Information Technology: Executive office for U.S. Attorneys Needs to Institutionalize Key IT Management Disciplines
Published: 2003-07-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Executive Office for United States Attorneys (EOUSA) of the Department of Justice is responsible for managing information technology (IT) resources for the United States Attorneys' Offices. GAO was asked to determine the extent to which EOUSA has institutionalized key IT management capabilities that are critical to achieving Justice's strategic goal of improving the integrity, security, and efficiency of its IT systems.
section_title: What GAO Found
paragraphs: To varying degrees, EOUSA has partially defined and implemented certain IT management disciplines that are critical to successfully achieving the Justice Department's strategic goal of improving the integrity, security, and efficiency of its IT systems. However, it has yet to institutionalize any of these disciplines, meaning that it has not defined existing policies and procedures in accordance with relevant guidance, and it has yet to fully implement what it has defined. In particular, while EOUSA has developed an enterprise architecture--a blueprint for guiding operational and technological change--the architecture was not developed in accordance with certain best practices. In addition, while the office has implemented certain process controls for selecting, controlling, and evaluating its IT investments, it has not yet implemented others that are necessary in order to develop an effective foundation for investment management. Further, it has not implemented important management practices that are associated with an effective security program. In contrast, it has defined--and is implementing on a major system that we reviewed--most, but not all, of the management practices associated with effective systems acquisition. Institutionalization of these IT management disciplines has not been an agency priority and is not being guided by plans of action or sufficient resources. Until each discipline is given the priority it deserves, EOUSA will not have the IT management capabilities it needs to effectively achieve the department's strategic goal of improving the integrity, security, and efficiency of its IT systems.

section_title: Letter
paragraphs: This report is one of a series in response to your request that we evaluate  the management activities of the Executive Office for United States  Attorneys (EOUSA) and the U.S. Attorneys’ Offices (USAO). As part of this  request, you asked us to determine the extent to which EOUSA—the  organization responsible for managing information technology (IT)  resources for the USAOs—has institutionalized key IT management  capabilities critical to achieving the Department of Justice’s strategic goal  of improving the integrity, security, and efficiency of its IT systems. As  agreed, to meet this objective, we focused on whether EOUSA had  institutionalized four important IT management disciplines: enterprise  architecture management, investment management, system acquisition  management, and security management. Research shows that these  disciplines are institutionally employed by leading public and private sector  organizations. They are also provided for in legislation and federal  guidance.
Details on our objective, scope, and methodology are in appendix I.
subsections: section_title: Background
paragraphs: U.S. Attorneys prosecute criminal cases brought forward by the federal  government, prosecute and defend civil cases in which the United States is  a party, and collect debts owed to the federal government that are  administratively uncollectible. EOUSA was established in 1953 as a  component of the Department of Justice to, among other things, provide  general executive assistance and administrative and operational support to  the 93 USAOs located throughout the 50 states, the District of Columbia,  Guam, the Marianas Islands, Puerto Rico, and the U. S. Virgin Islands and  to coordinate with other Department of Justice organizational units and  other federal agencies on behalf of the U.S. Attorneys. One of EOUSA’s key  responsibilities is managing the USAOs’ IT resources, including preparing  their annual IT budget submissions and supporting their acquisition and  maintenance of IT assets.
IT plays an important role in helping the USAOs meet their mission  objectives and, according to EOUSA planning documents, the USAOs’  reliance on IT is to increase in response to expected growth in the number  and complexity of their cases. Currently, EOUSA manages an IT  environment consisting of central and distributed computing and  communication resources in Washington, D.C., and 93 USAOs, respectively.  Connectivity among these offices, Justice headquarters, and Justice’s Data  Center in Rockville, MD, is through a virtual private network (VPN)  connection on the Justice Consolidated Network (JCN), with such security safeguards as firewalls between USAO local area networks and JCN. The  VPN/firewall combination, which provides the foundation for secure  communications between EOUSA and the sites mentioned above, is  currently being replaced. Figure 1 generally depicts EOUSA’s network  topology. The USAOs’ support is also provided by such application systems  as the Legal Information Office Network System, which is a case  management system that compiles, maintains, and tracks information  about defendants, crimes, criminal charges, court events, and witnesses,  and the Victim Notification System, which notifies crime victims of the  status of their cases and assists with checking compliance with regulations  and policies concerning victim notification.
Recognizing the importance of IT to achieving the USAOs’ mission, EOUSA  appointed a Chief Information Officer (CIO) in May 2001 and assigned the  CIO accountability and responsibility for managing central and distributed  IT resources and services, including   managing the IT budget for the office and all of the USAOs;  developing and acquiring new systems, including case management  systems, and providing support for existing systems;  managing network, telephone, and video communications; and  securing IT assets (data, applications, and supporting networks).
In fiscal year 2003, EOUSA reports that it plans to spend approximately  $125 million on about 20 initiatives. Roughly $110 million of this amount is  to be spent on IT infrastructure and office automation projects (e.g.,  telecommunications programs). The remainder is to be spent on acquiring  mission support systems (e.g., Enterprise Case Management System  (ECMS), Victim Notification System) and maintaining existing ones.  Figure 2 shows the breakdown of estimated expenditures for fiscal year  2003.
section_title: EOUSA Has Yet to Institutionalize Key IT Management Disciplines
paragraphs: Research into the IT management practices that are employed by leading  public- and private-sector organizations has identified key institutional IT  management disciplines that are interrelated and critical to ensuring,  among other things, the integrity, security, and efficiency of IT systems.  These disciplines are also addressed in legislation and federal guidance.  1. enterprise architecture management, which involves defining,  maintaining, and implementing an institutional blueprint that defines  both the business and the supporting technology of the organization’s  current and target operating environments and a roadmap to achieve  the target environment;  2.
IT investment management, which involves selecting, controlling, and  evaluating a portfolio of investments within the context of an  enterprise architecture;  3.
IT security management, which involves protecting the integrity,  confidentiality, and availability of an organization’s IT assets (e.g., data,  application systems, and networks) and reducing the risks of  tampering, unauthorized intrusions and disclosures, and disruption of  operations.
4. system acquisition management, which involves managing selected  investments (system projects) in a manner that increases the  probability of promised system capabilities being delivered on time and  within budget.
As we have previously reported, to successfully institutionalize these  disciplines, organizations should develop integrated plans to guide their  efforts that (1) specify measurable goals, objectives, and milestones;  (2) specify needed resources; and (3) assign clear responsibility and  accountability for accomplishing well-defined tasks. In addition, these  plans should be approved by senior management. In implementing these  plans, it is important that organizations allocate adequate resources and  measure and report progress against planned commitments and that  appropriate corrective actions be taken to address deviations.
EOUSA has defined and implemented each of the four IT management  disciplines mentioned above to some degree. However, none has been  institutionalized, meaning that they are not fully defined in accordance  with best practices and what has been defined has not been fully  implemented. While these disciplines have been given attention since the  recent appointment of the CIO, they have not been treated as priorities, in  that action plans needed for successful institutionalization have not been  developed or resourced. As a result, EOUSA is currently limited in its  ability to meet Justice’s strategic goal of improving its IT systems, and the  USAOs will be challenged in their ability to effectively and efficiently meet  their mission goals and priorities.
subsections: section_title: EOUSA Is Not Performing Important Practices Associated with Effective Enterprise Architecture Management
paragraphs: An enterprise architecture (EA) is an investment blueprint that defines,  both in logical terms (including business functions and applications, work  locations, information needs and users, and the interrelationships among  these variables) and in technical terms (including hardware, software, data  communications, and security) how an organization operates today (“as  is”), how it intends to operate tomorrow (“to be”), and a roadmap for  transitioning from today to tomorrow. The development, maintenance, and  implementation of architectures are recognized hallmarks of successful  public and private organizations. According to a guide published by the  federal CIO Council,effective architecture management consists of a  number of core elements.
In February 2002, we published version 1.0 of our EA management maturity  framework, which arranges the core elements of the CIO Council’s guide  into five hierarchical stages. The framework provides an explicit  benchmark for gauging the effectiveness of architecture management and  provides a roadmap for making improvements. Table 1 summarizes the  framework’s five stages of maturity.
EOUSA has satisfied many of the framework’s core elements. Specifically,  it has satisfied about 80 percent of the elements associated with building  the EA management foundation—stage 2 of our EA management maturity  framework—and half of the 12 core elements associated with higher  maturity stages. At stage 2, it has established a chief architect and has  selected a framework (the Federal Enterprise Architecture Framework)  and, according to officials, selected a tool (the Enterprise Architecture  Management System) to serve as a repository for its EA artifacts. At the  higher stages of our framework, the CIO, for example, approved a version  of an EA in May 2002 that describes the “as is” and “to be” environments for  its core business functions.
However, the office has yet to satisfy several of the core elements that are  critical to effective EA management. For example, a committee or group  representing the enterprise has not yet been established to guide and  oversee the development of future versions of the architecture. Instead, the  current version of its architecture has been primarily guided and directed  by the CIO’s office. Until a committee or group representing the enterprise  is established, there is increased risk that the architecture will not  represent a corporate decision-making tool and will not be viewed and  endorsed officewide as such a tool.
Another example is the absence of a written or approved policy for  maintaining the EA. Without a documented, approved policy for EA  maintenance that, for example, assigns responsibility and accountability  for configuration management and version control, EOUSA risks allowing  its architecture to become outdated and irrelevant, thus limiting its  effectiveness in selecting and guiding IT investments.
EOUSA does not have a written plan of action for strengthening EA  management and evolving the current version of its EA, because, according  to the CIO, developing such a plan is not a priority. Table 2 shows EOUSA’s  performance in addressing the core elements of our maturity framework.
section_title: Needed to Effectively Manage IT Investments
paragraphs: Effective IT investment management provides for evaluating each  proposed and ongoing investment, based on EA alignment and measurable  risks and returns and for selecting and controlling these investments as a  portfolio of competing investment options. We have developed a  framework that defines and measures an organization’s maturity in IT  investment management (ITIM) and provides a basis for improving  investment management. This framework, which is based on the IT  investment management practices of leading private- and public-sector  organizations, is structured to permit progression through five maturity  stages (shown in table 3). Each maturity stage consists of critical processes  and key practices that should be implemented for an organization to  become more effective in managing its IT investments.
According to the framework, the first key step toward an effective  investment management process is to build the investment foundation. An  organization with this foundation (stage 2 maturity) has attained  repeatable, successful investment control processes and basic selection  processes at the project level. Successful management at this level allows  an organization to measure the progress of existing IT projects and to  identify variances in cost, schedule, and performance expectations by  following established, disciplined processes. The organization should also  be able to take corrective action, if appropriate, and should possess basic  capabilities for selecting new project proposals. To accomplish this level of  basic control, an organization should establish an investment board,  identify the business needs and opportunities to be addressed by each  project, and use this knowledge in the selection of new proposals.
The office has satisfied two of the critical processes for stage 2, but it has  not satisfied the other three. Specifically, it has established an investment  governing board, known as the Investment Review Board (IRB) and  developed a guide to direct its operations. It is also defining project needs  in alignment with the agency’s mission goals. However, the office has not,  for example, defined procedures for project oversight. In addition, while an  IT project and systems inventory exists as part of its “as is” architecture, a  policy specifying how it will be used for investment management purposes  has not been defined. Until EOUSA satisfies all critical processes for stage  2, it will not have the foundation it needs to build its investment  management capability and it will not have an effective investment  process. Table 4 summarizes our assessment of stage 2 capabilities.
EOUSA has not demonstrated that maturing its IT investment management  process is a priority by developing a plan for doing so and devoting  resources to execute the plan. Until the office develops and implements a  plan for establishing mature IT investment management processes  (including all critical processes for building the investment management  foundation), EOUSA will not have the full suite of capabilities it needs to  ensure that project selection and control processes are repeatable or that it  has the best mix of investments to meet agency priorities.
section_title: EOUSA Has Not Implemented Effective Security Practices
paragraphs: Effective information security management is critical to EOUSA’s ability to  ensure the reliability, availability, and confidentiality of its information  assets, and thus it is fundamental to its ability to perform its mission. Our  research into public- and private-sector organizations with strong  information security programs shows that leading organizations’ programs  include (1) establishing a central security focal point with appropriate  resources, (2) continuously assessing business risks, (3) implementing and  maintaining policies and controls, (4) promoting awareness, and  (5) monitoring and evaluating the effectiveness of policies and controls.
Currently, EOUSA is not fully satisfying any of these tenets of effective  security. In addition, it has not demonstrated that institutionalizing  effective security practices is a priority by developing a plan to guide its  efforts to address security weaknesses and committing resources to  perform essential security functions. Until such a plan is developed and  effectively implemented, data, systems, and networks are at risk of  inadvertent or deliberate misuse, fraud, improper disclosure, or  destruction—possibly without detection. For example, the reliability and  integrity of case information may be compromised, or sensitive crime  victim information may be improperly disclosed.
subsections: section_title: Central Security Focal Point Is Established but Has Not Been Appropriately Resourced
paragraphs: According to our framework, central management of key security functions  is the foundation of an effective information security program, because it  allows knowledge and expertise to be incorporated and applied on an  enterprisewide basis. Having a central security focal point supported by  appropriate resources is especially important for managing the increased  risks associated with a highly connected computing environment, such as  JCN, where security weaknesses in one segment of an organization’s  network can compromise the security of another segment’s IT assets. In  addition, centralizing the security management function provides a focal  point for coordinating the activities associated with the other four elements  of a strong information security program.
In June 2001, EOUSA appointed a security officer with responsibility for  centrally managing all aspects of IT security. However, EOUSA has not  assigned sufficient staff to adequately carry out these responsibilities. For  example, no staff has been assigned to monitor firewall logs or support  the development of a centrally managed IT security training program— activities that fall under the security officer’s purview. Each of these  activities is discussed further in the following sections.
Officials said that they recognize the need for additional staff resources to  perform these activities. They also stated that they were in the process of  hiring two people to support security functions, but they agreed that this  would still not allow for performance of key security responsibilities.  Without an appropriately resourced security program, security breaches  may not be detected or addressed in a timely manner, awareness of  security requirements across the organization may be inconsistent, and  vulnerabilities in the current IT environment may not be appropriately  addressed.
section_title: Risks Have Not Always Been Assessed
paragraphs: According to our framework, identifying and assessing business risks is an  essential step in determining what IT security controls are needed and  what resources should be invested in these controls. Federal guidance  advocates performing risk assessments at least once every 3 years—or  when a significant change in a system or the systems environment (e.g.,  new threats) has occurred. These assessments should address the risks  that are introduced through connections to other networks and the impact  on an organization’s mission should network security be compromised. In  line with this guidance, EOUSA’s certification and accreditation process  requires that a risk assessment be completed for each system before any  office can use it.
According to EOUSA, a major system that recently underwent EOUSA’s  certification and accreditation process is the replacement for the existing  firewall/VPN system. This system is intended to be the foundation for  secure communications between EOUSA, Justice, and the geographically  dispersed USAOs. Accordingly, we analyzed this system and found that  while the firewall/VPN replacement system has been certified and  accredited, the existing firewall/VPN system—which was deployed in 1996  and, as of May 9, 2003, was operating at 75 of the 240 sites—had not had a  risk assessment performed and had not been certified and accredited.  Officials told us that they have not performed such an assessment on this  network because (1) it is not cost-effective to use limited resources to  perform an assessment on a network that is to be fully replaced by June 30,  2003, and (2) the risks inherent in the network are minimal, given that it  resides on Justice’s JCN, for which they said they assume Justice had  performed risk assessments.
We agree that it does not make sense at this point to perform a risk  assessment on the existing firewall/VPN system given that the replacement  system is expected to be fully deployed by the end of June 2003. However,  this does not change the fact that EOUSA has operated the network for  about 7 years without understanding its exposure to risk. This is  particularly important, because EOUSA officials could not provide us with  evidence to support the assumption that Justice had performed a risk  assessment for JCN. Moreover, previous studies have shown that Justice  has had long-standing weaknesses in several aspects of its IT security  program. According to EOUSA, its recently established certification and  accreditation program will not allow this to happen again.
section_title: Key Security Controls Have Not Been Implemented
paragraphs: According to our framework, risk-based, cost-effective security policies  and related technology controls (such as firewalls configured to explicit  rules and intrusion detection devices located to monitor key network  assets) and procedural controls (such as contingency plans) are needed to  protect a system from compromise, subversion, and tampering. Federal  and Justice guidance also advocate establishing these policies and  controls.
While EOUSA is guided by many Justice security policies, it has not yet  implemented key security controls that are needed to satisfy them. For  example, CIO officials told us that the existing firewall/VPN system, which,  as of May 9, 2003, was operating at 75 sites, is not based on explicit firewall  rules. Moreover, according to these officials, no intrusion detection devices  monitor the wide-area network (WAN) routers, firewalls, and VPN  devices. Rather, the intrusion detection devices that are currently  implemented are located only within the local area network environment  (i.e., within a USAO). Also, the contingency plan developed for the  replacement firewall/VPN system was not prepared according to federal  guidelines. For example, the contingency plan does not specify procedures  for notifying recovery personnel or assessing damage to systems. CIO  officials told us that they had not implemented these security controls  because, as previously noted, they believe the risks inherent in the network  are minimal given that it resides on Justice’s JCN, for which they said they  assumed Justice had performed risk assessments. However, as previously  stated, EOUSA provided no evidence to support this assumption, and  Justice has had longstanding security weaknesses.
Until EOUSA implements security controls, it may be unaware of  vulnerabilities, increasing the risk that intruders may take control of  network devices or that data passing through its firewalls can be read or  manipulated. In addition, EOUSA may not be able to respond to security  breaches adequately and in a timely manner. This is particularly  threatening given the sensitivity of the information used by the USAOs in  performing their work.
section_title: EOUSA Does Not Adequately Promote User Awareness
paragraphs: According to our framework, promoting user awareness through education  and training is essential to successfully implementing information security  policies, achieving user understanding of security policies, and ensuring  that security controls are instituted properly. This is because computer  users—and others with access to information resources—are not able to  comply with policies of which they are unaware or which they do not fully  understand. Our framework suggests that a central group be tasked with  educating users about current information security risks and helping to  ensure consistent understanding and administration of policies.
As previously mentioned, the security officer is responsible for promoting  awareness of computer security. However, the security officer does not  carry out this responsibility because provision of the resources to do so has  not been viewed as an agency priority. According to the security officer,  each district is thus responsible for managing its own IT training program,  and the security officer does not know to what extent these programs  address awareness of computer security. Without a centralized approach to  security education and training, the security officer cannot adequately  ensure that users are consistently aware of or fully understand the  organizational policies and procedures with which they are expected to  comply, thus risking the integrity, reliability, and confidentiality of data and  systems. According to EOUSA officials, they plan to hire staff to develop  and implement a centralized program by August 2003.
section_title: EOUSA Is Not Monitoring the Effectiveness of Security Controls
paragraphs: Our framework recognizes the need to continuously monitor controls,  through tests and evaluations, to ensure that the controls have been  appropriately implemented and are operating as intended. Further,  Justice’s policy requires annual testing of security controls and requires  EOUSA to (1) verify that the policies and procedures in component  organizations are consistent with this policy and (2) enforce compliance  with component and Justice security policies, including identifying  sanctions and penalties for noncompliance. In addition, our framework and  related best practices—as well as Justice’s own policy—advocate keeping  summary records of security incidents, to allow measurement of the  frequency of various types of violations and the damage suffered from  these incidents. This type of oversight is critical because it enables  management to identify problems and their causes—and to make the  necessary corrections.
CIO officials told us that testing has never been conducted to determine  whether EOUSA’s policies and procedures are consistent with Justice’s and  whether security controls are generally effective. According to these  officials, testing has not been a priority because they assumed that Justice  was performing tests of the WAN environment. However, Justice officials  told us that, although they had evaluated the contractor’s management of  the WAN’s circuits, they had not performed any tests to determine the  effectiveness of technical and other controls associated with the WAN. The  lack of testing heightens the risk that individuals both within and outside  Justice could compromise EOUSA’s external and internal security controls  to gain extensive unauthorized access to its networks and to networks to  which it is connected.
EOUSA officials also told us that, contrary to Justice’s policy, they do not  maintain summary records of security incidents. Specifically, the  production firewall/VPN software and routers at over 240 locations do not  have audit logs that are activated, and the replacement routers, firewalls,  and VPN devices are being implemented with no audit logs activated.  According to these officials, they have not activated the audit logs because  resources have not been allocated to provide for this security control. This  lack of auditing heightens the risk of undetected intruders using EOUSA’s  systems to modify, bypass, or negate its firewalls and routers. Additionally,  without these audit logs the office would be unable to reconstruct security- related incidents.
section_title: EOUSA Is Employing Important Acquisition Management Practices on a Key System
paragraphs: Rigorous and disciplined system acquisition processes and practices can  reduce the risk of fielding systems that do not perform as intended, are  delivered late, or cost more than planned. The Software Engineering  Institute (SEI), recognized for its expertise in acquiring software-intensive  systems, has published models and guides for determining an  organization’s acquisition process maturity. One of those models, referred  to as the Software Acquisition Capability Maturity Model (SA-CMM),  addresses an organization’s acquisition management ability. The SA-CMM  model defines organizational maturity according to five levels (see table 5).
According to SEI, level 2 (the repeatable level) demonstrates that basic  management processes, known as key process areas, have been  established to track performance, cost, and schedule, and that the  organization has the means to repeat earlier successes on similar projects.  An organization that has these processes in place is in a much better  position to successfully acquire software-intensive systems than an  organization that does not.
As a Justice component, EOUSA must comply with all departmental  policies and procedures, including Justice’s system development life-cycle  management guidance. Since EOUSA officials told us that the Enterprise  Case Management System (ECMS), which is intended to be the enterprise  solution for managing and tracking case workload within the USAOs, is the  first acquisition effort to follow Justice guidance from its inception, we  compared this project, and the Justice guidance used to manage it, against  SEI’s SA-CMM, and we found that the project was being managed in  accordance with the majority of the applicable level 2 practices. Table 6  represents a summary of our findings for this acquisition (see app. I for an  expanded analysis).
More specifically, the office has performed all of the key practices in the  requirements development and management and project management  key process areas. These include (1) establishing a written policy for  developing and managing system-related contractual requirements; (2)  having bi-directional traceability between the contractual requirements and  the contractor’s work products and services; (3) measuring and reporting  to management on the status of requirements development and  management activities; (4) designating responsibility for project  management; (5) keeping plans current during the life of the project as re- planning occurs, issues are resolved, requirements are changed, and new  risks are discovered; and (6) tracking the risks associated with cost,  schedule, resources, and the technical aspects of the project.
EOUSA has also performed the majority of the key practices in the  remaining four process areas. However, it does not have written policies  for either the contract tracking and oversight or the software acquisition  planning key process areas. Policies in general are key to establishing  well-defined and enduring processes and procedures. In these two areas,  policies would ensure that the office’s approach to tracking and overseeing  contractors and planning the acquisition is defined in a repeatable and  measurable fashion. In addition, during the solicitation process, the office  did not document its plans for solicitation activities, which would provide  those involved with objectives for the solicitation process and a defined  way to manage and control solicitation activities and decisions. In  evaluation, the office has yet to satisfy 9 of the 15 required practices.  Officials told us that they intend to satisfy them but that they do not have a  plan for addressing those practices or for implementing all of the required  practices on future system acquisitions. According to these officials,  developing such a plan is currently not a priority.
By developing and implementing a plan for satisfying all of these key  process areas on ECMS and future acquisitions, EOUSA can increase its  chances of successfully acquiring needed system capabilities on time and  within budget.
section_title: Conclusions
paragraphs: EOUSA has taken important steps to define and implement four key IT  management disciplines. Nevertheless, key aspects of each discipline have  yet to be institutionalized, leaving the office challenged in its ability to  achieve the department’s strategic goal of improving the integrity, security,  and efficiency of its IT systems. Critical to the office’s success going  forward will be treating institutionalization of each of these management  disciplines as priority matters by developing integrated plans of action for  addressing the weaknesses that we identified in each and effectively  implementing these plans—including assignment of appropriate resources  and measurement and reporting of progress. Without taking these steps,  EOUSA is unlikely to fully establish the IT management capabilities it  needs.
section_title: Recommendations
paragraphs: To strengthen the office’s IT management capacity and increase its chances  of improving the integrity, security, and efficiency of its IT systems, we  recommend that the Attorney General direct the EOUSA Director to treat  institutionalization of EA management, IT investment management, IT  security management, and system acquisition management as priorities  by developing and implementing action plans to address the weaknesses in  each discipline that are identified in this report. These plans should, at a  minimum, provide for accomplishing the following:  establish a committee or group representing the enterprise that is  responsible for directing, overseeing, or approving the EA;  ensure that EA products are under configuration management;  define, approve, and implement a policy for IT investment compliance   specify metrics for measuring EA benefits; and  define, approve, and implement a policy for maintaining the EA.
For IT investment management,  regularly oversee each IT project’s progress toward cost and schedule  milestones, using established criteria, and require corrective actions  when milestones have not been achieved;  define and implement a policy for using the IT project and systems  inventory for managerial decision making; and  ensure that an established, structured process is used to select new IT  proposals.
For IT security management,  allocate the appropriate resources to enable the responsibilities of the  security officer to be fully performed;  ensure that risk assessments are performed on all existing and future   implement intrusion detection devices to monitor activity at the routers,  firewalls, and VPN devices, and implement other network security  controls as noted in the report;  develop and implement a centralized approach to security education  and training; and  perform regular tests to determine compliance with policies and  procedures and the effectiveness of security controls.
For system acquisition management,  develop and implement a policy for contract tracking and oversight;   develop and implement a policy for system acquisition planning; and   address the remaining key practices associated with evaluation as  ECMS progresses in the life cycle; and  ensure that the Software Engineering Institute acquisition practices  identified in this report are used in future system acquisitions.
In developing these plans, the Director should ensure that each plan (1) is  integrated with the other three plans; (2) defines clear and measurable  goals, objectives, and milestones; (3) specifies resource needs; and  (4) assigns clear responsibility and accountability for implementing the  plan. In implementing each plan, the Director should ensure that the  needed resources are provided and that progress is measured and reported  periodically to the Attorney General.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report signed by the EOUSA Director  (reprinted in app. III), the office agreed with our findings relative to  enterprise architecture management, IT investment management, and  system acquisition management. EOUSA also agreed with our  recommendations in these three areas and stated that it intends to  implement the recommendations. However, EOUSA stated that it disagreed  with our findings and our recommendations regarding information security  management, although at the same time it cited certain actions that it  intends to take, such as implementing a centralized security training  program and monitoring security audit logs, that are consistent with our  security findings and associated recommendations. Further, the office  disagreed that the state of its efforts to institutionalize best management  practices in the four areas is due to it not treating each area as an office  priority. It also disagreed with our conclusion that the state of its efforts to  institutionalize best practices currently limits its ability to meet Justice’s  strategic goal of improving its IT systems, and that the USAOs will be  challenged in their ability to effectively and efficiently meet mission goals  and priorities. Each of these three areas of disagreement is addressed  below.
First, with respect to information security management, EOUSA stated that  it has one of the strongest security programs in Justice, and perhaps the  federal government. To support this statement, the office cited 10 security  initiatives it has implemented, such as certification and accreditation of  more than eight systems, real-time encryption of all data in laptops and  handheld devices, and conduct of vulnerability assessments and  penetration testing. It also noted, among other things, that it had added 10  field security positions and 2 headquarters positions, and that its data are  monitored 24 hours a day, seven days a week, and have never been  compromised. We do not question these statements concerning the office’s  information security program and associated activities because (1) the  purpose and scope of our review was not to compare EOUSA to other  Justice component organizations or other federal agencies, and thus  EOUSA’s relative standing is not relevant to the findings in our report and  (2) the message of our report is not that EOUSA has not taken steps to  improve its information security posture, but rather that the office’s  information security management efforts, including ongoing and complete  improvement steps, are weak in a number of areas relative to information  security management best practices. Accordingly, we make  recommendations aimed at addressing identified weaknesses, including a  recommendation to implement network intrusion detection devices and  other security controls. While EOUSA’s comments cited plans that are  consistent with many of our security-related recommendations, it  disagreed with the recommendation relative to its wide area network on  the grounds that this network is managed, secured, and monitored by  Justice and Sprint. We understand that the WAN is not managed by EOUSA,  and accordingly our recommendation was aimed at actively monitoring the  network routers, firewalls, and VPN devices, which are managed by  EOUSA. To avoid any confusion about this recommendation, we have  clarified its wording to better reflect our intentions. Similarly, in light of the  recent progress that EOUSA has made replacing its VPN system, we have  adjusted our finding and recommendation concerning the office’s exposure  to risk from its old VPN system.
Second, with respect to our statements that EOUSA has not treated  institutionalization of each of the four IT management disciplines— enterprise architecture management, IT investment management, system  acquisition management, and information security management—as  agency priorities, the office stated that these statements were unfair and  that it did not agree with them. To support its position, EOUSA made the  following two points: (1) it has made tremendous progress, as evidenced by  our report recognizing those best practices that it is satisfying, and (2) it  has received the highest level of support from Justice, as evidenced by the  establishment of the EOUSA CIO position in 2001, the progress that has  been made in the last 2 years compared to other Justice component  organizations, and EOUSA’s being viewed by Justice senior management as  a leader in IT management. We do not challenge EOUSA’s two points  because they are not relevant to our position regarding treating  institutionalization of each of the four IT management disciplines as agency  priorities. Our position is based on two facts that EOUSA did not dispute:  (1) plans for addressing the weaknesses cited in our report do not exist and  (2) limitations in resources to address these weaknesses were cited by  EOUSA officials as the reason why the weaknesses exist. In our view, if  each of these areas were an agency priority, then plans would be in place to  address the weaknesses, and resources to execute the plans would be  committed.
Third, with respect to our conclusion that EOUSA is currently limited in its  ability to meet Justice’s strategic goal of improving its IT systems, and that  the USAOs are thereby challenged in their ability to effectively and  efficiently meet their mission goals and objectives, the office disagreed but  did not offer any comments to counter our conclusion beyond those cited  above. Given that any organization’s ability to effectively leverage  technology is determined in large part by its institutionalized capabilities in  these four IT disciplines, we have not modified our conclusion.
EOUSA provided additional comments that have been incorporated in the  report as appropriate. EOUSA’s written comments are reproduced in  appendix III, along with our detailed evaluation of each comment.
As arranged with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after the  date of this letter. At that time, we will send copies of this report to  interested congressional committees. We will also send copies to the  Director of the Office of Management and Budget, the Attorney General of  the United States, the EOUSA Director, and the EOUSA CIO. We will also  send copies to others upon request. In addition, copies will be available at  no charge on our Web site at www.gao.gov.
Should you or your offices have questions on matters discussed in this  report, please contact me at (202) 512-3439. I can also be reached by E-mail  at hiter@gao.gov. An additional GAO contact and staff acknowledgments  are listed in appendix IV.
section_title: Objective, Scope, and Methodology
paragraphs: Our objective was to determine the extent to which the Executive Office  for United States Attorneys (EOUSA) has institutionalized key information  technology (IT) management capabilities to achieve the Department of  Justice’s strategic goal of improving the integrity, security, and efficiency of  its IT systems. To meet this objective, we focused on whether EOUSA had  institutionalized four key IT management disciplines: enterprise  architecture management, IT investment management, information  security management, and system acquisition management.
To evaluate EOUSA’s enterprise architecture (EA) management, we first  solicited responses to an EA management questionnaire, reviewed EA  plans and products, and interviewed officials to verify their responses.  Next, we compared the information that we had collected with GAO’s  February 2002 EA management maturity framework to determine the  extent to which EOUSA was employing effective EA management  practices. This framework is based on the Practical Guide to Federal  Enterprise Architecture, published by the Chief Information Officers’  (CIO) Council. We did not use the revised framework issued in April  2003 because, by then, we had already completed our work.
To evaluate EOUSA’s IT investment management (ITIM), we used GAO’s  ITIM framework and assessed the extent to which EOUSA had satisfied  the critical processes associated with stage 2 of the five-stage  framework—building the investment foundation. We focused on stage 2  processes because officials told us that they had only recently begun  defining and implementing the specific practices that are associated  with this stage. To conduct our assessment, we reviewed relevant  EOUSA and Justice policies, procedures, guidance, and  documentation—including the office’s investment management guide  and associated memorandums, project proposals, and budget  documents. We also interviewed the CIO and the senior official who is  responsible for implementing IT investment management. We then  compared this information with our maturity framework to determine  the extent to which the office was employing effective IT investment  management practices.
To evaluate EOUSA’s information security management, we used our  executive guide for information security management, as well as  Justice policy and guidance and relevant EOUSA U.S. Attorney  Procedures.We reviewed internal Justice and other reports identifying  security weaknesses at Justice and EOUSA and information on how  these weaknesses will be addressed. We also reviewed the certification  and accreditation package and the deployment schedule for the virtual  private networkthat the office is currently deploying, because EOUSA  and the USAOs rely on this network to carry out its mission. We  interviewed Justice officials and EOUSA officials within the Office of  the CIO about the office’s security management.
To evaluate EOUSA’s system acquisition management, we used the  Software Engineering Institute’s Software Acquisition Capability  Maturity Model, focusing on six of the seven key process areas that are  defined for level 2 of the model’s five-level maturity scale. We focused  on level 2 processes because they represent the minimum level of  maturity needed to effectively manage system acquisition projects. We  used the office’s acquisition of the Enterprise Case Management System  as a case study because officials stated that it is representative of how  they intend to acquire systems. In addition, this system will be critical in  providing fundamental support to the U.S. Attorneys as they work to  achieve mission goals. We reviewed key project documentation, such as  the concept of operations, project plan, and requirements traceability  matrix, and we interviewed system acquisition officials. We also  reviewed the Justice guidance used to manage the project. We then  compared this information to the Software Acquisition Capability  Maturity Model to determine the extent to which the office was  employing effective system acquisition management practices.
We performed our work at EOUSA headquarters in Washington, D.C., from  November 2002 to May 2003, in accordance with generally accepted  government auditing standards.
section_title: Comments from the Department of Justice
paragraphs: The following are GAO’s comments on the Department of Justice’s letter  dated June 16, 2003.
subsections: section_title: GAO Comments
paragraphs: 1. We disagree. Our position that institutionalization has not been a  priority is based on two facts that EOUSA did not dispute: (1) plans for  addressing the weaknesses cited in our report do not exist and (2)  limitations in resources to address these weaknesses were cited by  EOUSA officials as the reason why the weaknesses exist. If each of  these areas were an agency priority, then plans would be in place to  address the weaknesses, and resources to execute the plans would be  committed. 2. We do not question EOUSA’s statement that it has made “tremendous  progress.” Our work focused on determining the extent to which  EOUSA currently satisfies key practices in the four IT management  disciplines. It did not include developing a baseline from which to  measure progress. To EOUSA’s credit, our review showed that the  office has satisfied many key practices in each discipline, and we have  noted this in our report.  3. We agree and include both of these facts in our report. 4. We disagree. EOUSA’s comments did not include any information to  refute our conclusion. Given that it did not have a plan for fully  implementing best practices for each discipline, and had not allocated  adequate resources to support such a plan, we have not modified our  conclusion.  5. We do not question these statements about the position of EOUSA and  the USAOs relative to other Justice components. Such a comparison  was not part of the scope of our work.  6. We disagree. EOUSA has not gained this maturity level. Rather,  according to EOUSA, the contractor that maintains its LIONS  application is certified as a level 3 software developer. In contrast, our  work focused on EOUSA’s capabilities as a software acquirer, and thus  addresses a different organization, discipline, and maturity model.  7. See comment 1. 8. We do not question this statement because the position of EOUSA and  the USAOs relative to other Justice components or other law  enforcement entities was not part of the scope of our work. 9. As noted in our report, EOUSA satisfied about 80 percent of the  elements of just stage 2 of the EA management framework. It has  satisfied about 60 percent of the elements (12 out of 19) of the entire  framework.  10. We have modified the report to reflect this comment. 11. We agree. However, according to GAO’s IT Investment Management  Framework, to satisfy the proposal selection critical process, EOUSA  would need to demonstrate the use of the criteria it has defined.  Because it has not yet done so, it is not satisfying the critical process  and thus has met two out of five elements of stage 2 of the framework. 12. We disagree. Our assessment is based on EOUSA’s satisfaction of key  practices laid out in our executive guide for information security  management. This assessment showed that EOUSA has not fully  satisfied any of these key practices. For example, EOUSA does not  (1) have a central security focal point with appropriate resources,  (2) adequately promote user awareness, and (3) regularly monitor the  effectiveness of security controls. Until EOUSA addresses these and  other security weaknesses we identify in our report, it will not have  implemented effective security practices. 13. See comment 8. 14. We do not question this statement because determining whether the  data of the United States Attorneys have never been compromised and  are monitored 24 hours a day, 7 days a week was not within the scope  of our work and EOUSA did not provide any evidence supporting its  assertions. 15. See comment 1. Additionally, our finding is that the  institutionalization of information security management has not been  an agency priority.  16. We do not question these security initiatives. Additionally, we  emphasize that our message is not that EOUSA has not taken steps to  improve its information security posture, but rather that the office’s  information security management efforts, including ongoing and  completed improvement steps, are weak in a number of areas relative  to information security management best practices. 17. We agree, but would add that our recommendation could be addressed  by actively monitoring activity at the routers, firewalls, and wide area  network devices, which we understand are remotely managed by  EOUSA. To avoid any potential confusion on this point, we have  clarified our recommendation. Implementing an intrusion detection  system to monitor activity at the routers, firewalls, and other network  devices would enable EOUSA to detect hostile attempts to manage  those devices. 18. We do not question EOUSA’s statement that it has been working to  resolve vulnerabilities identified during a security audit conducted by  the Justice Inspector General. The scope of the Inspector General’s  audit, however, was narrower than ours in that it focused on EOUSA’s  local area network environment.  19. We agree that given EOUSA’s recent progress in deploying the  replacement network its exposure to risk is currently limited. We have  modified the security risk assessment section of the report and the  associated recommendation to reflect this change in circumstances. 20. We agree and thus do not conclude that EOUSA’s risk assessment  program is inadequate. Rather, based on the fact that a risk assessment  was not performed on the network that EOUSA has operated since  1996 and, until recently, relied exclusively on, we conclude that EOUSA  has not always performed risk assessments. Additionally, to recognize  the recent change in circumstances we have modified our  recommendation concerning risk assessments.  21. We do not question these statements. We support the use of automated  tools to review audit logs, particularly because these logs were not  being reviewed, and EOUSA attributed this to a lack of resources. We  also support EOUSA’s plan to conduct regular tests to determine  compliance with policies and procedures. Both of these planned  actions are consistent with our recommendations. 22. We do not question this statement. However, as noted in our report, the  office did not have a plan to address the issues that are discussed in our  report.  23. We do not question these statements because our review did not  address contingency plans for all certified and accredited systems. As  stated in the report, while a contingency plan was developed for the  replacement network, it was not prepared in accordance with federal  guidelines. For example, the plan did not specify procedures for  notifying recovery personnel. To clarify our position, we have added  examples to the report of this plan’s noncompliance with federal  guidelines. 24. We support EOUSA’s stated commitment to establish a centralized  security training program. Establishing such a program is consistent  with our recommendations. 25. We have modified the report to reflect that the Enterprise Case  Management System is the first acquisition to follow the Justice life- cycle methodology from its inception.  26. See comment 6.  27. We have modified the report to reflect that EOUSA’s acquisitions are  processed through the department and must comply with all  departmental policies and procedures.
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the individual named above, Nabajyoti Barkakati, Jamey  Collins, Joanne Fiorino, Anh Q. Le, Sabine R. Paul, and William F.  Wadsworth made key contributions to this report.
section_title: GAO’s Mission
paragraphs: The General Accounting Office, the audit, evaluation and investigative arm of  Congress, exists to support Congress in meeting its constitutional responsibilities  and to help improve the performance and accountability of the federal government  for the American people. GAO examines the use of public funds; evaluates federal  programs and policies; and provides analyses, recommendations, and other  assistance to help Congress make informed oversight, policy, and funding  decisions. GAO’s commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site  daily. The list contains links to the full-text document files. To have GAO e-mail this  list to you every afternoon, go to www.gao.gov and select “Subscribe to   e-mail alerts” under the “Order GAO Products” heading.
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Public Affairs