Information Technology: OMB and Agencies Need to Fully Implement Major Initiatives to Save Billions of Dollars
Published: 2013-01-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The federal government plans to spend more than $74 billion on IT investments in fiscal year 2013. Given the size of these investments and the criticality of many of them to the health, economy, and security of the nation, it is important that OMB and federal agencies provide appropriate oversight of and adequate transparency into these programs. Nevertheless, IT projects too frequently incur cost overruns and schedule slippages, and result in duplicate systems while contributing little to mission-related outcomes.
GAO was asked to testify on the results and recommendations from its selected reports that focused on key aspects of the federal government's acquisition and management of IT investments. To prepare this statement, GAO drew on previously published work.
section_title: What GAO Found
paragraphs: GAO has issued a number of key reports on the federal government's efforts to efficiently acquire and operate information technology (IT) investments and found that if major initiatives are fully implemented, billions of dollars in savings could be realized. In particular, GAO has made recommendations regarding the Office of Management and Budget's (OMB) public website, known as the IT Dashboard, which provides detailed information on federal agencies' major IT investments; agencies' efforts to perform analyses on existing IT investments; and agencies' progress toward consolidating data centers.
OMB has taken significant steps to enhance the oversight, transparency, and accountability of federal IT investments by creating its IT Dashboard, and by improving the accuracy of investment ratings. However, there were issues with the accuracy and reliability of cost and schedule data in the Dashboard, and GAO has recommended steps that OMB and agencies should take to improve these data--this is important since the Dashboard reports 190 investments totaling almost $12.5 billion being at risk. GAO recently reported that six federal agencies consistently rated the majority of their IT investments as low risk. Further, the Department of Defense's (DOD) ratings reflected considerations in addition to those OMB recommends, and consequently it did not rate any of its investments as high risk. However, GAO has recently reported that several DOD investments experienced significant performance problems and were indeed high risk, and that DOD business systems modernization is a high-risk area. In the past, OMB reported trends for risky IT investments needing management attention as part of its annual budget submission, but discontinued this reporting in fiscal year 2010. GAO recommended OMB analyze agencies' investment risk over time as reflected in the Dashboard's ratings and present its analysis with the President's annual budget submission.
While agencies plan to spend billions on operational investments--more than $54 billion in fiscal year 2013-- they have not always provided adequate oversight of these investments. Specifically, GAO reported in October 2012 that five agencies had operational investments with a fiscal year 2011 budget of over $3 billion that had not undergone operational analyses as required by OMB. The report also noted that until operational investments are fully assessed, there was increased potential for these multibillion dollar investments to result in unnecessary waste and duplication. GAO recommended that the five agencies conduct required analyses.
GAO reported on the federal government's progress toward data center consolidation (which OMB expects will save $3 billion by 2015). In July 2012, GAO found that agencies updated their required inventories and plans, but only 3 of 24 agencies in the review submitted complete inventories and only 1 agency submitted a complete plan, as required by OMB. Until these inventories and plans were complete, agencies would continue to be at risk of not realizing anticipated savings, improved infrastructure utilization, or energy efficiency. Accordingly, GAO reiterated a prior recommendation to update inventories and plans, and also recommended that agencies use best practices when developing estimates.
section_title: What GAO Recommends
paragraphs: GAO has issued numerous recommendations to OMB and agencies on key aspects of IT management, including (1) OMB's public website, known as the IT Dashboard, which provides detailed information on federal agencies' major IT investments, and (2) efforts to oversee IT operations and consolidate data centers.

section_title: Letter
paragraphs: I am pleased to be here today to discuss the highlights and  recommendations of our selected reports that focused on key aspects of  the federal government’s acquisition and management of information  technology (IT) investments. As reported to the Office of Management  and Budget (OMB), federal agencies plan to spend more than $74 billion  on IT investments in fiscal year 2013. Given the size of these investments  and the criticality of many of these systems to the health, economy, and  security of the nation, it is important that OMB and federal agencies  provide appropriate oversight of and adequate transparency into these  programs.
As we have previously reported, federal IT projects too frequently incur  cost overruns and schedule slippages while contributing little to mission- related outcomes. During the past several years, we have issued  multiple reports and testimonies on federal initiatives to acquire and  improve the management of IT investments. We made numerous  recommendations to federal agencies and OMB to further enhance the  management and oversight of IT programs.
As part of its response to our prior work, OMB deployed a public website  in June 2009, known as the IT Dashboard, which provides detailed  information on federal agencies’ major IT investments, including  assessments of actual performance against cost and schedule targets  (referred to as ratings) for approximately 700 major federal IT  investments. In addition, OMB has initiated other significant efforts  following the creation of the Dashboard. For example, it developed a 25- point plan for reforming federal IT (IT Reform Plan), launched an initiative  to reduce the number of federal data centers (the Federal Data Center  Consolidation Initiative (FDCCI)), implemented a cloud computing policy,  and recently initiated its PortfolioStat effort.
You asked us to testify on the results and recommendations from our  selected reports that focused on key aspects of the federal government’s  acquisition and management of IT investments. Accordingly, my  testimony specifically discusses our recent reports on OMB’s IT  Dashboard, IT acquisition best practices, management of IT operations  and maintenance (O&M) investments, cloud computing, the IT Reform  Plan, and data center consolidation. All work on which this testimony is based was performed in accordance with generally accepted government  auditing standards or all sections of GAO’s Quality Assurance Framework  that were relevant to our objectives. Those standards and the framework  require that we plan and perform our audits and engagements to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives; the framework  also requires that we discuss any limitations in our work. We believe that  the information, data, and evidence obtained and the analysis conducted  provide a reasonable basis for our findings and conclusions based on our  objectives.
subsections: section_title: Background
paragraphs: OMB assists the President in overseeing the preparation of the federal  budget submission and supervising budget administration in executive  branch agencies. In helping to formulate the President’s spending plans,  OMB is responsible for evaluating the effectiveness of agency programs,  policies, and procedures; assessing competing funding demands among  agencies; and setting funding priorities. Further, the agency ensures that  the budget submission is consistent with relevant statutes and  presidential objectives.
Each year, OMB and federal agencies work together to determine how  much the government plans to spend on IT projects and how these funds  are to be allocated. As reported to OMB, federal agencies plan to spend  more than $74 billion on IT investments in fiscal year 2013, which is the  total expended for not only acquiring such investments, but also the  funding to operate and maintain them. Of the reported amount, agencies  plan to spend about $20 billion on development and acquisition, and $54  billion on O&M. Figure 1 shows the percentages of total planned  spending for 2013.
However, this $74 billion does not reflect the spending of the entire  federal government. We have previously reported that OMB’s figure  understates the total amount spent in IT investments. Specifically, it does  not include IT investments by 58 independent executive branch agencies,  including the Central Intelligence Agency, or by the legislative or judicial  branches. Further, agencies differed on what they considered an IT  investment; for example, some have considered research and  development systems as IT investments, while others have not. As a  result, not all IT investments are included in the federal government’s  estimate of annual IT spending. OMB provided guidance to agencies on  how to report on their IT investments, but this guidance did not ensure  complete reporting or facilitate the identification of duplicative  investments. Consequently, we recommended, among other things, that  OMB improve its guidance to agencies on identifying and categorizing IT  investments.
To assist agencies in managing their IT investments, Congress enacted  the Clinger-Cohen Act of 1996, which requires OMB to establish  processes to analyze, track, and evaluate the risks and results of major  capital investments in information systems made by federal agencies and  report to Congress on the net program performance benefits achieved as  a result of these investments. Further, the act places responsibility for  managing investments with the heads of agencies and establishes chief  information officers (CIO) to advise and assist agency heads in carrying  out this responsibility.
Many of these investments are critical to our nation. For example, they  include systems to process tax returns, secure our nation, and control  aircraft.
However, the federal government has spent billions of dollars on poorly  performing IT investments, as the following examples illustrate:  In July 2010, OMB directed the National Archives and Records  Administration (NARA) to halt development of its Electronic Records  Archive system at the end of fiscal year 2011 (1 year earlier than  planned). OMB cited concerns about the system’s cost, schedule, and  performance and directed NARA to better define system functionality  and improve strategic planning. Through fiscal year 2010, NARA had  spent about $375 million on the system. We issued several reports  and made recommendations to improve this system. These findings  and recommendations contributed to the decision to halt the system.
In January 2011, the Secretary of Homeland Security ended the  Secure Border Initiative Network program after obligating more than  $1 billion to the program because it did not meet cost-effectiveness  and viability standards. Since 2007, we have identified a range of  issues and made several recommendations to improve this  program. For example, in May 2010 we reported that the final  acceptance of the first two deployments had slipped from November  2009 and March 2010 to September 2010 and November 2010,  respectively, and that the cost-effectiveness of the system had not  been justified. We concluded that the Department of Homeland  Security (DHS) had not demonstrated that the considerable time and  money being invested to acquire and deploy the program was a wise  and prudent use of limited resources. As a result, we recommended  that the department (1) limit near-term investment in the first  incremental block of the program, (2) economically justify any longer- term investment in it, and (3) improve key program management  disciplines. This work contributed to the department’s decision to  cancel the program.
In February 2011, the Office of Personnel Management canceled its  Retirement Systems Modernization program after several years of  trying to improve the implementation of this investment. According to  the Office of Personnel Management, it spent approximately $231  million on this investment. We issued a series of reports on the  agency’s efforts to modernize its retirement system and found that the  Office of Personnel Management was hindered by weaknesses in  several important management disciplines that are essential to  successful IT modernization efforts.recommendations in areas such as project management,  organizational change management, testing, cost estimating, and  earned value management. In May 2008, an Office of Personnel  Management official cited the issues that we identified as justification  for issuing a stop work order to the system contractor, and the agency  subsequently terminated the contract.
In March 2011, we reported that while the Department of Defense’s  (DOD) Navy Next Generation Enterprise Network investment’s first  increment was estimated to cost $50 billion, the program was not well- positioned to meet its cost and schedule estimates. Accordingly, we  recommended DOD limit further investment until it conducts an interim  review to reconsider the selected acquisition approach and addresses  its investment management issues. DOD stated that it did not concur  with the recommendation to reconsider its acquisition approach, but  we maintained that without doing so, DOD could not be sure it was  pursuing the most cost-effective approach.
In December 2012, DOD canceled the Air Force’s Expeditionary  Combat Support System after having spent more than a billion dollars  and missing multiple milestones. We issued several reports on this  system and found that, among other things, the program was not fully  following best practices for developing reliable schedules and cost  estimates.
In addition to these poorly performing investments, the IT Dashboard  identifies other at-risk investments. Specifically, as of August 2012,  according to the IT Dashboard, 190 of the federal government’s  approximately 700 major IT investments—totaling almost $12.5 billion— were in need of management attention (rated “yellow” to indicate the need  for attention or “red” to indicate significant concerns). (See fig. 2.)
As previously mentioned, in June 2009, to further improve the  transparency into and oversight of agencies’ IT investments, OMB  publicly deployed the IT Dashboard. As part of this effort, OMB issued  guidance directing federal agencies to report, via the Dashboard, the  performance of their IT investments. Currently, the Dashboard publicly  displays information on the cost, schedule, and performance of over 700  major federal IT investments at 26 federal agencies. Further, the public  display of these data is intended to allow OMB, other oversight bodies,  and the general public to hold the government agencies accountable for  results and progress.
In December 2010 OMB released its 25-point plan to reform federal IT.  Among other things, the plan noted the goal of turning around or  terminating at least one-third of underperforming projects by June 2012.
To its credit, OMB’s IT Reform Plan provided specific actions to agencies  so they could (1) more effectively manage IT acquisitions and (2) achieve  operational efficiencies. To effectively manage IT acquisitions, the plan  identified key actions such as improving accountability and governance  and aligning acquisition processes with the technology cycle. To achieve  operational efficiencies, the plan outlined actions required to adopt cloud  solutions and leverage shared services. One of these actions was the  consolidation of data centers as described in OMB’s FDCCI, which was  announced in February 2010 and included a high-level goal to reduce the  cost of data center hardware, software, and operations. Another action  that was identified was related to cloud computing. OMB developed a  “Cloud First” policy that required each agency CIO to fully migrate three  services to a cloud solution by June 2012, and implement cloud-based  solutions whenever a secure, reliable, and cost-effective cloud option  exists.
As part of the IT Reform Plan, in 2011 the Federal CIO Council launched  an initial Best Practices platform on http://www.CIO.gov to provide agency  case studies that demonstrate best practices in managing federal IT  systems. According to OMB, agencies have been encouraged to  develop practices that focus on early, frequent, and constructive  communication during the acquisition process so that the government  clearly understands the marketplace and can obtain an effective solution  at a reasonable price.
Further, since June 2010, OMB has required agencies to develop and  carry out an operational analysis (OA) policy for examining the ongoing  performance of existing operational IT investments to measure, among  other things, whether the investment is continuing to meet business and  customer needs and is contributing to meeting the agency’s strategic  goals. OMB’s guidance calls for the policy to provide for an annual OA of  each investment that addresses the following: cost, schedule, customer  satisfaction, strategic and business results, financial goals, and  innovation.
More recently, the Federal CIO initiated the PortfolioStat effort for  commodity IT in March 2012. OMB requires agency Deputy Secretaries  or Chief Operating Officers to lead PortfolioStats—IT portfolio reviews— working in coordination with CIOs, Chief Financial Officers, and Chief  Acquisition Officers. Such an effort, as planned, is appropriate given the  numerous investments performing the same function, as we reported in  February 2012. For example, 27 major federal agencies planned to  spend $2.7 billion on 580 financial management systems in 2011. See  figure 3 for the total number of investments within the 27 federal  agencies, by function.
OMB believes that the PortfolioStat effort has the potential to save the  government $2.5 billion over the next 3 years by, for example,  consolidating duplicative systems.
We previously reported and testified on the issue of duplicative IT  investments at DOD and the Department of Energy. Specifically, we  found 37 potentially duplicative investments, accounting for about $1.2  billion in total IT spending for fiscal years 2007 through 2012. We made  recommendations to those agencies to report on the progress of efforts to  identify and eliminate duplication, where appropriate.
section_title: Opportunities Exist to Improve Acquisitions and Operations of IT Investments
paragraphs: Over the past several years, we have highlighted OMB efforts to enhance  oversight of IT acquisition. Most notably, we issued a series of reports on  the IT Dashboard. In addition, we identified common factors critical to  successful IT investments.
IT Dashboard  OMB has taken significant steps to enhance the oversight, transparency,  and accountability of federal IT investments by creating its IT Dashboard,  and by improving the accuracy of investment ratings. However, there  were issues with the accuracy and reliability of cost and schedule data,  and we recommended steps that OMB should take to improve these data.
Our July 2010 report found that the cost and schedule ratings on  OMB’s Dashboard were not always accurate for the investments we  reviewed, because these ratings did not take into consideration  current performance. As a result, the ratings were based on outdated  information. We recommended that OMB report on its planned  changes to the Dashboard to improve the accuracy of performance  information and provide guidance to agencies to standardize  milestone reporting. OMB agreed with our recommendations and, as  a result, updated the Dashboard’s cost and schedule calculations to  include both ongoing and completed activities. Similarly, in March  2011, OMB had initiated several efforts to increase the Dashboard’s  value as an oversight tool, and had used its data to improve federal IT  management.calculations contributed to inaccuracies in the reported investment  performance data. These included, for instance, missing data  submissions or erroneous data at each of the five agencies we  reviewed, along with instances of inconsistent program baselines and  unreliable source data. As a result, we recommended that the  agencies take steps to improve the accuracy and reliability of their  Dashboard information, and that OMB improve how it rates  investments relative to current performance and schedule variance.  Most agencies generally concurred with our recommendations; OMB  agreed with our recommendation for improving ratings for schedule  variance. It disagreed with our recommendation to improve how it  reflects current performance in cost and schedule ratings, but more  recently made changes to Dashboard calculations to address this  while also noting challenges in comprehensively evaluating cost and  schedule data for these investments.
However, agency practices and the Dashboard’s   noted that that the accuracy of investment  cost and schedule ratings had improved since our July 2010 report  because OMB had refined the Dashboard’s cost and schedule  calculations. Most of the ratings for the eight investments we reviewed  were accurate, although more could be done to inform oversight and  decision making by emphasizing recent performance in the ratings.  We recommended that the General Services Administration comply  with OMB’s guidance for updating its ratings when new information  becomes available (including when investments are rebaselined) and  the agency concurred. Since we previously recommended that OMB  improve how it rates investments, we did not make any further  recommendations.
More recently, in October 2012 we found that opportunities existed to  improve transparency and oversight of investment risk at our selected  agencies. Specifically, CIOs at six federal agencies consistently  rated the majority of their IT investments as low risk. These agencies  rated no more than 12 percent of their investments as high or  moderately high risk, and two agencies (DOD and the National  Science Foundation) rated no investments at these risk levels. Over  time, about 47 percent of the agencies’ Dashboard investments  received the same rating in every rating period. For ratings that  changed, DHS and Office of Personnel Management reported more  investments with reduced risk when initial ratings were compared with  those in March 2012; the other four agencies reported more  investments with increased risk. In the past, OMB reported trends for  risky IT investments needing management attention as part of its  annual budget submission, but discontinued this reporting in fiscal  year 2010. Accordingly, we recommended OMB analyze agencies’  investment risk over time as reflected in the Dashboard’s CIO ratings  and present its analysis with the President’s annual budget  submission, with which OMB concurred.
Further, agencies generally followed OMB’s instructions for assigning  CIO ratings, which included considering stakeholder input, updating  ratings when new data become available, and applying OMB’s six  evaluation factors. DOD’s ratings were unique in reflecting additional  considerations, such as the likelihood of OMB review, and  consequently DOD did not rate any of its investments as high risk.  However, in selected cases, these ratings did not appropriately reflect  significant cost, schedule, and performance issues reported by GAO  and others. Although three DOD investments experienced significant  performance problems and were part of a GAO high-risk area  (business systems modernization), they were all rated low risk or  moderately low risk by the DOD CIO. For example, in early 2012, we  reported that Air Force’s Defense Enterprise Accounting and  Management System (DEAMS) faced a 2-year deployment delay and  an estimated cost increase of about $500 million from an original life- cycle cost estimate of $1.1 billion (an increase of approximately 45  percent), and that assessments by DOD users had identified  operational problems with the system, such as data accuracy issues,  an inability to generate auditable financial reports, and the need for  manual workarounds. In July 2012, the DOD Inspector General  reported that the DEAMS’s schedule delays were likely to diminish the  cost savings it was to provide, and would jeopardize the department’s  goals for attaining an auditable financial statement. DOD’s CIO rated  DEAMS low risk or moderately low risk from July 2009 through March  2012.
Moreover, DOD did not apply its own risk management guidance to  the ratings, which reduces their value for investment management  and oversight. Therefore, we recommended that DOD ensure that its  CIO ratings reflect available investment performance assessments  and its risk management guidance. DOD concurred with our  recommendation.
Critical Factors Underlying Successful Major Acquisitions  To help the federal agencies address the well-documented acquisition  challenges they face, we identified seven successful investment  acquisitions and nine common factors critical to their success in 2011.  Specifically, we reported that department officials identified seven  successful investment acquisitions, in that they best achieved their  respective cost, schedule, scope, and performance goals.common factors critical to the success of three or more of the seven  investments were: (1) program officials were actively engaged with  stakeholders; (2) program staff had the necessary knowledge and skills;  (3) senior department and agency executives supported the programs; (4)  end users and stakeholders were involved in the development of  requirements; (5) end users participated in testing of system functionality  prior to formal end user acceptance testing; (6) government and  contractor staff were stable and consistent; (7) program staff prioritized  requirements; (8) program officials maintained regular communication  with the prime contractor; and (9) programs received sufficient funding.  Further, officials from all seven investments cited active engagement with  program stakeholders as a critical factor to the success of those  investments. These critical factors support OMB’s objective of improving  the management of large-scale IT acquisitions across the federal  government, and wide dissemination of these factors could complement  OMB’s efforts.
The nine  In addition to efficiently acquiring IT investments, it is also important for  the federal government to efficiently manage operational investments,  especially since agencies are planning to spend about $54 billion in fiscal  year 2013 on operational systems. Accordingly, we issued key reports on  the federal government’s oversight of IT investments in O&M, progress  toward meeting OMB data center consolidation goals, and progress  toward cloud computing as specified in the “Cloud First” policy.
Oversight of Investments in O&M  While agencies spend billions on operational investments, they have not  always provided adequate oversight of these investments. Specifically,  assessments of the performance of such investments—commonly  referred to as OAs—varied significantly, as we reported in October  2012.perform such analyses annually to ensure O&M investments continue to  meet agency needs. The guidance also includes 17 key factors  (addressing areas such as cost, schedule, customer satisfaction, and  innovation) that are to be assessed.
The agencies in our review were DHS, DOD, the Departments of Health and Human  Services (HHS), the Treasury, and Veterans Affairs (VA). all investments and that all factors are fully assessed; and OMB revise its  guidance to include directing agencies to report on the IT Dashboard the  results from the OAs. The five agencies and OMB agreed with our  recommendations.
Data Center Consolidation  Agencies have developed plans to consolidate data centers; however,  these plans were incomplete and did not include best practices. We  issued two reports on the federal government’s effort to consolidate data  centers and made several recommendations for improvements.
Our July 2011 report found that agency consolidation plans indicated  that agencies anticipated closing about 650 data centers by fiscal year  2015 and saving about $700 million in doing so. However, only one  of the 24 agencies submitted a complete inventory and no agency  submitted complete plans. Further, OMB did not require agencies to  document the steps they took, if any, to verify the inventory data. We  noted the importance of having assurance as to the accuracy of  collected data and, specifically, the need for agencies to provide OMB  with complete and accurate data and the possible negative impact of  that data being missing or incomplete. We concluded that until these  inventories and plans were completed, agencies would not be able to  implement their consolidation activities and realize expected cost  savings. Moreover, without an understanding of the validity of  agencies’ consolidation data, OMB could not be assured that  agencies were providing a sound baseline for estimating consolidation  savings and measuring progress against those goals. Accordingly, we  made several recommendations to OMB, including that the Federal  CIO require that agencies, when updating their data center  inventories, state what actions have been taken to verify the  inventories and to identify any associated limitations on the data.
In a subsequent report we noted that agencies updated their  inventories and plans, but key elements were still missing.  Specifically, as of September 2011, 24 agencies identified almost  2,900 total centers, established plans to close 1,186 of them by 2015,  and estimated they would realize over $2.4 billion in cost savings in  doing so. OMB noted that the savings would be even greater and  estimated that FDCCI would realize $3 billion in savings by 2015.However, while OMB required agencies to complete missing elements  in their data center inventories and plans by the end of September  2011, only 3 agencies submitted complete inventories, and only 1  agency submitted a complete plan. Further, in their consolidation  plans, 13 agencies did not provide a full master program schedule,  and 21 agencies did not fully report their expected cost savings. Our  report noted that until these inventories and plans were complete,  agencies would continue to be at risk of not realizing anticipated  savings, improved infrastructure utilization, or energy efficiency. We  also reiterated our recommendation that the agencies complete the  missing elements of their inventories and plans.
In addition, while OMB required a master program schedule and a  cost-benefit analysis (a type of cost estimate) as key requirements of  agencies’ consolidation plans, none of the five agencies we reviewed  had a schedule or cost estimate that was fully consistent with the four  selected attributes of a properly sequenced schedule (such as having  identified dependencies) or the four characteristics that form the basis  of a reliable cost estimate (such as being comprehensive and well- documented). OMB had established a standardized cost model to aid  agencies in their consolidation planning efforts, but use of the model  was voluntary. As a result, we recommended that the five selected  agencies should implement recognized best practices when  establishing schedules and cost estimates for their consolidation  efforts and that OMB ensure agencies utilize its standardized cost  model across the consolidation initiative. OMB and three agencies  agreed with our recommendation, and two did not agree or disagree  with it.
Finally, we highlighted consolidation successes, such as the benefits  of focusing on key technologies and the benefits of working with other  agencies and components to identify consolidation opportunities.  However, agencies continued to report a number of the same  challenges that we first described in 2011, while other challenges  were evolving. For example, 15 agencies reported continued issues  with obtaining power usage information, and 9 agencies reported that  their organization continued to struggle with acquiring the funding  required for consolidation. In light of these successes and challenges,  we noted that it was important for OMB to continue to provide  leadership and guidance, such as—as we previously recommended— using the consolidation task force to monitor agencies’ consolidation  efforts. Therefore, we recommended that OMB ensure that all future  revisions to the guidance on data center consolidation inventories and  plans are defined in an OMB memorandum and posted to the FDCCI  public website in a manner consistent with the guidance published in  2010. OMB agreed with our recommendation.
Cloud Computing  Implementing cloud computing has security implications, which federal  agencies began addressing. Further, agencies made progress  implementing OMB’s “Cloud First” policy. We reported on these two  issues and made recommendations.
In May 2010, we reported that cloud computing can both increase and  decrease the security of information systems in federal agencies.  Risks included dependence on the security practices and assurances  of a vendor, dependency on the vendor, and concerns related to  sharing of computing resources. Federal agencies had begun efforts  to address information security issues for cloud computing, but key  guidance was lacking and efforts remained incomplete. Although  individual agencies had identified security measures needed when  using cloud computing, they had not always developed corresponding  guidance. For example, only nine agencies reported having approved  and documented policies and procedures for writing comprehensive  agreements with vendors when using cloud computing. Agencies had  also identified challenges in implementing existing federal information  security guidance and the need to streamline and automate the  process of implementing this guidance. These concerns included  having a process to assess vendor compliance with government  information security requirements and the division of information  security responsibilities between the customer and vendor. Among  other things, we recommended that OMB establish milestones for  completing a strategy for implementing the federal cloud computing  initiative.
Federal agencies made progress in implementing OMB’s “Cloud First”   Consistent with this policy, each policy, as we reported in July 2012.of the seven agencies in our review incorporated cloud computing  requirements into their policies and processes. Further, each of the  seven agencies met the OMB deadlines to identify three cloud  implementations by February 2011 and to implement at least one  service by December 2011. However, two agencies did not plan to  meet OMB’s deadline to implement three services by June 2012, but  planned to do so by calendar year’s end. Each of the seven agencies  also identified opportunities for future cloud implementations, such as  moving storage and help desk services to a cloud environment. While  each of the seven agencies submitted plans to OMB for implementing  the cloud solutions, all but one plan were missing key required  elements. As a result, we recommended that the seven agencies  develop key planning information, such as estimated costs and legacy  IT systems’ retirement plans, for existing and planned services. The  agencies generally agreed with these recommendations.
IT Reform Plan  OMB’s IT Reform Plan acknowledged many of these acquisition and  operation issues by requiring 25 actions to be completed by 2012. For  example, it required agencies to launch a best practices collaboration  platform and shift to a “Cloud First” policy. We reported on the federal  government’s progress toward implementing these actions in April 2012.OMB and key federal agencies had made progress on action items in the  IT Reform Plan, but there were several areas where more remained to be  done. Specifically, we reviewed 10 actions and found that 3 were  complete: design a cadre of specialized IT acquisition professionals.  stand-up contract vehicle for infrastructure,  reform and strengthen investment review boards, and  Additionally, 7 items were partially completed: work with Congress to create budget models for modular  complete plans for data center consolidation,   issue guidance on modular development,   shift to a “Cloud First” policy, work with Congress to consolidate routine IT purchases under agency  CIO,  launch a best practices platform, and  redefine the role of agency CIO and CIO Council.
OMB reported greater progress than we determined. While OMB officials  acknowledged that there is more to do in each of the topic areas, they  considered the key action items to be completed because the IT Reform  Plan has served its purpose as a catalyst for a set of broader initiatives.  They explained that work will continue on all of the initiatives even after  OMB declares that the related action items are completed under the IT  Reform Plan. We disagreed with this approach and noted that in  prematurely declaring the action items to be completed, OMB risked  losing momentum on the progress it has made to date. We recommended  that three agencies complete key IT Reform action items. We also  recommended that OMB accurately characterize the status of the IT  Reform Plan action items in the upcoming progress report in order to  keep momentum going on action items that are not yet completed.
Further, OMB and key agencies planned to continue efforts to address  the seven items that we identified as behind schedule, but lacked time  frames for completing most of them. For example, OMB had planned to  work with congressional committees during the fiscal year 2013 budget  process to assist in exploring legislative proposals to establish flexible  budget models and to consolidate certain routine IT purchases under  agency CIOs. However, OMB had not established time frames for  completing five of the seven IT Reform Plan action items that were behind  schedule. Accordingly, we recommended that OMB ensure that the action  items called for in the IT Reform Plan be completed by the responsible  parties prior to the completion of the IT Reform Plan’s 18-month deadline  of June 2012, or if the June 2012 deadline could not be met, by another  clearly defined deadline; and provide clear time frames for addressing the  shortfalls associated with the action items.
Last, OMB had not established performance measures for evaluating the  results of most of the IT reform initiatives we reviewed. Specifically, OMB  established performance measures for 4 of the 10 action items, including  data center consolidation and cloud computing. However, no performance  measures existed for 6 other action items, including establishing the best  practices collaboration platform and developing a cadre of IT acquisition  professionals. Thus, we recommended that OMB establish outcome- oriented measures for each applicable action item.
In summary, OMB’s and agencies’ recent efforts have resulted in greater  transparency and oversight of federal spending, but continued leadership  and attention is necessary to build on the progress that has been made.
For example, federal agencies need to continue to improve the accuracy  of information on the Dashboard to provide greater transparency and  even more attention to the billions of dollars invested in troubled projects.  Further, the expanded use of the common factors critical to the  successful management of large-scale IT acquisitions should result in the  more effective delivery of mission-critical systems. In addition, the federal  government can more efficiently manage operational systems by ensuring  the $54 billion in O&M is continuing to improve mission performance, in  particular the $3 billion which had not undergone required analyses. The  federal government can also build on the momentum of the $2.4 billion in  estimated savings as a result of data center consolidation efforts. Overall,  implementation of outstanding GAO recommendations can help further  reduce wasteful spending on poorly managed, unnecessary, and  duplicative investments.
Chairman Issa, Ranking Member Cummings, and Members of the  Committee, this concludes my statement. I would be pleased to answer  any questions at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you should have any questions about this testimony, please contact me  at (202) 512-9286 or by e-mail at pownerd@gao.gov. Individuals who  made key contributions to this testimony are Dave Hinchman, Assistant  Director; Gary Mountjoy, Assistant Director; Rebecca Eyler; Kevin Walsh;  and Shawn Ward.
This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  The  published  product  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary if you wish to reproduce this material separately.