Information Sharing Environment: Better Road Map Needed to Guide Implementation and Investments
Published: 2011-07-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Recent planned and attempted acts of terrorism on U.S. soil underscore the importance of the government's continued need to ensure that terrorism-related information is shared in an effective and timely manner. The Intelligence Reform and Terrorism Prevention Act of 2004, as amended, mandated the creation of the Information Sharing Environment (ISE), which is described as an approach for sharing terrorism-related information that may include any method determined necessary and appropriate. GAO was asked to assess to what extent the Program Manager for the ISE and agencies have (1) made progress in developing and implementing the ISE and (2) defined an enterprise architecture (EA) to support ISE implementation efforts. In general, an EA provides a modernization blueprint to guide an entity's transition to its future operational and technological environment. To do this work, GAO (1) reviewed key statutes, policies, and guidance; ISE annual reports; and EA and other best practices and (2) interviewed relevant agency officials.
section_title: What GAO Found
paragraphs: Since GAO last reported on the ISE in June 2008, the Program Manager for the ISE and agencies have made progress in implementing a discrete set of goals and activities and are working to establish an "end state vision" that could help better define what the ISE is intended to achieve and include. However, these actions have not yet resulted in a fully functioning ISE. Consistent with the Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act), the ISE is to provide the means for sharing terrorism-related information across five communities--homeland security, law enforcement, defense, foreign affairs, and intelligence--in a manner that, among other things, leverages ongoing efforts. To date, the ISE has primarily focused on the homeland security and law enforcement communities and related sharing between the federal government and state and local partners, to align with priorities the White House established for the ISE. It will be important that all relevant agency initiatives--such as those involving the foreign affairs and intelligence communities--are leveraged by the ISE to enhance information sharing governmentwide. The Program Manager and agencies also have not yet identified the incremental costs necessary to implement the ISE--which would allow decision makers to plan for and prioritize future investments--or addressed GAO's 2008 recommendation to develop procedures for determining what work remains. Completing these activities would help to provide a road map for the ISE moving forward. The administration has taken steps to strengthen the ISE governance structure, but it is too early to gauge the structure's effectiveness. The Program Manager and ISE agencies have developed architecture guidance and products to support ISE implementation, such as the "ISE Enterprise Architecture Framework," which is intended to enable long-term business and technology standardization and information systems planning, investing, and integration. However, the architecture guidance and products do not fully describe the current and future information sharing environment or include a plan for transitioning to the future ISE. For example, the EA framework describes information flows for only 3 of the 24 current business processes. In addition, the Program Manager's approach to managing its ISE EA program does not fully satisfy the core elements described in EA management best practices. For example, an EA program management plan for the ISE does not exist. The Program Manager stated that his office's approach to developing ISE architecture guidance is based on, among other things, the office's interpretation of the Intelligence Reform Act. Nevertheless, the act calls for the Program Manager to, among other things, plan for and oversee the implementation of the ISE, and officials from the key agencies said that the lack of detailed and implementable ISE guidance was one limiting factor in developing agency information sharing architectures. Without establishing an improved EA management foundation, including an ISE EA program management plan, the federal government risks limiting the ability of ISE agencies to effectively plan for and implement the ISE and more effectively share critical terrorism-related information.
section_title: What GAO Recommends
paragraphs: GAO recommends that in defining a road map for the ISE, the Program Manager ensure that relevant initiatives are leveraged, incremental costs are defined, and an EA program management plan is established that defines how EA management practices and content will be addressed. The Program Manager generally agreed with these recommendations.

section_title: Letter
paragraphs: Recent planned and attempted acts of terrorism on U.S. soil underscore  the importance of the federal government’s continued need to ensure that  terrorism-related information is shared with stakeholders across all levels  of government, the private sector, and foreign countries in an effective  and timely manner. To facilitate this sharing, section 1016 of the  Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence  Reform Act), as amended by the Implementing Recommendations of the  9/11 Commission Act of 2007 (9/11 Commission Act), required the  President to create an Information Sharing Environment (ISE)—an  approach to facilitate the sharing of terrorism and homeland security  information, which may include any methods determined necessary and  appropriate. In accordance with the act, the President designated a  Program Manager to plan for, oversee implementation of, and manage  the ISE. Other duties and responsibilities of the Program Manager include  assisting in the development of policies and issuing procedures,  guidelines, instructions, and functional standards, as appropriate, for the  management, development, and proper operation of the ISE, as well as  monitoring and assessing its implementation. According to the Program  Manager, the ISE is not intended to be a traditional, dedicated information  system. Rather, in general, the ISE is to ensure—to the greatest extent  practicable—a decentralized, distributed, and coordinated environment  that builds upon existing systems and leverages ongoing efforts.
In January 2005, we designated information sharing for homeland  security a high-risk area because the federal government faced  formidable challenges in analyzing and disseminating this information in a  timely, accurate, and useful manner. We reported that information is a  crucial tool in fighting terrorism and that its timely dissemination is critical  to maintaining the security of our nation. The federal government’s  sharing of terrorism-related information remained a high-risk area in our  February 2011 update.
In March 2006, we reported that the ISE had not yet been established.  Subsequently, in November 2006, the Program Manager issued an  implementation plan in accordance with the Intelligence Reform Act that  provided an initial structure and approach for establishing the ISE, but  acknowledged that further work was needed to fully define the ISE. In  June 2008, we reported that the Program Manager had completed a  number of tasks within the implementation plan and had included other  information sharing initiatives in the ISE, but the plan did not include  some important elements that were needed to implement the ISE, such  as more fully defining and communicating the ISE’s scope and  communicating that information to stakeholders involved in the  development of the ISE. We also reported that the desired results to be  achieved by the ISE, including individual projects and specific milestones,  had not yet been determined. We reported that these elements are  essential in providing a road map, or program plan, to effectively  implement the ISE. We recommended that the Program Manager and  agencies more fully define the scope and specific results to be achieved  by the ISE and develop performance measures to track progress. The  Program Manager generally agreed and has taken some steps to address  these recommendations but has not yet fully addressed them, as  discussed later in this report.
In response to your request, this report updates our prior work and  addresses to what extent the Program Manager for the ISE and key  stakeholder agencies have (1) made progress in developing and  implementing the ISE, and what work remains, and (2) defined an  enterprise architecture (EA) to support ISE implementation efforts. The  stakeholder agencies we reviewed are the five key agencies the Program  Manager identified, consistent with the Intelligence Reform Act, as critical  to developing and implementing the ISE—the Departments of Homeland  Security (DHS), Justice (DOJ), State (State), and Defense (DOD), as well  as the Office of the Director of National Intelligence (ODNI). These  agencies represent five information sharing communities that collect the  homeland security, law enforcement, foreign affairs, defense, and  intelligence information deemed critical for sharing in order to provide for  homeland security.
To determine the extent to which the Program Manager and stakeholder  agencies have made progress in developing and implementing the ISE,  we reviewed relevant statutes and policies, including the Intelligence  Reform Act and the 9/11 Commission Act. We also reviewed our prior  reports and best practices identifying effective program management,  federal coordination, and cost estimation. Through our review of these  laws, guidance, and reports, we identified standards and best practices  for program and project management and used them to inform our  assessment of efforts to develop and implement the ISE and related  efforts. We used semistructured interviews to gather information from the  key agencies and facilitate analysis of their perspectives on the  development of and remaining challenges impeding implementation of the  ISE. We also used the interviews to obtain information from these  agencies on the status of key activities the Program Manager identified as  accomplishments in the 2009 and 2010 ISE annual reports to Congress,  among other things. In addition, we reviewed and analyzed agency  guidance and plans for implementing the ISE and conducted interviews  with officials from the key agencies to assess actions taken by the  Program Manager to address recommendations in our 2008 report  related to defining the purpose and scope of the ISE and the results to be  achieved.
To determine the extent to which the Program Manager for the ISE and  key stakeholder agencies have defined an EA to support ISE  implementation efforts, we reviewed ISE architecture guidance and  products prepared by the Office of the Program Manager—such as the  ISE Enterprise Architecture Framework (EAF)—and ISE architecture  products prepared by the key ISE agencies, such as the DHS Information  Sharing Segment Architecture. We then compared ISE architecture  guidance and products against our prior reports and federal guidance on  defining EA content and managing EA programs, including our Enterprise  Architecture Management Maturity Framework (EAMMF) and the Office  of Management and Budget (OMB) and the Federal Chief Information  Officer Council’s Federal Segment Architecture Methodology. In  addition, we interviewed officials from the Office of the Program Manager,  key federal agencies, and OMB to obtain their perspectives on efforts to  develop and manage an ISE EA. Appendix I provides additional details  about our objective, scope, and methodology.
We conducted this performance audit from October 2009 through July  2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit  to obtain sufficient, appropriate evidence to provide a reasonable basis  for our findings and conclusions based on our audit objectives. We  believe that the evidence obtained provides a reasonable basis for our  findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Following the terrorist attacks of 2001, Congress and the executive  branch took numerous actions aimed explicitly at establishing a range of  new measures to strengthen the nation’s ability to identify, detect, and  deter terrorism-related activities and protect national assets and  infrastructure from attack. One theme common to nearly all these efforts  was the need to share timely information on terrorism-related matters with  a variety of agencies across all levels of government. The ability to share  security-related information can unify the efforts of federal, state, and  local government agencies in preventing or minimizing terrorist attacks.
subsections: section_title: History of the Information Sharing Environment
paragraphs: Section 1016 of the Intelligence Reform Act, as amended by the 9/11  Commission Act, required the President to take action to facilitate the  sharing of terrorism-related information by creating an information sharing  environment—what has become the ISE. Consistent with the Intelligence  Reform Act, the Program Manager intends for the ISE to provide the  means for sharing terrorism information in a manner that—to the greatest  extent practicable—ensures a decentralized, distributed, and coordinated  environment that builds upon existing systems and leverages ongoing  efforts. Under the act, the President is to designate a Program Manager  to, among other things, plan for, oversee implementation of, and manage  the ISE. The act also established an Information Sharing Council to assist  the President and the Program Manager in carrying out these duties.  Furthermore, the act required the President, with the assistance of the  Program Manager, to submit to Congress a report containing an  implementation plan for the ISE not later than 1 year after the date of  enactment (enacted December 17, 2004) and specified elements to be  included in this plan. These elements include, among other things, a  description of the function, capabilities, resources, and conceptual design  of the ISE; budget estimates; metrics and performance measures; and  delineation of ISE stakeholder roles. The act also required the submission  of annual performance management reports, beginning not later than 2  years after enactment, and annually thereafter, on the state of the ISE  and on information sharing across the federal government.
In April 2005, the President designated a Program Manager responsible  for information sharing across the federal government, in accordance with  the Intelligence Reform Act. In December 2005, the President issued a  memorandum to implement measures consistent with establishing and  supporting the ISE. The memorandum set forth information sharing  guidelines, such as defining common standards for how information is to  be acquired, accessed, shared, and used within the ISE and  standardizing the procedures for handling sensitive but unclassified  information. The memorandum also directed the heads of executive  departments and agencies to actively work to promote a culture of  information sharing within their respective agencies and reiterated the  need to leverage ongoing information sharing efforts in the development  of the ISE.
In November 2006, the Program Manager issued an ISE implementation  plan to provide an initial structure and approach for ISE design and  implementation. The plan incorporated the guidelines in the President’s  December 2005 memorandum as well as elements spelled out in the  Intelligence Reform Act. For example, the plan included steps toward  developing standardized procedures for handling sensitive but  unclassified information as well as protecting information privacy, as  called for in the President’s information sharing guidelines. Under the  plan, the ISE would consist of five “communities of interest”—homeland  security, law enforcement, foreign affairs, defense, and intelligence. In  addition, in August 2007, the Program Manager issued the initial version  of an EAF, which is intended to support ISE implementation efforts.
In October 2007, the President issued the National Strategy for  Information Sharing. The strategy focuses on improving the sharing of  homeland security, terrorism, and law enforcement information related to  terrorism within and among all levels of government and the private  sector. The strategy notes that the ISE is intended to enable trusted  partnerships among all levels of government in order to more effectively  detect, prevent, disrupt, preempt, and mitigate the effects of terrorism  against the United States. Further, according to the strategy, these  partnerships should enable the trusted, secure, and appropriate  exchange of terrorism-related information across the federal government;  to and from state, local, and tribal governments, foreign allies, and the  private sector; and at all levels of security classifications. The strategy  reaffirmed that stakeholders at all levels of government, the private  sector, and foreign allies play a role in the ISE. The strategy also outlined  some responsibilities for ISE stakeholders at the state, local, and tribal  government levels.
In July 2009, the administration established the Information Sharing and  Access Interagency Policy Committee (ISA IPC) within the Executive  Office of the President to, among other things, identify information sharing  priorities going forward. The committee—with representation of  participating ISE agencies and communities—is intended to provide  oversight and guidance to the ISE. In June 2010, the President  appointed the current Program Manager and the White House designated  the White House Senior Director for Information Sharing Policy and the  Program Manager co-chairs of the ISA IPC. The ISA IPC is responsible  for advising the President and Program Manager in developing policies,  procedures, guidelines, roles, and standards necessary to establish,  implement, and maintain the ISE. Also, pursuant to the Intelligence  Reform Act, the head of each department or agency that participates in  the ISE is required to ensure compliance with information sharing  policies, procedures, guidelines, rules, and standards. Further, OMB  provides budgetary, programmatic, and architecture policy guidance to  ISE agencies; prepares the President’s budget; and measures  performance.
The ISE is not a traditional, dedicated information system, according to  the Program Manager. Rather, it is an interrelated set of policies,  processes, and systems intended to allow ISE agencies to access and  share information in a decentralized, distributed, and coordinated  environment that builds upon existing systems and leverages ongoing  efforts. The Program Manager also noted that the ISE is not a program in  the traditional sense with a finite set of requirements, deliverables, and  milestones and an agreed-to budget and manpower resources.  Nevertheless, it is an effort that receives government funding and can be  reviewed using program and project management principles.
section_title: Our Previous Reports on ISE Efforts
paragraphs: In June 2008, we reported that the Program Manager and stakeholder  agencies had completed a number of tasks outlined in the 2006  implementation plan, including, among other things,  the development of proposed common terrorism information sharing  standards—a set of standard operating procedures intended to  govern how information is to be acquired, accessed, shared, and used  within the ISE—and  the development of procedures and markings for sensitive but  unclassified information to facilitate the exchange of information  among ISE participants. Departments and agencies are in the  process of determining how they will implement this guidance (once  implemented, this effort could help improve access to information and  therefore improve information sharing).
Nevertheless, we reported that the action items in the Program Manager’s  June 2006 implementation plan did not address all of the activities that  must be completed to implement the ISE. For example, we noted that  work remained in defining the ISE’s scope and in determining all  terrorism-related information that should be part of the ISE. Moreover, we  found that the desired results to be achieved by the ISE—that is, how  information sharing is to be improved, the individual projects and  initiatives to achieve these results, and specific milestones—had not yet  been determined. Thus, as previously discussed, we recommended,  among other things, that the Program Manager more fully define the  scope and specific results to be achieved by the ISE along with the key  milestones and individual projects or initiatives needed to achieve these  results. The Program Manager and agencies have taken some steps to  address this recommendation but have not yet fully addressed it, as we  discuss later in this report.
The sharing of terrorism-related information remains on our high-risk list.  Our work in this area has consistently focused on how well the federal  government is sharing information among federal agencies as well as  with state, local, tribal, private sector, and international partners. As such,  our focus has been on progress the federal government has made in  standing up the ISE. In February 2011, we reported that while the federal  government has continued to make progress in sharing terrorism-related  information among its many partners, it does not yet have a fully  functioning ISE in place.
section_title: Program Manager and Agencies Have Advanced Key Information Sharing Activities but Have Not Yet Developed a Comprehensive Road Map to Effectively Implement the ISE
paragraphs: Since we issued our 2008 report, the Program Manager and agencies  have established a discrete set of goals and undertaken activities to guide  development and implementation of the ISE, but these actions do not fully  address our recommendations or provide the comprehensive road map  that we called for in our report. For example, the Program Manager and  agencies have not yet fully defined what the ISE is expected to achieve  and contain, identified the incremental costs necessary to implement the  ISE, or fully developed procedures to show what work remains and  related milestones to provide accountability for results. The administration  has taken steps to strengthen the ISE governance structure to help guide  the development and implementation of the ISE, but it is too early to  gauge the structure’s effectiveness.
subsections: section_title: The Program Manager and Agencies Have Established a Discrete Set of Goals and Undertaken Activities under the ISE, but Work Remains in Developing and Implementing the ISE
paragraphs: In November 2006 and in accordance with the Intelligence Reform Act,  the Program Manager submitted an ISE implementation plan to Congress  that, according to the plan, was intended to help guide development of  the ISE for a 3-year period. The plan addressed initial actions for defining  the ISE as well as agency responsibilities and time frames. However, as  we discussed in our 2008 report, the plan did not include some important  elements needed to develop and implement the ISE. Work remained in,  among other things, defining and communicating the scope and desired  results to be achieved by the ISE, specific milestones to achieve the  results, and the individual projects and execution sequence needed to  achieve these results and implement the ISE.
Subsequently, in part based on recommendations made in our 2008  report, the Program Manager worked with the five key agencies to create  a new plan to guide development of the ISE, which they called an ISE  “framework.” Specifically, the framework identified four goals for the ISE,  which were to (1) create a culture of sharing; (2) reduce barriers to  sharing; (3) improve information sharing practices with federal, state,  local, tribal, and foreign partners; and (4) institutionalize sharing. The  framework also identified 14 specific subgoals or activities agencies were  to pursue. Some of these activities were intended to institutionalize  information sharing practices into agency operations, such as establishing  information sharing and incentive programs for federal employees. For  example, DHS, DOJ, and DOD, as well as ODNI have made information  sharing a factor in their incentives programs by offering employees  awards based on their contributions to information sharing and  collaboration practices. The framework also cataloged agencies’ ongoing  information sharing initiatives to leverage their benefits across the  government, consistent with the Intelligence Reform Act, including the  following:    The Nationwide Suspicious Activity Reporting Initiative. This  initiative builds on what state and local law enforcement and other  agencies have been doing for years—gathering information regarding  behaviors and incidents indicative of criminal activity that may be  precursors to terrorism—and establishes a standardized process to  share this information among agencies to help detect and prevent  terrorism-related activity. In February 2010, DOJ became the lead  agency for the initiative and established a program management  office to support its development in cooperation and coordination with  DHS and the Federal Bureau of Investigation.    The national network of fusion centers. This initiative is designed  to leverage the fusion centers that all 50 states and some major urban  areas have established to address gaps in terrorism-related  information sharing that the federal government cannot address alone  and provide a conduit for information sharing within each state,  among other things. In 2010, federal, state, and local officials from  across the country launched the first nationwide assessment of fusion  center capabilities, with the goal of helping centers close gaps so they  have a consistent baseline of information sharing capabilities.  Information from this assessment is to be used to develop strategies  and realign resources to close those gaps going forward.
ISE privacy and civil liberties. ISE stakeholders have made an effort  to strengthen privacy, civil rights, and civil liberties across all sectors  of the ISE. According to the July 2010 annual report, 9 of 15 ISE  stakeholders had implemented ISE privacy policies. These policies  are intended to ensure that privacy and other legal rights of  Americans are protected in the development and use of the ISE.
For the subgoals in the framework, the Program Manager established a  process to gauge and track agencies’ progress in implementing these  subgoals and a related set of performance measures. The Program  Manager included the framework in both the June 2009 and July 2010  annual progress reports to Congress. As discussed later in this report, the  framework and annual reports to Congress did not specifically address  what work remained in completing the initiatives or related milestones.
The ISE framework has served as a plan to guide development of the ISE  and its discrete set of 14 subgoals. The framework includes a number of  elements that our work has shown are important for developing and  implementing broad, crosscutting initiatives like the ISE, such as defined  goals, objectives, activities, and metrics. However, as discussed in more  detail later in this report—in part because the framework is limited to  these 14 subgoals and does not define what the fully functioning ISE is to  achieve and include—it does not provide the comprehensive road map  that is needed to further develop and implement the ISE going forward. In  April 2010, the White House Senior Director for Information Sharing  Policy acknowledged that the ISE framework is a set of 14 disparate  activities that do not constitute a governmentwide initiative to share  terrorism information, as envisioned by the Intelligence Reform Act.  According to the Program Manager, the role of the current framework in  guiding further development of the ISE and the extent to which other  activities will be integrated into the framework have not yet been  determined. Therefore, it is unclear how, if at all, the framework and its  related goals and activities will be used to guide future development of  the ISE.
section_title: More Fully Defining the ISE, Related Costs, and What Work Remains Could Help to Facilitate Implementation and Accountability for Results
paragraphs: More than 6 years after enactment of the Intelligence Reform Act and  initial efforts to create the ISE, there is not a clear definition of what the  ISE is intended to achieve and include. The Program Manager and ISE  agencies have ongoing efforts to more fully define this “end state” vision,  which is a key next step for ISE development, by the end of summer  2011. After this vision is defined, it will be important for the Program  Manager and ISE agencies to ensure that all relevant agency initiatives  are leveraged by the ISE to improve information sharing across all  communities and to define the incremental costs related to implementing  the ISE so agencies can determine how to fund future investments. The  Program Manager has enhanced monitoring of ISE initiatives, but  additional actions could help demonstrate progress and provide  accountability for results. In addition to Intelligence Reform Act  requirements, our prior work has found that these activities help to  provide a road map for responsible parties in developing and  implementing broad, crosscutting initiatives like the ISE. Such actions  are also consistent with criteria we use to assess whether agencies have  made progress to resolve past terrorism-related information sharing  problems, thereby reducing the risk that these problems pose to  homeland security.
A road map for the ISE should identify key next steps for ISE  development and start with a clear definition of what the ISE is intended  to achieve and include—or the “end state” vision. In 2008, we reported  that while the Program Manager had completed a plan with an initial  structure and approach for ISE design and implementation, he had not  yet determined the desired results to be achieved by the ISE, and we  recommended that he do so, among other things. The Program Manager  has also acknowledged the importance of developing an end state vision  for the ISE and noted that he is doing so as part of efforts to update the  2007 National Strategy for Information Sharing. The Program Manager  said that this update will drive future ISE implementation efforts and will  help individual agencies across all five communities adapt their  information sharing policies, related business processes, architectures,  standards, and systems to effectively operate with the ISE.
According to the Program Manager, the end state vision will define the  current state of the ISE and the future vision to be achieved by agencies  as they work to further develop and implement the ISE. DHS and DOJ  officials we contacted also cited the importance of developing an end  state vision to assist in guiding development and implementation of the  ISE. For example, DOJ officials stated that a defined end state would  facilitate development and implementation of common goals going  forward.
The Program Manager has publicly acknowledged the need to accelerate  ISE progress. To inform efforts to define an end state vision, the Program  Manager has been soliciting ideas and input from ISE stakeholder  agencies. According to the Program Manager, the updated National  Strategy for Information Sharing and the ISE end state vision have not  been finalized, and therefore it is premature to speculate on questions  such as changes in program or investment priorities as well as  information sharing gaps and challenges to be addressed. In June 2011,  the Program Manager said that the national strategy will be updated in  the near future, but he did not provide a specific date.
According to the Program Manager, the end state vision will be a  snapshot at a point in time because as threats continue to evolve, the ISE  will need to evolve as well. The Program Manager noted that after  development of the end state vision is completed, supporting  implementation plans will be needed to help guide achievement of the  vision, including plans that define what activities and initiatives will be  needed to achieve the end state and to guide development and  implementation of the ISE. Such plans would be consistent with our call  for a road map, if they contain key ingredients such as roles,  responsibilities, and time frames for these activities, among other things.  Further, as we discuss later in this report, the process of defining an EA  for the ISE—and agencies’ associated segment architectures that support  their individual ISE activities—could help the Program Manager and  agencies in their efforts to define the current operational and  technological capabilities within the ISE, the future capabilities needed,  and a plan to transition between the two.
The September 11, 2001, terrorist attacks exposed that the five ISE  communities—homeland security, law enforcement, foreign affairs,  defense, and intelligence—were insulated from one another, which  resulted in gaps in the sharing of information across all levels of  government. Before the attacks, the overall management of information  sharing activities among government agencies and between the public  and private sectors lacked priority, proper organization, coordination, and  facilitation. Consistent with the Intelligence Reform Act, the ISE is  intended to provide the means for sharing terrorism information across  the five communities in a manner that, among other things, builds upon  existing systems and leverages ongoing efforts. To date, the ISE has  primarily focused on the homeland security and law enforcement  communities and related sharing between the federal government and  state and local partners, in part to align with information sharing priorities.
OMB ISE programmatic guidance shows that ISE activities have been  primarily focused on sharing within the homeland security and law  enforcement communities and with domestic partners—such as state and  local law enforcement agencies. This guidance—developed in  collaboration with ISE leadership—outlines the White House’s priorities  for the ISE and those that agencies are to focus on and align resources  and investments to during a given fiscal year. For fiscal year 2012, OMB’s  programmatic guidance identifies the following priorities, which are  primarily focused on sharing information between the federal government  and state and local partners:    building a national integrated network of fusion centers,    continuing implementation of the Nationwide Suspicious Activity  Reporting Initiative,    establishing Sensitive but Unclassified/Controlled Unclassified  Information network interoperability,  improving governance of the Classified National Security Information  Program, and    advancing the implementation of controlled unclassified information  policy.
Officials from all five communities generally agreed that ISE activities  undertaken to date have been primarily focused on sharing within the  homeland security and law enforcement communities—primarily domestic  sharing between the federal government and state, local, and tribal  partners. According to DOJ officials, this initial focus was appropriate and  allowed the Program Manager to leverage agencies’ ongoing efforts to  share terrorism-related information. The officials noted that by focusing on  a select set of initiatives—such as the Nationwide Suspicious Activity  Reporting Initiative and the national network of fusion centers—the  Program Manager was able to make progress toward implementing ISE  priorities. We recognize that recent homeland security incidents and the  changing nature of domestic threats make continued progress in  improving sharing between federal, state, and local partners critical.  However, consistent with the Intelligence Reform Act, the ISE is intended  to provide the means for sharing terrorism information across all five  communities.
The Program Manager and ISE agencies have not yet ensured that  initiatives within the foreign affairs, defense, and intelligence communities  have been fully leveraged by the ISE to enhance information sharing  within and across all communities. According to State officials, the  department shares terrorism-related information with other agencies  through a variety of efforts and initiatives related to national and  homeland security. The officials noted that most of the initiatives are non- ISE efforts, meaning that they did not originate in the Program Manager’s  office. The officials also noted that the department has only been asked to  provide one kind of terrorism-related information as part of one ISE  initiative related to Suspicious Activity Reporting and complied with this  request. According to the Program Manager, State also possesses  information about entrants to the country that could be valuable to the  ISE. However, in April 2011, State officials said that the Office of the  Program Manager has not contacted the department’s coordinator for the  ISE to request information on programs or initiatives related to people  entering the country. Therefore, the Program Manager and State have not  determined if this information could be used to benefit other ISE  communities. DOD officials also said that the department is undertaking  activities outside of the ISE, such as efforts to develop interagency  agreements between DOD and the Federal Bureau of Investigation for  the purpose of sharing terrorism-related information. According to DOD  officials, this effort could be part of the ISE if the information addressed  within these agreements is consistent with the ISE’s established  standards, among other things.
In addition, the December 25, 2009, attempted terrorist attack highlighted  the importance of effective information sharing within the intelligence  community and demonstrated the potential consequences if information is  not shared in a manner that facilitates its use in analysis, investigations,  and operations. The intelligence community’s efforts to better share  classified information among intelligence agencies are highlighted in the  2010 annual report, but the report does not discuss the extent to which  these initiatives are being coordinated within and among the five  communities or how the ISE could leverage their benefits. For example,  the report discusses an initiative that will allow intelligence community  personnel to search for or discover information, including terrorism- related information, across all agencies within the community. According  to the Program Manager, this ODNI initiative—while so far limited to the  intelligence community—should be highlighted as a best practice across  the ISE. However, the 2010 report does not discuss whether and how  these technological advances could be used to benefit other communities  or how they are implementing this best practice. Also, according to the  Program Manager, the ISE has generally left the sharing of Top Secret  and higher information to ODNI and intelligence community agencies  since they manage most of this information. He said that this was unlikely  to change significantly in the future. Ensuring that the intelligence  community is fully involved in developing the ISE could help resolve the  problems the September 11 attacks exposed—especially that critical  information was contained in agencies’ individual stovepipes and not  shared.
Further, in part because of the focus on domestic sharing with the  homeland security and law enforcement communities, not all agencies  have been similarly engaged in building the ISE or have had their  initiatives leveraged as discussed above. Officials from the five key  agencies said that they have actively participated in ISA IPC meetings  and have had opportunities to provide feedback on emerging policy  decisions. They also noted that when appropriate, they participate in the  development and implementation of OMB priorities and initiatives set forth  by the ISA IPC and Program Manager. However, State, DOD, and ODNI  officials also reported that development of the ISE has had limited focus  to date on information sharing within and among the foreign affairs,  defense, and intelligence communities.
State officials said that the ISE priorities established to date generally do  not engage State’s mission because the initiatives are primarily focused  on sharing with state and local partners, while State’s mission focuses on  building relationships within the foreign affairs community. Similarly, DOD  officials said they have been engaged in some ISE priorities—such as  implementing the Nationwide Suspicious Activity Reporting Initiative—but  that DOD has not been tasked to lead any new terrorism-related  information sharing initiatives. In addition, ODNI officials said that  because many ISE activities are focused on efforts with state, local, tribal,  and private sector partners, the intelligence community’s participation in  those activities is limited as the intelligence community, by mission and  statute, primarily focuses on foreign intelligence.
The Program Manager acknowledged that the most visible outcomes of  the ISE have been in the law enforcement and homeland security  communities. However, he noted that officials from the Office of the  Program Manager have worked with State to standardize terrorism- related information sharing agreements with foreign governments; worked  with DOJ and DOD to develop information technology standards that  allow different agencies to exchange information; and worked with ODNI  and the intelligence community to develop terrorism-related information  products for state, local, and tribal governments. The Program Manager  also noted that State, DOD, and ODNI are participants in the ISA IPC and  have been afforded opportunities to help set ISE programmatic priorities  and participate in discussions and decisions about where to strategically  prioritize scarce resources. Nevertheless, the Program Manager has also  recognized the need to enhance and extend partnerships across all five  communities and said that significant outreach to ISE agencies has been  under way since he became Program Manager in July 2010. In addition to  his outreach efforts, the Program Manager has suggested that specific  agencies—such as State, DOD, and ODNI—could also develop  proposals for how their information sharing activities could be better  integrated into the ISE.
Consistent with the Intelligence Reform Act, the ISE is intended to provide  the means for sharing terrorism information across all five communities in  a manner that builds upon existing systems and leverages ongoing  efforts. After the end state vision is defined, taking actions to ensure that  all relevant information sharing initiatives across the five communities are  fully leveraged could help the Program Manager and ISE agencies  enhance information sharing governmentwide and better enable the  federal government to share information that could deter or prevent  potential terrorist attacks.
Section 1016 of the Intelligence Reform Act required the President, with  the assistance of the Program Manager, to include as part of the ISE’s  implementation plan, a budget estimate that identified the incremental  costs associated with designing, testing, integrating, deploying, and  operating the ISE. In June 2008, we reported that the initial ISE  Implementation Plan issued in 2006 did not provide a budget estimate  that identified incremental costs in accordance with the act, but that the  Program Manager indicated that steps to develop such an estimate would  be taken in the future. At that time, a budget estimate that identified  incremental costs had not been developed, in part, because the ISE was  in such an early stage of development and it would have been difficult for  agencies to know what to include in developing such a cost estimate. The  Program Manager, in the 2009 ISE annual progress report, also identified  the need to coordinate investments for terrorism-related initiatives as both  a priority and a challenge, but noted that limited progress had been made  in defining the resources needed to implement the ISE. The 2010 annual  progress report noted that the Office of the Program Manager had  developed a process that is intended to link ISE initiatives and  performance measures to investment decisions. However, the Program  Manager could not identify the level of investments that have been  dedicated to the ISE to date. The Program Manager also could not  identify the future incremental investments needed to develop and  implement the ISE, in part because the Program Manager and key  agencies had not yet determined what the ISE is to achieve and include.
Officials from the Office of the Program Manager said they had not  prepared estimated costs for the ISE and that there has never been a  stand-alone budget for the program. The officials said that because the  ultimate goal of the ISE is to become an institutionalized practice among  agencies, to separate or designate funding for ISE-related activities as  part of agency budget processes would undermine this overarching goal.  Further, OMB officials said that because information sharing is a core  mission of all departments and agencies, they are to cover costs to  implement information sharing initiatives from within their existing  budgets. Nevertheless, while an estimate has not been prepared, the  Program Manager said that progress has been made in collecting certain  ISE-related costs. Specifically, OMB, in cooperation with the Office of the  Program Manager, modified OMB Circular A-11 in 2010 to collect more  information from agencies about planned ISE-related technology  investments. This effort is intended to identify costs related to agencies’  information technology system investments, but it does not identify other  types of incremental costs associated with implementing the ISE, such as  those involving training and other administrative programs and activities.  The Deputy Program Manager acknowledged the importance of  identifying such incremental costs but noted that ISE agencies are best  positioned to establish this cost and budget information.
Two of five agencies that we contacted noted that governmentwide  initiatives, such as the ISE, are often difficult to implement without  dedicated funding for mandated programs. For example, State officials  noted that the department had challenges redirecting operational funds to  achieve ISE program objectives during fiscal years 2008 and 2009. DOJ  officials also acknowledged the challenges in implementing new  governmentwide efforts without related funding, but noted that the use of  “seed funding” in support of key terrorism-related information sharing  initiatives—such as the Nationwide Suspicious Activity Reporting Initiative  and fusion center programs—has been one of the major successes of the  ISE.
We recognize that attaining accurate and reliable incremental cost  estimates for the ISE is a difficult undertaking, complicated further by the  fact that the Program Manager and agencies are still defining what the  ISE is, is to include, and is to attain. However, new ISE requirements will  need additional investments, regardless of whether they are funded  through existing agency budgets, a separate program budget, or another  mechanism. Our best practices on cost estimation note that the ability of  agencies to generate reliable cost estimates is a critical function for  effective program management. In addition, our prior work shows that  cost information can help agencies allocate resources and investments  according to priorities and constraints, track costs and performance, and  shift such investments and resources as appropriate. After the ISE end  state vision is defined and needed activities and initiatives are identified,  developing incremental cost estimates would help agencies plan and  budget for these activities and initiatives and allow Congress and other  decision makers to prioritize future investments and demonstrate a  continued commitment to supporting the ISE.
The Intelligence Reform Act requires the Program Manager to, among  other things, monitor implementation of the ISE by federal departments  and agencies to ensure that adequate progress is being made and  regularly report the findings to Congress. In June 2008, we reported that  the Office of the Program Manager was monitoring ISE implementation— as demonstrated through its September 2007 annual report to  Congress—but that such monitoring did not include an overall  assessment of progress in implementing the ISE and how much work  remained. Thus, we recommended, among other things, that the Program  Manager (1) develop a way to measure and demonstrate results to  ensure that the ISE was on a measurable track to success and to show  the extent to which the ISE had been implemented and what work  remained and (2) more fully define the key milestones needed to achieve  ISE results. The Program Manager generally agreed and has taken  some steps to address these recommendations but has not yet fully  addressed them. These practices are critical to an effective monitoring  system and would help to provide an accurate accounting for progress to  Congress and other stakeholders. Further, our prior work on high-risk  issues shows that agencies must have a way to monitor and demonstrate  progress against baseline requirements—in this case, the activities,  milestones, and results to be achieved for the ISE.
The Program Manager has taken steps to address our recommendations  by instituting a “maturity model” to monitor and track progress. For  example, the maturity model tracks each of the 14 initiatives in the ISE  framework from their early stages of development until they are  considered to be institutionalized into agency operations. The model  contains four levels:    Ad-hoc: Information sharing occurs among functions or groups with  few repeatable processes.    Defined: Information sharing sources and products are identified and  processes are followed.    Managed: Information sharing is well characterized and consistently  performed across organizational boundaries.  Institutionalized: Information sharing is quantitatively managed and  business processes are aligned, seeking continuous improvement.
In the July 2010 annual report to Congress, the Program Manager noted  that 9 of the 14 initiatives were at the second level and had been  “defined,” and the remaining 5 were at level three and being “managed.”  The maturity model and related reporting provide useful information on  the status of ISE initiatives and provide a general indicator of the overall  progress of the ISE. Nevertheless, these actions do not fully address our  recommendations because the annual reports do not specifically address  what work remains in completing the 14 initiatives or related milestones  for completion, which are important elements in determining overall  progress in implementing the ISE and establishing accountability for  future efforts. The Program Manager’s ongoing efforts to define the ISE  end state vision and implementing road map—to the extent that they  include associated time frames and milestones for achieving both  individual projects or activities as we recommended in June 2008 as well  as the capabilities of a fully implemented ISE as envisioned—would help  to provide a baseline for decision makers and investors to measure ISE  progress. This baseline could be used to determine what work has been  achieved and remains and whether additional efforts to accelerate  progress are needed, among other things.
While the framework did not establish time frames or milestones, the  Office of the Program Manager uses an annual performance  questionnaire to collect information on the agencies’ progress in  implementing 10 of the 14 initiatives to inform the maturity model.  According to officials from the Office of the Program Manager, the survey  does not include data on the other 4 initiatives—the Nationwide  Suspicious Activity Reporting Initiative, fusion centers, efforts to  standardize controlled unclassified information, and the Interagency  Threat Assessment and Coordination Group. Instead, the officials said  that each of the agencies with responsibility for leading these efforts  monitors its own performance to ensure progress and provides a  summary of progress highlights to the Office of the Program Manager,  which is incorporated into the annual report. For example, the 2010  annual report highlighted the successful integration of a Federal Bureau  of Investigation system into the Nationwide Suspicious Activity Reporting  Initiative. These summaries provide information that shows what agencies  are doing and demonstrate recent accomplishments, but they do not  provide a gauge to measure progress achieved versus what work  remains or milestones for completing remaining work regarding fully  developing and implementing the ISE.
In January 2011, the ISA IPC and the Office of the Program Manager  initiated an effort to make ISE priority programs and related goals more  transparent and to better monitor progress. Specifically, according to the  Deputy Program Manager, agencies that are responsible for  implementing ISE priority programs are leading efforts to establish 3-, 6-,  and 12-month goals for these programs. He noted that once the goal- setting process is established, information on progress made in reaching  these goals may be included in future ISE annual reports. This process  should help to provide accountability over ISE priority programs on a  yearly basis.
The 2008, 2009, and 2010 annual reports to Congress include some  performance measures, such as the number of departments and  agencies that have conducted ISE-related awareness training or have  developed and implemented ISE privacy policies. Including these  measures in annual reports is an important step in providing  accountability for results, but it does not fully address our  recommendation because the measures generally focus on counting  activities (i.e., output measures) accomplished rather than results  achieved (i.e., outcome measures), such as how and to what extent  sharing has been improved and ultimately, to the extent possible, what  difference these improvements are making in helping to prevent terrorist  attacks. The Deputy Program Manager stated that the Office of the  Program Manager recognizes the need to develop performance  measures that show how and to what extent sharing has been improved  and that the goal-setting process should assist in transitioning from output  to outcome-oriented performance measures.
We recognize and have reported that it is difficult to develop performance  measures that show how certain information sharing efforts have affected  homeland security. Nevertheless, we have recommended that agencies  take steps toward establishing such measures to hold them accountable  for the investments they make. We also recognize that agencies may  need to evolve from relatively easier output measures—that for example  count the number of agencies that have conducted ISE-related  awareness training—to more meaningful measures that weigh agencies’  satisfaction with the timeliness, usefulness, and accuracy of information  shared until the agencies can establish outcome measures that determine  what difference the information made to federal, state, local, and other  homeland security efforts. Thus, we continue to believe that our June  2008 recommendation to the Program Manager and key agencies to  develop performance measures that show the extent to which the ISE has  been implemented and sharing improved has merit and should be fully  implemented.
section_title: The Administration Has Taken Steps to Strengthen the ISE Governance Structure, but It Is Too Early to Gauge the Structure’s Effectiveness
paragraphs: Our prior work on high-risk issues shows that a strong commitment from  top leadership to addressing problems and barriers to sharing terrorism- related information is important to reducing related risks. In July 2009, the  White House established the ISA IPC within the Executive Office of the  President to subsume the role of its predecessor interagency body—the  Information Sharing Council. The Assistant to the President for  Homeland Security and Counterterrorism designated the White House  Senior Director for Information Sharing Policy to chair the new committee.  These changes were intended to bring high-level policy decision making  and oversight to the development of the ISE.
The Intelligence Reform Act requires the Program Manager to plan for,  manage, and oversee implementation of the ISE, including assisting in  the development of policies to guide implementation and ensure  progress. In a July 2009 testimony, the Program Manager at that time  cited concerns about the Program Manager’s authority and provided  recommendations intended to help strengthen the ISE effort. For  example, among other things, he recommended having a presidential  appointee serve as Program Manager and having the Program Manager  co-chair the ISA IPC. Following this Program Manager’s resignation, an  acting Program Manager assumed responsibility for implementing the ISE  until June 2010, at which time the President appointed the current  Program Manager. Also, in June 2010, the Assistant to the President for  Homeland Security and Counterterrorism designated the Program  Manager as a co-chair of the ISA IPC—along with the White House  Senior Director for Information Sharing Policy—which was consistent with  the prior Program Manager’s recommendations. According to the Office  of the Program Manager, having the Program Manager for the ISE also  co-chair the ISA IPC was intended to acknowledge that policies, business  practices, architectures, standards, and systems developed for the ISE  can be applicable to other types of national security information beyond  terrorism and vice versa. In this role, the Program Manager is to ensure  the close alignment of the ISE and broader national security information  sharing activities.
The new Program Manager stated that he would have one of four levels  of involvement in implementing the specific activities listed in the 2010  annual progress report to Congress:    Monitoring: For certain information sharing activities that agencies are  generally implementing on their own initiative, the Office of the  Program Manager is to stay informed of ongoing developments to  determine whether the activity might be a potential best practice that  is applicable to other ISE mission partners. The Program Manager  also monitors activities to stay abreast of issues that might eventually  surface through the ISE process. For example, the Program Manager  said he monitors the intelligence community’s efforts to better share  classified information among intelligence agencies.    Advising: For some agency initiatives, the Program Manager said that  the Office of the Program Manager may be called on to provide  specialized information sharing expertise, even though the office is  not responsible for actual implementation. For example, the Program  Manager said his office has an advisory role in supporting the  Nationwide Suspicious Activity Reporting Initiative.    Supporting: For selected activities with significant implications for the  ISE, the Program Manager said that the Office of the Program  Manager is to play a more active support role, that this support could  take many forms, and that it may include co-investment of seed  capital in the early stages of specific high-priority efforts. For example,  the Program Manager said the office supports agencies’ efforts to  designate and share controlled unclassified information.    Leading: The Program Manager also said there are several activities  for the ISE as a whole where the Office of the Program Manager is to  take the lead role, providing the financial and personnel resources  necessary to carry them out. For example, the Program Manager said  the office has the lead role in providing communications and outreach  related to the ISE.
The Program Manager also noted that his role could evolve as activities  mature, as it did for the Nationwide Suspicious Activity Reporting  Initiative.
The administration’s steps to strengthen the ISE governance structure  address concerns the prior Program Manager identified and our criteria  for committed leadership. However, it is too early to tell how the new  structure will affect the continued development and implementation of the  ISE and if the Program Manager’s new role will provide him sufficient  leverage and authority to ensure that agencies consistently implement  information sharing improvements governmentwide.
section_title: The Enterprise Architecture Management Foundation for Supporting ISE Implementation Could Be Improved
paragraphs: The Program Manager’s 2010 annual report to Congress states that the  office’s architecture program for the ISE describes the rules and practices  needed for planning and operating ISE systems consistent with EA best  practices. According to relevant guidance, an EA, or modernization  blueprint, should include descriptions (i.e., “architecture views”) of an  enterprise’s current and future environment for business processes, data  and information, applications and services, technology, and security in  meaningful models, diagrams, and narrative. In addition, our Enterprise  Architecture Management Maturity Framework (EAMMF) recognizes that  various approaches for structuring an EA exist and can be applied to the  extent that they are relevant and appropriate for a given enterprise. These  approaches generally provide for breaking down an enterprise into its  logical parts and allowing various components of an enterprise (e.g., ISE  mission partners) to develop their respective parts of the EA in relation to  enterprisewide needs and the inherent relationships and dependencies  that exist among the parts. Accordingly, our EAMMF provides flexibility  for how such an EA should be developed and does not prescribe a  specific approach by which organizations should develop EA content. In  addition to providing descriptions of an enterprise’s current and future  environment, relevant guidance states that an EA should include an  enterprise sequencing plan for transitioning from the current environment  to the future environment. Specifically, the enterprise sequencing plan  should describe an incremental strategy that includes scheduling multiple,  concurrent, interdependent activities and incremental implementation to  evolve the enterprise.
We have previously reported that successfully managing the development  and implementation of an EA depends in large part on the extent to which  effective management controls (e.g., policies, structures, processes, and  practices) are employed. Our EAMMF provides a benchmark against  which to measure the extent to which a given enterprise is effectively  managing its architecture program. It defines various stages of maturity  for an EA and the management controls expected to be in place for each  stage. Stages 1 and 2 of this framework can be viewed as providing for  the institutional leadership and foundational management capabilities for  the later stages to build upon and thereby achieve program success. For  example, in stage 1 an enterprise commits to developing an EA and  defines the purpose of its EA, and in stage 2 it defines the methodology  and plans by which EA products are to be developed and maintained. An  EA program that has not satisfied key stage 1 and 2 core elements can  be considered ad hoc, unstructured, and unlikely to succeed. It is  important to note that the EAMMF should not be viewed as either a rigidly  applied checklist or as the only relevant benchmark for managing and  assessing an EA program. Instead, it is intended to be applied flexibly  with discretion in light of each enterprise’s unique facts and  circumstances.
The Program Manager has developed architecture guidance to assist in  the implementation of the ISE. For example, in August 2007, Version 1.0  of the ISE EAF was released and in September 2008 it was revised. The  framework is to provide strategic guidance to enable long-term business  and technology standardization and information systems planning,  investing, and integration in the ISE by documenting and organizing the  ISE mission business goals and processes, services, data, and  technologies and other operational capabilities necessary to facilitate  information sharing. In addition, in May 2008 the Office of the Program  Manager issued its Profile and Architecture Implementation Strategy  (PAIS) to augment its ISE EAF and in June 2009 it was revised. Among  other things, the PAIS describes a series of steps that the ISE agencies  are to follow when developing their information sharing segment  architectures to support the implementation of ISE capability. These  steps are generally consistent with federal guidance, such as the federal  Chief Information Officers Council’s Federal Segment Architecture  Methodology.
The Program Manager and ISE agencies have also begun to develop  products that describe several components of an ISE EA. For example,  the Program Manager has worked with ISE agencies to establish cross- agency ISE segment architectures, such as the ISE Suspicious Activity  Reporting evaluation environment segment architecture, which is  intended to assess selected architectural concepts supporting the  business processes, procedures, and policies associated with a  nationwide Suspicious Activity Reporting capability, among other things.  In addition, as described subsequently in this report, three ISE agencies  have developed information sharing segment architectures, which are  intended to identify common ISE services, standards, and other ISE tools  to allow for opportunities to reuse and leverage services among ISE  departments and agencies.
Although the ISE architectural guidance and products provide some  information to guide information sharing activities at the five key ISE  implementing agencies, they do not fully describe the ISE’s current and  future environment for business processes, data and information,  applications and services, technology, and security consistent with  relevant guidance. For example, the EAF identifies 24 current ISE  business processes and describes activities and information flows for 3  current business processes. However, it does not describe business  activities and information flows for the remaining 21 current business  processes, such as the business process that supports responding to a  terrorism-related threat. These information flows are important for  identifying specific terrorism data needed to be shared among the ISE  business processes and establishing mutually understood data definitions  and structures to facilitate data integration across the ISE. Without such  common definitions and structures, ISE agencies risk needing to invest  significant time and resources to interpret and restructure data received  from multiple systems supporting different ISE business processes.
Moreover, the ISE EAF describes some aspects of the future technology  environment, such as a set of technical standards that has been identified  for use in planning, implementing, and deploying ISE information  technology infrastructure, but it does not describe the ISE’s current  technology environment (e.g., the existing databases and  communications networks that support the Alerts, Warnings, and  Notifications business process). In addition, an ISE enterprise sequencing  plan that describes the interdependent activities to be undertaken by the  Program Manager and ISE agencies to incrementally achieve the target  ISE does not exist. As a result, ISE agencies and the Program Manager  risk not synchronizing or integrating their interdependent ISE activities to  inform timely initiation of ISE projects or development of ISE policies and  procedures. Appendix III provides a detailed analysis and descriptions of  the ISE architectural content reflected in the EAF and associated  architectural documents.
If managed properly, an EA program can help simplify, streamline, and  clarify the interdependencies and relationships among an enterprise’s  diverse mission and mission-support operations and information needs,  including its associated information technology environment. However,  the Office of the Program Manager’s approach to managing ISE  architecture-related activities does not fully satisfy the core elements  described in our EAMMF for establishing institutional commitment and  creating the EA management foundation. Of the 13 core elements  spanning these two stages that we reviewed, 1 was fully satisfied, 9 were  partially satisfied, and 3 were not satisfied. (See app. IV for a detailed  description of each core element and our analysis of the extent to which  each has been satisfied.) For example, in consultation with the ISA IPC,  proactive steps have been taken to address EA-related cultural barriers,  such as parochialism and cultural resistance among ISE agencies.  However, an EA program management plan that, among other things,  reflects ISE EA program work activities, events, and time frames and  defines accountability mechanisms does not exist. As a result, ISE  agencies risk not budgeting and allocating adequate resources for ISE  work activities, and risk delaying the start or completion of their ISE work  activities because of a lack of information about the activities and events  associated with the ISE EA program. Regardless of the architectural  approach used for the ISE, establishing the EA management foundation  is important for guiding the development of ISE architecture products to  effectively support ISE implementation efforts.
Finally, agency-specific information sharing segment architectures, which  according to ISE guidance are to be developed to identify common ISE  services, standards, and other ISE tools to allow for opportunities to reuse  and leverage services among ISE departments and agencies, have not  been fully defined. According to the Program Manager’s July 2010  annual report to Congress, ODNI and State have not developed such  segment architectures. In its technical comments on a draft of this report,  ODNI acknowledged that it does not have an information sharing  segment architecture, and is working to make data sharable through  Intelligence Community policies. For example, Intelligence Community  Directive 501 states that all information collected and analysis produced  by a member of the intelligence community shall be made available for  automated discovery by authorized Intelligence Community personnel,  consistent with applicable law and in a manner that protects fully the  privacy rights and civil liberties of all U.S. persons. Also according to the  Program Manager’s July 2010 annual report to Congress, DOJ, DHS, and  DOD have taken steps to develop their respective segment architectures.  However, the DOJ, DHS, and DOD information sharing segment  architectures are all missing important content. For example, none of  these three departments has fully defined the needed business and  information requirements. (The extent to which these three departments  have developed their information sharing segment architectures is  described in app. V.) As a result, there may be an insufficient basis for  identifying opportunities to avoid duplication of effort and launch initiatives  to establish and implement common, reusable, and interoperable  solutions and services across the ISE to achieve cost savings.
The ISE EAF is intended to establish a strategic road map that enables  ISE departments and agencies to further develop their respective EAs in  order to implement information sharing capabilities. However, as we have  previously reported, high-level EA frameworks and guidance, such as  OMB’s federal EA, do not necessarily provide sufficient content for  guiding the implementation of systems. The ISE EAF and associated  architectural documentation also do not (1) provide sufficient architectural  content (e.g., descriptions of ISE business processes and interagency  information exchange requirements) necessary for ISE agencies to  develop their information sharing architectures or (2) include an ISE  enterprise sequencing plan that would serve as an effective road map for  ISE departments and agencies. In addition, officials from the key ISE  implementing agencies indicated that the lack of detailed and  implementable ISE guidance was one limiting factor in developing agency  information sharing segment architectures. Improved ISE architecture  content and an ISE enterprise sequencing plan could enable better  planning for the distributed ISE and allow for implementation of ISE  capabilities in manageable pieces.
The Program Manager stated that his office and OMB are using a  standardized EA framework and method for the ISE to identify critical  business processes and interfaces, establish standards for data formats,  identity management and credentialing, and exchange protocols for  information sharing between enterprises in a manner that permits each  department and agency to satisfy ISE requirements while also optimizing  its own EAs for its specific missions. The Program Manager added that  this approach is based on (1) OMB decisions to establish a standardized  EA framework that departments and agencies that own their respective  information systems and architectures could use to develop, modify, and  integrate those systems into the ISE; (2) the Office of the Program  Manager’s interpretation of the Intelligence Reform Act; and (3) the Office  of the Program Manager’s understanding that a full EA must be  organization based and tied to budget authority.
Nevertheless, the Intelligence Reform Act calls for the Program Manager  to plan for and oversee the implementation of the ISE and to assist in the  development of policies, as appropriate, to foster the development and  proper operation of the ISE. It further calls for the Program Manager to  issue governmentwide procedures, guidelines, instructions, and functional  standards, as appropriate, for the management, development, and  operation of the ISE, consistent with the direction and policies issued by  the President, the Director of National Intelligence, and the Director of  OMB. In addition, the Chief Information Officers Council has previously  reported that a well-defined EA can promote better planning and facilitate  management of an extensive, complex environment. Moreover, as  described previously in this report, our EAMMF recognizes that EAs can  be developed in a distributed manner and accordingly does not prescribe  a specific approach by which organizations should develop needed EA  content. By not ensuring that an improved EA management foundation for  the ISE exists, the federal government, as a whole, is not well positioned  to realize the significant benefits that well-defined ISE EA guidance and  products can provide. Such benefits include better planning for ISE  implementation; improved decision making regarding capability  enhancement and resource allocation across the ISE enterprise;  increased collaboration on interdependent ISE work activities; and  effective sharing of critical terrorism information among appropriate ISE  agencies and state, local, and tribal governments and private sector  entities.
section_title: Conclusions
paragraphs: The ISE is to fulfill a critical purpose in a time when acts of terrorism on  U.S. soil have recently been attempted or planned. The Program  Manager and key agencies have taken actions to define and implement  the ISE, such as developing a framework to advance an initial set of  goals, activities, and metrics. However, they also recognize that these  actions do not yet go far enough to define and implement a fully  functioning ISE and that there is more work to do. In addition, our work  has identified actions that are needed after the end state vision for the  ISE is defined, such as ensuring that all relevant information sharing  initiatives across the five communities are fully leveraged by the ISE,  consistent with the Intelligence Reform Act. This could help to ensure that  all critical information with a possible nexus to terrorism is being shared  as needed, and that relevant agency initiatives are considered to  determine how they could be leveraged by the ISE for the benefit of all  stakeholders, thereby helping to improve information sharing  governmentwide. Also, to the extent possible, defining incremental costs  necessary to implement the ISE, consistent with the Intelligence Reform  Act, could help decision makers plan for and prioritize future investments.  Further, while the Program Manager has taken steps to measure and  demonstrate results of ISE efforts, additional actions are needed to  address our prior recommendations to ensure that the ISE is on a  measurable track to success and to show the extent to which the ISE has  been implemented, what work remains, and milestones for completing  remaining work.
The Program Manager and ISE agencies have developed architecture  guidance and products—such as the EAF—to assist in implementing the  ISE, but crucial work remains. The guidance and products provide some  foundational information about the ISE, but they do not fully define the  suite of ISE architecture products that describe the ISE current and future  operational and technical environment to support ISE implementation.  Further, ISE EA management practices do not fully address the core  elements described in our EAMMF, such as establishing an EA program  management plan that, among other things, reflects ISE EA program  work activities, events, and time frames and defines accountability  mechanisms. Moreover, it is unclear when, how, and by whom these core  elements will be satisfied and missing architecture content—such as  business activities and information flows, the ISE technology  environment, and an enterprise sequencing plan—will be developed.  Establishing an improved EA management foundation, including well- defined EA guidance for the ISE, would better position the government to  realize significant benefits, such as better planning for implementation,  improved decision making, and ultimately more effective sharing of critical  terrorism-related information among all ISE agencies.
section_title: Recommendations for Executive Action
paragraphs: To help ensure effective implementation of the ISE, we recommend that  the Program Manager, with full participation from relevant stakeholders,  take the following three actions.
To support future progress in developing and implementing the ISE, we  recommend that after the end state is defined, the Program Manager  in consultation with the ISA IPC and key ISE agencies, determine to  what extent relevant agency initiatives across all five communities  could be better leveraged by the ISE so that their benefits can be  realized governmentwide and  in coordination with the ISA IPC and OMB, task the key ISE agencies  to define, to the extent possible, the incremental costs needed to help  ensure successful implementation of the ISE and prioritize  investments.
To better define ISE EA guidance and effectively manage EA activities to  support ISE implementation efforts, we recommend that the Program  Manager, in consultation with the ISA IPC and key ISE agencies,  establish an ISE EA program management plan that (1) reflects ISE EA  program work activities, events, and time frames for improving ISE EA  management practices and addressing missing architecture content and  (2) defines accountability mechanisms to help ensure that this program  management plan is implemented.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report for comment to the Program Manager  for the ISE, OMB, DHS, DOJ, State, DOD, and ODNI. Based on  subsequent discussions with officials from the Office of the Program  Manager, we revised portions of the draft that discuss the ISE EA and the  related recommendation to clarify that our focus is primarily on  architectural management practices and that various approaches can be  used for structuring an EA. We received written responses from the  Program Manager and DHS, which are summarized below and reprinted  in appendix VI and appendix VII, respectively. Also, on June 17, 2011, the  Federal Chief Enterprise Architect and other OMB officials provided oral  comments. The Program Manager and Federal Chief Enterprise Architect  generally agreed with the three recommendations in this report, while  DHS did not address them. The Program Manager, DHS, DOJ, and ODNI  provided technical comments, which we have incorporated in this report  where appropriate. State and DOD informed us that they had no  comments.
subsections: section_title: Program Manager’s Comments
paragraphs: The Program Manager’s written comments did not specifically mention  whether he agreed with the three recommendations in this report, but the  Office of the Program Manager subsequently confirmed via e-mail on   July 7, 2011, that the Program Manager generally agreed with all of them,  with elaboration as follows.
The Program Manager generally agreed with the first recommendation  related to the need to determine to what extent relevant agency initiatives  across all five communities are being leveraged by the ISE. He noted that  the Program Manager and the ISA IPC have already leveraged a great  number of initiatives that support the realization of the ISE and that they  will continue to identify and leverage agency initiatives to improve  information sharing. The Program Manager provided numerous examples  of activities that he said have been leveraged by the ISE and referred us  to the annual reports to Congress for more examples. We recognize that  the examples provided illustrate agency initiatives to share information  and several of them are discussed in this report. In general, however, the  Program Manger has not demonstrated how these initiatives are being  leveraged by the ISE for the benefit of all stakeholders and to help  improve information sharing governmentwide. The Program Manager  expects the updated National Strategy for Information Sharing— complemented by follow-on implementation policy, programmatic and  budgetary guidance, and performance metrics—to address this  recommendation. The updated strategy and follow-on guidance and  metrics could address the intent of the recommendation if they  appropriately discuss how initiatives are being leveraged by the ISE.
The Program Manager generally agreed with the second  recommendation related to the need to define incremental costs for the  ISE. However, he noted that OMB has the role of providing programmatic  guidance and collecting budgetary requirements, and ensuring that they  are integrated into the budget for each federal department and agency.  The Program Manager also said that it is critical to note that federal  departments and agencies own, plan for, and manage their programs,  systems, and architectures, while the Office of the Program Manager  provides the integrating guidance through the ISA IPC. Further, he noted  that the individual departments and agencies are responsible for  identifying costs over and above their program baselines to extend the  benefits of information sharing throughout the ISE. We recognize that  OMB and agencies play key roles in defining incremental costs for the  ISE. Nevertheless, the Program Manager is responsible for leading and  coordinating these efforts, as envisioned by the Intelligence Reform Act.  Thus, we believe that the Program Manager is the appropriate party to  task key ISE agencies to define, to the extent possible, the incremental  costs needed to help ensure successful implementation of the ISE. The  Program Manager expects the updated National Strategy for Information  Sharing and other activities—including programmatic and budgetary  guidance—to address this recommendation. The updated strategy and  follow-on guidance could address the intent of the recommendation if they  support defining incremental costs needed to help ensure successful  implementation of the ISE.
The Program Manager generally agreed with the third recommendation  related to the need to more fully define ISE EA plans. He stated that the  ISE needs an integrated plan with an established vision, goals, policy  framework, performance management framework, and guidelines. From a  planning perspective, the Program Manager noted that the National  Strategy on Information Sharing—to be updated in the near future— followed by an integrated suite of implementation guidance and practices  (e.g., the ISE EAF and the PAIS) provide the tools to effectively manage  the ISE. He added that through these and other documents, the Office of  the Program Manager will establish the vision, a program management  plan, and an executable road map for the ISE. Further, he noted that the  office will work with ISE departments and agencies to identify and  prioritize their projects in support of the ISE. These actions could address  the intent of the recommendation if the strategy and suite of  implementation guidance and practices establish an ISE EA program  management plan that (1) reflects ISE EA program work activities,  events, and time frames for improving ISE EA management practices and  addressing missing architecture content and (2) defines accountability  mechanisms to help ensure that this program management plan is  implemented.
The Program Manager also provided comments indicating that much of  this report treats the ISE as a centrally designed and defined information  system enterprise and stated that our analysis looks for the tools and  processes applicable to such an enterprise. This report and the EAMMF  that comprises the basis for much of our analysis recognize that various  approaches for structuring an EA exist and can be applied to the extent  that they are relevant and appropriate for a given enterprise. As stated in  this report and our EAMMF, these approaches generally provide for  breaking down an enterprise into its logical parts and allowing various  components of an enterprise (e.g., ISE mission partners) to develop their  respective parts of the EA in relation to enterprisewide needs and the  inherent relationships and dependencies that exist among the parts. For  example, this report acknowledges agency-developed information sharing  segment architectures—which can represent a portion of an ISE EA—and  states that improved ISE architecture content and an ISE enterprise  sequencing plan could enable better planning for the distributed ISE.
In addition, the Program Manager stated that he consulted with the key  ISE agencies and they agreed that they do not need or want the Program  Manager to establish additional ISE EA guidance or an ISE EA. As we  previously noted, various approaches can be used for structuring an EA.  However, our work showed that agency information sharing architectures  were either not developed or incomplete, and that pertinent officials from  ISE agencies cited the lack of detailed and implementable ISE guidance  as one factor limiting their efforts to develop agency information sharing  architectures. Thus, we believe that an ISE EA program management  plan is needed that (1) reflects ISE EA program work activities, events,  and time frames for improving ISE EA management practices and  addressing missing architecture content and (2) defines accountability  mechanisms to help ensure that this program management plan is  implemented.
In addition to providing comments on each of the three recommendations,  the Program Manager noted that the draft report did not fully address the  roles and responsibilities of OMB and the departments and agencies that  support the ISE, and that recognizing the key roles played by these  entities is pivotal to assessing progress in the ISE. He explained that  OMB plays a key role in the planning, budgeting, and oversight of the  federal agencies and their contributions to the ISE. He also noted that it is  primarily through the partnership between OMB and the Office of the  Program Manger that program direction, funding, and performance  measurement can be effectively achieved. He added that departments  and agencies (1) are responsible for developing, deploying, modifying,  and maintaining their respective information system investments and  associated EAs and (2) play an active role in determining the policies,  priorities, and direction of the ISE—originally through the Information  Sharing Council—and are now an integral part of the ISA IPC. Further,  the Program Manager noted that the information they share and the tools  used to share it are by their nature a part of the ISE, regardless of  whether the process is identified by the Program Manager. We recognize  that OMB and agencies play important roles in defining and building the  ISE. Nevertheless, the Program Manager is responsible for leading and  coordinating these efforts, in accordance with the Intelligence Reform Act.  Thus, we directed the recommendations to him, in consultation with the  ISA IPC, key ISE agencies, and OMB as appropriate.
section_title: Other Agencies’ Comments
paragraphs: In oral comments provided on June 17, 2011, the Federal Chief  Enterprise Architect and other OMB officials generally agreed with all  three recommendations in this report. Regarding the first  recommendation to ensure that agency initiatives are leveraged, the  Federal Chief Enterprise Architect noted that all five ISE primary areas of  focus (homeland security, law enforcement, foreign affairs, defense, and  intelligence) are important and that the Program Manager should continue  to ensure effective coordination of these communities. He added that  such coordination should occur in consultation with OMB and appropriate  agencies at the federal, state, local, and tribal levels. Regarding the  second recommendation to identify incremental costs, the Federal Chief  Enterprise Architect noted that the Program Manager should work in  collaboration with OMB and federal agencies to identify investments that  are related to the ISE, and ensure that waste and duplication are not  occurring and that the execution of the program is consistent with legal  mandates and administration policies and priorities. Regarding the third  recommendation to more fully define ISE EA plans, the Federal Chief  Enterprise Architect agreed that our EAMMF was appropriate for  evaluating the ISE EA and that the Office of the Program Manager should  issue an EA program management plan that contains milestones, time  frames, and accountability mechanisms. He noted that the Program  Manager and ISE agencies each have a role in developing ISE  architecture products.
In its written comments, DHS noted that the department remains  committed to continuing its work with the Program Manager and relevant  stakeholders to further define and implement a fully functioning ISE. DHS  added that the department is engaged with the Program Manager on a  number of key initiatives at the ISA IPC to ensure the realization of  information sharing benefits governmentwide.
We are sending copies of this report to the Program Manager for the  Information Sharing Environment; the Director of National Intelligence; the  Director of the Office of Management and Budget; the Secretaries of the  Departments of Defense, Homeland Security, Justice, and State; and  appropriate congressional committees. This report also is available at no  charge on the GAO Web site at http://www.gao.gov.
Should you or your staff have any questions about this report, please  contact Eileen R. Larence at (202) 512-6510 or larencee@gao.gov or  David A. Powner at (202) 512-9286 or pownerd@gao.gov. Contact points  for our Offices of Congressional Relations and Public Affairs may be   found on the last page of this report. Key contributors to this report are  acknowledged in appendix VIII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our reporting objectives were to review to what extent the Program  Manager for the Information Sharing Environment (ISE) and key  stakeholder agencies have (1) made progress in developing and  implementing the ISE, and what work remains, and (2) defined an  enterprise architecture (EA) to support ISE implementation efforts. The  stakeholder agencies we reviewed are the five agencies that the Program  Manager identified as critical to developing and implementing the ISE— the Departments of Homeland Security (DHS), Justice (DOJ), State  (State), and Defense (DOD) as well as the Office of the Director of  National Intelligence (ODNI). These agencies represent five information  sharing communities identified that collect the homeland security, law  enforcement, foreign affairs, defense, and intelligence information  deemed critical for sharing in order to provide for homeland security.
To determine the extent to which the Program Manager and stakeholder  agencies have made progress in developing and implementing the ISE,  we reviewed key statutes and policies, including the Intelligence Reform  and Terrorism Prevention Act of 2004 (Intelligence Reform Act) and the  Implementing Recommendations of the 9/11 Commission Act of 2007.  We also reviewed our prior reports and best practices identifying effective  program management, federal coordination, and cost estimation.
Through our review of these laws, guidance, and reports, we identified  standards and best practices for program and project management and  used them to inform our assessment of efforts to develop and implement  the ISE and related efforts. We used semistructured interviews to gather  information from the key agencies and facilitate analysis of their  perspectives on the development of and remaining challenges impeding  implementation of the ISE. We also used interviews to obtain information  from these agencies on the status of key activities the Program Manager  identified as accomplishments in the 2009 and 2010 ISE annual reports to  Congress, among other things. In addition, we reviewed and analyzed  agency documentation on guidance and plans and conducted interviews  with agency officials to assess actions taken by the Program Manager to  address recommendations in our 2008 report related to defining the  purpose and scope of the ISE and the results to be achieved.
To determine to what extent the Program Manager for the ISE and key  stakeholder agencies have defined an EA to support ISE implementation  efforts, we examined the extent to which (1) key current, or “as-is,” and  future, or “to-be,” EA content and a plan for transitioning from the current  to the future environment have been established; (2) the Office of the  Program Manager has established a structure for effectively managing  ISE architecture development and implementation; and (3) key federal  agencies have defined their information sharing segment architectures  (ISSA) to support ISE implementation.
To determine the extent to which key current and future EA content, and  a plan for transitioning from the current to the future environment has  been established, we compared ISE architecture guidance, such as the  ISE Enterprise Architecture Framework (EAF) and associated   documents, to relevant EA content guidance. We also interviewed  officials from the Office of the Program Manager, including the Program  Manager and the Executive for Programs and Technology, as well as  officials from the key federal agencies, to determine, among other things,  their perspectives on ISE architecture content. In addition, we met with  Office of the Program Manager officials to discuss variances between ISE  EA content reflected in the ISE EAF and associated documents and EA  content expectations established in relevant federal guidance.
To determine the extent to which the Office of the Program Manager has  established a structure for effectively managing ISE architecture  development and implementation, we used our Enterprise Architecture  Management Maturity Framework (EAMMF), and determined the extent  to which the Office of the Program Manager has satisfied key elements  associated with providing institutional leadership and foundational  management capabilities. To make this determination, we reviewed  relevant ISE documentation, including Executive Order 13,388 (October  25, 2005); the December 16, 2005, presidential memorandum regarding  Guidelines and Requirements in Support of the Information Sharing  Environment; the Intelligence Reform Act; Program Manager guidance;  and Chief Architects Roundtable and Common Information Sharing  Standards working groups’ meeting minutes. We also interviewed officials  from the Office of the Program Manager and compared documentation  collected and information provided during interviews to determine the  extent to which the office and the Information Sharing and Access  Interagency Policy Committee addressed EAMMF elements associated  with establishing institutional commitment and direction and creating the  management foundation for EA development and use. We did not  evaluate the extent to which the ISE architecture program had adequate  staff and budget resources because of the lack of a stand-alone budget  for the ISE program and the classified nature of the ODNI budget.
To determine the extent to which key federal agencies have defined their  ISSAs to support ISE implementation, we determined the extent to which  agency-developed ISSAs have addressed ISE architecture guidance  established by the Office of the Program Manager. Specifically, we  determined key ISSA development steps defined in the Program  Manager’s Profile and Architecture Implementation Strategy that are  consistent with best practices documented in the Federal Segment  Architecture Methodology. We then reviewed the agency-developed  ISSAs and relevant supporting documentation, such as information  sharing strategies and information sharing implementation plans, against  these key ISSA development steps. We also interviewed officials from  DOD (the Office of the Assistant Secretary for Defense, Networks and  Information Integration/DOD Chief Information Officer (CIO)), DHS (Office  of the CIO), DOJ (Justice Management Division/Office of the CIO), and  State (Office of Management Policy, Rightsizing, and Innovation) to  understand the reasons why the agency-developed ISSAs have yet to  fully address the key ISSA development steps.
We conducted this performance audit from October 2009 through July  2011 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: ISE Framework Goals and Subgoal Activities
paragraphs: To better define and manage ISE implementation, the Program Manager  adopted the ISE framework to guide development of the ISE going  forward. Specifically, the framework identified four goals and 14 specific  subgoals or activities agencies were to pursue. The goals and subgoals  follow.
Subgoal 1.1: Information sharing is exhibited across departments and  agencies as a routine part of doing business and recognized as an  imperative to success.
Subgoal 1.2: All personnel charged with sharing terrorism-related  information are trained to carry out information sharing responsibilities.
Subgoal 1.3: Employees are routinely recognized and rewarded for  effective information sharing, as well as expertise and competency  development.
Subgoal 2.1: Federal departments and agencies practice security  reciprocity among federal, state, local, and private sector entities,  including people, facilities, and systems.
Subgoal 2.2: Consistent marking and handling of controlled unclassified  information is practiced across the U.S. government; practices are also  adopted by state, local, tribal, and private sector entities.
Subgoal 2.3: ISE participants build trusted distributed infrastructure for  sharing information with all other participants, and are able to leverage  repeatable processes from each others’ architecture programs to  maximize availability of common ISE shared services.
Subgoal 2.4: ISE departments and agencies; state, local, and tribal  governments; and the private sector protect privacy in a consistent  manner.
Subgoal 3.1: All federal, state, local, tribal, and law enforcement entities  operating domestically participate in a standardized, integrated approach  to gathering, documenting, processing, analyzing, and sharing terrorism- related suspicious activity information.
Subgoal 3.2: A national, integrated network of state and major urban area  fusion centers that enables federal, state, local, tribal, and private sector  organizations to gather, document, process, analyze, and share relevant  information in order to protect our communities.
Subgoal 3.3: Federal agencies produce, share, and disseminate both  time-sensitive and strategic information and intelligence products that  meet state, local, tribal, and private sector needs.
Subgoal 3.4: Federal departments and agencies have implemented  appropriate policies and processes to coordinate and facilitate the sharing  of information with foreign governments and allies.
Subgoal 4.1: Integrated performance and investment processes monitor  progress toward performance goals and successfully use investments to  support activities that maintain or enhance information sharing.
Subgoal 4.2: ISE participants sustain their investments in information  systems that support a trusted, distributed infrastructure for sharing  information.
Subgoal 4.3: ISE participants use common practices and policies for  producing, handling, and using information.
section_title: Appendix III: Analysis of ISE Architecture Content
paragraphs: According to relevant guidance, an enterprise architecture (EA) should  describe architectural views of the business processes, data, applications  and services, technology, and security for the enterprise’s current and  future environments. An EA should also include a sequencing plan for  transitioning from the current environment to the future environment.  Table 1 describes the extent to which the Information Sharing  Environment (ISE) architecture documents address such relevant EA  guidance.
section_title: Appendix IV: ISE’s Satisfaction of Selected EA Institutional Leadership and Management Controls
paragraphs: Table 2 describes the Information Sharing Environment’s (ISE)  satisfaction of selected core elements in stages 1 and 2 of our Enterprise  Architecture Management Maturity Framework (EAMMF).
section_title: Appendix V: Analysis of Information Sharing Segment Architectures
paragraphs: Tables 3, 4, and 5 provide a summary of Department of Defense (DOD),  Department of Homeland Security (DHS), and Department of Justice  (DOJ) efforts to address the key segment architecture development  steps.
section_title: Appendix VI: Comments from the Program Manager for the Information Sharing Environment
section_title: Appendix VII: Comments from the Department of Homeland Security
section_title: Appendix VIII: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contacts
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, Eric Erdman, Assistant Director;  Anh Le, Assistant Director; David Alexander; Justin Booth; R.E. Canjar;  Katherine Davis; R. Denton Herring; Michael Holland; Ashfaq Huda;  Thomas Lombardi; Linda Miller; Victoria Miller; Krzysztof Pasternak; Karl  Seifert; Adam Vodraska; and Michelle Woods made key contributions to  this report.