Homeland Security: Progress Made to Implement IT Reform, but Additional Chief Information Officer Involvement Needed
Published: 2017-05-18T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In 2014, Congress enacted IT reform legislation, referred to as FITARA, which includes provisions related to seven areas of IT acquisition management. In 2015, OMB released FITARA implementation guidance that outlined agency CIO responsibilities and required agencies to develop action plans for implementing the guidance.
This report examines, among other things, the extent to which DHS has implemented selected action plans and the key challenges that DHS has faced in implementing selected FITARA provisions.
To do so, GAO analyzed DHS's efforts to implement a sample of 31 of 109 action plans that DHS had reported as complete and that described later-stage implementation steps. To determine challenges, GAO analyzed and compared DHS documentation, including a random sample of IT-related contracts and agreements, to selected FITARA provisions to identify gaps between what was required by FITARA and what DHS had implemented. These provisions required, among other things, significant coordination between DHS headquarters and five components.
section_title: What GAO Found
paragraphs: The Department of Homeland Security (DHS) has fully implemented 28 of the 31 selected Federal Information Technology (IT) Acquisition Reform Act (FITARA) action plans; however, as of December 2016, DHS did not fulfill all aspects of 3 action plans. For example, one action plan is to use an updated process for reviewing troubled programs to provide support to such programs; however, DHS has not finalized its policy for this process. Until DHS ensures that these 3 plans are implemented, it will lack assurance that it is fulfilling FITARA's goals.
DHS faces challenges in implementing certain FITARA provisions:
Chief Information Officer (CIO) approval of contracts and agreements. FITARA requires, among other things, the agency CIO to review and approve IT contracts and agreements associated with major investments (e.g., high cost) prior to award. However, the CIO did not participate in the approval of any of the 48 contracts in GAO's sample associated with major investments. While DHS has made improvements to its review process, until the Office of the CIO determines how to increase its review of contracts and agreements, the CIO will continue to have limited visibility into planned IT expenditures.
CIO evaluation of risk. DHS's Office of the CIO was conducting risk evaluations of major IT investments and updating the ratings on the Office of Management and Budget's (OMB) public website known as the IT Dashboard, as required by FITARA. However, in October 2016, DHS changed its process for evaluating 30 of DHS's 93 major IT investments and, as a result, the CIO is no longer primarily responsible for the evaluations or associated risk ratings that are publicly reported for these investments. Instead, multiple DHS organizations and officials are to evaluate these investments and the CIO's assessment only accounts for about 18 percent of the total score. Further, while under the old process, DHS's CIO was responsible for assessing these 30 investments against criteria that OMB guidance stated CIOs may use, under the new process, the CIO is only to assess these investments against one of OMB's criteria (see table below). This process change challenges the CIO's ability to publicly report risk ratings.
Until DHS addresses these challenges, the goal of FITARA to elevate the role of the department CIO in acquisition management will not be fully realized.
section_title: What GAO Recommends
paragraphs: GAO is making 7 recommendations to DHS to ensure that it fully and effectively implements FITARA. Among other things, GAO recommends that DHS fully implement the action plans and address challenges related to CIO contract approval and evaluation of risk. DHS concurred with all 7 recommendations and provided estimated completion dates for implementing each of them.

section_title: Letter
paragraphs: The federal government plans to spend more than $89 billion on  information technology (IT) in fiscal year 2017. However, prior IT  expenditures too often have failed to meet cost and schedule  expectations or make significant contributions to mission-related  outcomes. To address these concerns, in December 2014, Congress  enacted IT reform legislation, commonly referred to as the Federal  Information Technology Acquisition Reform Act or FITARA. In June 2015,  the Office of Management and Budget (OMB) released FITARA  implementation guidance that, among other things, outlined  responsibilities and authorities of federal agency chief information officers  (CIO); it also required agencies to develop action plans needed to  implement the FITARA guidance.
The Department of Homeland Security (DHS) relies heavily on IT to carry  out its mission. In fiscal year 2016, the department’s IT budget of  approximately $6.2 billion was the third largest in the federal government.  Given the importance of implementing FITARA and the size of its budget,  we reviewed the progress that this department has made in addressing  the act. Specifically, our objectives were to (1) determine the extent to  which DHS has developed action plans that address FITARA, and the  extent to which DHS has implemented selected action plans; and (2)  determine the key challenges that DHS is facing in implementing selected  FITARA provisions.
To address the initial part of the first objective—determine the extent to  which DHS has developed action plans that address FITARA—we  identified and reviewed each of the 131 action plans which DHS  developed in accordance with OMB’s FITARA implementation guidance  that identified 17 topic areas of agency CIOs’ roles and responsibilities,  referred to as common baseline sections. OMB’s 17 baseline areas and  DHS’s 131 supporting action plans are related to three of the five FITARA  sections applicable to DHS: agency CIO authority enhancements,  portfolio reviews, and the expansion of training and use of IT acquisition  cadres.
In addition, we reviewed the department’s IT acquisition human capital  plan and its data center consolidation plan, which were intended to  address FITARA’s fourth and fifth applicable sections on the expansion of  training and use of IT acquisition cadres, and data center consolidation,  respectively. Further, we reviewed the department’s plan for assessing IT  program risks, which was developed prior to the enactment of FITARA,  but is consistent with the act’s provisions on enhanced transparency and  improved risk management. We compared the information in each of  these plans to the five applicable sections in FITARA. We did not assess  whether DHS would be in full compliance with FITARA if the plans were  implemented.
To address the second part of the first objective—determine the extent to  which DHS has implemented selected FITARA action plans—we first  identified those action plans (of the 131 total plans) that DHS reported it  had fully implemented as of April 2016. This resulted in the identification  of 109 action plans. (The remaining 22 of the 131 total plans were  identified by DHS as not yet fully implemented and, thus, were not  included in our selection pool.)
From the 109 plans that the department identified as fully implemented,  we then selected a sample of the plans for review. To create the sample,  we selected only those action plans that (1) were included in the 11  common baseline sections that DHS identified as fully implemented (out  of the 17 total sections) and (2) described later-stage implementation  steps; we did not include plans that described earlier-stage, or preliminary  steps which the department said had been implemented. For example,  we included in our sample action plans that focused on the  implementation of an updated process, rather than action plans that  focused on the preliminary identification of how a process needs to be  updated. Based on these criteria, we selected a sample of 31 action  plans.
We then obtained and analyzed available DHS documentation supporting  the implemented actions, such as DHS policy documents, guidance  documents, concepts of operations, process models, program  management briefings, meeting minutes, memorandums, committee  charters, and relevant e-mails to and from staff in DHS’s Office of the  Chief Information Officer (OCIO) and OMB. We compared the  documentation to the selected action plans to determine the extent to  which DHS had implemented the plans. We also interviewed cognizant  officials from across the department, including from the OCIO, the  Enterprise Business Management Office (EBMO), the Office of the Chief  Human Capital Officer, the Office of Program Accountability and Risk  Management, and the Office of the Chief Procurement Officer. We  discussed with these officials the steps that DHS had taken to implement  the selected action plans.
Regarding our assessments of the sample of DHS’s FITARA action plans,  we determined an action plan to be fully implemented when the evidence  provided by DHS officials fulfilled all aspects of the action plan’s  description. We assessed an action plan as being partially implemented  when the evidence fulfilled some, but not all, aspects of the action plan’s  description. For action plans that we determined to be partially  implemented (although the department had identified them as being fully  implemented), we reviewed documentation and met with department  officials to identify the causes for why those action plans were not yet fully  implemented.
To address the second objective, we identified the five sections within  FITARA that were applicable to DHS as a covered agency. These  sections related to agency CIO authority enhancements, enhanced  transparency and improved risk management, portfolio reviews, federal  data center consolidation, and the expansion of training and use of IT  acquisition cadres. We then selected and reviewed provisions for three of  those sections—agency CIO authority enhancements, enhanced  transparency and improved risk management, and the expansion of  training and use of IT acquisition cadres. (We did not select provisions  from the sections on portfolio reviews and federal data center  consolidation because we had recently completed work that addressed  these sections.)
To select the provisions from within the three sections, we first identified  those that would require significant coordination between DHS  headquarters and its components—since such coordination is especially  important to the department’s decentralized structure. We also identified  those that should have already been implemented by the department  based on the time that had passed since FITARA was enacted in  December 2014.
Based on the criteria, we selected provisions that require:  the DHS CIO to review and approve IT contracts and agreements  before the department enters into them (part of the agency CIO  authority enhancements section);  the department CIO to evaluate each major IT investment according  to risk, in accordance with guidance issued by the Director of OMB  (part of the enhanced transparency and improved risk management  section); and  the department to develop and strengthen its IT acquisition cadre, to  include having highly skilled program and project managers (part of  the expansion of training and use of IT acquisition cadres section).
We examined the implementation of these provisions by DHS  headquarters and the department’s five operational components with the  largest planned fiscal year 2016 IT budgets, as reported on OMB’s IT  Dashboard. These components were the Transportation Security  Administration, U.S. Citizenship and Immigration Services, U.S. Coast  Guard, U.S. Customs and Border Protection, and U.S. Immigration and  Customs Enforcement.
Further, to address the contract approval provision within this objective,  we selected a random sample of contracts and interagency agreements  from each of the five selected components and headquarters. To do so,  we first asked DHS to provide us with a list of contracts for IT or IT  services that met the following criteria: must have been awarded between October 1, 2015 and May 31, must have been unclassified; and must not have been identified as a contract modification.
From the list of contracts provided by DHS, we then selected a subset of  contracts from each of the five selected components and headquarters to  review. Specifically, based on the total value of each contract, we  randomly selected 17 contracts from each of the components and  headquarters using the following cost ranges: $100,000 to less than $1 million (7 contracts), $1 million to less than $2.5 million (7 contracts), and $2.5 million and above (3 contracts).
Two of the selected components—U.S. Citizenship and Immigration  Services and U.S. Immigration and Customs Enforcement—did not have  enough contracts in each cost range for us to assess the total number of  contracts we had planned. In instances where this occurred, we reviewed  these components’ available, applicable contracts within those particular  cost ranges.
As a result, our sample consisted of a total of 92 contracts. Of the 92  contracts, DHS officials from headquarters and the five selected  components associated 48 contracts with major investments and 21 with  non-major investments. Officials from headquarters, Customs and  Border Protection, and the U.S. Coast Guard were unable to map 23  contracts in our sample to an IT investment.
To select the sample of agreements for review, we first asked DHS to  provide us with a list of agreements for IT or IT services that met the  following criteria: must have been classified by DHS as interagency acquisitions  (rather than financial transactions); must have been entered into between October 1, 2015 and May 31, must have had a total value of greater than $100,000; and must have been unclassified.
Based on the above criteria, DHS provided a list of 24 interagency  agreements from headquarters and the five selected components. We  included all of those agreements in our review. Of the 24 interagency  agreements, DHS officials associated 8 agreements with major  investments and 5 with non-major investments. The officials were unable  to map 11 interagency agreements in our sample to an IT investment.
To determine whether each contract or interagency agreement was  approved prior to DHS entering into them, we obtained and analyzed  each of the contracts and agreements, as well as associated approval  documentation, such as acquisition review decision documents. We then  compared the contracts, agreements, and associated approval  documentation to the FITARA provisions to identify gaps between what  FITARA required and what DHS had implemented. Specifically, we  compared the: (1) signature date on the contract or agreement to the date  that was identified on the associated approval documentation and (2)  amount approved to the amount awarded.
Additionally, because DHS used its governance process—referred to as  the IT Acquisition Review process—to approve contracts and  agreements, we assessed whether the DHS CIO (for contracts and  agreements associated with major investments) or a delegate who  reports directly to the CIO (for contracts and agreements associated with  non-major investments) was a full participant in that process, as required  by FITARA. Specifically, for contracts and agreements associated with  major investments, we analyzed the contract or agreement and  associated approval documentation to determine whether the CIO signed  off on the contract or agreement, attended a meeting where it was  discussed, or provided written comments regarding it.
For contracts and agreements associated with non-major investments, we  analyzed the contract or agreement and associated approval  documentation to determine the position title of the official who approved  the proposed contract or agreement. We then asked officials from DHS  headquarters and the five components to identify whether the approving  official reported directly to the DHS CIO, as required by FITARA. If that  person did not directly report to the DHS CIO, we asked for  documentation demonstrating whether the DHS CIO or an official who  reports directly to the CIO was involved as a full participant in the  approval process (i.e., attended a meeting where the specific contract or  agreement was discussed, or provided written comments regarding it).
We also interviewed cognizant DHS officials from headquarters and the  five selected components to discuss DHS’s IT Acquisition Review  process, the steps DHS had taken to review and approve IT contracts  and agreements prior to award, and the reasons for any gaps we  identified to determine their challenges in fully implementing this FITARA  provision.
Within our second objective, to address the provision of FITARA that  requires the DHS CIO to evaluate each major IT investment according to  risk and update the associated CIO ratings on OMB’s IT Dashboard in  accordance with OMB guidance, we analyzed DHS’s policy for updating  the CIO ratings on the Dashboard. We also analyzed DHS’s assessment  template that was used for developing the ratings reported on the  Dashboard. We then compared these documents to the FITARA provision  to identify gaps between what FITARA required and what DHS had  implemented. Further, we interviewed officials from EBMO and the Office  of Program Accountability and Risk Management to discuss the steps  DHS had taken to evaluate its major IT investments and update the  associated CIO ratings on OMB’s IT Dashboard. We also discussed with  these officials the reasons for the gaps we identified to determine their  challenges in addressing these gaps and fully implementing the provision.
To identify any challenges associated with implementing the FITARA  provision that required DHS to develop and strengthen its IT acquisition  cadre, we obtained and analyzed documentation on DHS headquarters’  and the five selected components’ efforts to develop and deploy a skilled  IT acquisition cadre. Specifically, we assessed the department’s  acquisition human capital plan and IT strategic plan, and compared them  to the FITARA provision to identify gaps between what FITARA required  and what DHS had implemented. We also interviewed cognizant DHS  officials from headquarters and the five selected components to discuss  the steps DHS had taken to implement an IT acquisition cadre. In  addition, we discussed with these officials the reasons for the gaps we  identified to determine what, if any, challenges they encountered in  addressing these gaps and fully implementing the provision.
To assess the reliability of the data that we used to support the findings in  this report, we reviewed relevant program documentation to substantiate  evidence obtained through interviews with agency officials. We  determined that the data used in this report were sufficiently reliable for  the purposes of our reporting objectives. We made appropriate attribution  indicating the sources of the data.
We conducted this performance audit from March 2016 to May 2017 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Information systems are critical to the health, economy, and security of  the nation. To support these systems, the federal government plans to  invest more than $89 billion on IT in fiscal year 2017. However, prior IT  expenditures too often have produced failed projects—that is, projects  with multimillion dollar cost overruns, schedule delays measured in years,  and questionable mission-related achievements.
These failed projects often suffered from a lack of disciplined and  effective management, such as project planning, requirements definition,  and program oversight and governance. In many instances, agencies had  not consistently applied best practices that are critical to successfully  acquiring IT investments. Based on these issues, in 2015, we designated  the management of IT acquisitions and operations across the federal  government as high risk.
DHS has been challenged in improving the management of its IT projects.  We have reported on these challenges since shortly after the department  was created in 2002. In particular, we have reported on DHS’s need to  improve its executive oversight of IT investments and its use of key  program management practices.
In 2003, we also designated the transformation of DHS as high risk  because it had to transform 22 agencies—several with major  management challenges—into one department. The department  subsequently made important progress in implementing its range of  missions and in strengthening and integrating its management functions  (e.g., acquisition, financial, and IT). However, in 2015 we reported that,  among other things, additional work was needed for DHS to continue to  improve its IT management. We have made numerous  recommendations to help the department address these challenges.
subsections: section_title: IT Management and Reform Legislation
paragraphs: Over the last three decades, Congress has enacted several laws to assist  the federal government in managing IT investments. For example, the  Paperwork Reduction Act of 1995 required OMB to develop and oversee  policies, principles, standards, and guidelines for federal agency IT  functions. It also required individual agencies to establish processes for  maximizing the value and managing the risk of major information system  initiatives.
The following year, in 1996, Congress enacted the Clinger-Cohen Act to  strengthen those requirements by, among other things, mandating the  appointment of agency CIOs. Under these two laws, CIO responsibilities  for IT management include implementing and enforcing applicable  government-wide and agency IT management principles, standards, and  guidelines; assuming responsibility and accountability for IT investments;  and monitoring the performance of IT programs and advising the agency  head on whether to continue, modify, or terminate such programs.
More recently, in December 2014, Congress passed IT reform legislation  (commonly referred to as the Federal Information Technology Acquisition  Reform Act or FITARA). This law holds promise for improving agencies’  acquisitions of IT and enabling Congress to monitor agencies’ progress  and hold them accountable for reducing duplication and achieving cost  savings.
FITARA includes provisions related to seven areas of management— referred to as FITARA sections. Five of these sections are applicable to  DHS as a covered agency; six are applicable to OMB in its executive  branch budget and policy role; and six are applicable to the General  Services Administration, both as a covered agency and in its government- wide acquisition role:
Agency CIO authority enhancements. Agency CIOs are required to  (1) approve the IT budget requests of their respective agencies, (2)  certify that IT investments are adequately implementing OMB’s  incremental development guidance, (3) review and approve contracts  for IT prior to award, and (4) approve the appointment of other agency  employees with the title or functions of component CIO.
Enhanced transparency and improved risk management. OMB  and agencies are to make publicly available detailed information on  federal IT investments, and agency CIOs are to categorize their  investments by risk. In addition, in the case of major investments  rated as high risk for 4 consecutive quarters, the law requires that the  agency CIO and the investment’s program manager conduct a review  aimed at identifying and addressing the causes of the risk.
Portfolio review. Agencies are to annually review their IT investment  portfolios in order to, among other things, increase efficiency and  effectiveness, and identify potential waste and duplication.
Federal data center consolidation initiative. Agencies are required  to provide OMB with a data center inventory, a strategy for  consolidating and optimizing the data centers (to include planned cost  savings), and quarterly updates on progress made.
Expansion of training and use of IT acquisition cadres. Agencies  are to update their acquisition human capital plans to address  supporting the timely and effective acquisition of IT. In doing so, the  law calls for agencies to consider, among other things, establishing IT  acquisition cadres or developing agreements with other agencies that  have such cadres.
Maximizing the benefit of the federal strategic sourcing initiative.
OMB is to issue regulations requiring that federal agencies compare  their purchases of services and supplies to what is offered under the  federal strategic sourcing initiative.
Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software.
Most of these FITARA sections relate to our high-risk topic on the  government-wide management of IT acquisitions and operations. With  regard to this topic, for example, we focus on the need for CIO authority  enhancements, portfolio reviews, and federal data center consolidation.
section_title: OMB’s FITARA Implementation Guidance
paragraphs: In June 2015, OMB released guidance that describes how agencies are  to implement FITARA. Among other things, this guidance outlined topic  areas related to agency CIOs’ roles and responsibilities—referred to as  OMB’s common baseline sections. For example, the CIO is responsible  for engaging with program managers, reviewing and approving the IT  budget request, and developing the IT workforce. Table 1 identifies  OMB’s 17 common baseline sections and associated topics.
OMB also developed an assessment template for agencies to use to  assess their current practices against the common baseline sections— referred to as a self-assessment. Based on OMB’s guidance, agencies  are expected to use the template to document areas where they are not  in conformance with the baseline sections. The guidance also directed  the agencies to develop action plans describing the changes they needed  to make in order to conform to the baseline sections. The guidance  further directed agencies to conduct an annual review and to update the  self-assessment, with the first update to be completed by the end of April  2016.
In response to the guidance, in November 2015, DHS submitted to OMB  a self-assessment of its conformance with the common baseline. As a  result of the assessment, DHS identified 130 action plans that it intended  to implement to ensure that the department would meet all baseline  responsibilities. According to the assessment, the department originally  planned to implement all of the action plans by the end of May 2016.  However, the department updated its assessment in April 2016 and  revised the number of action plans to 131. It also deferred the  implementation of certain action plans and revised the final time frame by  which it expected to implement all of the plans to the second quarter of  fiscal year 2018. As of April 2016, the department reported to OMB that it  had fully implemented 109 of its 131 action plans. Appendix I lists the  department’s 131 action plans and the respective OMB common baseline  sections with which they are associated.
section_title: Oversight of DHS’s IT Investments
paragraphs: DHS acquires IT and other capabilities that are intended to improve its  ability to execute its mission to prevent and deter terrorist attacks, and  protect against and respond to threats and hazards to the nation. In  accordance with OMB guidance, the department classifies its IT  investments as major and non-major investments.
DHS’s capital planning guidance states that the department’s major  investments are those that are expected to cost $50 million or more over  their life cycles, while non-major investments are those expected to cost  less than $50 million over their life cycles. According to data that DHS  reported to OMB’s IT Dashboard, the department had 92 major IT  investments in fiscal year 2016 and planned to spend about $5.1 billion  on them during that year.
DHS’s Under Secretary for Management is designated as the  department’s Chief Acquisition Officer and, as such, is responsible for  managing the implementation of department-wide acquisition policies. To  help manage and oversee the department’s investments, DHS’s Office of  Program Accountability and Risk Management is responsible for the  department’s overall acquisition governance process and is to report  directly to the Under Secretary for Management. Specifically, this office  has the responsibility to develop and update program management  policies and practices, facilitate and assist in the review of major  programs, provide guidance for workforce planning activities, provide  support to program managers, and collect program performance data.
Further, per the department’s policy, DHS’s CIO, who also reports to the  Under Secretary for Management, is responsible for setting departmental  IT policies, processes, and standards. This official also is to ensure that  IT acquisitions comply with the department’s IT management processes,  technical requirements, and approved enterprise architecture, among  other things. Within the OCIO, EBMO has been given primary  responsibility for administering the CIO’s responsibilities and, as such, for  ensuring that the department’s IT investments align with its missions and  objectives. EBMO is also responsible for leading the implementation of  DHS’s FITARA action plans. Figure 1 shows the key department-level  organizations with IT acquisition management responsibilities at DHS.
To help manage the department’s IT acquisitions, DHS implemented a  governance process—referred to as the IT Acquisition Review process— which is managed by EBMO. This governance process is intended to  ensure IT acquisitions align with DHS’s missions and policies. As part of  this process, the CIO is responsible for reviewing, prior to award,  contracts and agreements that have planned values of $2.5 million or  more, among other criteria. In addition, DHS’s components that have a  CIO are to review, for their respective component, contracts and  agreements with planned values of less than $2.5 million, among other  criteria.
section_title: DHS’s Plans Addressed FITARA and Most, but Not All, Selected Plans Have Been Fully Implemented
paragraphs: DHS developed plans, including 131 action plans, that addressed the five  sections of FITARA that were applicable to the department. Further, as  of December 2016, DHS fully implemented 28 of the 31 action plans we  selected for review. However, we identified 3 action plans that the  department has not fully implemented because specific actions called for  in these plans had not been undertaken. Ensuring that its action plans are  fully implemented will better position DHS to effectively manage the  department’s IT acquisitions, consistent with FITARA.
subsections: section_title: DHS Developed Plans that Addressed FITARA
paragraphs: DHS developed 131 action plans that, collectively, addressed three of the  five applicable FITARA sections: (1) agency CIO authority enhancements,  (2) portfolio reviews, and (3) development and deployment of an IT  acquisition cadre. For example, related to the agency CIO authority  enhancements section—which requires DHS to, among other things,  approve the department’s IT budget requests—the department developed  action plans for identifying and reviewing relevant policies that impact the  processes, roles, and responsibilities within DHS’s budget phases;  documenting and modeling the current processes; identifying gaps and  opportunities in those current processes; and documenting and  implementing updated policies to ensure the DHS CIO is involved in the  department’s IT budgeting decisions and the management of IT  programs.
In addition, DHS developed action plans that relate to the portfolio review  section of FITARA. This section requires the department to annually  review its portfolios of IT investments in order to, among other things,  identify potential duplication in similar investments within the portfolios.  DHS’s action plans to address this section included, among other things,  identifying gaps in the department’s current processes where OMB’s  common baseline requirements were not satisfied; updating relevant  policies and guidance to collect the necessary information related to  executing the IT budget; and ensuring policy updates are approved by  relevant parties.
The department also created action plans to address the section of  FITARA related to IT acquisition cadres. Specifically, this section requires  the department to consider developing and implementing a cross- functional group trained in IT program management and acquisition. For  example, DHS created action plans for identifying training opportunities  that will enhance staff development at multiple levels, developing a  workforce planning process for assessing the department’s current  technology skills, identifying existing employee skillsets related to  acquisition and IT, and aligning the department’s existing course  inventory to acquisition certifications and specializations in IT.
Beyond the 131 FITARA action plans, the department developed a  separate plan that addressed the FITARA section that requires DHS to  consolidate its data centers. Specifically, DHS developed a strategic plan  that describes how it intends to implement OMB’s data center  consolidation guidance.
In addition, the department previously developed a plan that is consistent  with the remaining section of FITARA that is applicable to DHS— enhanced transparency and improved risk management. This section  requires the department to make publicly available detailed information on  its federal IT investments, and the CIO to categorize the department’s  investments by risk. Related to the requirements in this section, in 2013,  DHS issued a plan which stated that IT programs’ risks were to be  assessed on a regular basis and that the assessments would serve as  the basis for the ratings to be regularly published on OMB’s IT  Dashboard. (This plan is discussed in more detail later in the report.)
As a result of the department developing these plans to implement  FITARA, it should be better positioned to implement the act. Further,  doing so has more effectively positioned the department to take steps to  elevate the role of its CIO and improve the oversight of its IT acquisition  and management.
section_title: DHS Has Taken Steps that Fully Implemented Most, but Not All, of the Selected FITARA Action Plans
paragraphs: Of the 31 selected action plans that we reviewed, 28 of them (about 90  percent) have been fully implemented as of December 2016 (that is, the  evidence provided by DHS fulfilled all aspects of the action plan’s  description), as the department reported. However, 3 action plans (about  10 percent) have not been fully implemented, even though the  department reported them as fully implemented. In these instances, the  evidence of the actions taken by the department fulfilled some, but not all,  aspects of the action plan’s description. Table 2 provides the  implementation status of the 31 selected action plans and the OMB  common baseline sections associated with each of these action plans.
For the 28 selected action plans that the department fully implemented,  DHS officials had, for example, updated multiple policies related to the  department’s planning, programming, and budgeting phases; ensured  that the updated policies were approved by relevant parties; and  submitted the updated policies to OMB. In addition, the department  documented and implemented updated processes for the planning,  programming, and budgeting phases to ensure that the CIO has, among  other things, visibility into IT resource plans and decisions. Further, the  department revised relevant documentation and processes to reflect the  CIO’s responsibility to approve components’ requests for reprogramming  or transferring IT resources.
However, the remaining 3 selected action plans were not yet fully  implemented due to two factors: (1) the steps taken did not address all  planned actions and (2) DHS updated its policies with conflicting  guidance. Specifically, DHS’s steps to implement action plans 19 and 20  addressed part, but not all, of these plans. Related to action 19—to  leverage the updated DHS TechStat process to provide support to  failing or troubled programs—OCIO officials were in the process of  updating the department’s TechStat policy to comply with FITARA, but  had not completed the update. As of December 2016, the officials stated  that they could not provide a date for when the policy would be finalized.  Until the CIO, who is responsible for establishing departmental IT policies,  finalizes the TechStat policy, the department will be limited in its ability to  ensure that DHS is meeting FITARA’s IT acquisition reform goals, as well  as consistently providing support to failing or troubled programs.
With regard to action 20—to ensure the IT Program/Project Manager  Center of Excellence reviews IT performance metrics and strategies— DHS developed IT performance metrics. However, as of December 2016,  EBMO officials stated that the Center of Excellence had not begun using  these metrics across all programs to identify poorly performing programs.
These officials told us that they expected the Center of Excellence to  begin using these metrics across all programs to identify those needing  assistance in the second quarter of fiscal year 2017. Use of these metrics  by the center will be vital to its ability to proactively identify poorly  performing programs and help them to improve their performance.
With regards to action 24, which required that the DHS CIO certify  investments’ incremental development activities, the department updated  its multiple systems engineering life-cycle policies and guidance  documents with conflicting information regarding who was to certify these  development activities. While one of the policies was updated to specify  that the DHS CIO was the certifier, another policy and a guidance  document was updated to specify that the component CIO was the  certifier.
Officials from EBMO and the Office of Program Accountability and Risk  Management stated that these documents were not written at the same  time and, as a result, reflected conflicting policies and guidance that  needed further clarification. However, the officials did not state when they  intended to make the clarifications and updates to the policies and  guidance. Until the Under Secretary for Management, who is responsible  for managing the implementation of department-wide acquisition policies,  updates DHS’s relevant policies and guidance in a consistent manner to  identify that the DHS CIO is to certify investments’ incremental  development activities, the department is at risk of excluding the CIO from  important investment oversight activities.
section_title: DHS Faces Several Challenges in Implementing FITARA
paragraphs: DHS currently faces a number of important challenges in implementing  several selected FITARA provisions. These provisions relate to (1) the  CIO’s approval of IT contracts and agreements before award, (2) the  CIO’s evaluation of each major IT investment according to risk, and (3)  the development and deployment of an IT acquisition cadre. While the  department has taken steps aimed at addressing these challenges, more  work remains. Moreover, until the department takes actions that fully  address these challenges, the goal of FITARA to elevate the role of the  department CIO may not be fully realized.
subsections: section_title: CIO Review of Certain Contracts and Agreements Is a Challenge for DHS
paragraphs: FITARA prohibits a covered agency (such as DHS) from entering into a  contract or agreement for IT or IT services (associated with major and  non-major investments), unless the contract or agreement has been  reviewed and approved by the agency CIO. FITARA allows the CIO to  delegate these review and approval duties if a contract or agreement is to  support a non-major IT investment. In such cases, the delegated official  must report directly to the agency CIO. Accordingly, in order to properly  distinguish the appropriate approving official, per FITARA, it is necessary  for an agency to determine whether each IT contract and agreement is  associated with a major or non-major investment.
Alternatively, FITARA states that an agency may use its governance  processes to approve any contract or agreement (associated with major  investments), if the agency CIO is a full participant in the governance  processes. Further, when governance processes are used for review of  contracts or agreements associated with non-major IT investments, the  CIO or an individual who reports directly to the agency CIO must be a full  participant in the governance processes.
While DHS used its governance process (e.g., the CIO’s IT Acquisition  Review process, discussed earlier) to approve contracts and interagency  agreements associated with major and non-major investments, the DHS  CIO did not directly review or approve any of the contracts or interagency  agreements that we examined. Furthermore, the CIO or an appropriate  delegate was not always a full participant in the department’s use of its  governance process to approve the contracts and interagency  agreements that we reviewed, as required by FITARA. Specifically,
Of the 48 contracts and 8 interagency agreements in our sample  that department officials associated with major investments (i.e., those  requiring additional management attention because of, among other  things, their significance to the department’s mission or high costs, as  defined by OMB), the DHS CIO neither directly reviewed, nor  participated in the governance process to review, any of those  contracts or agreements, as required by FITARA. Instead, all of the  contracts and interagency agreements were reviewed by either the  Executive Director or Deputy Executive Director of EBMO, or a  component official, which was not in compliance with FITARA.
While an appropriate delegate who reported directly to the department  CIO participated in the review of 5 of the 21 selected contracts that  DHS officials associated with non-major investments, the department  CIO or an appropriate delegate did not participate in the review of the  remaining 16 contracts (about 76 percent). In addition, neither the  DHS CIO nor an appropriate delegate participated in the review of any  of the 5 interagency agreements in our sample that were associated  with non-major investments. Instead, these contracts and interagency  agreements were reviewed and approved, as part of the governance  process, by someone who did not report directly to the DHS CIO,  such as a deputy assistant commissioner or a management analyst.  Such review and approval was not consistent with FITARA.
Table 3 summarizes the number of selected contracts and interagency  agreements that were and were not reviewed by the appropriate official  prior to award, as required by FITARA.
Further, the department CIO did not prioritize the reviews of contracts  associated with major IT investments, even for those with known  performance problems. For example, three of the contracts in our sample  were associated with two major DHS IT investments with past or existing  performance issues: Customs and Border Protection’s Automated  Commercial Environment investment and United States Citizenship and  Immigration Services’ Transformation investment. We have previously  reported on significant performance problems with these investments.  However, the DHS CIO did not directly review and approve the contracts  for these troubled investments, as required by FITARA for contracts  associated with major investments. Instead, the Customs and Border  Protection CIO and the Executive Director of EBMO reviewed the  contracts for these investments, respectively.
According to OCIO officials, the reason why the department CIO  delegated the approval of contracts and agreements in a way that was  inconsistent with FITARA was that DHS had a large volume of contracts,  which made it challenging for the department CIO and those who  reported to the CIO to review every contract and agreement. Specifically,  data provided by DHS showed that, in fiscal year 2016, the department  awarded approximately 5,100 contracts for IT or IT services. According to  DHS officials, as a work around to this resource constraint, the  department CIO delegated the review and approval of contracts and  agreements to EBMO or component officials.
OCIO officials recognized that the department needs to make  improvements to better meet the intent of FITARA’s contract and  agreement approval section and they have begun taking steps to do so.  For example, in May 2016, the department updated its department-wide  acquisition procedures to require greater participation in the acquisition  planning process by the DHS CIO and component CIOs. Specifically, the  updated procedures specify that the DHS CIO is required to review and  sign the acquisition plans—which are developed early in the  procurement planning process and provide top-level plans for the overall  acquisition approach—associated with major IT acquisitions that have  estimated life-cycle costs of greater than $50 million or service  acquisitions with an annual expenditure of $100 million or more.  Additionally, the updated procedures specify that the component CIOs  are to review and sign the acquisition plans for all acquisitions involving  sensitive information. Further, in October 2016, OCIO updated its  associated IT Acquisition Review governance process to implement these  new procedures.
Nevertheless, while these updates to the department-wide acquisition  procedures and governance process represent improvements by allowing  the CIO and component CIOs insight into early procurement planning, the  CIO’s visibility into contracts is limited because these top-level acquisition  plans do not include important details (e.g., the full scope of the work to  be performed) that are contained in specific contracts.
Additionally, the department’s governance process requires contracts or  agreements that are associated with major investments and that have  total estimated procurement values of at least $2.5 million to be submitted  to the DHS OCIO for review. However, these processes still do not  require contracts and agreements that are associated with major  investments and are under this threshold to be submitted for CIO review,  which is inconsistent with FITARA.
In response to our concerns, in April 2017, OCIO officials stated that they  had begun to analyze how they could best increase the CIO’s and  appropriate delegates’ reviews of contracts and agreements, while  considering the department’s staffing constraints. The officials also stated  that, once this analysis is complete, they plan to update their governance  process accordingly; however, they did not know when these actions  would be completed. Until the governance process is updated in a way  that increases the CIO’s and appropriate delegates’ reviews of contracts  and agreements associated with major and non-major investments, the  DHS CIO will continue to have limited visibility into the department’s  planned IT expenditures. Additionally, the CIO may lack critical data to  make investment decisions and may not be able to use the increased  authority that FITARA’s contract and agreement approval provision is  intended to provide.
Further exacerbating this issue, FITARA does not allow agency CIOs to  delegate the review and approval of contracts and agreements  associated with major investments, but there were many contracts and  interagency agreements in our sample for which DHS officials were  unable to map to a major or non-major IT investment; as such, they could  not ensure that these contracts and agreements were reviewed by the  appropriate officials. Specifically, officials from DHS headquarters,  Customs and Border Protection, and the U.S. Coast Guard were unable  to map 23 of the 92 contracts (about 25 percent) and 11 of the 24  interagency agreements (about 46 percent) in our sample to a major or  non-major IT investment.
The officials cited various reasons for why they could not map these  contracts and interagency agreements to a major or non-major IT  investment. Specifically,
OCIO officials stated that only contracts and agreements that go  through the department’s headquarters-level contract approval  process (i.e., defined by DHS as those valued at $2.5 million or over  and are associated with major investments) are required to identify  the associated investments. These officials stated that, at the  headquarters level, the department does not ask about the  investments associated with contracts and agreements that do not go  through this headquarters-level contract approval process.
While Customs and Border Protection officials were able to identify  the IT investments associated with the majority of their contracts and  interagency agreements in our sample, these officials stated that  certain contracts were not associated with planned IT investments.  Rather, according to the officials, these contracts were to address  emerging needs (e.g., a need for new laptops) that Customs and  Border Protection offices had identified that were not originally  planned as part of an investment.
U.S. Coast Guard officials stated that their process for accounting for  all IT costs does not include a mapping of every contract or  agreement to a major or non-major IT investment. These officials said  they were working with DHS headquarters to improve their process for  tracking contracts and agreements associated with IT investments,  but did not specify a time frame for completing this effort.
Until the Under Secretary for Management updates DHS headquarters’,  Customs and Border Protection’s, and U.S. Coast Guard’s processes to  track, for all contracts and agreements, the IT investment with which each  is associated (as applicable), the department will be challenged in its  ability to ensure that the contracts and agreements that are associated  with these investments receive the appropriate level of oversight.
section_title: DHS’s Recent Change in Its Risk Rating Process Creates a Barrier to Reporting the CIO’s Assessment to OMB’s IT Dashboard
paragraphs: FITARA requires each agency CIO to categorize its major IT investments  according to risk, in accordance with guidance issued by the Director of  OMB. In this regard, OMB issued guidance in June 2015 that directed  agency CIOs to evaluate and categorize (i.e., rate) the risk of each major  IT investment. In addition, OMB’s guidance directs agencies to report  their CIO risk ratings on OMB’s public website known as the IT  Dashboard.
Prior to October 2016, DHS’s OCIO, on behalf of the CIO, was  conducting such evaluations on the department’s major IT investments in  accordance with OMB’s six criteria. The office was also regularly updating  the associated CIO risk ratings on the IT Dashboard, as required by  FITARA and OMB.
However, as of October 2016, the CIO was no longer directly responsible  for the full evaluations or the associated risk ratings that are publicly  reported on the IT Dashboard for approximately one-third of the  department’s major IT investments. This was due to DHS’s Under  Secretary for Management issuing a new policy in October 2016 that  assigned responsibility for collecting the appropriate acquisition program  data for evaluating the health of all level one and level two major  acquisition programs (both IT and non-IT) that are on the department’s  Master Acquisition Oversight List to the Office of Program Accountability and Risk Management. According to EBMO officials, as of December  2016, these level one and level two investments that the Office of  Program Accountability and Risk Management was to facilitate the  evaluation of included 30 of DHS’s 93 major IT investments. DHS’s policy  further states that the department CIO is to report the ratings that are  facilitated by the Office of Program Accountability and Risk Management  on these 30 IT investments to OMB’s IT Dashboard. The officials also  stated that OCIO is to continue to have responsibility for the evaluations  of the 63 other IT investments not on that oversight list, and for reporting  the associated risk ratings of these investments to the IT Dashboard.
According to the Office of Program Accountability and Risk  Management’s evaluation template, 39 factors, each with an associated  weight, are to be considered in conducting the evaluations, and each  factor is to be assessed by different organizations and officials within the  department. These organizations and officials include, among others, the  Offices of Program Accountability and Risk Management, the Chief  Procurement Officer, the Chief Information Officer, Systems Engineering,  and the Chief Financial Officer; as well as the Director of Operational Test  and Evaluation, and the Joint Requirements Council. After all of the  offices prepare their parts of the assessment, the Office of Program  Accountability and Risk Management is to calculate a final evaluation  rating based on the 39 factors and their weights.
For its part, the CIO is responsible for assessing the 30 IT investments  against 10 of the 39 factors, which accounts for about 18 percent of the  total assessment score. Thus, over 80 percent of the evaluation and final  assessment score for the investments included in the evaluation  facilitated by the Office of Program Accountability and Risk Management  does not involve the key IT management executive—the CIO.
Moreover, DHS’s CIO was previously responsible for evaluating and  reporting the associated risk ratings of the department’s 30 major IT  investments on the Master Acquisition Oversight List against the criteria  that OMB’s 2015 guidance stated CIOs may use to evaluate and report  the risk of their programs. However, as shown in table 4, under the new  process facilitated by the Office of Program Accountability and Risk  Management, the CIO is only responsible for assessing these  investments against one of OMB’s criteria.
Further, while the Office of Program Accountability and Risk Management  is responsible for facilitating the development of the risk ratings that are  reported to the IT Dashboard for these 30 IT investments, as of  December 2016, according to DHS officials, OCIO was also conducting a  separate evaluation on these investments. Specifically, OCIO officials  stated that they have continued to conduct their own evaluations in order  to meet OCIO’s other investment oversight responsibilities.
As such, the Under Secretary for Management’s October 2016  assignment of responsibility for facilitating the assessment of these  investments to the Office of Program Accountability and Risk  Management is not only in conflict with FITARA, but also in conflict with  guidance the Acting Deputy Under Secretary for Management issued in  April 2015 in response to our prior recommendation to the department.  Specifically, in March 2015, we reported that there were overlapping  responsibilities and duplicative efforts between the Office of Program  Accountability and Risk Management and the OCIO in the oversight and  management of IT investments on the Master Acquisition Oversight List.  We recommended in our 2015 report that DHS develop written guidance  to clarify the roles and responsibilities of the Office of Program  Accountability and Risk Management and OCIO for conducting oversight  of major acquisition programs.
In response to our recommendation, in April 2015, the Acting Deputy  Under Secretary for Management issued guidance that clarified that the  CIO is responsible for performing the program assessments for the IT  investments on the Master Acquisition Oversight List, which then are to  be reported on the IT Dashboard. Accordingly, the Under Secretary for  Management’s recent change suggests that the issue of overlapping  responsibilities and duplicative efforts between the Office of Program  Accountability and Risk Management and the OCIO in the oversight and  management of certain IT investments that we raised 2 years ago has not  yet been adequately addressed within the department.
Thus, rather than elevating the CIO’s role per the goal of FITARA, the  recent change in DHS’s evaluation of these IT investments is achieving  the opposite effect by reducing the CIO’s role and creating a barrier for  this official to appropriately report investment risk ratings to the  Dashboard. According to EBMO officials, the department’s goal is to use  one evaluation process that covers all major IT investments in order to  ensure consistency across all evaluations reported on the Dashboard.  However, as of December 2016, DHS officials did not know when the  department would begin using only one evaluation process for its major IT  investments, or who would be responsible for those reviews under that  single process. Until the Under Secretary for Management updates and  implements the process that the department uses for assessing the risks  of major IT investments to ensure that the ratings reported fully reflect the  CIO’s assessment of each major IT investment, Congress’ and the  public’s insight into the assessment of each major investment’s risk and  performance will be limited.
section_title: DHS Faces Challenges in Developing and Strengthening Its IT Acquisition Cadre
paragraphs: FITARA requires agencies to update their acquisition human capital plans  to address how the agencies are meeting their human capital  requirements. In particular, the act requires agencies to consider, among  other things, establishing cross-functional groups trained in IT program  management and IT acquisition—referred to as IT acquisition cadres. In  July 2011 (prior to the enactment of FITARA), OMB’s Office of Federal  Procurement Policy issued guidance that identified key knowledge areas  essential for such a cadre, including, among other things, IT strategic  planning, acquisition planning, information security requirements, risk  management, requirements definition, and contract management. We  have also previously issued a human capital guide that stresses the  importance of federal agencies ensuring that their employees have the  skills needed to perform effectively and achieve agency goals. Our  guidance states that, among other things, federal agencies need to  determine what skills and competencies are necessary in order to meet  current and future challenges, assess any gaps in current skills and  competencies, and address those gaps.
Although DHS has taken certain actions toward implementing an IT  acquisition cadre and developing an acquisition human capital plan, the  department has experienced challenges in fully implementing this  FITARA provision. Specifically,
DHS has not defined its IT acquisition cadre. While DHS updated  its acquisition human capital plan in April 2016 to address its use of  the procedures required by FITARA, the department faces challenges  in strengthening its IT acquisition cadre because it has not yet  identified the specific positions or personnel that are to be included in  the cadre. To its credit, the department identified the number of  acquisition personnel that it has in multiple functional areas, such as  its project/program managers, contracting officers, and system  engineering staff. However, it has not determined how many of those  staff are knowledgeable in IT investment management and whether  they should be considered a part of the IT acquisition cadre.
The department also reported in its April 2016 acquisition human  capital plan that directors and project/program managers within OCIO  are required to maintain appropriate certifications to oversee IT  acquisitions. However, it has not determined whether this group of  workforce professionals has the specialized skills and knowledge  needed in all of the areas outlined in OMB’s Office of Federal  Procurement Policy’s guidance.
EBMO officials told us that they hope to define the entire IT  acquisition cadre through a survey and/or skills assessment during  fiscal year 2017; however, specific plans for doing so had not been  established. Until the CIO establishes time frames and implements a  plan for (1) identifying the specific staff or positions currently within its  IT acquisition cadre; and (2) assessing whether these staff and  positions address all of the specialized skills needed, as outlined in  the Office of Federal Procurement Policy’s cadre guidance, the  department risks not having the critical skills needed to effectively  acquire IT services. In addition, the department will continue to be  challenged in its ability to meet FITARA’s intent of making timely  progress toward developing and strengthening its IT acquisition cadre.
DHS lacks clarity on the acquisition skills needed to support its  new IT delivery model. DHS’s IT Strategic Plan for fiscal years 2015  through 2018 calls for a paradigm shift in the department’s IT delivery  model—from acquiring IT assets to acquiring services, and acting as  a service broker (e.g., an intermediary between the purchaser of a  service and the seller of that service). According to OCIO officials, this  shift will require a significant change in the skillsets of DHS’s  employees.
However, the department has faced challenges in implementing this  new IT delivery model because it has not identified its future skillset  needs or determined the gaps, if any, between its employees’ current  skillsets and its future needs. DHS awarded a workforce management  contract in July 2016 to, among other things, assist with the  implementation of the new IT delivery model at headquarters,  including defining future IT skill sets needed and conducting a skills  gap analysis. However, while EBMO officials stated in December  2016 that they would conduct these activities by the end of fiscal year  2017, the department did not have a specific plan for when it would  identify its future IT skillset needs, or analyze and address the skills  gaps resulting from the new delivery model.
Until the CIO establishes time frames and implements a plan for (1)  identifying future IT skillset needs to support DHS’s new delivery  model, (2) conducting a skills gap analysis, and (3) resolving any skills  gaps identified, the department will continue to be challenged in its  ability to ensure that it has the skillsets necessary to perform the new  responsibilities associated with the shift.
section_title: Conclusions
paragraphs: In response to FITARA, DHS has taken several key steps toward  improving the department-level CIO’s role in IT acquisitions, including  updating the department’s acquisition governance process and  associated guidance to require greater participation by the CIO. However,  additional actions are needed by the CIO. Specifically, related to the  department’s incomplete implementation of its action plan to use the  updated DHS TechStat process to provide support to failing or troubled  programs, until the CIO finalizes the department’s TechStat policy, DHS  will be limited in its ability to help such programs. In addition, the DHS  CIO’s lack of review of certain contracts and agreements puts the  department at risk of awarding duplicative or unnecessary contracts and  agreements. As such, until the CIO updates the department’s IT  Acquisition Review governance process to increase the number of  contracts and agreements (associated with both major and non-major  investments) that are reviewed by the CIO and appropriate delegates, the  CIO will continue to have limited visibility into the department’s planned IT  expenditures.
Further, the department’s lack of knowledge about the specific staff or  positions in its IT acquisition cadre; the skillsets it currently has; and the  skills it needs to implement its new IT delivery model, reduces OCIO’s  ability to ensure that it has all of the skillsets required. Without the CIO  establishing time frames and implementing a plan for (1) identifying the  specific staff or positions currently within its IT acquisition cadre; and (2)  assessing whether these staff and positions address all of the specialized  skills needed, as outlined in the Office of Federal Procurement Policy’s  cadre guidance, the department risks not having the critical skills needed  to effectively acquire IT services. Moreover, without the CIO establishing  time frames and implementing a plan for (1) identifying future IT skillset  needs to support DHS’s new delivery model, (2) conducting a skills gap  analysis, and (3) resolving any skills gaps identified, the department will  continue to be challenged in its ability to ensure that it has the skillsets  necessary to perform the new responsibilities associated with the shift.
DHS’s Under Secretary for Management has also taken actions aimed at  implementing FITARA by updating the department’s acquisition policies  and guidance documents. However, until the Under Secretary for  Management makes additional updates to these acquisition policies and  guidance documents to be consistent in identifying that the DHS CIO is to  certify investments’ incremental development activities (as required by  one of the department’s FITARA action plans), the CIO is at risk of not  being included in important investment oversight activities.
In addition, the contracts and interagency agreements for which DHS  officials could not determine whether they were associated with a major  investment is concerning. Until the Under Secretary for Management  updates DHS headquarters’, Customs and Border Protection’s, and the  U.S. Coast Guard’s processes to track, for all contracts and agreements,  the IT investment with which each is associated (as applicable), the  Under Secretary has limited assurances that these contracts and  agreements will be reviewed by the appropriate officials. Lastly, the Under  Secretary for Management’s recent policy change that limited the CIO’s  input into risk ratings for certain major IT investments has devalued the  CIO’s role. Until the Under Secretary updates and implements the  process that the department uses for assessing the risks of major IT  investments to ensure that the ratings reported to the IT Dashboard fully  reflect the CIO’s assessment of each major IT investment, Congress’ and  the public’s insight into the assessment of each major investment’s risk  and performance will be limited.
section_title: Recommendations for Executive Action
paragraphs: To ensure that DHS effectively implements FITARA, we are making  seven recommendations to the Secretary of Homeland Security.
Specifically, we are recommending that the Secretary of Homeland  Security direct the Under Secretary for Management to direct the Chief  Information Officer to take the following actions:  finalize the department’s TechStat policy; update the department’s IT Acquisition Review governance process to  increase the number of contracts and agreements (associated with  both major and non-major investments) that are reviewed by the CIO  and appropriate delegates; establish time frames and implement a plan for (1) identifying the  specific staff or positions currently within the department’s IT  acquisition cadre; and (2) assessing whether these staff and positions  address all of the specialized skills and knowledge needed, as  outlined in OMB’s Office of Federal Procurement Policy’s guidance for  developing an IT acquisition cadre; and establish time frames and implement a plan for (1) identifying the  department’s future IT skillset needs as a result of DHS’s new delivery  model, (2) conducting a skills gap analysis, and (3) resolving any skills  gaps identified.
Further, we are recommending that the Secretary of Homeland Security  direct the Under Secretary for Management to update the department’s acquisition policies and guidance to be  consistent in identifying that the DHS CIO is to certify investments’  incremental development activities; update DHS headquarters’, Customs and Border Protection’s, and  U.S. Coast Guard’s processes to track, for all contracts and  agreements, the IT investment with which each is associated (as  applicable); and update and implement the process DHS uses for assessing the risks  of major IT investments to ensure that the CIO rating reported to the  Dashboard fully reflects the CIO’s assessment of each major IT  investment.
section_title: Agency Comments and Our Evaluation
paragraphs: DHS provided written comments on a draft of this report, which are  reprinted in appendix II. In its comments, the department concurred with  all seven of our recommendations and provided estimated completion  dates for implementing each of them. For example, the department stated  that, by June 30, 2017, its headquarters OCIO intends to develop a  department-level plan for identifying the staff included in DHS’s IT  acquisition cadre. Further, it said the DHS OCIO plans to require the  components to develop associated component-level plans for identifying  their IT acquisition cadres.
In response to our recommendation that the Under Secretary for  Management update DHS headquarters’ processes to track, for all  contracts and agreements, the IT investment with which each is  associated (as applicable), the department described recent actions that it  had taken to implement this recommendation. Specifically, it stated that  OCIO had updated the tool used as part of the IT Acquisition Review  governance process to require that the contract number be provided for  all acquisitions reviewed by headquarters OCIO. The department further  noted that the tool also links each acquisition to the associated funding  investment. The department reported that these updates were completed  on January 31, 2017. We will follow-up with the department to obtain  documentation demonstrating that the tool tracks this information.
In response to oral comments that were also provided by DHS officials on  a draft of this report, we clarified one of our recommendations. The  department concurred with this clarified recommendation in its written  comments.
In addition, we received technical comments from DHS headquarters and  component officials, which we have incorporated, as appropriate.
We are sending copies of this report to the appropriate congressional  committees, the Secretary of Homeland Security, and other interested  parties. In addition, this report is available at no charge on the GAO  website at http://www.gao.gov.
Should you or your staffs have any questions on information discussed in  this report, please contact Carol Harris at (202) 512-4456 or  Harriscc@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made major contributions to this report are listed in  appendix III.
section_title: Appendix I: The Department of Homeland Security’s (DHS) Action Plans to Implement Information Technology Acquisition Reform
paragraphs: The table below lists DHS’s 131 Federal Information Technology  Acquisition Reform Act (FITARA) action plans and the respective Office of  Management and Budget (OMB) common baseline sections with which  they are associated. Additionally, the table lists DHS’s planned  implementation dates for each of the department’s FITARA action plans,  as of April 2016, and identifies the 31 action plans that were included in  GAO’s review.
section_title: Appendix II: Comments from the Department of Homeland Security
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contacts named above, the following staff also made  key contributions to this report: Shannin O’Neill (Assistant Director); Emily  Kuhn (Analyst-in-Charge); Mathew Bader; Ronalynn (Lynn) Espedido;  Rebecca Eyler; Javier Irizarry; and Corey Rodriguez.