NASA Information Technology: Urgent Action Needed to Address Significant Management and Cybersecurity Weaknesses
Released: 2018-05-22T00:00:00

Letter

Background

NASA’s mission is to drive advances in science, technology, aeronautics, and space exploration to enhance knowledge, education, innovation, economic vitality, and stewardship of Earth. The NASA Administrator is responsible for leading the agency and is accountable for all aspects of its mission, including establishing and articulating its vision and strategic priorities and ensuring successful implementation of supporting policies, programs, and performance assessments.

Within NASA headquarters, the agency has four mission directorates that define its major core mission work: (1) Aeronautics Research conducts cutting-edge research to enable revolutionary advances in future aircraft, as well as in the airspace in which they will fly; (2) Human Exploration and Operations is responsible for NASA space operations, developing new exploration and transportation systems, and performing scientific research; (3) Science carries out the scientific exploration of Earth and space to expand the frontiers of Earth science, planetary science, and astrophysics, and (4) Space Technology develops revolutionary technologies through transparent, collaborative partnerships that expand the boundaries of aerospace. The agency also has a mission support directorate to manage its business needs and administrative functions, such as human capital management.

In addition to NASA headquarters in Washington, D.C., the agency is composed of nine field centers managed by NASA employees, and one federally funded research and development center that are responsible for executing programs and projects. NASA centers are located throughout the country and manage projects or programs for multiple mission directorates. For example, the Goddard Space Flight Center supports various IT programs within the Science mission directorate, while the Johnson Space Center supports multiple programs in the Human Exploration and Operations mission directorate.

According to NASA documents, the agency planned to spend $1.6 billion of its fiscal year 2018 budget authority on IT. Of this total, $888 million was to be used for business IT and $672.8 million was to be used for mission IT. Business IT includes the infrastructure and systems needed to support internal agency operations, such as commodity IT (e.g., e-mail and communications systems), infrastructure, IT management, administrative services, and support systems, whereas mission IT includes the technology needed to support space programs and research for the agency’s mission programs. The technology that the agency uses to support its mission programs includes highly-specialized IT, defined by NASA as any equipment, system, and/or software that is used to acquire, store, retrieve, manipulate, and/or transmit data or information when the IT is embedded in a mission platform or provides a platform required for simulating, executing, or operating a mission.

Historically, NASA and its Inspector General have reported that funding for and oversight of highly-specialized IT has been decentralized among mission directorates and embedded within launch programs and other mission activities instead of being identified as IT to be managed as part of the agency’s IT portfolio. According to the Inspector General, the agency’s decentralized funding for and oversight of IT has minimized agency-wide visibility into and oversight of NASA’s spending on these systems.

NASA’s IT Management and Governance Structure

The agency’s Chief Information Officer (CIO) reports directly to the NASA Administrator and serves as the principal advisor to the NASA Administrator and senior officials on all matters pertaining to IT. The CIO is to provide leadership, planning, policy direction, and oversight for the management of NASA’s information and systems. Toward this end, the CIO’s responsibilities include developing and implementing approaches for executing the goals and outcomes in the NASA strategic plan; ensuring that the agency’s human resources possess the requisite knowledge and skills in IT and information resources management; maximizing the value of NASA IT investments through an investment management process; and leading and implementing the agency’s IT security program. The CIO also is responsible for developing and implementing agency-wide IT policies and processes.

NASA’s CIO also is to direct, manage, and provide policy guidance and oversight of the agency’s center CIOs. Each center has a CIO responsible for supporting center leadership and managing IT staff.

Similarly, each mission directorate has a representative who coordinates with programs on IT-specific issues and, as needed, obtains support from the Office of the CIO. Both center CIOs and mission directorate IT representatives report to the NASA CIO and to the leadership of their respective centers and mission directorates.

The CIO is supported by staff in the Office of the CIO. This office is organized into four divisions responsible for (1) IT security, (2) capital planning and governance, (3) technology and innovation, and (4) enterprise services and integration. Collectively, these divisions support NASA’s approach to IT strategic and workforce planning, governance boards and practices, and cybersecurity.

In March 2017, the Office of the CIO submitted plans to establish a fifth division focused on new applications, and also to rename existing divisions to better represent the services they provide. For example, the Office of the CIO proposed that the Capital Planning and Governance Division be renamed the IT Business Management Division. As of March 2018, NASA had not yet approved or implemented the planned reorganization.

Figure 1 depicts the organization of the Office of the CIO, including relevant reporting relationships for center CIOs and mission directorate IT representatives, as of March 2018.

GAO and NASA’s Office of Inspector General Have Reported on Longstanding Weaknesses in IT Management

We and NASA’s Office of Inspector General have reported on longstanding IT management weaknesses within the agency. For example, in October 2009, we reported that NASA had made progress in implementing IT security controls and aspects of its information security program, but that it had not always implemented appropriate controls to sufficiently protect the confidentiality, integrity, and availability of information and systems. We also identified control vulnerabilities and program shortfalls, which, collectively, increased the risk of unauthorized access to NASA’s sensitive information, as well as inadvertent or deliberate disruption of its system operations and services. We recommended that the NASA Administrator take steps to mitigate control vulnerabilities and fully implement a comprehensive information security program. The agency concurred with our eight recommendations and stated that it was taking actions to mitigate the information security weaknesses identified.

In addition, NASA’s Office of Inspector General has issued 24 reports over the last 7 years on IT governance and security weaknesses at the agency. For example, in June 2013, the office reported that the decentralized nature of NASA’s operations and its longstanding culture of autonomy had hindered the agency’s ability to implement effective IT governance. Specifically, the report stated that the CIO had limited visibility and control over a majority of IT investments, operated in an organizational structure that marginalized the authority of the position, and could not enforce security measures across NASA’s computer networks. Moreover, the IT governance structure in place at the time was overly complex, did not function effectively, and operated under a decentralized model that relegated decision making about critical IT issues to numerous individuals across NASA, leaving such decisions outside the purview of the CIO.

The Office of Inspector General made eight recommendations to the NASA Administrator for improving IT governance, including calling for all governance to be consolidated within the Office of the CIO to ensure adequate visibility, accountability, and integration into all mission-related IT assets and activities. The Administrator concurred with six and partially concurred with two of the recommendations and planned actions sufficient for the Office of Inspector General to close all eight recommendations as implemented. However, the Office of Inspector General later reported that the extent to which NASA had implemented the agreed-upon changes was in doubt based on subsequent audit findings that NASA was still struggling with limited agency CIO authority, decentralized IT operations, and ineffective IT governance.

A follow-on report issued in October 2017 described a continued lack of progress in improving IT governance, determined that the CIO’s visibility into investments across the agency continued to be limited, and identified flaws in the process developed to improve governance. Specifically, the Office of Inspector General noted that the Office of the CIO had made changes to its IT governance boards over the past few years, but the boards had not made strategic decisions to substantively impact how NASA IT would be managed. According to the Office of Inspector General, slow implementation of the revised governance structure had left many IT officials operating under the previous inefficient and ineffective framework.

The report also noted that, as of August 2017, the Office of the CIO had not finalized the roles and responsibilities for IT management and lingering confusion regarding security roles, coupled with poor IT inventory practices, had negatively impacted NASA’s security posture. Importantly, the report explained that the Office of the CIO continued to have limited influence over IT management within the mission directorates and at centers.

The Office of Inspector General made five recommendations to the CIO that were intended to improve, among other things, governance and security. As of October 2017, NASA had concurred with three recommendations, partially concurred with two recommendations, and described corrective actions taken or planned. However, the Office of Inspector General found that NASA’s original proposed action to address the fourth recommendation was insufficient; thus, in December 2017, the agency established additional proposed actions to address that recommendation.

Key IT Management Disciplines

We have identified a set of essential and complementary management disciplines that provide a sound foundation for IT management. These include the following:

Strategic planning: Strategic planning defines what an organization seeks to accomplish and identifies the strategies it will use to achieve desired results. We have previously reported that a defined strategic planning process allows an agency to clearly articulate its strategic direction and establish linkages among planning practices, such as goals, objectives, and strategies and identified leading practices for agency planning.

Workforce planning: We have previously reported that it is important for an agency to have a strong IT workforce to help ensure the timely and effective acquisition of IT. In November 2016, we identified eight key workforce planning activities derived from the Clinger-Cohen Act of 1996 and relevant guidance, including memorandums and guidance from OPM and OMB, and prior GAO reports. These laws and guidance focus on the importance of setting the strategic direction for workforce planning, analyzing the workforce to identify skill gaps, developing strategies to address skill gaps, and monitoring and reporting on progress in addressing skill gaps.

IT governance: IT projects can significantly improve an organization’s performance, but they can also become costly, risky, and unproductive. In 1996, Congress passed the Clinger-Cohen Act, which requires executive branch agencies to establish a process for selecting, managing, and evaluating investments in order to maximize the value and assess and manage the risks of IT acquisitions. Agencies can maximize the value of their investments and minimize the risks of their acquisitions by having an effective and efficient governance process, as described in GAO’s guide to effective IT investment management.

Cybersecurity: Federal systems and networks are often interconnected with other internal and external systems and networks, including the Internet. When systems are interconnected, the number of avenues of attack increases and the attack surface expands. Effective security for agency systems and data is essential to prevent data tampering, disruptions in critical operations, fraud, and inappropriate disclosure of sensitive information, including personal information entrusted to the government by members of the American public. Taking action to assure that an agency’s contractors and partners are adequately protecting the agency’s information and systems is one way an agency can address cybersecurity risks.

NIST has issued a suite of information security standards and guidelines that, collectively, provide comprehensive guidance on managing cybersecurity risk to agencies and any entities performing work on the agencies’ behalf. NIST’s cybersecurity framework was issued in February 2014 in response to Executive Order 13636. The framework outlines a risk-based approach to managing cybersecurity risk and protecting an organization’s critical information assets. Subsequent to the issuance of the cybersecurity framework, a May 2017 executive order required agencies to use the framework to manage cybersecurity risks. The order outlined actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cybersecurity threats to digital and physical security.

NASA Has Not Yet Effectively Established and Implemented Leading IT Management Practices

NASA has not yet effectively established and implemented leading IT management practices for strategic planning, workforce planning, governance, and cybersecurity. Specifically,

The agency’s IT strategic planning process is not yet fully documented and its IT strategic plan lacks key elements called for by leading practices.

NASA has not yet established an IT workforce planning process consistent with leading practices.

The agency has taken recent action to improve its IT governance structure; however, it has not yet fully established that structure, documented improvements to its investment selection process, fully implemented investment oversight leading practices, or fully defined its policies and procedures for IT portfolio management.

NASA has not fully established an effective approach to managing agency-wide cybersecurity risk. While it has designated a risk executive, the agency lacks a dedicated office to provide comprehensive executive oversight of risks. In addition, the agency- wide cybersecurity risk management strategy is currently in development, and the agency’s information security program plan does not address all leading practices and has not been finalized. Further, policies and procedures for protecting NASA’s information systems are in place, but the agency has not ensured that they are always current or integrated.

NASA Has Not Fully Documented Its IT Strategic Planning Process

Leading practices of IT strategic planning established in OMB guidance call for an agency to document its IT strategic planning process, including, at a minimum, documenting the responsibilities and accountability for IT resources across the agency. It also calls for documenting the method by which the agency defines its IT needs and develops strategies, systems, and capabilities to meet those needs.

NASA’s documented IT strategic planning process describes the responsibilities and accountability for IT resources across the agency. For example, NASA has assigned specific governance bodies with responsibility for developing and overseeing the implementation of the IT strategy. Also, in its IT strategic plan, NASA described key stakeholders across the agency that are responsible for the development of the plan. These stakeholders include the Associate CIOs, representatives from mission directorates, mission support organizations, and the centers.

On the other hand, the methods by which the agency defines its IT needs and develops strategies, systems, and capabilities to meet those needs are not documented. For example, according to the IT strategic plan, the Office of the CIO is to perform a gap analysis to inform the development of NASA’s roadmap that translates its IT needs and the strategies identified for meeting those needs into tactical plans. The tactical plans are to define how the strategic plan will be incrementally executed to achieve the longer term goals.

However, the Office of the CIO has not documented in its strategic planning policies and procedures how the CIO will perform the gap analysis or the methods for developing these tactical plans and roadmaps. This is particularly important since, according to officials in NASA’s Office of the CIO, the centers vary as to whether they have developed their own IT strategic plans or tactical plans, and the office does not oversee or review any center-level plans to ensure they align with the NASA IT strategic plan.

According to officials in the Office of the CIO, NASA used a new model in formulating its IT strategy for fiscal years 2018 to 2021, such as including a broader set of stakeholders in the strategic planning cycle before documenting the strategic planning process. The officials stated that they intend to identify lessons learned from using this new model and formally document a complete and repeatable IT strategic planning process in the future. However, the agency has not established time frames for when the Office of the CIO will fully document its strategic planning process. Without a fully documented strategic planning process, NASA risks not being able to clearly articulate what it seeks to accomplish and identify the IT resources needed to achieve desired results in a way that is consistent and complete.

NASA Has Improved Its IT Strategic Plan, but Has Not Yet Established a Comprehensive Plan

In addition to calling for agencies to fully document the strategic planning process, leading practices from OMB guidance and our prior research and experience at federal agencies have shown that an agency should develop a comprehensive and effective IT strategic plan that (1) is aligned with the agency’s overall strategy; (2) identifies the mission of the agency, results-oriented goals, and performance measures that permit the agency to determine whether implementation of the plan is succeeding; (3) includes strategies, with resources and time frames, that the governing IT organization intends to use to achieve desired results; and (4) provides descriptions of interdependencies within and across projects so that they can be understood and managed. The resulting plan is to serve as an agency’s vision, or road map, and help align information resources with business strategies and investment decisions.

NASA has taken steps to improve its IT strategic plan, but the updated plan is not comprehensive in that it does not fully address all four elements of a comprehensive and effective plan outlined above. In this regard, the agency had a prior strategic plan covering the time frame of March 2014 to November 2017. More recently, in December 2017, the CIO and Associate Administrator approved an updated plan for implementation. The updated plan is intended for use from the date it was approved through fiscal year 2021.

Regarding the four elements of a comprehensive IT strategic plan, NASA’s prior plan addressed one element, partially addressed two elements, and did not address one element. The updated plan was slightly improved in that it addressed two elements, partially met one element, and did not meet one element of a comprehensive strategic plan. Table 1 provides a summary of the extent to which NASA’s prior IT strategic plan (covering the time frame of March 2014 to November 2017) and recently updated IT strategic plan (covering the time frame of December 2017 to fiscal year 2021) addressed key elements of a comprehensive strategic plan.

NASA’s prior IT strategic plan was aligned with the agency’s overall strategic plan and identified the mission of the agency and results- oriented goals. However, these goals were not linked to specific performance measures that were needed to track progress and did not always describe strategies to achieve desired results. Additionally, this plan lacked descriptions of interdependencies within and across projects.

NASA’s updated IT strategic plan is aligned with the agency’s overall strategic plan and identifies the mission of the agency and results- oriented goals. For example, the plan describes the agency’s IT vision, mission, principles, and objectives of five strategic goals—excellence, data, cybersecurity, value, and people. To support these goals, the plan defines 14 objectives to be accomplished over 4 years. For example, the plan defines objectives for increasing the effectiveness of NASA’s IT strategy execution through disciplined program and project management.

In addition, NASA has improved upon the prior plan by identifying performance measures that allow the agency to determine whether it is succeeding in the implementation of its goals. For example, in order to increase the effectiveness of its IT strategy execution, the Office of the CIO expects 85 percent of projects to be in conformance with approved project plans by the end of fiscal year 2018. As another example, to prepare its employees to achieve NASA’s IT vision, the Office of the CIO plans to, by the end of fiscal year 2020, identify skills gaps and ways to close the gaps based on the workforce strategy.

However, similar to the prior plan, the updated plan does not fully describe strategies NASA intends to use to achieve the desired results or descriptions of interdependencies within and across projects. Specifically, the plan discusses how the agency intends to achieve its strategic goals and objectives through various activities. For example, according to the plan, to increase the effectiveness of investment analysis and prioritization, NASA intends to implement a financial management process that integrates Office of the CIO, center, and mission directorate IT spending. The plan states that this process will map IT investments to NASA’s vision and strategy, as well as enable high-quality internal and external investment insight and reporting.

However, the updated plan does not further describe the strategies NASA intends to use to accomplish these activities, including a schedule for significant actions and the resources needed to achieve this objective. For instance, the plan states that the Office of the CIO will define clear lines of authority and accountability for IT between the agency and NASA’s centers, but does not describe a strategy, including time frames and resources, for accomplishing this. Additionally, the plan does not describe interdependencies between projects, which is essential to help define the relationships within and across projects and major initiatives.

According to NASA’s CIO, the updated strategic plan was kept at a higher level with the expectation that more detailed implementation plans (e.g., tactical plans and roadmaps) would define the necessary projects and interdependencies. However, NASA has not defined guidance for developing the implementation plans to ensure that any plans developed will fully describe strategies and interdependencies, or time frames for when these plans will be completed. Until NASA incorporates the key elements of a comprehensive IT strategic plan, it will lack critical information needed to align information resources with business strategies and investment decisions.

NASA Has Gaps in Its IT Workforce Planning Efforts

Key to an agency’s success in managing its IT investments is sustaining a workforce with the necessary knowledge, skills, and abilities to execute a range of management functions that support the agency’s mission and goals. Achieving such a workforce depends on having effective human capital management consistent with workforce planning activities pursuant to federal laws and guidance.

Specifically, OMB requires agencies to develop and maintain a current workforce planning process. In addition, we reported in 2016 on the importance of setting a strategic direction for IT workforce planning, identifying skills gaps and implementing strategies to address them, and monitoring and reporting on progress in addressing the identified skills gaps. We identified eight key IT workforce planning activities that are essential to agency efforts to establish an effective IT workforce: 1. establish and maintain a workforce planning process; 2. develop competency and staffing requirements; 3. assess competency and staffing needs regularly; 4. assess gaps in competencies and staffing; 5. develop strategies and plans to address gaps in competencies and 6. implement activities that address gaps (including IT acquisition cadres, cross-functional training of acquisition and program personnel, career paths for program managers, plans to strengthen program management, and use of special hiring authorities); 7. monitor the agency’s progress in addressing competency and staffing 8. report to agency leadership on progress in addressing competency and staffing gaps.

The Office of the CIO has had IT workforce planning efforts underway since 2015 that are intended to address the workforce planning activities listed above; however, the office has not finalized or implemented any of the planned actions. The office recently began working to establish a more comprehensive workforce strategy for fiscal year 2019 to align with the agency’s increased emphasis on improving the overall workforce. Specifically, in the draft NASA Strategic Plan, the agency established a workforce development goal and two strategic objectives that relate to its IT workforce and call for, among other things, workforce training and efforts to increase cybersecurity awareness to reduce cybersecurity risks.

Nevertheless, NASA has gaps in its IT workforce planning efforts. Of the eight key IT workforce planning activities that we previously outlined, NASA partially implemented five and did not implement three. Table 2 shows the extent to which NASA has implemented each IT workforce planning activity and provides examples of workforce practices planned or implemented, as well as those not yet undertaken.

According to NASA’s CIO, the Office of the CIO put IT workforce planning activities on hold in 2015 pending the outcome of more comprehensive, agency-wide efforts. Specifically, the agency began planning and developing a new phased program—the Mission Support Future Architecture Program—designed to deliver workforce and other mission support services, including a talent management program. Phase 1 of the new phased Mission Support Future Architecture Program began in May 2017.

According to the NASA CIO, the Office of the CIO is expected to be part of a future phase and to renew its IT workforce planning as part of that effort. However, the CIO did not have an estimate for when the Office of the CIO would join the program. Until NASA implements all of the key IT workforce planning activities discussed in this report, the agency will have difficulty anticipating and responding to changing staffing needs. Further, NASA will face challenges in controlling human capital risks when developing, implementing, and operating IT systems.

NASA’s IT Governance Approach Does Not Fully Address Leading Practices

Leading practices for governing IT, such as those identified by GAO in its IT investment management framework, call for agencies to establish and follow a systematic and organized approach to investment management to help lay a foundation for successful, predictable, and repeatable decisions. Critical elements of such an approach include instituting an IT investment board (or boards), developing and documenting a governance process for investment selection and for investment oversight, and establishing governance policies and procedures for managing the agency’s overall IT investment portfolio.

NASA Has Not Fully Instituted an Effective Governance Structure

Instituting an effective IT governance structure involves establishing one or more governance boards, clearly defining the boards’ roles and responsibilities, and ensuring that they operate as intended. Moreover, Section 811(a) of the National Aeronautics and Space Administration Transition Authorization Act of 2017 directs the agency to ensure that the NASA CIO, mission directorates, and centers have appropriate roles in governance processes. The act also calls on the Administrator to provide, among other things, an IT program management framework to increase the efficiency and effectiveness of IT investments, including relying on metrics for identifying and reducing potential duplication, waste, and cost.

NASA has established three boards focused specifically on IT governance—an IT Council which is its executive-level IT board, a CIO Leadership Team, and an IT Program Management Board which provides oversight of programs and projects. Meeting minutes for the three IT- specific governance bodies identified above revealed that these groups are meeting as required by their charters.

Further, two of NASA’s agency-wide councils (whose governance responsibilities extend beyond IT) also play a role in IT governance. Specifically, the Mission Support Council is the governance body to which the IT Council escalates unresolved decisions, and the Agency Program Management Council is responsible for reviewing and approving highly- specialized IT. In addition, NASA centers have the option to create center-specific IT governance boards to make decisions about center- level IT investments under the authority of center CIOs.

Table 3 describes the roles of the IT-specific governance boards, the agency-wide councils with roles in IT governance, and the center-level IT governance boards. The table also includes additional details on how frequently the councils and boards meet, the dollar thresholds NASA has established to determine which investments each council or board reviews, and which officials serve as members of the boards.

Although it has established and assigned responsibilities for the aforementioned governance councils and boards, NASA has not yet fully instituted an effective investment board governance structure for several reasons.

Planned improvements to the IT governance structure are not yet complete. NASA has established new governance boards in addition to the boards listed above, but has not yet approved charters to guide their operations. Specifically, the Office of the CIO has revised its governance structure to establish six new boards, one for each of its IT programs. Agency officials, including the IT governance lead, reported that the boards had been established; however, as of December 2017, NASA had not yet approved charters defining the new governance bodies’ membership, functions, and interactions with other governance boards.

Roles and responsibilities of the IT governance boards and agency-wide governance councils are not clearly defined. NASA continues to operate a federated governance model with decentralized roles and responsibilities for governance of mission and business IT investments. Business IT is selected and approved by the IT-specific governance boards, but mission IT follows a different path for investment selection in that it is not reviewed and approved by the CIO along with other IT investments proposed for selection. Instead, the Agency Program Management Council’s reviews focus on the selection of overall mission programs, and not on selecting IT. As a result, mission IT has historically been reported to the Office of the CIO only if the program has been designated as a major agency IT investment to be reported to OMB.

NASA has begun making changes to its decentralized governance approach in response to provisions in legislation commonly referred to as the Federal Information Technology Acquisition Reform Act that are intended to ensure that the CIO has visibility into both mission and business IT investments. However, the agency has not yet developed policies and procedures to clarify how these changes will affect the CIO’s and governance boards’ roles and responsibilities. For example, in January 2017, the IT Council approved an updated definition for highly-specialized IT and established new expectations about the extent to which highly-specialized IT investments would be reviewed by the NASA CIO.

However, NASA has not clarified roles and responsibilities for identifying such investments and ensuring they are reported by mission directorate programs to the CIO. In addition, the agency has not yet outlined procedures for how these investments that are overseen by the agency-wide Agency Program Management Council are to be reported to the CIO or IT-specific governance boards.

During a January 2017 IT Council meeting, the NASA CIO acknowledged that roles and responsibilities for IT governance were unclear and that it would take 1 to 2 years to clarify them. In July 2017, the Deputy CIO recognized that significant work remained for NASA to achieve a consistent agency-wide governance approach with established roles and responsibilities.

While the IT governance boards are meeting regularly, they are not consistently operating as intended. Board charters finalized in 2016 defined the membership for the governance boards and established expectations for the expertise to be made available to support board decisions. However, the boards are not consistently operating with all designated board members in attendance. For example, the Chief Engineer was designated as a member of the IT Council, but the council’s meeting minutes indicated that the Deputy Chief Engineer regularly attends the council meetings instead.

In addition, IT Program Management Board meetings are consistently held with fewer voting members than designated by the board’s charter. The board’s meeting minutes indicated that fewer than six voting members regularly attend board meetings instead of the eight voting members outlined in the board charter. For example, the minutes showed that each meeting has been held with only one center and mission support directorate representative—instead of the two required by the charter.

NASA officials, including the Associate CIO for Capital Planning and Governance, stated that planned efforts to update the governance structure and develop additional guidance for IT investment management have impacted the agency’s time frames for fully establishing its new boards and defining their roles and responsibilities. Specifically, these officials stated that the Office of the CIO is working to develop a comprehensive IT framework intended to update the governance structure, fully establish the new governance boards, and define governance roles and responsibilities. According to the officials, this framework is expected to be finalized in 2018, but the office did not provide a detailed schedule with milestones for completing the framework. Without a detailed schedule for updating the governance structure and establishing a comprehensive IT framework to help ensure that the revised governance boards are fully established and operating as intended, NASA may not be able to improve IT governance in accordance with the requirements in the National Aeronautics and Space Administration Transition Authorization Act of 2017.

NASA Has Not Completed or Updated Governance Selection Process Policies and Procedures and Lacks Established Guidance for Reselecting Investments

According to our IT investment management guide, defining policies and procedures for selecting investments provides investment boards and others with a structured process and a common understanding of how investments will be selected. Selection policies and procedures should, among other things, establish thresholds or criteria (e.g., investment size, technical difficulty, risk, business impact, customer needs, and cost- benefit analysis) for boards to use in identifying, analyzing, prioritizing and selecting new IT proposals.

In addition, outlining a process for reselecting ongoing projects is intended to support board decisions about whether to continue to fund projects not meeting established goals or plans. Using the defined selection process promotes consistency and transparency in IT governance decision making. Further, after the guidance has been developed, organizations must actively maintain it, making sure that it always reflects the board’s current structure and the processes that are being used to manage the selection of the organization’s IT investments.

NASA’s defined selection process policies and procedures designated the CIO with responsibility to ensure that IT governance, investment management, and program/project management processes are integrated to facilitate the selection of appropriate IT investments. The agency has established multiple policies and procedures outlining certain aspects of how both mission programs and business IT investments are to be planned, such as standardized templates for requesting approval to plan investments and direction for teams to use in planning for investments. In addition, the Office of the CIO has established a Capital Planning and Investment Control Guide for business IT investments and issues annual budget guidance for requesting funding for IT investments.

The agency’s selection process also includes specific IT governance processes developed by centers for the investments they review. For example, Goddard Space Flight Center had developed additional center- specific guidance assigning lead responsibility for assessing new and ongoing projects. The center also has established predetermined criteria, such as whether projects conflict, overlap, or are redundant with other projects, and the risk if the investment was not funded.

Nevertheless, NASA’s established process does not yet define thresholds or criteria (e.g., qualitative or quantitative data) to be analyzed and compared when governance boards make decisions to select investments. Charters for NASA’s governance boards outline the functions these boards are to perform and direct them to be involved in IT governance. However, the charters do not outline specific thresholds or procedures that the boards are to follow in selecting investments.

For example, NASA’s process does not fully define how investment risks are to be evaluated. NASA policy establishes dollar thresholds for IT governance board reviews, but does not define any other parameters for how risk will be evaluated. In addition, NASA has established an expectation that the new capital investment review process is to yield risk- based decisions for all investments and help mitigate IT security risks. However, guidance for capital investment reviews does not address how investment risks are to be evaluated.

Moreover, NASA’s selection process policies and procedures have not been updated to reflect efforts to improve governance. Its guidance for selecting investments (and for all aspects of its governance process) is fragmented, and the agency has not updated its policies and procedures to reflect current selection practices. In addition, this guidance does not yet reflect recent efforts to clarify and standardize the definitions of fundamental IT investment terms, such as “information technology” and “major” investments.

Further, while NASA has begun changing its selection process to ensure that the CIO and IT governance boards will be provided data about all IT investments, including mission IT investments such as highly-specialized IT, the agency’s selection policies have not been updated to reflect these changes. NASA’s Capital Planning and Investment Control Guide does not require all investments to be included in the selection process (or other IT governance processes) and the NASA Space Flight Program and Project Management procedures for mission program governance do not address whether or how the investments within mission programs are to be reported to the agency’s IT-specific governance boards.

In addition, NASA has not yet defined a reselection process for IT investments. Current policies and guidance for selecting investments do not clearly define a consistent approach for how performance is to be considered in reselecting investments. Without a defined reselection process, the agency’s boards lack structure and a common understanding about how to make decisions about whether to continue to fund projects not meeting established goals or plans.

NASA officials acknowledged that the current policies and procedures do not establish sufficient content within the business cases and IT plans for proposed investments to support effective governance decision making.

The agency has begun working to update its policy for IT program and project management but did not expect to complete the update until April 2018. Further, even when this key IT investment management policy is updated, the agency will still need to update related policies and procedures to reflect changes it has made but not yet documented in the investment selection process. NASA has not yet established plans for when all needed updates to the policies and procedures will be completed.

Until NASA updates its IT governance policies and procedures to establish thresholds and procedures to guide its boards in decision making and outline a process for reselecting investments, the agency will be limited in its assurance that the investment selection process will provide a consistent and structured method for selecting investments. Further, until all relevant governance policies and procedures are updated to reflect current investment selection practices and proposed changes intended to provide the CIO with data about mission IT, the CIO will not be positioned to minimize investments that present undue risk to the agency and ensure accountability for both business and mission IT.

NASA Lacks Criteria for Assessing Investment Performance and Ensuring Oversight of All Investments

Organizations that provide effective IT investment oversight have documented policies and procedures that, among other things, ensure that data on actual performance (e.g., cost, schedule, benefit, and risk) are provided to the appropriate IT investment board(s). In addition, such organizations establish procedures for escalating or elevating unresolved or significant issues; ensure that appropriate actions are taken to correct or terminate underperforming IT projects based on defined criteria; and regularly track corrective actions until they are completed.

As with investment selection, NASA has established multiple policies and procedures for the oversight of IT investments. In October 2015, the agency added to its oversight processes by establishing a capital investment review process to improve the quality of the information available for investment oversight and established a matrix defining dollar thresholds to delineate oversight among the IT governance boards. The IT Program Management Board is also assigned specific oversight responsibilities for reviewing investment cost, schedule, performance, and risk at key lifecycle decision points for investments submitted for its review. In addition, the IT Program Management Board’s charter requires this board to track, among other things, board decisions about investments and action items.

In implementing NASA’s oversight practices, the IT Program Management Board consistently reviewed updates on investment performance (i.e., cost, schedule, and benefits) and progress. In addition, the IT Program Management Board’s oversight decisions about IT investments are documented in meeting minutes, and the board also records any action items identified for investments in the decision memorandums it submits to the CIO.

Nevertheless, we identified limitations in NASA’s established oversight policies and procedures. For example, the agency’s policies and procedures require IT investments to report data to the governance boards at key decision points but do not establish specific thresholds or other criteria for the governance boards to use in overseeing the investments’ performance or escalating investments to review by other boards. The oversight guidance also does not specify the conditions under which a project would be terminated.

In addition, weaknesses we identified in oversight of specific NASA IT investments highlighted additional limitations of the established oversight process.

Specifically, NASA did not have a mechanism for alerting the IT Program Management Board to provide oversight if investments were underperforming or overdue for review. For example, significant schedule overruns did not trigger additional oversight for one investment. In March 2015, NASA approved the proposed design for an investment to implement a security tool in June 2015 at an expected cost of $1.3 million. Although the project fell 13 months behind schedule and encountered unforeseen challenges, the IT Program Management Board did not review the investment again until June 2017—2 years later.

Not all IT investments followed the established oversight process. For example, in our review of governance board meeting minutes and documentation, we identified an investment that was close to completion before the IT Program Management Board reviewed its proposed design. Specifically, in February 2016, the board was asked—1 day before the investment was to become operational—to (1) approve the proposed design and (2) grant authority to operate for the investment intended for use by NASA staff and external partners. Although concerns about limited oversight were noted, the investment was approved.

Further, NASA lacks procedures to ensure that action items identified are tracked. We identified instances in which the IT Program Management Board did not consistently track action items identified for IT investments. NASA’s investments typically report back to the IT Program Management Board at future decision point reviews about steps taken to address documented action items. However, the board’s meeting minutes and documentation identified multiple examples of investments that were returned to the board at future decision points without reporting on whether identified action items had been addressed.

Moreover, NASA’s oversight processes do not encompass highly- specialized or other IT that supports mission programs. After reviewing NASA’s fiscal year 2015 budget request, OMB directed NASA to identify unreported IT investments throughout the agency to ensure that all related spending would be documented. NASA established a team in 2016 to explore how to identify such investments so that they could be reported to the CIO. The team initiated efforts to identify such investments in mission directorates and evaluated various mechanisms that NASA could employ to detect unreported IT. However, the agency has not yet finalized decisions about how to implement the team’s recommendations, including those for fully identifying investments for all mission directorates or determining which mechanisms to employ to identify unreported IT. According to NASA officials, time frames for completing these activities have not yet been established.

In July 2017, NASA officials, including the Deputy CIO, acknowledged in governance board meeting minutes describing needed improvements, that the agency had not yet fully identified its IT footprint and needed to establish a comprehensive investment management process to address federal requirements, including those governing processes for selecting, reselecting, and overseeing IT investments. NASA officials explained that important progress had been made in improving oversight practices, but that efforts to implement more thorough capital investment reviews and identify IT investments across the agency had not yet been completed. The officials reported that they anticipated additional improvement to be made by the next annual budget cycle.

However, expanding NASA’s oversight of IT will require continued coordination with the mission directorates to work through any needed changes to the longstanding differences in NASA’s management of mission and business IT. The scope and complexity of such efforts are likely to be significant and may take time to plan and implement. Clearly defining how IT across the agency is to be identified and reported to the CIO would likely involve changes to policies and processes within and across NASA’s IT, engineering, and mission program areas and would involve expertise and collaboration from those same groups. Until such practices are fully established, NASA will continue to operate with limitations in its oversight process and projects that fall short of performance expectations. In addition, the agency will face increased risk that its oversight will fail to (1) prevent duplicative investments, (2) identify opportunities to improve efficiency and effectiveness, and (3) ensure that investment progress and performance meet expectations.

NASA Has Not Yet Fully Defined Policies and Procedures for Managing Investments as a Portfolio

The IT investment management framework developed by GAO notes that, as investment management processes mature, agencies move from project specific processes to managing investments as a portfolio. The shift from investment management to IT portfolio management enables agencies to evaluate potential investments by how well they support the agency’s missions, strategies, and goals. According to the framework, the investment board enhances the IT investment management process by developing a complete investment portfolio. As part of the process to develop a complete portfolio, an agency is to establish and implement policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio.

NASA has not yet fully defined its policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio. In its Annual Capital Investment Review Implementation Plan, dated October 2015, NASA began documenting policies for IT portfolio management and procedures for creating and evaluating the portfolio. For example, the procedures state that NASA is to update its IT portfolio annually in conjunction with the agency’s planning and budgeting process. Additionally, in its IT Capital Planning and Investment Control Process guide, dated October 2006, NASA outlined procedures the agency can use to analyze the portfolio by establishing factors that should be taken into consideration, including the relative benefits, costs, and risks of the investment compared to all other proposals and the strength of the investment’s linkage to NASA’s strategic business plan.

However, these documents do not constitute a comprehensive IT portfolio management process in that they do not specifically define the procedures for creating and modifying the IT portfolio selection criteria; analyzing, selecting, and maintaining the investment portfolio; or reviewing, evaluating, and improving the performance of its portfolio. Further, the policies and procedures have not been updated to reflect current NASA practices. Specifically, the current policies and procedures have not been updated to reflect changes the agency made to its capital investment review process that are relevant to portfolio management.

According to NASA officials, the reason that the agency has not fully defined its policies and procedures is because they are intended to be part of a new IT portfolio management framework that also requires NASA to make changes to its investment management process. Specifically, the IT portfolio management plan that NASA drafted in January 2017 called for the agency to develop new IT investment criteria, discover currently unreported IT investments, develop an investment review process, and implement an IT investment dashboard and reporting tool, and a communications plan.

Although the IT Council has not yet approved the IT portfolio management plan, NASA has begun work to address elements of the draft plan, including building the requirements for an IT dashboard and reporting tool for implementation in 2018. In addition, according to Office of the CIO officials, the capital planning team is continuing to work with stakeholders to develop a comprehensive IT framework and investment review process. However, no firm dates have been established for the approval and implementation of the final plan or the framework. Until NASA fully defines its policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio, the agency will lack assurance it is identifying and selecting the appropriate mix of IT projects that best meet its mission needs.

NASA Has Not Fully Established an Effective Approach for Managing Cybersecurity Risk

We have previously reported that securing federal government computerized information systems and electronic data is vital to the nation’s security, prosperity, and well-being. Yet, the security over these systems is inconsistent and agencies have faced challenges in establishing cybersecurity approaches. Accordingly, we have recommended that federal agencies address control deficiencies and fully implement organization-wide information security programs.

NIST’s cybersecurity framework is intended to support federal agencies as they develop, implement, and continuously improve their cybersecurity risk management programs. In this regard, the framework identifies cybersecurity activities for achieving specific outcomes over the lifecycle of an organization’s management of cybersecurity risk. According to NIST, the first stage of the cybersecurity risk management lifecycle— which the framework refers to as “identify”—is focused on foundational activities for effective risk management that provide agencies with the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities. NIST also provides specific guidance for implementing foundational activities and achieving desired outcomes that calls for, among other things, the following:

A risk executive in the form of an individual or group that provides agency-wide oversight of risk activities and facilitates collaboration among stakeholders and consistent application of the risk management strategy.

A cybersecurity risk management strategy that articulates how an agency intends to assess, respond to, and monitor risk associated with the operation and use of the information systems it relies on to carry out the mission.

An information security program plan that describes the security controls that are in place or planned for addressing an agency’s risks and facilitating compliance with applicable federal laws, executive orders, directives, policies, or regulations.

Risk-based policies and procedures that act as the primary mechanisms through which current security requirements are communicated to help reduce the agency’s risk of unauthorized access or disruption of services.

However, NASA has not yet fully implemented these foundational activities of effective cybersecurity risk management.

Efforts to Establish Executive Oversight of Cybersecurity Are Underway

According to NIST guidance, federal agencies should establish a risk executive in the form of an individual or group that provides organization- wide oversight of risk activities and facilitates collaboration among stakeholders and consistent application of the risk management strategy. This functional role helps to ensure that risk management is institutionalized into the day-to-day operations of organizations as a priority and integral part of carrying out missions.

NASA has developed a policy regarding the establishment of a risk executive function in accordance with NIST guidance, but it has not fully implemented the policy. Specifically, the agency’s policy designates the Senior Agency Information Security Officer (SAISO) as the risk executive. According to the policy, the SAISO is charged with ensuring that cybersecurity is considered and managed consistently across the systems that support the agency and its partnerships—academic, commercial, international, and others that leverage NASA resources and extend scientific results. The policy also calls for the SAISO to establish an office with the mission and resources for information security operations, security governance, and cyber-threat analysis.

In accordance with its policy, NASA has designated an Acting SAISO. Since April 2017, the Acting SAISO has led the IT Security Division within the Office of the CIO—an office that coordinates information security operations, security governance, security architecture and engineering, and cyber-threat analysis.

However, the agency has not yet established a risk executive office with assigned leadership positions and defined roles and responsibilities. According to NASA documentation, the agency had planned for the office to become operational by mid-December 2016. Agency officials, including the Acting Deputy Associate CIO for Information Security, explained that an IT security program office was not established in 2016 because the planned time frame for doing so was not realistic and failed to take into account other risk management efforts competing for available resources. For example, the officials stated that the agency was focused on a priority goal of deploying a centralized tool across its centers that would provide monitoring of implemented security controls to ensure they are functioning adequately.

According to the NASA CIO, the agency planned to establish a comprehensive risk executive function by employing a cybersecurity risk manager in April 2018 and forming a program office—called the Enterprise Security Office—by September 2018. NASA’s new cybersecurity risk manager began work on April 2, 2018. The agency’s plan to have the new cybersecurity risk manager establish a comprehensive risk executive function should help ensure that current risk management efforts and decisions are appropriate and consistently carried out across the agency and its external partnerships.

NASA Has Not Yet Established an Agency-Wide Cybersecurity Risk Management Strategy

NIST guidance states that federal agencies should establish and implement an organizational strategy for managing cybersecurity risk that guides and informs how the agency assesses, responds to, and monitors risk to the information systems being relied on to carry out its mission. The strategy should, among other things, make explicit an agency’s risk tolerance, accepted risk assessment methodologies, a process for consistently evaluating risk across the organization, risk response strategies, approaches for monitoring risk over time, and priorities for investing in risk management.

In 2015, NASA recognized the need to establish and implement an agency-wide strategy for managing its cybersecurity risks to address weaknesses it had identified with the decentralized approach it was using. Specifically, because the agency’s centers had independently developed approaches for managing cybersecurity risk, there was little integration regarding risk management and practices across the agency. Further, NASA determined that the decentralized, center-level approach did not provide sufficient transparency regarding risks that could affect mission directorate programs.

To overcome the limitations of its decentralized approach, NASA planned to develop and begin implementing a comprehensive cybersecurity strategy by the end of September 2016 that was expected to include the key elements identified in NIST guidance. For example, it was expected to define the agency’s risk tolerance, establish a methodology for identifying and assessing risks, and provide a clear understanding of NASA’s risk posture.

However, the strategy was not completed as planned and is currently in development. According to officials in the Office of the CIO, including the Acting Deputy Associate CIO for Information Security, the strategy was not completed as planned due to the complexity and scope of the effort. For example, the officials stated that establishing an effective agency- wide strategy required insight into center-specific practices and significant input from stakeholders at all levels of NASA. In addition, these officials and the NASA CIO explained that the agency’s efforts were redirected in order to respond to a new executive order from the President to develop an action plan for adopting NIST’s cybersecurity framework in phases.

According to NASA’s CIO, the agency plans to move forward with drafting an agency-wide cybersecurity strategy that reflects the agency’s approach to using NIST’s framework; however, the agency has not yet established time frames for completing this effort. Until NASA establishes and implements a comprehensive strategy for managing its cybersecurity risks using NIST’s framework, its ability to make operational decisions that adequately address security risks and prioritize IT security investments will be hindered.

NASA’s Information Security Program Plan Does Not Fully Address Relevant Leading Practices and Is Not Finalized

NIST recommends that federal agencies develop and disseminate an information security program plan that describes the organization-wide security controls that are in place or planned for addressing the agency’s risks and complying with applicable federal laws, executive orders, directives, policies, or regulations. Specifically, the plan should provide a description of the agency’s program management controls and common controls in place or planned for meeting relevant federal, legal, or regulatory requirements; include the identification and assignment of roles, responsibilities, and coordination among organizational entities responsible for different aspects of information security; define the frequency for reviews of the security program plan; and receive approval from a senior official with responsibility and accountability for the risk being incurred.

NASA issued a draft information security program plan in November 2017 that addresses many of the components called for in NIST guidance. For example, the plan discusses program management controls that will be established, including the development of an inventory of its information systems, measures to determine information security performance, and an information security workforce development and improvement program; common controls that are to be implemented agency-wide, including configuration management, contingency planning, and personnel security; roles and responsibilities for promoting collaboration and providing consolidated unclassified security operations, and incident response and IT security awareness and training capabilities; and responsibility for ensuring that the information security program plan is maintained, approved by the NASA CIO, and reviewed annually.

However, the plan is currently in draft and incomplete. For example, it does not yet describe the majority of the security functions and services that are to be carried out by the agency’s IT Security Division to address the relevant federal statutory and regulatory requirements. Specifically, the plan does not identify the agency-wide privacy controls derived from standards promulgated pursuant to federal law and guidance that, according to the agency, are an integral part of its security program.

According to NASA’s Acting Deputy Associate CIO for Information Security, the information security program plan has not been finalized because of an upcoming revision to NIST’s guidance for implementing security controls. Specifically, a fifth revision of NIST SP 800-53 is planned for release in December 2018. NASA’s Acting Deputy Associate CIO for Information Security stated that the agency intends to finalize its draft plan after incorporating the updated NIST guidance.

In the absence of an established information security program plan, NASA’s view of the security controls that protect its systems will remain decentralized, and it will lack assurance that it has established oversight over security controls for all of its systems. In addition, the agency will continue to operate its systems without defined and established information security requirements that are essential to agency-wide operations.

NASA’s Security Policies and Procedures Are Not Always Current or Integrated

NIST Special Publication 800-53 recommends that agencies create policies and procedures to facilitate the appropriate application of security controls. If properly implemented, these policies and procedures may be able to effectively reduce the risk that could come from cybersecurity threats such as unauthorized access or disruption of services. Because risk-based policies and procedures are the primary mechanisms through which federal agencies communicate views and requirements for protecting their computing environments, it is important that they are established and kept current.

NASA has taken steps to document policies and procedures that address the security controls identified in NIST guidance for protecting information systems. For example, the agency established an overarching security policy that identified roles and responsibilities related to configuration management, contingency planning, and incident response. In addition, the agency issued procedures for implementing each of the NIST controls.

However, NASA does not have current and fully integrated policies and procedures. For example, the agency’s overarching policy for implementing security controls expired in May 2017. In addition, approximately one-third of the documents that guide the implementation of these controls remained in effect past their expiration dates instead of being updated before they had expired per NASA policy requirements.

Further, in July 2017, NASA determined that cybersecurity roles and responsibilities were not always clear and sufficiently integrated across policies. For example, responsibilities were not consistently well-defined in the policies for governance, IT security, program and project management, and systems engineering. In addition, although NASA’s Policy Directive 2810.1E, NASA Information Security Policy provided the SAISO with responsibility for the agency’s cybersecurity risk, the policy assigned mission directorates control over risk decisions for their missions and programs and the centers were given the authority to implement any technical changes needed to address risk.

NASA’s Procedural Requirement 2810.1A, Security of Information Technology states that the agency’s SAISO is responsible for ensuring that information security policies and procedures are reviewed and appropriately updated. However, according to officials in the Office of the CIO, including the specialist for IT security, responsibilities for establishing, reviewing, and updating policies and procedures are being shared by two groups: the IT Security Division, led by the SAISO, and the Capital Planning and Governance Division. Specifically, the IT Security Division controls the content of IT-related policies and procedures but does not have control over the established NASA-wide process for reviewing the policies and procedures to determine if any changes are needed to the content. Instead, the Capital Planning and Governance Division is responsible for ensuring formal review and approval of any IT- related policies and procedures through the standard agency process and schedule.

Officials from the Office of the CIO, including the specialist for IT security, also stated that they intend to (1) establish a policy management framework that would provide the SAISO with more control over policies and procedures and include an annual document review, and (2) clarify and update cybersecurity roles and responsibilities in NASA policies. However, the agency has not yet developed a plan and specific time frame for completing these activities.

In addition, the Acting Deputy Associate CIO for Information Security stated that, having expired policies and procedures is not significant because they will remain in use until they are rescinded or superseded by updated versions. However, until NASA fully updates its policies and procedures to govern security over the agency’s computing environments, it will have limited assurance that controls over information are appropriately applied to its systems.

Conclusions

NASA continues to pursue efforts to improve IT strategic planning, workforce planning, IT governance, and cybersecurity, but consistently lacks the documented processes needed to ensure that policies and leading practices are fully addressed. Specifically, the agency has taken steps to improve the content of its strategic plan and established an agency-wide goal for improving its workforce. In addition, after analyzing its IT management and governance structure, NASA took action to streamline its governance boards and standardize and strengthen its selection and oversight of investments, including initiating a portfolio management process. NASA has also moved toward new strategies and plans to bolster cybersecurity.

Nevertheless, while NASA has made progress, the agency has not yet fully addressed many of the leading IT management practices noted in this report or completed efforts to increase the CIO’s authority over, and visibility into, agency-wide IT. Among other things, NASA has not fully documented a process for IT strategic planning or addressed all key elements of a comprehensive plan. In addition, it has not yet fully implemented a workforce planning process and has gaps in efforts to address leading practices. Regarding IT governance, its efforts to institute an effective governance structure and update policies and procedures for selecting IT investments are not yet complete. Moreover, NASA has not yet addressed weaknesses in its oversight practices or fully defined policies and procedures for developing an effective portfolio management process.

Similarly, although NASA continues cybersecurity improvement efforts, important elements of an effective cybersecurity approach have not been completed, including establishing a risk management strategy, an information security program plan, and updated policies and procedures. Until NASA leadership fully addresses these leading practices, its ability to overcome its longstanding weaknesses and ensure effective oversight and management of IT across the agency will remain limited. Moreover, NASA may be limited in its ability to strengthen its risk posture, including ensuring effective cybersecurity across partnerships with commercial entities, federal agencies, and other countries.

Recommendations for Executive Action

We are making 10 recommendations to the National Aeronautics and Space Administration:

The Administrator should direct the Chief Information Officer to develop a fully documented IT strategic planning process, including methods by which the agency defines its IT needs and develops strategies, systems, and capabilities to meet those needs. (Recommendation 1)

The Administrator should direct the Chief Information Officer to update the IT strategic plan for 2018 to 2021 and develop associated implementation plans to ensure it fully describes strategies the agency will use to achieve the desired results and descriptions of interdependencies within and across programs. (Recommendation 2)

The Administrator should direct the Chief Information Officer to address, in conjunction with the Chief Human Capital Officer, gaps in IT workforce planning by fully implementing the eight key IT workforce planning activities noted in this report. (Recommendation 3)

The Administrator should direct the Chief Information Officer to institute an effective IT governance structure by completing planned improvement efforts and finalizing charters to fully establish IT governance boards, clearly defining roles and responsibilities for selecting and overseeing IT investments, and ensuring that the governance boards operate as intended. (Recommendation 4)

The Administrator should direct the Chief Information Officer to update policies and procedures for selecting investments to provide a structured process, including thresholds and criteria needed for, among other things, evaluating investment risks as part of governance board decision making, and outline a process for reselecting investments. (Recommendation 5)

The Administrator should direct the Chief Information Officer to address weaknesses in oversight practices and ensure routine oversight of all investments by taking action to document criteria for escalating investments among governance boards and establish procedures for tracking corrective actions for underperforming investments. (Recommendation 6)

The Administrator should ensure that the Chief Information Officer fully defines policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio. (Recommendation 7)

The Administrator should direct the Chief Information Officer to establish an agency-wide approach to managing cybersecurity risk that includes a cybersecurity strategy that, among other things, makes explicit the agency’s risk tolerance, accepted risk assessment methodologies, a process for consistently evaluating risk across the organization, response strategies and approaches for monitoring risk over time, and priorities for risk management investments; (Recommendation 8) an information security program plan that fully reflects the agency’s IT security functions and services and agency-wide privacy controls for protecting information; (Recommendation 9) and policies and procedures with well-defined roles and responsibilities that are integrated and reflect NASA’s current security practices and operating environment. (Recommendation 10)

Agency Comments and Our Evaluation

We provided a draft of this product to NASA for comment. In its comments, which are reproduced in appendix II, NASA concurred with seven of the recommendations, partially concurred with two recommendations, and did not concur with one recommendation.

NASA partially concurred with our first and second recommendations. Specifically, consistent with the first recommendation, NASA agreed to fully document its strategic planning process, including the methods by which the agency defines IT needs and develops outcomes, strategies, major actions, and performance measures to meet those needs.

In addition, our second recommendation called for NASA to update the strategic plan and develop associated implementation plans. With regard to updating the plan, NASA stated that its strategic plan provides the context and parameters to support achievement of the agency's vision and mission through the strategic use of IT. The agency also stated that this plan describes the business outcomes, strategies, major actions, and performance measures to achieve the desired results.

With regard to the implementation plans related to our first and second recommendation, NASA agreed to develop the associated implementation plans for accomplishing the IT strategic plan, including descriptions of the interdependencies within and across programs. Nevertheless, in commenting on both recommendations, as well as the first recommendation, NASA stated that it does not believe that implementation plans, including specific IT capability and system changes, should be part of a strategic plan. The agency also maintained that the implementation plans, including descriptions of interdependencies within and across programs, are at a lower level than the IT strategic plan, since detailed IT implementation plans are more dynamic than the four-year NASA IT Strategic Plan.

However, our first and second recommendations do not call for NASA to incorporate implementation plans within the strategic plan. Rather, as discussed in the report, it is important that NASA document how it intends to accomplish the activities outlined in the strategic plan. Further, we continue to believe that NASA should address the weaknesses we identified in this report by updating the strategic plan to incorporate strategies on resources and time frames to achieve desired results and descriptions of interdependencies within and across projects so that they can be understood and managed. Thus, we stand by both recommendations (recommendations 1 and 2) that the agency take these actions.

NASA did not concur with our third recommendation to implement the IT workforce planning activities noted in our report. In this regard, the agency stated that its workforce improvement efforts were already underway. Specifically, NASA stated that IT workforce planning is part of the agencywide Mission Support Future Architecture Program. It added that, among other things, this program is intended to ensure that mission support resources, including the IT workforce, are optimally structured to support NASA’s mission. In addition, NASA referenced our two additional ongoing audits of the agency’s IT workforce, and noted that its activities related to IT workforce planning would be centered on any recommendations resulting from those audits.

In our view, neither of these circumstances should hinder NASA from addressing our recommendation in this report. As of March 2018, the agency’s IT workforce plans were out-of-date and incomplete because activities the agency had been planning since 2015 had not been finalized in an approved plan or implemented. Further, NASA had not yet determined when the Office of the CIO would become an active part of the agencywide Mission Support Future Architecture program or developed plans for when that program’s assessment of the IT workforce would be completed.

Thus, instead of limiting NASA’s ability to address our recommendation, implementing the workforce planning activities discussed in this report could complement the agency’s ongoing and future efforts. Specifically, NASA could use the IT workforce leading practices described in this report to strengthen any new workforce plans and assess the implementation of any planned improvements. Until NASA documents an IT workforce planning process and implements all of the key IT workforce planning activities, the agency may not be effectively positioned to anticipate and respond to changing staffing needs. Further, the agency is likely to face challenges in controlling human capital risks when developing, implementing, and operating IT systems.

NASA concurred with our four recommendations aimed at addressing deficiencies in its IT governance (recommendations 4 through 7). In this regard, the agency described planned actions intended to address each of these recommendations. For example, among other activities, the agency stated that it intended to publish charters for all IT governance boards; have the IT Council review governance board operations annually; document criteria for escalating investments among governance boards; and update policies and procedures for managing its investments as a portfolio.

Similarly, NASA concurred with our three recommendations related to establishing an agency-wide approach to managing cybersecurity risk (recommendations 8, 9, and 10). The agency described actions it had taken or planned to address each of these recommendations. In particular, with regard to establishing a cybersecurity risk management strategy (recommendation 8), NASA asserted that it had already taken actions that met the requirements of our recommendation. Specifically, NASA stated that it had established an approach to developing its cybersecurity risk management strategy by approving a charter for an agency-wide team to address cybersecurity risk management needs and hiring a Chief Cybersecurity Risk Officer to oversee agency-wide risk management initiatives.

While these actions constitute steps toward addressing the recommendation, we disagree that establishing a charter for a team and hiring a Chief Cybersecurity Risk Officer fully addresses the recommendation. As previously noted in this report, the agency does not have a cybersecurity risk management strategy that includes elements of NIST guidance. The strategy should, among other things, make explicit the agency’s risk tolerance, accepted risk assessment methodologies, a process for consistently evaluating risk across the organization, risk response strategies, approaches for monitoring risk over time, and priorities for investing in risk management. Ensuring that the established agency-wide team and the Chief Cybersecurity Risk Officer develop a cybersecurity risk management strategy that aligns with the NIST guidance will be essential to fully address our recommendation.

NASA also provided technical comments on the draft report, which we incorporated, as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Administrator of the National Aeronautics and Space Administration, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

Should you or your staffs have any questions on information discussed in this report, please contact Carol Harris at (202) 512-4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: Objective, Scope, and Methodology

The National Aeronautics and Space Administration Transition Authorization Act of 2017 included a provision for us to review the effectiveness of the agency’s approach to overseeing and managing information technology (IT), including its ability to ensure that resources are aligned with agency missions, cost effective, and secure. Our specific objective for this review was to address the extent to which the National Aeronautics and Space Administration (NASA) has established and implemented leading IT management practices in strategic planning, workforce planning, governance, and cybersecurity.

To address this objective, we compared NASA’s IT management policies, procedures, and other documentation to criteria established by federal laws and leading practices. This documentation included the agency’s strategic plans, workforce gap assessments, governance board meeting minutes and briefings, charters, policies and procedures, and other documentation of the Chief Information Officer’s (CIO) authority. We also reviewed relevant reports by GAO and the NASA Office of Inspector General.

With regard to IT strategic planning, we identified the strategic plans and related planning guidance issued by NASA and the Office of the CIO, including NASA’s Governance and Strategic Management Handbook, dated November 26, 2014; NASA’s Information Resources Management Strategic Plan, dated March 2014; and NASA’s updated Information Technology Strategic Plan for fiscal years 2018 to 2021. We then reviewed the agency’s overall strategic plan, and evaluated its previous and current IT strategic plans against key practices for IT strategic planning that we have previously identified. These practices call for documenting the agency’s IT strategic planning processes and developing an IT strategic plan that aligns with the agency’s overall strategy; identifies the mission of the agency, results-oriented goals, and performance measures that permit the agency to determine whether implementation of the plan is succeeding; includes strategies the governing IT organization will use to achieve desired results; and provides descriptions of interdependencies within and across projects so that they can be understood and managed.

To determine the extent to which NASA has established and implemented leading IT workforce planning practices, we conducted a comparative analysis of NASA’s IT workforce planning policies and documents. Specifically, we compared agency documents, such as NASA policy directives, the desk guide, and documentation of efforts to establish IT workforce competencies and staffing requirements and conduct gap assessments, to GAO’s IT workforce framework. GAO’s framework consists of four IT workforce planning steps and eight key activities. The eight key activities were identified in federal law, regulations, and guidance, including the Clinger-Cohen Act of 1996, the legislation referred to as the Federal Information Technology Acquisition Reform Act, Office of Management and Budget (OMB) guidance, the Office of Personnel Management’s Human Capital Framework, and GAO reports.

Based on our assessment of the documentation and discussions with agency officials, we assessed the extent to which the agency implemented, partially implemented, or did not implement the activities. We considered an activity to be fully implemented if NASA addressed all of the underlying practices for the activity; partially implemented if it addressed some but not all of the underlying practices for the activity; and not implemented if it did not address any of the underlying practices for the activity.

We assessed IT governance practices by comparing NASA documentation to critical processes identified by GAO in the IT investment management framework. To align our work with the provision in Section 811(a) of the National Aeronautics and Space Administration Transition Authorization Act of 2017 calling for NASA to take actions regarding IT governance, we selected critical processes from Stage 2 of the framework: instituting the investment board; selecting and reselecting investments that meet business needs; and providing investment oversight.

For each critical process, we compared key practices outlined in the framework to NASA documentation. The documentation we reviewed included NASA’s IT governance policies and procedures, and charters and other guidance. We also reviewed governance board meeting minutes and briefings from each board’s first meeting in 2016 through meetings held in August 2017.

In addition, we selected key practices for effective governance from Stage 3 of the IT investment management framework regarding establishing and implementing policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio. We then compared documentation, including NASA’s IT Capital Planning and Investment Control Process guide dated October 2006, and Annual Capital Investment Review Implementation Plan dated October 2015, and draft IT portfolio management plans, against these practices.

Using standards and guidance from the National Institute of Standards and Technology (NIST), which identify foundational elements of effective cybersecurity risk management, we evaluated NASA’s cybersecurity risk management approach by analyzing policies and plans for establishing a comprehensive risk evaluating documents and plans for establishing a cybersecurity risk comparing a draft Information Security Program Plan to determine if it was consistent with NIST guidance; and analyzing policies and procedures to determine if they address relevant NIST security controls and are current.

In addition to assessing NASA headquarters, we reviewed IT management practices at two of the agency’s nine centers (Marshall Space Flight Center in Huntsville, Alabama; and Johnson Space Center in Houston, Texas) and at one of NASA’s four mission directorates (the Human Exploration and Operations Mission Directorate). The two centers and one mission directorate were selected because they had the largest fiscal year 2017 IT budgets, respectively, as reported on the federal IT dashboard. We also visited the Goddard Space Flight Center in Greenbelt, Maryland, because of the center’s proximity to GAO. The results of our work at the selected NASA centers and mission directorate are not generalizable to other NASA centers and mission directorates.

To assess the reliability of these data, we compared them to budgetary data obtained directly from NASA’s Office of the CIO. We found the data to be sufficiently reliable for the purpose of identifying the NASA centers and mission directorate with the largest IT budgets. We also interviewed cognizant officials with responsibilities for IT management at NASA headquarters and for the selected centers and mission directorate.

We conducted this performance audit from May 2017 to May 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

Appendix II: Comments from the National Aeronautics and Space Administration

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact name above, the following staff also made key contributions to this report: Eric Winter (Assistant Director), Donald Baca, Rebecca Eyler, Amanda Gill (Analyst in Charge), Tom Johnson, Kate Nielsen, Teresa Smith, and Niti Tandon.