Issues 

Page 7 GAO-06-823 Information Technology 
Appendix I: Briefing to Staffs 

on Home

Committees

Subcommittees

land Security, Senate and House

 on Appropriations

Page 8 GAO-06-823 Information Technology 

Appendix I: Briefing to Staffs Subcommittees 

on Homeland Security, Senate and House 

Committees on Appropriations 

Briefing to the staffs of the

Subcommittees on Homeland Security,

Senate and House Committees on Appropriations

April 28, 2006

Information Technology: Immigration and Customs 

Enforcement Is Beginning to Address Infrastructure 

Modernization Program Weaknesses but Key Improvements

Still Needed
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 9 GAO-06-823 Information Technology 

2

Briefing Overview

• Introduction

• Objectives

• Results in Brief

• Background

• Results

• Legislative Conditions

• Status of Open Recommendations

• Observations

• Conclusions

• Recommendations

• Agency Comments

• Attachment I: Scope and Methodology
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 10 GAO-06-823 Information Technology 

3

Introduction

The Department of Homeland Security’s (DHS) Bureau of Immigration and 

Customs Enforcement (ICE)1 is responsible for enforcing immigration, border 

security, trade, and other laws by, for example, investigating and collecting

intelligence on individuals and groups that act to violate these laws. ICE is also 

responsible for protecting federal facilities. 

Atlas is the ICE program developed to modernize the bureau’s information 

technology (IT) infrastructure, which includes the hardware (e.g., servers, routers,

storage devices, communication lines) and system software (e.g., database 

management and operating systems and network management) that provide an 

environment for operating and maintaining software applications.

According to ICE, the goals of Atlas include improving information sharing, 

strengthening information security, and improving workforce productivity. 

1ICE was formed from the former Immigration and Naturalization Service (INS), U.S. Customs Service, and other entities. Atlas began in 2002

under the former INS.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 11 GAO-06-823 Information Technology 

4

Introduction

The fiscal year 2005 Department of Homeland Security Appropriations Act

2

appropriated about $39.60 million for Atlas3 and prohibited DHS from obligating 

these funds until the department submitted a plan for how the funds were to be 

spent that satisfied the following legislative conditions: 

• meets the capital planning and investment control review requirements

established by the Office of Management and Budget (OMB), including OMB 

Circular A-11, part 7;4

• complies with DHS’s enterprise information systems architecture;

• complies with the acquisition rules, requirements, guidelines, and systems 

acquisition management practices of the federal government;

• is reviewed and approved by DHS’s Investment Review Board (IRB),5 the

Secretary of Homeland Security, and OMB; and

• is reviewed by the GAO.

2Pub. L. No. 108-334 (Oct. 18, 2004). 3In the Act, Atlas is called Automation Modernization. 4OMB Circular A-11 establishes policy for planning, budgeting, acquisition, and management of federal capital assets. 5The purpose of the IRB is to integrate capital planning and investment control, budgeting, and acquisition. It is also to ensure that spending on

investments directly supports and furthers the mission and that this spending provides optimal benefits and capabilities to stakeholders and customers.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 12 GAO-06-823 Information Technology 

5

Introduction

DHS submitted its fiscal year 2005 expenditure plan for $39.60 million on March 

15, 2006, to the Senate and House Appropriations Subcommittees on Homeland

Security. 

DHS submitted its fiscal year 2004 plan, which was for $9.8 million appropriated in

fiscal year 2004, on March 16, 2005. We reviewed the plan, briefed the 

subcommittees in May 2005, and reported our results in September 2005.6

6 GAO, Information Technology: Management Improvements Needed on Immigration and Customs Enforcement’s Infrastructure Modernization 

Program, GAO-05-805, (Washington, D.C.: Sept. 7, 2005).
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 13 GAO-06-823 Information Technology 

6

Objectives

As agreed, our objectives were to

1. determine whether the Atlas fiscal year 2005 expenditure plan satisfies the 

legislative conditions, 

2. determine the status of our prior recommendations on Atlas, and

3. provide any other observations about the expenditure plan and DHS’s 

management of the Atlas program.

We conducted our work at DHS and ICE headquarters in Washington, D.C., 

from March 2006 through April 2006 in accordance with generally accepted

government auditing standards. Details of our scope and methodology are 

provided in attachment I.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 14 GAO-06-823 Information Technology 

7

Results in Brief

Objective 1: Satisfaction of legislative conditions

Legislative conditions

1. Meets the capital planning and investment control review 

requirements established by OMB, including OMB Circular A-11,

part 7.

2. Complies with the DHS enterprise information systems

architecture.

3. Complies with the acquisition rules, requirements, guidelines, and 

systems acquisition management practices of the federal 

government.

4. Is reviewed and approved by the DHS IRB, Secretary of

Homeland Security, and OMB.

5. Is reviewed by GAO.

Status

satisfied

7Partially satisfied means that the plan, in combination with supporting documentation, and stated commitments by program officials, either satisfied 

or provides for satisfying many, but not all, key aspects of the condition that we reviewed.

8Satisfied means that the plan, in combination with supporting documentation, and stated commitments by program officials, either satisfied or 

provided for satisfying every aspect of the condition that we reviewed.

partially satisfied7

Source: GAO.

satisfied

partially satisfied

satisfied8
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 15 GAO-06-823 Information Technology 

8

Results in Brief

Objective 2: Status of actions to implement our open recommendations

GAO recommendations

1. Revise and update the cost-benefit analysis.

2. Ensure the Atlas program office is operational.

3. Develop and implement an updated Atlas security plan and 

privacy impact assessment.

4. Develop and implement rigorous performance management

practices.

5. Ensure that future expenditure plans fully disclose the system

capabilities, schedule, cost and benefits to be delivered, as well

as the acquisition strategy for Atlas.

Status

9Partially complete means actions are under way to implement the recommendation.

10In progress means that actions have been initiated to implement the recommendation.

partially complete9

in progress10

in progress

partially complete

Source: GAO.

in progress
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 16 GAO-06-823 Information Technology 

9

Results in Brief

Objective 3: Other Observations

• Project management planning does not include key elements. Specifically, the

project plans developed for each of the seven Atlas projects do not include key 

elements of effective project planning such as identifying constraints and risks

and being reviewed and approved by management and key stakeholders.

• The program is starting to address an August 2005 OMB assessment that 

found, among other things, that Atlas was not demonstrating results and had

program management weaknesses. As a result, the administration did not 

provide funding for Atlas in its fiscal year 2007 budget. In April 2006, the 

program developed a corrective action plan to address assessment findings. 

Examples of corrective actions planned and under way include establishing a 

program management office and developing performance goals and 

measures. Program officials did not request to be reassessed by OMB in fiscal 

year 2006 because they did not believe significant improvement could be 

shown during that period. Rather, these officials are planning to be reassessed 

in fiscal year in 2007.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 17 GAO-06-823 Information Technology 

10

Results in Brief

We are making recommendations to the Secretary of Homeland Security to 

improve Atlas expenditure planning and program management. 

In commenting on a draft of this briefing, ICE officials, including the deputy chief 

information officer who is also the Atlas program manager, agreed with our results.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 18 GAO-06-823 Information Technology 

11

Background

ICE

ICE was formed as a component agency of DHS in 2003 when the law

enforcement functions of the Justice Department’s former Immigration and 

Naturalization Service (INS) and the Treasury Department’s former Customs 

Service and other agencies were merged into DHS.

The ICE mission is to ensure the security of the American people and homeland

by, among other means, investigating violators of and enforcing the nation's

immigration and customs laws; policing and securing federal buildings and other 

facilities; and collecting, analyzing, and disseminating intelligence to assist in these 

endeavors. 

Headed by the Assistant Secretary of Immigration and Customs Enforcement, ICE

has approximately 15,000 employees in more than 400 offices domestically and in

other countries.

The Atlas program was started by INS in 2002. Responsibility for the program was

transferred to ICE in 2003 as part of the establishment of DHS.

The figure on the following slide shows ICE and Atlas organizational placement

within DHS. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 19 GAO-06-823 Information Technology 

12

Background

ICE and Atlas Organizational Placement

DHS Organizational Structure (simplified)

Customs and

Border 

Protection

Customs and

Border 

Protection

Atlas Program

Secret

Service

Secret

Service

Immigration

and Customs

Enforcement

Immigration

and Customs

Enforcement

Federal 

Emergency

Management

Agency

Federal 

Emergency

Management

Agency

Coas Coastt G Guuaarrdd

Department of

Homeland Security

Secretary

Department of

Homeland Security

Secretary

Deputy Secretary

Office of

Investigations

Office of

Investigations Office of

Intelligence

Office of

Intelligence

Office of

Detention and

Removal 

Operations

Office of

Detention and

Removal 

Operations

Office of

Federal 

Protective 

Service

Office of

Federal 

Protective

Service

Transportation 

Security

Administration

Transportation

Security

Administration

Chief 

Information 

Officer

Chief 

Information 

Officer

Source: GAO analysis of DHS data.

UUS-VISI S-VISITT

Under Secretary for 

Management

Under Secretary for 

Management

CChief I hief Innformation Officer formation Officer CChief h Financial Officer ief Financial Officer

Under Secretary for 

Science and Technology

Under Secretary for 

Science and Technology Under Secretary for 

Preparedness

Under Secretary for 

Preparedness

Citizenship

and 

Immigration

Services

Citizenship

and 

Immigration

Services

Customs and

Border 

Protection

Customs and

Border 

Protection

Atlas Program

Secret

Service

Secret

Service

Immigration

and Customs

Enforcement

Immigration

and Customs

Enforcement

Federal 

Emergency

Management

Agency

Federal 

Emergency

Management

Agency

Coas Coastt G Guuaarrdd

Department of

Homeland Security

Secretary

Department of

Homeland Security

Secretary

Deputy Secretary

Department of

Homeland Security

Secretary

Department of

Homeland Security

Secretary

Deputy Secretary

Office of

Investigations

Office of

Investigations Office of

Intelligence

Office of

Intelligence

Office of

Detention and

Removal 

Operations

Office of

Detention and

Removal 

Operations

Office of

Federal 

Protective 

Service

Office of

Federal 

Protective

Service

Transportation 

Security

Administration

Transportation

Security

Administration

Chief 

Information 

Officer

Chief 

Information 

Officer

Source: GAO analysis of DHS data.

UUS-VISI S-VISITT

Under Secretary for 

Management

Under Secretary for 

Management

CChief I hief Innformation Officer formation Officer CChief h Financial Officer ief Financial Officer

Under Secretary for 

Science and Technology

Under Secretary for 

Science and Technology Under Secretary for 

Preparedness

Under Secretary for 

Preparedness

Citizenship

and 

Immigration

Services

Citizenship

and 

Immigration

Services
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 20 GAO-06-823 Information Technology 

13

Background

Impetus for Atlas

According to ICE officials, Atlas was initiated to address information sharing and

security limitations within the former INS caused by, for example, 

• obsolete hardware/software that needed refreshing;

• incompatible, noninteroperable information systems; and

• uneven system security capabilities.

These officials stated that these challenges were exacerbated by the formation of

ICE because the organizations merged into ICE had different hardware/software 

environments (e.g., multiple e-mail systems) and different missions and customer 

needs.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 21 GAO-06-823 Information Technology 

14

Background

Goals of Atlas

The stated goals of Atlas are, among other things, to 

• promote information sharing and collaboration,

• strengthen information security, and

• enhance workforce productivity.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 22 GAO-06-823 Information Technology 

15

Background

Atlas Projects

The fiscal year 2005 expenditure plan states that Atlas consists of these seven11 

interrelated projects.

• Migrate ICE offices to DHS OneNetwork infrastructure to provide investigators and 

other staff with faster access to information used to accomplish mission duties.

Integration12

• Deploy a common e-mail application to replace multiple and disparate e-mail 

applications currently in use across ICE organizations. 

• Implement a single common active directory. 

• Initiate hardware refresh.

Common Computing

Environment

Project Description

Source: GAO analysis of DHS data.

11Since the FY 2004 expenditure plan, Atlas program officials merged Electronic Access/E-Government with Enterprise Information and more

recently renamed the project ICE Mission Information. In addition, Atlas added a new project called Data Center Migration. 12In the FY 2004 expenditure plan, Atlas called this project Connectivity.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 23 GAO-06-823 Information Technology 

16

Background

Atlas Projects

Continued

• Organize information so ICE users can find relevant, timely information from the

best sources.

• Improve information searching and indexing capabilities and implement tools for 

integrating legacy applications with Web-enabled front-ends.

• Establish ICE-wide content management capability.

ICE Mission 

Information13

• Create information, system/application platform, network, and computer security

measures to protect ICE information and systems.

Information 

Assurance

• Provide state-of-the-art engineering facilities and tools to manage, operate, 

evaluate, and test new technologies to ensure alignment to the DHS enterprise

architecture (EA).

Architecture 

Engineering14

Project Description

13This project used to be called Enterprise Information. 14In the FY 2004 expenditure plan, Atlas called this project Infrastructure Engineering.

Source: GAO analysis of DHS data.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 24 GAO-06-823 Information Technology 

17

Background

Atlas Projects

Continued.

• Plan to migrate ICE hardware and applications from the Department of Justice 

data centers to the common DHS data center solution.

Data Center 

Migration

Project Description

• Implement program management practices, policies, and processes.

• Provide adequate program office staffing.

• Manage and oversee Atlas projects and contractors, including developing tools to

help in these endeavors.

• Ensure compliance with DHS’s enterprise architecture.

• Monitor adherence to cost, schedule, and performance goals.

Transformation

Planning

Source: GAO analysis of DHS data.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 25 GAO-06-823 Information Technology 

18

Background

Atlas Appropriations

Atlas Appropriated Funds

15Counterterrorism funding came from the Department of Defense and Emergency Supplemental Appropriations for Recovery from and Response

to Terrorist Attacks on the United States Act, 2002. Pub. L. No. 107-117 (Jan. 10, 2002); H.R. Report 107-350 (Dec. 19, 2001). 16Pub. L. No. 108-90 (Oct. 1, 2003). 17Pub. L. No. 108-334 (Oct. 18, 2004). 18DHS's fiscal year 2006 appropriations (Pub. L. No. 109-90, Oct. 18, 2005) provided $40.15 million for Atlas. In December 2005, this amount was

reduced to $39.7 million via a 1 percent government-wide rescission in Pub. L. No 109-148 (Dec. 30, 2005), Emergency Supplemental

Appropriations to Address Hurricanes in the Gulf of Mexico and Pandemic Influenza, 2006.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 26 GAO-06-823 Information Technology 

19

Background

ICE reports that it has expended $61.5 million of the $73.4 million available for 

Atlas in fiscal years 2002, 2003, and 2004. The following table shows the 

expenditures by project. 

$7.1

2.0

0

0

.8

2.1

$2.2

Expenditures in

fiscal year 200420

Architecture Engineering 0 0 0

Common Computing Environment $0 $10.5 $12.7

Transformation Planning 0 .9 2.9

$17.6

10.2

1.3

6.1

Expenditures in

fiscal year 200219

$36.8

3.9

4.6

16.9

Expenditures in

fiscal year 200319

Total $61.5

Information Assurance 14.1

ICE Mission Information 6.7

Integration 25.1

Total

Project

(millions of dollars)

Atlas Expenditures

19As of March 15, 2006. 20As of April 6, 2006.

Source: GAO analysis of DHS data.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 27 GAO-06-823 Information Technology 

20

Background

Planned Use of Fiscal Year 2005 Funding

11.40

1.60

$18.00

FY 05 funds (in millions)

• Implement technology to support Enterprise

Interoperability and Enterprise Query

• Upgrade Web farm (replace obsolete

hardware and software supporting the 

Internet and Intranet Web server 

environment)

ICE mission information

• Integrate ICE network to DHS One network

• Deploy streaming video for field sites

• Upgrade firewall

Integration

• Implement active directory and mail exchange

system

• Refresh hardware

• Carry out project management activities

• Provide services for the interoperability lab

Common computing

environment

Project Planned use

According to the fiscal year 2005 expenditure plan, the $39.60 million is to be spent on 

seven projects.

Source: GAO analysis of DHS data.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 28 GAO-06-823 Information Technology 

21

Background

Planned Use of Fiscal Year 2005 Funding

Project FY 05 funds (in millions) Planned use

• Implement cyber identity management (single 

sign on) in coordination with DHS

• Perform audit log management

Information assurance 1.90

• Plan to migrate ICE hardware and 

applications from two Department of Justice 

data centers to a common DHS data center 

solution

Data center migration 1.40

Total $39.60

4.00

1.30

• Continue program management activities

• Improve project management support

• Enhance IT workforce (FTE recruitment)

Transformation planning

• Plan for the consolidated lab

• Establish an image lab that meets best 

practices

• Implement technology assessment program

Architecture engineering

Continued.

Source: GAO analysis of DHS data.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 29 GAO-06-823 Information Technology 

22

Objective 1 Results

Legislative Conditions

The Atlas expenditure plan satisfies or partially satisfies each of the legislative

conditions.

Condition 1 partially satisfied. The expenditure plan, including related program

documentation and statements from the program manager, partially satisfies the 

capital planning and investment control review requirements established by OMB, 

including Circular A-11, part 7, which establishes policy for planning, budgeting,

acquisition, and management of federal capital assets.

Examples of our analysis are included in the following table. As the table shows, 

not all OMB requirements have been satisfied, but oral commitments have been 

made for doing so. Given that ICE has reportedly already invested $61.5 million on

Atlas projects and plans to invest another $39.60 million this year, it is important for

ICE to follow through on these commitments.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 30 GAO-06-823 Information Technology 

23

Objective 1 Results

Legislative Conditions

Examples of OMB Circular A-11

requirements Results of our findings 

Indicate whether the investment was 

approved by an investment review

committee 

The plan was approved on December 21, 2005, by DHS’s Deputy 

Secretary, who chairs the DHS Investment Review Board. 

Provide justification and describe 

acquisition strategy 

A business case, including a cost-benefit analysis, was issued in

December 2005 to provide economic justification for the program. In

addition, the expenditure plan identifies the ICE contracts that are

being used, and to be used, to acquire hardware and software

products and program support services. An acquisition plan was 

approved in February 2006 which includes a statement of need and

the capabilities to be delivered through these contracts. While the 

program currently relies on ICE contracting support, the program

manager plans to hire a contracting officer’s technical

representative to help ensure compliance with contract criteria and 

Atlas program objectives, but no target date has been established 

for hiring this official.

Summarize life-cycle costs and costbenefit analysis, including the return on

investment 

The December 2005 cost-benefit analysis (discussed above) 

provides costs and benefits for the life cycle of Atlas, which is 

through the year 2024. The analysis also includes an estimated

return on investment for three alternative approaches. While the 

analysis was in large part, consistent with OMB and best practices 

guidance, it did omit key practices. For example, the analysis did 

not include all key mission requirements. According to the program 

manager, the analysis is considered to be a “living document” and 

the program plans to update it in the near future to, among other 

things, address these requirements. A specific plan and schedule

for the update was not provided. This area is more fully discussed

in the open recommendations section of the briefing.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 31 GAO-06-823 Information Technology 

24

Objective 1 Results

Legislative Conditions

Examples of OMB Circular A-11

requirements Results of our findings 

Provide performance goals and 

measures

Supporting documentation identifies seven proposed goals and 

measures, but three projects do not have measures. According to the 

program manager, the program is beginning to use the measures it has

but has not yet institutionalized their use. In addition, as part of updating 

the Atlas business case (in December 2005), the program mapped 

Atlas’s goals to ICE’s mission and goals. According to the program, it is

the program’s intent to develop measures for the three projects. 

However, a plan and timetable was not provided for when this would be

done. Our analysis of Atlas’s performance management is discussed in

more detail in the open recommendations section of the briefing. 

Address security and privacy The plan and supporting documentation state the importance of security

and privacy and provide high-level information on intended security 

measures, including one proposed project—Information Assurance—that 

is intended to implement an ICE security program. The plan allocates 

$1.9 million to this project. In addition, ICE issued an Atlas system 

security plan, as well as a security test and evaluation plan in April 2006. 

ICE also developed a draft Atlas privacy impact assessment in August 

2005. The security plan, however, did not include key practices called for 

by federal IT security guidance. This area is more fully discussed in the 

open recommendation section of the briefing. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 32 GAO-06-823 Information Technology 

25

Objective 1 Results

Legislative Conditions

Examples of OMB Circular A-11

requirements Results of our findings 

Provide for managing risk ICE issued a risk management plan on January 23, 2006. The risk plan 

provides guidance for identifying, analyzing, and resolving program risks 

before they occur. In addition, the program manager stated that the 

program recently hired a risk analyst to help identify and monitor risks. 

However, Atlas does not have, among other things, a complete inventory 

of all risks to the program. Program officials stated they plan on acquiring 

an automated tool by June 2006 to help them complete the inventory and 

manage risks. Our complete findings related to risk management are 

addressed in our open recommendations section. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 33 GAO-06-823 Information Technology 

26

Objective 1 Results

Legislative Conditions

Condition 2 partially satisfied. The plan, including related program

documentation and DHS officials’ statements, partially satisfies the condition that 

the department ensure Atlas is compliant with DHS’s enterprise architecture (EA).

An EA provides a clear and comprehensive picture of an organization’s

operations and its supporting systems and infrastructure. It is an essential tool for

effectively and efficiently engineering business processes and for implementing 

and evolving supporting systems in a manner that maximizes interoperability,

minimizes overlap and duplication, and optimizes performance. We have worked

with the Congress, OMB, and the federal Chief Information Officers Council to

highlight the importance of architectures for both organizational transformation 

and IT management. An important element of EA management is ensuring that IT

investments are compliant with EA, including basing such assessments on

documented analysis.

On August 6, 2004, we reported on version 1.0 of DHS’s EA, stating that DHS’s

initial EA provides a partial foundation but was missing key elements expected to

be found in a well-defined architecture.21 DHS has since developed version 2.0, 

and more recently version 2006, of its EA. We have not reviewed these versions 

of DHS’s EA. 21GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.:

Aug. 6, 2004).
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 34 GAO-06-823 Information Technology 

27

Objective 1 Results

Legislative Conditions

The DHS Enterprise Architecture Board, supported by the Enterprise Architecture

Center of Excellence,22 is responsible for ensuring that projects demonstrate

adequate technical and strategic compliance with the department’s EA. To this

end, the board conducts compliance reviews at key decision points in an

investment’s life cycle. Specifically, DHS guidance23 directs the board prior to an

investment’s acquisition milestone (referred to by DHS as key decision point 2) to

assess the investment against the transition strategy, data architecture, 

application component and technology architecture. 

In May 2005, the Atlas program manager in preparation for Atlas’s key decision

point 2, requested that the center assess the program’s compliance with the EA

and in doing so, provided supporting documentation, such as the expenditure 

plan and the business case. Using this information, center staff compared Atlas to

version 2.0 of the EA. 

In June 2005, the center reported the results of its assessment to the board,

stating that Atlas was in compliance; however, it also stipulated conditions to be

addressed by the program. The conditions included providing additional

documentation (e.g., a list of proposed infrastructure and IT systems that are to 

be funded by Atlas). 22A review group made up of subject manner experts that recommends EA compliance to the DHS Enterprise Architecture Board and ultimately

to the DHS IRB. 23Department of Homeland Security Enterprise Architecture Board: EAB Governance Process Guide, August 9, 2004. Draft Version 2.0.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 35 GAO-06-823 Information Technology 

28

Objective 1 Results

Legislative Conditions

In July 2005, the board approved this compliance determination subject to the 

same conditions specified by the center. According to board and center officials, 

including DHS’s chief architect, Atlas program officials later satisfied the conditions 

by providing the information.

According to the DHS chief architect, the Center for Excellence based its

determination on documentation submitted by the Atlas program manager and 

discussions among center members, which include subject matter experts and 

representatives from the component agencies and DHS’s Offices of Compliance 

and Computer Information Security.

However, the determination was not based on documented analysis mapping 

Atlas’s infrastructure architecture to the EA. Specifically, the DHS chief architect 

told us that the department does not have a documented methodology for

evaluating programs for compliance with the DHS EA, other than relying on the 

expertise of the Center for Excellence members. In addition, no analysis or

documentation was produced or given to us by the center staff that could be used 

to verify their Atlas alignment decision.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

29

Objective 1 Results

Legislative Conditions

Furthermore, center officials indicated that programs such as Atlas are not 

identified in the DHS EA version 2.0. Performing and documenting the analysis, 

based on a documented methodology, of how a project maps to its EA, is 

necessary to make informed, fact-based alignment determinations.

Given the critical role that Atlas is to play in contributing to DHS’s strategic

information sharing and interoperability goals, it is important for ICE and DHS to 

follow through on stated commitments to base Atlas compliance determinations on

documented and verifiable analysis.

Page 36 GAO-06-823 Information Technology 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

29

Objective 1 Results

Legislative Conditions

Furthermore, center officials indicated that programs such as Atlas are not 

identified in the DHS EA version 2.0. Performing and documenting the analysis, 

based on a documented methodology, of how a project maps to its EA, is 

necessary to make informed, fact-based alignment determinations.

Given the critical role that Atlas is to play in contributing to DHS’s strategic

information sharing and interoperability goals, it is important for ICE and DHS to 

follow through on stated commitments to base Atlas compliance determinations on

documented and verifiable analysis.

30

Objective 1 Results

Legislative Conditions

Condition 3 Satisfied. The plan, including related program documentation and

statements from the Atlas program manager, either satisfies or provides for 

satisfying the condition to comply with the acquisition rules, requirements,

guidelines, and systems acquisition management practices of the federal 

government. These practices provide a management framework based on the use 

of rigorous and disciplined processes for planning, managing, and controlling the 

acquisition of IT resources, including:

• acquisition planning, which ensures, among other things, that reasonable

plans, milestones, and schedules are developed and that all aspects of the 

acquisition effort are included in these plans;

• solicitation, which involves making sure that (1) a request for proposals

delineating a project’s requirements is prepared and (2) consistent with 

relevant solicitation laws and regulations, a contractor is selected that can 

most cost-effectively satisfy these requirements;

• requirements development and management, which includes establishing

and maintaining a common and unambiguous definition of requirements 

among the acquisition team, the system users, and the development 

contractor;

Page 37 GAO-06-823 Information Technology 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 38 GAO-06-823 Information Technology 

31

Objective 1 Results

Legislative Conditions

• project management provides for management of the activities within the 

project office and supporting contractors to ensure a timely, efficient, and 

cost-effective acquisition;

• contract tracking and oversight, which ensures that the development 

contractor performs according to the terms of the contract; needed contract 

changes are identified, negotiated, and incorporated into the contract; and 

contractor performance issues are identified early, when they are easier to

address; and

• evaluation, which determines whether the acquired products and services 

satisfy contract requirements before acceptance.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 39 GAO-06-823 Information Technology 

32

Objective 1 Results

Legislative Conditions

These acquisition management processes are also embodied in published best

practices models, such as the Software Engineering Institute’s (SEI) Software 

Acquisition Capability Maturity Model

®.24

Examples of our analysis of ICE performance of these processes and practices are 

shown on the following table.

They show that not all aspects of the processes and practices have been 

implemented, but that oral commitments have been made for doing so. 

Given that ICE has already invested $61.5 million on Atlas projects and plans to 

invest another $39.60 million this year, it is important for ICE to follow through on 

these commitments.

24Developed by Carnegie Mellon Software Engineering Institute (SEI), Software Acquisition Capability Maturity Model (SA-CMM®), Version

1.03 (March 2002).
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 40 GAO-06-823 Information Technology 

33

Objective 1 Results

Legislative Conditions

Examples of practices Results of our analysis 

Acquisition planning 

Ensures that reasonable 

plans, milestones, and

schedules are developed 

and that all aspects of the 

acquisition effort are

included in these plans.

The expenditure plan and supporting documents (e.g., the fiscal year 2005 Atlas budget 

submission to OMB known as an Exhibit 300) provide aspects of a high-level acquisition 

strategy, such as identifying the ICE contracts that are being used, and are to be used, to

acquire products and program support services. An acquisition plan was issued in February

2006 which includes a statement of program needs and the capabilities to be delivered through

these contracts. 

While the program currently relies on ICE contracting support, the program manager plans to

hire a contracting officer’s technical representative to help ensure compliance with contract

criteria and Atlas program objectives, but no target date has been established for hiring this

official. In addition, the business case issued in December 2005, provides details on

alternatives, cost, and schedule. A risk management plan for the program was issued on

January 23, 2006, and contains guidance for assessing risk, and also contains a partial 

inventory of risks. According to the program manager, Atlas is currently following the February 

2005, ICE System Lifecycle Management Handbook.25 The handbook addresses a number of

key process areas such as project management and requirements development and 

management; however, it does not address certain key acquisition management activities, such

as solicitation and contract tracking and oversight. Atlas program officials recognize this problem 

and plan to confer with the ICE acquisition officials, but did not offer a plan or date of when this

will be completed. 

Project management

Provides for the 

management of activities 

within the project office 

and supporting contractors 

to ensure a timely,

efficient, and cost-effective 

acquisition. 

ICE has begun to establish a program office with responsibility for managing the acquisition,

deployment, operation, and sustainment of Atlas. The Atlas program management office is

allocating funding of $4 million via the Transformation Planning project in the expenditure plan.

The current staffing of the program office consists of a program manager, who is also the deputy

Chief Information Officer (CIO), six project managers, and other contracting support personnel

(e.g., EA specialist, business analyst, risk analyst). According to the program manager, he is

currently in the process of hiring a deputy program manager and plans to hire a project manager 

for Data Center Migration once fiscal year 2005 expenditure plan funds become available. 

Although staff have been hired, the program office is still not fully operational since according to

the program manager, it will take a time for the new staff to obtain security clearances and pass 

other DHS personnel requirements. 

25U.S. Immigration and Customs Enforcement: System Lifecycle Management, The Systems Development Lifecycle of Immigration and Customs

Enforcement, February 2005, Version 1.0.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 41 GAO-06-823 Information Technology 

34

Objective 1 Results

Legislative Conditions

Condition 4 Satisfied. DHS and OMB satisfied the legislative condition requiring 

that the plan be reviewed and approved by the DHS IRB, Secretary of Homeland 

Security, and OMB. 

• The DHS Deputy Secretary, who chairs the DHS IRB, approved the plan on

December 21, 2005.

• OMB approved the plan on March 10, 2006.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 42 GAO-06-823 Information Technology 

35

Objective 1 Results

Legislative Conditions

Condition 5 Satisfied. GAO satisfied the condition that it review the plan. 

Our review was completed on April 28, 2006.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 43 GAO-06-823 Information Technology 

36

Objective 2 Results

Open Recommendations

Open recommendation 1: Revise and update the cost-benefit analysis to 

identify current mission requirements, determine how they will be met, and 

develop an estimate of the program’s incremental and life-cycle costs, benefits, 

schedule, and return on investment. This should also include establishing plans, 

associated tasks, and milestones for accomplishing this effort.

Status: Partially complete

The program developed a cost-benefit analysis, but in doing so, did not fully 

adhere to our recommendation and key practices called for by OMB.

26 To its

credit, the program established a plan, including associated tasks and 

milestones, for this effort and executed it, which resulted in issuance of a revised 

and updated cost-benefit analysis in December 2005 as part of an overall 

business case justification for Atlas mission requirements. The cost-benefit 

analysis included three alternative solutions for how the requirements would be 

met as well as estimates of each alternative’s life-cycle costs, benefits, schedule, 

and return on investment.27

26OMB, Guidelines and Discount Rates for Benefits-Cost Analysis of Federal Programs, Circular A-94. (Washington, D.C.: Oct. 29, 1992). 27The scope our work did not include assessing the reliability of the cost, benefit, and schedule estimates developed as part of the analysis.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 44 GAO-06-823 Information Technology 

37

Objective 2 Results

Open Recommendations

Open recommendation 1 (continued)

Further, the analysis also identifies net present value28 for each alternative.

However, there are several areas where the study is not consistent with our 

recommendation and OMB guidance on cost-benefit analyses and IT incremental 

investment. First, the study does not identify all key mission requirements. For 

example, while it addressed requirements related to Atlas’s support of 

information sharing within ICE and with other DHS components, it did not include 

requirements—stated in ICE’s July 2005 strategic plan—to support the sharing of

law enforcement and immigration information with external partners such as the 

Departments of Justice and State as well as state and local law enforcement

entities. Other examples of omitted requirements include the program’s intent to

(1) reengineer business processes as part of its IT infrastructure transformation

and (2) develop business applications.

28The discounted monetized value of expected net benefits (i.e., benefits minus costs).
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 45 GAO-06-823 Information Technology 

38

Objective 2 Results

Open Recommendations

Open recommendation 1 (continued)

According to the program manager, the study did not include these requirements 

because the former CIO did not envision them being part of Atlas; however, the

new CIO has a broader vision of Atlas that includes these requirements. 

Consequently, the program manager stated he has been tasked to develop an 

Atlas long-range strategic plan for information sharing with the goal of defining a 

comprehensive set of requirements that can be used to update the cost-benefit

analysis; at that time, the business case and its analysis of costs and benefits 

are to be updated to include any other outstanding requirements such as those 

for the reengineering and business applications. Including known requirements is 

important because it potentially affects, among other things, the alternatives

considered and their estimated costs and benefits.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 46 GAO-06-823 Information Technology 

39

Objective 2 Results

Open Recommendations

Open recommendation 1 (continued)

Second, a complete analysis of uncertainty (i.e., both a sensitivity analysis and a

Monte Carlo simulation29) for each of the alternatives was not performed,

although OMB and DHS guidance call for it. That is, the cost-benefit analysis did

not include a Monte Carlo simulation. According to the program officials, this

simulation was performed but was not included in the study. However, the results 

of the simulation, including supporting documentation, have yet to be provided to

us. Such an analysis of uncertainty is key because it provides decision makers

with a perspective on potential variability of costs and benefits should 

circumstances change. This is particularly critical in Atlas’s case because each of

the competing alternatives involve large estimated costs and benefits that were

close in comparison.

29 Uncertainty analyses generally include both a sensitivity analysis and a Monte Carlo simulation. A sensitivity analysis is a quantitative

assessment of the effect that a change in an assumption—the numerical value of a single parameter (such as unit labor cost)—will have on net

present value. A Monte Carlo simulation allows all of the model’s parameters to vary simultaneously according to their associated probability 

distribution. The result is a set of estimated probabilities of achieving alternative outcomes (costs, benefits, and/or net benefits) given the 

uncertainty in the underlying parameters.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 47 GAO-06-823 Information Technology 

40

Objective 2 Results

Open Recommendations

Open recommendation 1 (continued)

Third, OMB guidance calls for dividing projects into a series of smaller, 

incremental subprojects or releases so that investment decisions can be made

on each increment. Among other things, this reduces the risk of associated with 

investing large sums over many years in anticipation of delivering capabilities 

and expected business value far into the future. However, the cost-benefit 

analysis, and the alternative selected, shows that the program is being justified 

and will be measured on a monolithic basis, rather than in a series of increments.

It is important for Atlas to comply with this practice to enable informed 

incremental decision making and reduce the risk associated with the current

approach.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 48 GAO-06-823 Information Technology 

41

Objective 2 Results

Open Recommendations

Open recommendation 2: Make the Atlas program office operational by (1) 

developing a staffing needs assessment to determine the positions and the level 

of staffing needed for all projects to adequately manage the program, including a 

human capital strategy for acquiring the staff and a timetable for bringing them

on board; (2) finalizing the roles and responsibilities for the positions identified in

the staffing assessment and for the projects; and (3) implementing and 

institutionalizing key acquisition management controls, including risk

management processes where relevant responsibilities are assigned and key 

risks and their status are reported to an executive body.

Status: In progress

Atlas program officials have taken some, but not all, of the steps essential to 

make the program office operational. First, in April 2006, the program officials 

completed an organizational structure and staffing assessment. The assessment 

identified, among other things, an organizational structure, functions, and 

associated positions for the program office as well as the staff needed to fill the

positions. According to the assessment, a total of 11 full-time equivalents is

needed to staff the office. To date, ICE has hired most staff and is in the process
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 49 GAO-06-823 Information Technology 

42

Objective 2 Results

Open Recommendations

Open recommendation 2 (continued)

of hiring others. Staff currently in place include a program manager, who is also

the Deputy CIO, six project managers, and contracting support personnel (e.g.,

EA specialist, business analyst, risk analyst, documentation specialist). ICE is in

the process of hiring a deputy program manager and plans to hire a project 

manager for Data Center Migration once fiscal year 2005 expenditure plan funds 

become available. Program officials stated that these hires need to obtain

security clearances and pass other ICE personnel requirements before they can 

be brought on board to work. The program office’s organization structure,

functions, and staffing status are shown on the following page. 

Second, as part of the organizational structure and staffing assessment, the 

program office also finalized staff roles and responsibilities, including providing 

high-level tasks for each of the staff. In addition, the office drafted in April 2005, 

project charters which also further described roles and responsibilities for staff

serving on projects. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 50 GAO-06-823 Information Technology 

43

Objective 2 Results

Open Recommendations

Atlas Program Management Office

Common 

Computing

Environment

Common 

Computing

Environment

Architecture

Engineering

Architecture

Engineering InIntegtegrr

atatioionn ICE Mission 

Information

ICE Mission 

Information Information

Assurance

Information 

Assurance

Logistics

Analysts

Logistics

Analysts

Atlas

Financial

Analysts

Atlas

Financial 

Analysts

Ri Risksk Analysts EAEA Spe Specciaiali

l

sistt Analysts Documentation 

Analyst

Documentation

Analyst

DDep epuuty Program Manager ty Program Manager

AAtlas Program Manager tlas Program Manager

Atlas Program Management Office

Staff not hired.

Staff hired but not on board; temporary staff acting as lead.

Transformation

Planning

Source: GAO analysis of DHS data.

Business

Analysts

Business

Analysts

Configuration 

Management

Analysts

Configuration 

Management

Analysts

Test Evaluation 

Analysts

Test Evaluation

Analysts Technical

Writer

Technical 

Writer

PProject Manager roject Manager

Staff in place.

Data Center

Migration

ICE Chief

Information 

Officer (CIO)

Deputy CIO

ICE Chief

Information 

Officer (CIO)

Deputy CIO

Common 

Computing

Environment

Common 

Computing

Environment

Architecture

Engineering

Architecture

Engineering InIntegtegrr

atatioionn ICE Mission 

Information

ICE Mission 

Information Information

Assurance

Information 

Assurance

Logistics

Analysts

Logistics

Analysts

Atlas

Financial

Analysts

Atlas

Financial 

Analysts

Ri Risksk Analysts EAEA Spe Specciaiali

l

sistt Analysts Documentation 

Analyst

Documentation

Analyst

DDep epuuty Program Manager ty Program Manager

AAtlas Program Manager tlas Program Manager

Atlas Program Management Office

Staff not hired.

Staff hired but not on board; temporary staff acting as lead.

Transformation

Planning

Source: GAO analysis of DHS data.

Business

Analysts

Business

Analysts

Configuration 

Management

Analysts

Configuration 

Management

Analysts

Test Evaluation 

Analysts

Test Evaluation

Analysts Technical

Writer

Technical 

Writer

PProject Manager roject Manager

Staff in place.

Data Center

Migration

ICE Chief

Information 

Officer (CIO)

Deputy CIO

ICE Chief

Information 

Officer (CIO)

Deputy CIO

ICE Chief

Information 

Officer (CIO)

Deputy CIO

ICE Chief

Information 

Officer (CIO)

Deputy CIO
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 51 GAO-06-823 Information Technology 

44

Objective 2 Results

Open Recommendations

Open recommendation 2 (continued)

Third, the program office has begun to implement key acquisition management 

controls, such as risk management and acquisition management. For example, 

as previously discussed, the program has developed and issued acquisition and 

risk management plans. The Atlas acquisition plan was completed in February

2006, and the risk management plan was completed in January 2006. In 

addition, the Atlas program has defined and implemented key risk management

processes. For example, they have developed a risk management process that 

guides program office staff on how to, among other things, identify, report, and 

manage risks throughout an investment’s life cycle. They also hired an analyst to 

manage the Atlas risks. However, because the risk management process has 

just been recently implemented, a complete inventory of risks has not been 

prepared. According to program officials, risks associated with each of the 

individual projects that comprise Atlas are currently being identified and will be 

added to the inventory, and mitigation plans will be developed for each risk. 

Further, they plan to review all risks at monthly program management meetings.

Program officials stated that they expect to complete these actions by June

2006.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 52 GAO-06-823 Information Technology 

45

Objective 2 Results

Open Recommendations

Open recommendation 2 (continued)

Until the program management office is fully staffed and key capabilities are in

place and functioning, ICE faces the increased likelihood that Atlas will not meet 

its objectives on schedule and within budget.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 53 GAO-06-823 Information Technology 

46

Objective 2 Results

Open Recommendations

Open recommendation 3: Develop and implement an updated Atlas security

plan and privacy impact assessment. This should also include establishing plans, 

associated tasks, and milestones for accomplishing this effort. 

Status: Partially complete

The program has partially completed implementation of this recommendation.

Specifically, the program issued an updated Atlas security plan in April 2006. 

While the plan does include key practices called for by federal IT security

guidance,30 it also is missing important ones as well. Examples of missing or 

partially addressed practices include the following:

• Inventory of all information systems is incomplete,

• Description of all the systems covered by the plan is not yet complete,

• System interconnections and information sharing between each system are 

not defined, and

• Common and system-specific security controls are not defined.

30National Institute of Standards and Technology, Guide for Developing Security Plans for Federal Information Systems, Special Publication 800-

18 Revision 1: February 2006.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 54 GAO-06-823 Information Technology 

47

Objective 2 Results

Open Recommendations

With regard to the privacy impact assessment, the program issued a draft

assessment in August 2005 for management review. According to the program

manager, the draft has been approved by ICE management and is currently

under review by the department’s Privacy Office. Privacy officials told us they

have reviewed the draft and requested additional documentation from ICE but

did not provide a date for when its review would be finalized. The program

manager stated that the program would not begin using the assessment to guide

decisions on project privacy until the department-level review is completed.

Having a completed and approved security plan and privacy assessment are 

important because they provide system and privacy requirements that are used 

to guide further Atlas definition and acquisition. The security plan also describes 

the controls that are in place or planned for meeting the requirements. 

Proceeding without such information in a documented and approved fashion 

increases the risk that Atlas security and privacy requirements will not be 

effectively and efficiently addressed.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 55 GAO-06-823 Information Technology 

48

Objective 2 Results

Open Recommendations

Open recommendation 4: Develop and implement rigorous performance 

management practices for the Atlas program that include properly aligned goals, 

benefits, achievements, and anticipated achievements that are defined in

measurable terms. This should also include establishing plans, associated tasks, 

and milestones for accomplishing this effort.

Status: In progress

Atlas is in the process of (1) aligning Atlas goals, benefits, and other 

performance indicators and (2) expressing achievements in terms of measurable

outcomes. Specifically, the program has taken steps to align its goals and other 

indicators and is beginning to implement their use; however, the program has not 

addressed our recommendation about reporting achievements as measurable 

outcomes.

Since our last report, ICE’s CIO assigned the responsibility for addressing our

recommendations to the Atlas program manager. The program manager’s

approach to achieving goal alignment was to perform the necessary analysis as

part of updating the business case and finalizing the fiscal year 2005 expenditure
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 56 GAO-06-823 Information Technology 

49

Objective 2 Results

Open Recommendations

Open recommendation 4 (continued)

plan. As part of updating the Atlas business case (December 2005), the program

mapped Atlas’s mission and six goals to ICE’s mission and goals and then 

showed the link between these and the department’s overall mission and goals. 

The business case also maps Atlas’s goals to each of the Atlas projects. 

Further, in completing the current expenditure plan, the program identified nine

performance goals, which the program recently reduced to seven. The program

also developed a measure to gauge progress on each performance goal. 

Examples include:

• For the Common Computing Environment, the goal is to have 100 percent of 

ICE personnel using the target common e-mail system by the end of fiscal 

year 2006; the measurement is the percent of ICE personnel using the 

target e-mail system.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 57 GAO-06-823 Information Technology 

50

Objective 2 Results

Open Recommendations

Open recommendation 4 (continued)

• For the Program Management project, the goal is to have in fiscal year 2008, a

50 percent reduction in the current cost of operations and maintenance; the 

measurement is the percent reduction in operations and maintenance costs.

However, three of the projects did not have performance goals and measures. 

They are: Architecture Engineering, Transformation Planning, and Data Center 

Migration. According to the program manager, he plans to develop goals and 

measures for these projects by June 2006.

In addition, the program has not yet implemented and institutionalized the seven 

measures. According to the program manager, the program is currently beginning 

to collect data to do this but added that there is not much to measure until they get

expenditure plan funds and begin making progress on projects. Once the 

measurement process starts, he stated the program is to report the results to ICE’s

CIO at the monthly Atlas program management reviews and include the result in

future expenditure plans as well. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 58 GAO-06-823 Information Technology 

51

Objective 2 Results

Open Recommendations

Open recommendation 4 (continued)

With regard to reported achievements in the current expenditure plan, they are not

expressed in terms of measurable outcomes or results, but rather as activities

completed. Examples of this include:

• Initiated activities toward establishing an environment to support the

development and demonstration of enterprise query and interoperability 

capabilities,

• Completed high-level planning and preliminary analysis related to architecture

engineering, and 

• Designed and implemented limited operation of network and host-based

vulnerability scanning capabilities.

Until planned actions are implemented and being used to manage the program,

managers will still not have the necessary information for measuring progress and 

making well-informed investment decisions.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 59 GAO-06-823 Information Technology 

52

Objective 2 Results

Open Recommendations

Open recommendation 5: Ensure that future expenditure plans fully disclose

the system capabilities, schedule, cost, and benefits to be delivered, as well as 

the acquisition strategy for Atlas. 

Status: In progress

The fiscal year 2005 Atlas expenditure plan does not show the level of detail and 

scope of the program for Congress to understand its plans and commitments 

relative to system capabilities, cost, benefits, and schedule. It does not 

sufficiently describe progress made against program commitments (e.g., 

expected benefits). 

Instead, the expenditure plan and supporting documentation describe, for

example, high-level system capabilities to be delivered under each project, 

planned expenditure aggregated by project (not linked to system capabilities),

and high-level benefits of Atlas. It does not link planned expenditures to system

capabilities, set milestones for delivery of system capabilities, provide schedule

estimates, or discuss benefits to be realized as a result of planned system

investments.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 60 GAO-06-823 Information Technology 

53

Objective 2 Results

Open Recommendations

Open recommendation 5 (continued)

Our prior experience in working with Congress and other agencies on developing

and implementing expenditure plans shows that these plans need to disclose a 

sufficient level and scope of information in order for Congress to understand

what the system capabilities and benefits are to be delivered, by when, at what 

cost, and what progress is being made against the commitments. The program

manager stated he agreed and that the program planned to include this

information in future plans. 

Without the level of detail needed in the expenditure plans, Congress will not 

have the essential information needed to oversee progress and make informed 

decisions about expenditure plan approval.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 61 GAO-06-823 Information Technology 

54

Objective 3 Results

Observations: Project Plans

Observation 1: Project management planning does not include key elements.

According to the SEI’s Capability Maturity Model Integration,

31 a key process area

essential to effectively managing IT projects is planning. IT project planning

ensures, among other things, that the project team establishes and maintains 

written plans that define the scope and breath of project activities. According to

SEI, such project plans also provide the basis for performing and controlling project 

activities and are to be developed before initiating a project. Having project 

information documented in a written plan among other things (1) ensures 

commitment among project team members and between the team and its 

stakeholders and (2) provides a consistent understanding of the project across the 

organization. Project plans can also help to identify potential problems so that they

can be addressed early on in the project, when changes are less disruptive and 

cheaper to make. According to the maturity model, project plans are to include 

major milestones, constraints, risks, tasks to be accomplished, resources, skills 

requirements, stakeholder identification, stakeholder review and approval, budget,

and schedule. 

31For example, see Carnegie Mellon Software Engineering Institute, Capability Maturity Model Integration (CMMIsm), Version 1.1 (March

2002).
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 62 GAO-06-823 Information Technology 

55

Objective 3 Results

Observations: Project Plans

Observation 1 (continued)

However, Atlas’s current project plans are not fully consistent with this criteria. In

lieu of such plans, Atlas managers are to use project charters (issued in draft in

April 2006) and project schedules with associated work tasks to manage their

projects. Collectively, the charters and schedule include some key elements of

effective project planning. Specifically, they identify the key stakeholders, key team

members, mission statement, roles and responsibilities, major milestones, and

high-level work tasks to be accomplished.

However, other key elements are missing. For example, the charters have not been 

reviewed and approved by management and key stakeholders. In addition, the 

charters and schedules 

• are high-level in nature in that they were not based on a detailed work 

breakdown structure of task to be performed,

• do not include any discussion of the project’s cost and budget that would be

necessary to execute the project, and 

• do not identify constraints and risks.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 63 GAO-06-823 Information Technology 

56

Objective 3 Results

Observations: Project Plans

Observation 1 (continued)

The program manager stated that missing elements are to be incorporated as the

plans are received and made final.

Given that Atlas is reportedly currently spending on three projects and plans to 

spend more on all projects, it is important that the Atlas program develop more 

rigorous project plans to guide and control the management of these projects.

Without such plans, the program faces the increased likelihood its projects will not

meet its expectations on time and within budget.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 64 GAO-06-823 Information Technology 

57

Objective 3 Results

Observations: Program Assessment Rating Tool

Observation 2: Efforts underway to address OMB concerns that Atlas was not 

demonstrating results.

OMB uses a Program Assessment Rating Tool (PART) to assess how well 

government programs are performing. OMB reviewed the Atlas program and 

reported in August 2005 that the program was not demonstrating expected results. 

Specifically, OMB reported that there was insufficient evidence of program results 

and accountability. For example, it stated that the program had not demonstrated 

adequate progress in achieving its long-term performance goals. It also noted that 

the program was focused on short-term agency integration goals and lacked a 

long-term strategy to help the agency share information with its law enforcement 

partners. OMB also reported that the program has weak program management 

structure.

Citing this assessment, the Administration’s fiscal year 2007 budget stated that no 

funds were being provided for Atlas until the program’s weaknesses were 

addressed. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 65 GAO-06-823 Information Technology 

58

Objective 3 Results

Observations: Program Assessment Rating Tool

To address OMB’s findings, Atlas developed an action plan (dated April 2006)

citing steps planned and under way. Examples of steps planned and under way 

include the following:

• Establishing an Atlas program management office to manage and oversee the 

program, including plans to acquire a project management tool to report cost,

schedule, and performance data.

• Developing performance goals and measures for the program. According to 

the program officials, these goals and measures are being revised with the 

goal of being final by June 2006. 

• Developing a long-range strategy to help ICE share information with its law

enforcement and immigration enforcement partners.

According to OMB, programs that receive a “results not demonstrated” assessment

can request an abbreviated reassessment if they believe there is evidence of 

significant change. Program officials told us that a reassessment was not 

requested for fiscal year 2006 because agency management did not believe that 

significant improvement could be shown. They also stated that the program plans

to be reassessed in fiscal year 2007.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 66 GAO-06-823 Information Technology 

59

Objective 3 Results

Observations: Program Assessment Rating Tool

Until Atlas addresses management weaknesses, shows it is demonstrating results,

and is reassessed by OMB, it is unclear whether funding will be budgeted for 

further investment in Atlas.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 67 GAO-06-823 Information Technology 

60

Conclusions

The fiscal year 2005 Atlas expenditure plan, in combination with related program

documentation and program officials’ statements, satisfies or partially satisfies the 

legislative conditions set forth by Congress. However, this satisfaction is based on 

plans and commitments that provide for meeting these conditions, rather than on 

completed actions to satisfy the conditions. In addition, while steps are being

initiated that are intended to address program management weaknesses, a number 

of improvements, including those recommended in our past report, have yet to be

implemented. 

Thus, there is much that still needs to be accomplished to minimize the risks 

associated with the program’s capacity to deliver promised IT infrastructure

capabilities and benefits on time and within budget. Given that hundreds of millions 

of dollars are to be invested, it is essential that DHS follow through on its 

commitments to build the capacity to effectively manage the program. Proceeding 

without this capacity introduces unnecessary risks to the program and potentially 

jeopardizes its viability for future investment. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 68 GAO-06-823 Information Technology 

61

Conclusions

Moreover, congressional decision makers need reliable information about program

commitments that are to be met with the expenditure plan funds, including the 

benefits to be produced, the capabilities to be delivered, and the cost and schedule 

estimates to be met. By not providing this information in its fiscal year 2005

expenditure plan, DHS is impeding congressional oversight by not providing a 

meaningful basis for measuring performance and ensuring accountability.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 69 GAO-06-823 Information Technology 

62

Recommendations for Executive Action

To minimize risks to the Atlas program, we recommend that the Secretary of

Homeland Security, direct the Assistant Secretary for Immigration and Customs 

Enforcement to take the following two actions:

• Report periodically to Senate and House appropriations subcommittees

regarding the program’s progress in implementing our recommendations.

• Develop and implement Atlas project plans consistent with elements of 

effective project planning.
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 70 GAO-06-823 Information Technology 

63

Agency Comments

In their April 27, 2006, oral comments on a draft of this briefing, ICE officials,

including the Deputy CIO and Atlas program manager, agreed with our results.

These officials also provided technical comments, which we incorporated in the 

briefing as appropriate. 
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 71 GAO-06-823 Information Technology 

64

Attachment I

Scope and Methodology

To accomplish our objectives, we

• analyzed the fiscal year 2005 Atlas expenditure plan and supporting 

documents against legislative conditions and other relevant federal 

requirements, guidance, and best practices to determine whether the 

conditions were met. In doing so, we considered the conditions met when the 

expenditure plan, including supporting program documentation and program

officials’ representations, either satisfied or provided for satisfying the

conditions, and 

• assessed supporting documentation and interviewed program and other 

involved ICE and DHS officials to determine progress in implementing our

recommendations and establishing capabilities in program management areas, 

such as

• acquisition planning, 

• enterprise architecture, 

• project management, 

• human capital planning,
Appendix I: Briefing to Staffs Subcommittees

on Homeland Security, Senate and House

Committees on Appropriations

Page 72 GAO-06-823 Information Technology 

65

Attachment I

Scope and Methodology

• risk management,

• security, and 

• privacy.

For DHS and ICE data that we did not substantiate, we made appropriate 

attribution indicating the data source.

We conducted our work at ICE and DHS headquarters in Washington, D.C., from

March 2006 through April 2006 in accordance with generally accepted government 

auditing standards.
Appendix II: 

A

GAO Contact and Staff 

cknowledgments 

Page 73 GAO-06-823 Information Technology 

Appendix II: GAO Contact and Staff 

Acknowledgments 

Randolph C. Hite (202) 512-3439 

In addition to the individual named above, Gary Mountjoy, Assistant 

Director; Harold Brumm; Neil Doherty; Nancy Glover; James Houtz; Tom 

Mills; and Tammi Nguyen made key contributions to this report. 

GAO Contact 

Staff 

Acknowledgments 

(310625) 
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Mail or Phone 

To Report Fraud,

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER