Social Security Administration: Effective Information Technology Management Essential for Data Center Initiative
Published: 2009-04-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The American Recovery and Reinvestment Act of 2009 (Recovery Act) provides resources to the Social Security Administration (SSA) to help replace its National Computer Center. This data center, which is 30 years old, houses the backbone of the agency's automated operations, which are critical to providing benefits to nearly 55 million people, issuing Social Security cards, and maintaining earnings records. The act makes $500 million available to SSA for the replacement of its National Computer Center and associated information technology (IT) costs. In this testimony, GAO was asked to comment on key IT management capabilities that will be important to the success of SSA's data center initiative. To do so, GAO relied on previously published products, including frameworks that it has developed for analyzing IT management areas. GAO has not performed a detailed examination of SSA's plans for this initiative, so it is not commenting on the agency's progress or making recommendations.
section_title: What GAO Found
paragraphs: For an effort as central to SSA's mission as its planned new data center, effective practices in key IT management areas are essential. For example: (1) Effective strategic planning helps an agency set priorities and decide how best to coordinate activities to achieve its goals. For example, a strategic plan identifying interdependencies among modernization project activities helps ensure that these are understood and managed, so that projects--and thus system solutions--are effectively integrated. Given that the new data center is to form the backbone of SSA's automated operations, it is important that the agency identify goals, resources, and dependencies in the context of its strategic vision. (2) An agency's enterprise architecture describes both its operations and the technology used to carry them out. A blueprint for organizational change, an architecture is defined in models that describe (in business and technology terms) an entity's current operation and planned future operation, as well as a plan for transitioning from one to the other. An enterprise architecture can help optimize SSA's data center initiative by ensuring that its planning and implementation take full account of the business and technology environment. (3) For IT investment management, an agency should follow a portfoliobased approach in which investments are selected, controlled, and monitored from an agencywide perspective. By helping to allocate resources effectively, robust investment management processes can help SSA meet the accountability requirements and align with the goals of the Recovery Act. For example, projects funded under the act are to avoid unnecessary delays and cost overruns and are to achieve specific program outcomes. Investment management is aimed at precisely such goals: for example, accurate cost estimating (an important aspect of investment management) provides a sound basis for establishing a baseline to formulate budgets and measure program performance. Further, the act emphasizes energy efficiency--also a major concern for data centers, which have high power and cooling requirements. Investment management tools are important for evaluating the most cost-effective approaches to energy efficiency. (4) Finally, information security should be considered throughout the planning, development, and implementation of the data center. Security is vital for any organization that depends on information systems and networks to carry out its mission--especially for government agencies like SSA, where maintaining the public's trust is essential. One part of information security management is contingency and continuity of operations planning--vital for a data center that is to be the backbone of SSA's operations and service delivery. Data centers are vulnerable to a variety of service disruptions, including accidental file deletions, network failures, systems malfunctions, and disasters. Accordingly, it is necessary to define plans governing how information will be processed, retrieved, and protected in the event of minor interruptions or a full-blown disaster. These capabilities will be important in helping to ensure that SSA's data center effort is successful and effectively uses Recovery Act funds.

section_title: Letter
paragraphs: I am pleased to be here today to comment on the efforts of the  Social Security Administration (SSA) to use resources provided by  the American Recovery and Reinvestment Act of 2009 (Recovery  Act) to replace its National Computer Center. Among its provisions,  the act makes $500 million available to SSA for the replacement of  the center and associated information technology (IT) costs. This  data center, which is 30 years old, houses the backbone of the  agency’s automated operations, which are critical to providing  benefits to nearly 55 million people, issuing Social Security cards,  and maintaining earnings records.
SSA has stated that it needs to replace the facility to provide more  current processing capabilities and support the current and growing  requirements of a 24-hour a day, 7-day a week electronic service  delivery operation. The agency has decided that building a new  facility will allow it to address limitations in the current facility,  such as power supply and grid problems, as well as the presence of  aging water pipes running in the same area as the equipment wiring.  At the same time, the agency plans to move to more modern  database technology to replace current systems, which still contain  about 36 million lines of COBOL code – a programming language  that is generally viewed as obsolete by the computer industry.
To date, we have not performed a detailed examination of SSA’s  plans for this initiative; however, by all indications, this effort is  expected to be a significant undertaking. Accordingly, its success  will depend on how effectively the agency plans and manages the  initiative—from inception through delivery. Although IT investments  can improve organizational performance, they can also become  risky, costly, unproductive ventures that do not yield intended  results. As we have described in numerous reports and testimonies,  federal IT projects too frequently incur cost overruns and schedule  slippages.
Our research into IT management best practices and our evaluations  of agency IT management performance have identified essential and  complementary management disciplines that agencies can use to  guide their efforts on major IT endeavors. These are related to key  issues specific to data centers—identified by other research—that  can affect efforts to construct or modernize these facilities. At your  request, my testimony today summarizes selected key management  capabilities that will be important to the success of SSA’s data  center initiative, and ties these capabilities to issues associated  specifically with data centers, as well as to meeting the  requirements of the Recovery Act.
In developing this testimony, we relied on previously published  products, including frameworks that we have developed for  analyzing IT management areas. We also consulted published  literature on data center construction issues and considerations. We  conducted our work in support of this testimony in April 2009.
subsections: section_title: Background
paragraphs: SSA projects that its current data center will not be adequate to  support the demands of its growing workload. In fiscal year 2008,  SSA’s benefit programs provided a combined total of approximately  $650 billion to nearly 55 million beneficiaries. According to the  agency, the number of beneficiaries is estimated to increase  substantially over the next decade. In addition, SSA’s systems  contain large volumes of medical information, which is used in  processing disability claims. About 15 million people are receiving  federal disability payments, and SSA has been contending with  backlogs in processing disability claims.
According to SSA officials, the agency plans to use a large portion of  the $1 billion in funding that it was allocated by the Recovery Act  primarily to help build a large-scale data center and to develop new  software to reduce the backlog of disability claims.  The act provides  $500 million from the stimulus package for data center expenses, of  which $350 million is slated for the building infrastructure and part  of the remaining funding for IT-related upgrades. This is not the  entire projected cost: SSA has indicated that it needs a total of about  $800 million to fund a new IT infrastructure, including the new data  center—the physical building, power and cooling infrastructure, IT  hardware, and systems applications.
The Recovery Act’s goals, among other things, include creating or  saving more than 3.5 million jobs over the next two years and  encouraging renewable energy and energy conservation. According  to the Office of Management and Budget (OMB), the act’s  requirements include unprecedented levels of transparency,  oversight, and accountability for various aspects of Recovery Act  planning and implementation. These requirements are intended to  ensure, among other things, that   ●  funds are awarded and distributed in a prompt, fair, and reasonable  ●  the recipients and uses of all funds are transparent to the public, and  the public benefits of these funds are reported clearly, accurately,  and in a timely manner;  ●  funds are used for authorized purposes and instances of fraud,  waste, error, and abuse are mitigated;  ●  projects funded under the act avoid unnecessary delays and cost  ●  program goals are achieved, including specific program outcomes  and improved results on broader economic indicators.
section_title: Attention to Key IT Management Areas Will Help SSA in Its Data Center Initiative
paragraphs: An effort as central to SSA’s ability to carry out its mission as its  planned new data center requires effective IT management. As our  research and experience at federal agencies has shown,  institutionalizing a set of interrelated IT management capabilities is  key to an agency’s success in modernizing its IT systems. These  capabilities include, but are not limited to  ●  strategic planning to describe an organization’s goals, the strategies  it will use to achieve desired results, and performance measures;  ●  developing and using an agencywide enterprise architecture, or  modernization blueprint, to guide and constrain IT investments;  ●  establishing and following a portfolio-based approach to investment  implementing information security management that ensures the  integrity and availability of information.
The Congress has recognized in legislation the importance of these  and other IT management controls, and OMB has issued guidance.  We have observed that without these types of capabilities,  organizations increase the risk that system modernization projects  will (1) experience cost, schedule, and performance shortfalls and  (2) lead to systems that are redundant and overlap. They also risk  not achieving such aims as increased interoperability and effective  information sharing. As a result, technology may not effectively and  efficiently support agency mission performance and help realize  strategic mission outcomes and goals.
All these management capabilities have particular relevance to the  data center initiative.   ●  IT strategic planning. A foundation for effective modernization,  strategic planning is vital to create an agency’s IT vision or roadmap  and help align its information resources with its business strategies  and investment decisions. An IT strategic plan, which might include  the mission of the agency, key business processes, IT challenges,  and guiding principles, is important to enable an agency to consider  the resources, including human, infrastructure, and funding, that are  needed to manage, support, and pay for projects. For example, a  strategic plan that identifies interdependencies within and across  modernization projects helps ensure that these are understood and  managed, so that projects—and thus system solutions—are  effectively integrated. Given that the new data center is to form the  backbone of SSA’s automated operations, it is important that the  agency identify goals, resources, and dependencies in the context of  its strategic vision.  ●  Enterprise architecture. An enterprise architecture consists of  models that describe (in both business and technology terms) how  an entity operates today and how it intends to operate in the future;  it also includes a plan for transitioning to this future state. More  specifically, it describes the enterprise in logical terms (such as  interrelated business processes and business rules, information  needs and flows, and work locations and users) as well as in  technical terms (such as hardware, software, data, communications,  and security attributes and performance standards). It provides  these perspectives both for the enterprise’s current environment  and for its target environment, as well as a transition plan for  moving from one to the other. In short, it is a blueprint for  organizational change. Using an enterprise architecture is important  to help avoid developing operations and systems that are  duplicative, not well integrated, unnecessarily costly to maintain  and interface, and ineffective in supporting mission goals.
Like an IT strategic plan (with which an enterprise architecture  should be closely aligned), an enterprise architecture is an  important tool to help SSA ensure that its data center initiative is  successful. Using an enterprise architecture will help the agency  ensure that the planning and implementation of the initiative take  full account of the business and technology environment in which  the data center and its systems are to operate.   ●  IT investment management. An agency should establish and follow  a portfolio-based approach to investment management in which IT  investments are selected, controlled, and monitored from an  agencywide perspective. In this way, investment decisions are  linked to an organization’s strategic objectives and business plans.  Such an approach helps ensure that agencies allocate their  resources effectively.
In 2008, we evaluated SSA’s investment management approach and  found that it was largely consistent with leading investment  management practices. SSA had established most practices needed  to manage its projects as investments; however it had not applied its  process to all of its investments. For example, SSA had not applied  its investment management process to a major portion of its IT  budget. We recommended that for full accountability, SSA should  manage its full IT development and acquisitions budget through its  investment management board. We also made several  recommendations for improving the evaluation of completed  projects, including the use of quantitative measures of project  success.
Going forward, ensuring that best practices in investment  management are applied to the data center initiative will help the  agency effectively use funds appropriated under the Recovery Act.  For example, projects funded under the act are to avoid  unnecessary delays and cost overruns and are to achieve specific  program outcomes and improved results on broader economic  indicators. Robust investment management controls are important  tools for achieving these goals. For example, developing accurate  cost estimates—an important aspect of investment management— helps an agency evaluate resource requirements and increases the  probability of program success. We have issued a cost estimating  guide that provides best practices that agencies can use for  developing and managing program cost estimates that are  comprehensive, well-documented, accurate, and credible, and that  provide management with a sound basis for establishing a baseline  to formulate budgets and measure program performance. The guide  also covers the use of earned value management (EVM), a technique  for comparing the value of work accomplished in a given period  with the value of the work expected. EVM metrics can alert  program managers to potential problems sooner than tracking  expenditures alone.
Finally, the Recovery Act emphasizes the importance of energy  efficiency and green building projects. Applying rigorous investment  management controls to the planning and implementation of the  data center design will help SSA determine the optimal approach to  aligning its initiative with these goals. Because of the large power  requirements and the heat generated by the equipment housed in  data centers, efficient power and cooling are major concerns,  particularly in light of evolving technology and increasing demand  for information. To optimize their power and cooling requirements,  agencies need to quantify cooling requirements and model these into  data center designs. Such considerations affect the choice of  locations for a new data center, facility requirements, and even floor  space designs. Ways to improve energy efficiencies in data center  facilities could include such cost-effective practices as reducing the  need for artificial light by maximizing the use of natural light and  insulating buildings more efficiently. For example, installing green  (planted) roofs can insulate facilities and at the same time absorb  carbon dioxide.   ●  Information security. For any organization that depends on  information systems and computer networks to carry out its mission  or business, information security is a critical consideration. It is  especially important for government agencies like SSA, where  maintaining the public’s trust is essential. Information security  covers a wide range of controls, including general controls that  apply across information systems (such as access controls and  contingency planning) and business process application-specific  controls to ensure the completeness, accuracy, validity,  confidentiality, and availability of data.
For the data center initiative, security planning and management  will be important from the earliest stages of the project through the  whole life cycle. In today’s environment, in which security threats  are both domestic and international, operational and physical  security is required to sustain the safety and reliability of the data  center’s services on a day-to-day basis. An agency needs to have  well-established security polices and practices in place and provide  periodic assessments to ensure that the information and the facility  are protected. Organizations must design and implement controls to  detect and prevent unauthorized access to computer resources (e.g.,  data, programs, equipment, and facilities), thereby protecting them  from unauthorized disclosure, modification, and loss. Specific  access controls could include means to verify personnel  identification and authorization.
Further, because a data center is the backbone of an organization’s  operations and service delivery, continuity of operations is a key  concern. Data centers need to be designed with the ability to  efficiently provide consistent processing of operations. Even slight  disruptions in power can adversely affect service delivery. Data  centers are vulnerable to a variety of service disruptions, including  accidental file deletions, network failures, systems malfunctions,  and disasters. In the design of a data center, continuity of operations  needs to be addressed at every level—including applications,  systems, and businesses. An agency needs to articulate, in a well  defined plan, how it will process, retrieve, and protect electronically  maintained information in the event of minor interruptions or a full- blown disaster. Disaster recovery plans should address all aspects  of the recovery, including where to move personnel and how to  maintain the business operations. Agency leaders need to prioritize  business recovery procedures and to highlight the potential issues in  such areas as application availability, data retention, speed of  recovery, and network availability.  ____________________________________________________________  In summary, given the projected increase in beneficiaries and the  exceptional volume of medical data processed, these IT  management capabilities will be imperative for SSA to follow as it  pursues the complex data center initiative.
Mr. Chairman, this completes my prepared statement. I would be  pleased to respond to any questions you or other Members of the  Subcommittee may have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you should have any questions about this statement, please  contact me at (202) 512-6304 or by e-mail at melvinv@gao.gov. Other  individuals who made key contributions to this statement are  Barbara Collier, Christie Motley, and Melissa Schermerhorn.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.