Homeland Security: Progress Made to Implement IT Reform, but Additional Chief Information Officer Involvement Needed
Released: 2017-05-18T00:00:00

Letter

Background

Information systems are critical to the health, economy, and security of the nation. To support these systems, the federal government plans to invest more than $89 billion on IT in fiscal year 2017. However, prior IT expenditures too often have produced failed projects—that is, projects with multimillion dollar cost overruns, schedule delays measured in years, and questionable mission-related achievements.

These failed projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT investments. Based on these issues, in 2015, we designated the management of IT acquisitions and operations across the federal government as high risk.

DHS has been challenged in improving the management of its IT projects. We have reported on these challenges since shortly after the department was created in 2002. In particular, we have reported on DHS’s need to improve its executive oversight of IT investments and its use of key program management practices.

In 2003, we also designated the transformation of DHS as high risk because it had to transform 22 agencies—several with major management challenges—into one department. The department subsequently made important progress in implementing its range of missions and in strengthening and integrating its management functions (e.g., acquisition, financial, and IT). However, in 2015 we reported that, among other things, additional work was needed for DHS to continue to improve its IT management. We have made numerous recommendations to help the department address these challenges.

IT Management and Reform Legislation

Over the last three decades, Congress has enacted several laws to assist the federal government in managing IT investments. For example, the Paperwork Reduction Act of 1995 required OMB to develop and oversee policies, principles, standards, and guidelines for federal agency IT functions. It also required individual agencies to establish processes for maximizing the value and managing the risk of major information system initiatives.

The following year, in 1996, Congress enacted the Clinger-Cohen Act to strengthen those requirements by, among other things, mandating the appointment of agency CIOs. Under these two laws, CIO responsibilities for IT management include implementing and enforcing applicable government-wide and agency IT management principles, standards, and guidelines; assuming responsibility and accountability for IT investments; and monitoring the performance of IT programs and advising the agency head on whether to continue, modify, or terminate such programs.

More recently, in December 2014, Congress passed IT reform legislation (commonly referred to as the Federal Information Technology Acquisition Reform Act or FITARA). This law holds promise for improving agencies’ acquisitions of IT and enabling Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings.

FITARA includes provisions related to seven areas of management— referred to as FITARA sections. Five of these sections are applicable to DHS as a covered agency; six are applicable to OMB in its executive branch budget and policy role; and six are applicable to the General Services Administration, both as a covered agency and in its government- wide acquisition role:

Agency CIO authority enhancements. Agency CIOs are required to (1) approve the IT budget requests of their respective agencies, (2) certify that IT investments are adequately implementing OMB’s incremental development guidance, (3) review and approve contracts for IT prior to award, and (4) approve the appointment of other agency employees with the title or functions of component CIO.

Enhanced transparency and improved risk management. OMB and agencies are to make publicly available detailed information on federal IT investments, and agency CIOs are to categorize their investments by risk. In addition, in the case of major investments rated as high risk for 4 consecutive quarters, the law requires that the agency CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk.

Portfolio review. Agencies are to annually review their IT investment portfolios in order to, among other things, increase efficiency and effectiveness, and identify potential waste and duplication.

Federal data center consolidation initiative. Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made.

Expansion of training and use of IT acquisition cadres. Agencies are to update their acquisition human capital plans to address supporting the timely and effective acquisition of IT. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres or developing agreements with other agencies that have such cadres.

Maximizing the benefit of the federal strategic sourcing initiative.

OMB is to issue regulations requiring that federal agencies compare their purchases of services and supplies to what is offered under the federal strategic sourcing initiative.

Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software.

Most of these FITARA sections relate to our high-risk topic on the government-wide management of IT acquisitions and operations. With regard to this topic, for example, we focus on the need for CIO authority enhancements, portfolio reviews, and federal data center consolidation.

OMB’s FITARA Implementation Guidance

In June 2015, OMB released guidance that describes how agencies are to implement FITARA. Among other things, this guidance outlined topic areas related to agency CIOs’ roles and responsibilities—referred to as OMB’s common baseline sections. For example, the CIO is responsible for engaging with program managers, reviewing and approving the IT budget request, and developing the IT workforce. Table 1 identifies OMB’s 17 common baseline sections and associated topics.

OMB also developed an assessment template for agencies to use to assess their current practices against the common baseline sections— referred to as a self-assessment. Based on OMB’s guidance, agencies are expected to use the template to document areas where they are not in conformance with the baseline sections. The guidance also directed the agencies to develop action plans describing the changes they needed to make in order to conform to the baseline sections. The guidance further directed agencies to conduct an annual review and to update the self-assessment, with the first update to be completed by the end of April 2016.

In response to the guidance, in November 2015, DHS submitted to OMB a self-assessment of its conformance with the common baseline. As a result of the assessment, DHS identified 130 action plans that it intended to implement to ensure that the department would meet all baseline responsibilities. According to the assessment, the department originally planned to implement all of the action plans by the end of May 2016. However, the department updated its assessment in April 2016 and revised the number of action plans to 131. It also deferred the implementation of certain action plans and revised the final time frame by which it expected to implement all of the plans to the second quarter of fiscal year 2018. As of April 2016, the department reported to OMB that it had fully implemented 109 of its 131 action plans. Appendix I lists the department’s 131 action plans and the respective OMB common baseline sections with which they are associated.

Oversight of DHS’s IT Investments

DHS acquires IT and other capabilities that are intended to improve its ability to execute its mission to prevent and deter terrorist attacks, and protect against and respond to threats and hazards to the nation. In accordance with OMB guidance, the department classifies its IT investments as major and non-major investments.

DHS’s capital planning guidance states that the department’s major investments are those that are expected to cost $50 million or more over their life cycles, while non-major investments are those expected to cost less than $50 million over their life cycles. According to data that DHS reported to OMB’s IT Dashboard, the department had 92 major IT investments in fiscal year 2016 and planned to spend about $5.1 billion on them during that year.

DHS’s Under Secretary for Management is designated as the department’s Chief Acquisition Officer and, as such, is responsible for managing the implementation of department-wide acquisition policies. To help manage and oversee the department’s investments, DHS’s Office of Program Accountability and Risk Management is responsible for the department’s overall acquisition governance process and is to report directly to the Under Secretary for Management. Specifically, this office has the responsibility to develop and update program management policies and practices, facilitate and assist in the review of major programs, provide guidance for workforce planning activities, provide support to program managers, and collect program performance data.

Further, per the department’s policy, DHS’s CIO, who also reports to the Under Secretary for Management, is responsible for setting departmental IT policies, processes, and standards. This official also is to ensure that IT acquisitions comply with the department’s IT management processes, technical requirements, and approved enterprise architecture, among other things. Within the OCIO, EBMO has been given primary responsibility for administering the CIO’s responsibilities and, as such, for ensuring that the department’s IT investments align with its missions and objectives. EBMO is also responsible for leading the implementation of DHS’s FITARA action plans. Figure 1 shows the key department-level organizations with IT acquisition management responsibilities at DHS.

To help manage the department’s IT acquisitions, DHS implemented a governance process—referred to as the IT Acquisition Review process— which is managed by EBMO. This governance process is intended to ensure IT acquisitions align with DHS’s missions and policies. As part of this process, the CIO is responsible for reviewing, prior to award, contracts and agreements that have planned values of $2.5 million or more, among other criteria. In addition, DHS’s components that have a CIO are to review, for their respective component, contracts and agreements with planned values of less than $2.5 million, among other criteria.

DHS’s Plans Addressed FITARA and Most, but Not All, Selected Plans Have Been Fully Implemented

DHS developed plans, including 131 action plans, that addressed the five sections of FITARA that were applicable to the department. Further, as of December 2016, DHS fully implemented 28 of the 31 action plans we selected for review. However, we identified 3 action plans that the department has not fully implemented because specific actions called for in these plans had not been undertaken. Ensuring that its action plans are fully implemented will better position DHS to effectively manage the department’s IT acquisitions, consistent with FITARA.

DHS Developed Plans that Addressed FITARA

DHS developed 131 action plans that, collectively, addressed three of the five applicable FITARA sections: (1) agency CIO authority enhancements, (2) portfolio reviews, and (3) development and deployment of an IT acquisition cadre. For example, related to the agency CIO authority enhancements section—which requires DHS to, among other things, approve the department’s IT budget requests—the department developed action plans for identifying and reviewing relevant policies that impact the processes, roles, and responsibilities within DHS’s budget phases; documenting and modeling the current processes; identifying gaps and opportunities in those current processes; and documenting and implementing updated policies to ensure the DHS CIO is involved in the department’s IT budgeting decisions and the management of IT programs.

In addition, DHS developed action plans that relate to the portfolio review section of FITARA. This section requires the department to annually review its portfolios of IT investments in order to, among other things, identify potential duplication in similar investments within the portfolios. DHS’s action plans to address this section included, among other things, identifying gaps in the department’s current processes where OMB’s common baseline requirements were not satisfied; updating relevant policies and guidance to collect the necessary information related to executing the IT budget; and ensuring policy updates are approved by relevant parties.

The department also created action plans to address the section of FITARA related to IT acquisition cadres. Specifically, this section requires the department to consider developing and implementing a cross- functional group trained in IT program management and acquisition. For example, DHS created action plans for identifying training opportunities that will enhance staff development at multiple levels, developing a workforce planning process for assessing the department’s current technology skills, identifying existing employee skillsets related to acquisition and IT, and aligning the department’s existing course inventory to acquisition certifications and specializations in IT.

Beyond the 131 FITARA action plans, the department developed a separate plan that addressed the FITARA section that requires DHS to consolidate its data centers. Specifically, DHS developed a strategic plan that describes how it intends to implement OMB’s data center consolidation guidance.

In addition, the department previously developed a plan that is consistent with the remaining section of FITARA that is applicable to DHS— enhanced transparency and improved risk management. This section requires the department to make publicly available detailed information on its federal IT investments, and the CIO to categorize the department’s investments by risk. Related to the requirements in this section, in 2013, DHS issued a plan which stated that IT programs’ risks were to be assessed on a regular basis and that the assessments would serve as the basis for the ratings to be regularly published on OMB’s IT Dashboard. (This plan is discussed in more detail later in the report.)

As a result of the department developing these plans to implement FITARA, it should be better positioned to implement the act. Further, doing so has more effectively positioned the department to take steps to elevate the role of its CIO and improve the oversight of its IT acquisition and management.

DHS Has Taken Steps that Fully Implemented Most, but Not All, of the Selected FITARA Action Plans

Of the 31 selected action plans that we reviewed, 28 of them (about 90 percent) have been fully implemented as of December 2016 (that is, the evidence provided by DHS fulfilled all aspects of the action plan’s description), as the department reported. However, 3 action plans (about 10 percent) have not been fully implemented, even though the department reported them as fully implemented. In these instances, the evidence of the actions taken by the department fulfilled some, but not all, aspects of the action plan’s description. Table 2 provides the implementation status of the 31 selected action plans and the OMB common baseline sections associated with each of these action plans.

For the 28 selected action plans that the department fully implemented, DHS officials had, for example, updated multiple policies related to the department’s planning, programming, and budgeting phases; ensured that the updated policies were approved by relevant parties; and submitted the updated policies to OMB. In addition, the department documented and implemented updated processes for the planning, programming, and budgeting phases to ensure that the CIO has, among other things, visibility into IT resource plans and decisions. Further, the department revised relevant documentation and processes to reflect the CIO’s responsibility to approve components’ requests for reprogramming or transferring IT resources.

However, the remaining 3 selected action plans were not yet fully implemented due to two factors: (1) the steps taken did not address all planned actions and (2) DHS updated its policies with conflicting guidance. Specifically, DHS’s steps to implement action plans 19 and 20 addressed part, but not all, of these plans. Related to action 19—to leverage the updated DHS TechStat process to provide support to failing or troubled programs—OCIO officials were in the process of updating the department’s TechStat policy to comply with FITARA, but had not completed the update. As of December 2016, the officials stated that they could not provide a date for when the policy would be finalized. Until the CIO, who is responsible for establishing departmental IT policies, finalizes the TechStat policy, the department will be limited in its ability to ensure that DHS is meeting FITARA’s IT acquisition reform goals, as well as consistently providing support to failing or troubled programs.

With regard to action 20—to ensure the IT Program/Project Manager Center of Excellence reviews IT performance metrics and strategies— DHS developed IT performance metrics. However, as of December 2016, EBMO officials stated that the Center of Excellence had not begun using these metrics across all programs to identify poorly performing programs.

These officials told us that they expected the Center of Excellence to begin using these metrics across all programs to identify those needing assistance in the second quarter of fiscal year 2017. Use of these metrics by the center will be vital to its ability to proactively identify poorly performing programs and help them to improve their performance.

With regards to action 24, which required that the DHS CIO certify investments’ incremental development activities, the department updated its multiple systems engineering life-cycle policies and guidance documents with conflicting information regarding who was to certify these development activities. While one of the policies was updated to specify that the DHS CIO was the certifier, another policy and a guidance document was updated to specify that the component CIO was the certifier.

Officials from EBMO and the Office of Program Accountability and Risk Management stated that these documents were not written at the same time and, as a result, reflected conflicting policies and guidance that needed further clarification. However, the officials did not state when they intended to make the clarifications and updates to the policies and guidance. Until the Under Secretary for Management, who is responsible for managing the implementation of department-wide acquisition policies, updates DHS’s relevant policies and guidance in a consistent manner to identify that the DHS CIO is to certify investments’ incremental development activities, the department is at risk of excluding the CIO from important investment oversight activities.

DHS Faces Several Challenges in Implementing FITARA

DHS currently faces a number of important challenges in implementing several selected FITARA provisions. These provisions relate to (1) the CIO’s approval of IT contracts and agreements before award, (2) the CIO’s evaluation of each major IT investment according to risk, and (3) the development and deployment of an IT acquisition cadre. While the department has taken steps aimed at addressing these challenges, more work remains. Moreover, until the department takes actions that fully address these challenges, the goal of FITARA to elevate the role of the department CIO may not be fully realized.

CIO Review of Certain Contracts and Agreements Is a Challenge for DHS

FITARA prohibits a covered agency (such as DHS) from entering into a contract or agreement for IT or IT services (associated with major and non-major investments), unless the contract or agreement has been reviewed and approved by the agency CIO. FITARA allows the CIO to delegate these review and approval duties if a contract or agreement is to support a non-major IT investment. In such cases, the delegated official must report directly to the agency CIO. Accordingly, in order to properly distinguish the appropriate approving official, per FITARA, it is necessary for an agency to determine whether each IT contract and agreement is associated with a major or non-major investment.

Alternatively, FITARA states that an agency may use its governance processes to approve any contract or agreement (associated with major investments), if the agency CIO is a full participant in the governance processes. Further, when governance processes are used for review of contracts or agreements associated with non-major IT investments, the CIO or an individual who reports directly to the agency CIO must be a full participant in the governance processes.

While DHS used its governance process (e.g., the CIO’s IT Acquisition Review process, discussed earlier) to approve contracts and interagency agreements associated with major and non-major investments, the DHS CIO did not directly review or approve any of the contracts or interagency agreements that we examined. Furthermore, the CIO or an appropriate delegate was not always a full participant in the department’s use of its governance process to approve the contracts and interagency agreements that we reviewed, as required by FITARA. Specifically,

Of the 48 contracts and 8 interagency agreements in our sample that department officials associated with major investments (i.e., those requiring additional management attention because of, among other things, their significance to the department’s mission or high costs, as defined by OMB), the DHS CIO neither directly reviewed, nor participated in the governance process to review, any of those contracts or agreements, as required by FITARA. Instead, all of the contracts and interagency agreements were reviewed by either the Executive Director or Deputy Executive Director of EBMO, or a component official, which was not in compliance with FITARA.

While an appropriate delegate who reported directly to the department CIO participated in the review of 5 of the 21 selected contracts that DHS officials associated with non-major investments, the department CIO or an appropriate delegate did not participate in the review of the remaining 16 contracts (about 76 percent). In addition, neither the DHS CIO nor an appropriate delegate participated in the review of any of the 5 interagency agreements in our sample that were associated with non-major investments. Instead, these contracts and interagency agreements were reviewed and approved, as part of the governance process, by someone who did not report directly to the DHS CIO, such as a deputy assistant commissioner or a management analyst. Such review and approval was not consistent with FITARA.

Table 3 summarizes the number of selected contracts and interagency agreements that were and were not reviewed by the appropriate official prior to award, as required by FITARA.

Further, the department CIO did not prioritize the reviews of contracts associated with major IT investments, even for those with known performance problems. For example, three of the contracts in our sample were associated with two major DHS IT investments with past or existing performance issues: Customs and Border Protection’s Automated Commercial Environment investment and United States Citizenship and Immigration Services’ Transformation investment. We have previously reported on significant performance problems with these investments. However, the DHS CIO did not directly review and approve the contracts for these troubled investments, as required by FITARA for contracts associated with major investments. Instead, the Customs and Border Protection CIO and the Executive Director of EBMO reviewed the contracts for these investments, respectively.

According to OCIO officials, the reason why the department CIO delegated the approval of contracts and agreements in a way that was inconsistent with FITARA was that DHS had a large volume of contracts, which made it challenging for the department CIO and those who reported to the CIO to review every contract and agreement. Specifically, data provided by DHS showed that, in fiscal year 2016, the department awarded approximately 5,100 contracts for IT or IT services. According to DHS officials, as a work around to this resource constraint, the department CIO delegated the review and approval of contracts and agreements to EBMO or component officials.

OCIO officials recognized that the department needs to make improvements to better meet the intent of FITARA’s contract and agreement approval section and they have begun taking steps to do so. For example, in May 2016, the department updated its department-wide acquisition procedures to require greater participation in the acquisition planning process by the DHS CIO and component CIOs. Specifically, the updated procedures specify that the DHS CIO is required to review and sign the acquisition plans—which are developed early in the procurement planning process and provide top-level plans for the overall acquisition approach—associated with major IT acquisitions that have estimated life-cycle costs of greater than $50 million or service acquisitions with an annual expenditure of $100 million or more. Additionally, the updated procedures specify that the component CIOs are to review and sign the acquisition plans for all acquisitions involving sensitive information. Further, in October 2016, OCIO updated its associated IT Acquisition Review governance process to implement these new procedures.

Nevertheless, while these updates to the department-wide acquisition procedures and governance process represent improvements by allowing the CIO and component CIOs insight into early procurement planning, the CIO’s visibility into contracts is limited because these top-level acquisition plans do not include important details (e.g., the full scope of the work to be performed) that are contained in specific contracts.

Additionally, the department’s governance process requires contracts or agreements that are associated with major investments and that have total estimated procurement values of at least $2.5 million to be submitted to the DHS OCIO for review. However, these processes still do not require contracts and agreements that are associated with major investments and are under this threshold to be submitted for CIO review, which is inconsistent with FITARA.

In response to our concerns, in April 2017, OCIO officials stated that they had begun to analyze how they could best increase the CIO’s and appropriate delegates’ reviews of contracts and agreements, while considering the department’s staffing constraints. The officials also stated that, once this analysis is complete, they plan to update their governance process accordingly; however, they did not know when these actions would be completed. Until the governance process is updated in a way that increases the CIO’s and appropriate delegates’ reviews of contracts and agreements associated with major and non-major investments, the DHS CIO will continue to have limited visibility into the department’s planned IT expenditures. Additionally, the CIO may lack critical data to make investment decisions and may not be able to use the increased authority that FITARA’s contract and agreement approval provision is intended to provide.

Further exacerbating this issue, FITARA does not allow agency CIOs to delegate the review and approval of contracts and agreements associated with major investments, but there were many contracts and interagency agreements in our sample for which DHS officials were unable to map to a major or non-major IT investment; as such, they could not ensure that these contracts and agreements were reviewed by the appropriate officials. Specifically, officials from DHS headquarters, Customs and Border Protection, and the U.S. Coast Guard were unable to map 23 of the 92 contracts (about 25 percent) and 11 of the 24 interagency agreements (about 46 percent) in our sample to a major or non-major IT investment.

The officials cited various reasons for why they could not map these contracts and interagency agreements to a major or non-major IT investment. Specifically,

OCIO officials stated that only contracts and agreements that go through the department’s headquarters-level contract approval process (i.e., defined by DHS as those valued at $2.5 million or over and are associated with major investments) are required to identify the associated investments. These officials stated that, at the headquarters level, the department does not ask about the investments associated with contracts and agreements that do not go through this headquarters-level contract approval process.

While Customs and Border Protection officials were able to identify the IT investments associated with the majority of their contracts and interagency agreements in our sample, these officials stated that certain contracts were not associated with planned IT investments. Rather, according to the officials, these contracts were to address emerging needs (e.g., a need for new laptops) that Customs and Border Protection offices had identified that were not originally planned as part of an investment.

U.S. Coast Guard officials stated that their process for accounting for all IT costs does not include a mapping of every contract or agreement to a major or non-major IT investment. These officials said they were working with DHS headquarters to improve their process for tracking contracts and agreements associated with IT investments, but did not specify a time frame for completing this effort.

Until the Under Secretary for Management updates DHS headquarters’, Customs and Border Protection’s, and U.S. Coast Guard’s processes to track, for all contracts and agreements, the IT investment with which each is associated (as applicable), the department will be challenged in its ability to ensure that the contracts and agreements that are associated with these investments receive the appropriate level of oversight.

DHS’s Recent Change in Its Risk Rating Process Creates a Barrier to Reporting the CIO’s Assessment to OMB’s IT Dashboard

FITARA requires each agency CIO to categorize its major IT investments according to risk, in accordance with guidance issued by the Director of OMB. In this regard, OMB issued guidance in June 2015 that directed agency CIOs to evaluate and categorize (i.e., rate) the risk of each major IT investment. In addition, OMB’s guidance directs agencies to report their CIO risk ratings on OMB’s public website known as the IT Dashboard.

Prior to October 2016, DHS’s OCIO, on behalf of the CIO, was conducting such evaluations on the department’s major IT investments in accordance with OMB’s six criteria. The office was also regularly updating the associated CIO risk ratings on the IT Dashboard, as required by FITARA and OMB.

However, as of October 2016, the CIO was no longer directly responsible for the full evaluations or the associated risk ratings that are publicly reported on the IT Dashboard for approximately one-third of the department’s major IT investments. This was due to DHS’s Under Secretary for Management issuing a new policy in October 2016 that assigned responsibility for collecting the appropriate acquisition program data for evaluating the health of all level one and level two major acquisition programs (both IT and non-IT) that are on the department’s Master Acquisition Oversight List to the Office of Program Accountability and Risk Management. According to EBMO officials, as of December 2016, these level one and level two investments that the Office of Program Accountability and Risk Management was to facilitate the evaluation of included 30 of DHS’s 93 major IT investments. DHS’s policy further states that the department CIO is to report the ratings that are facilitated by the Office of Program Accountability and Risk Management on these 30 IT investments to OMB’s IT Dashboard. The officials also stated that OCIO is to continue to have responsibility for the evaluations of the 63 other IT investments not on that oversight list, and for reporting the associated risk ratings of these investments to the IT Dashboard.

According to the Office of Program Accountability and Risk Management’s evaluation template, 39 factors, each with an associated weight, are to be considered in conducting the evaluations, and each factor is to be assessed by different organizations and officials within the department. These organizations and officials include, among others, the Offices of Program Accountability and Risk Management, the Chief Procurement Officer, the Chief Information Officer, Systems Engineering, and the Chief Financial Officer; as well as the Director of Operational Test and Evaluation, and the Joint Requirements Council. After all of the offices prepare their parts of the assessment, the Office of Program Accountability and Risk Management is to calculate a final evaluation rating based on the 39 factors and their weights.

For its part, the CIO is responsible for assessing the 30 IT investments against 10 of the 39 factors, which accounts for about 18 percent of the total assessment score. Thus, over 80 percent of the evaluation and final assessment score for the investments included in the evaluation facilitated by the Office of Program Accountability and Risk Management does not involve the key IT management executive—the CIO.

Moreover, DHS’s CIO was previously responsible for evaluating and reporting the associated risk ratings of the department’s 30 major IT investments on the Master Acquisition Oversight List against the criteria that OMB’s 2015 guidance stated CIOs may use to evaluate and report the risk of their programs. However, as shown in table 4, under the new process facilitated by the Office of Program Accountability and Risk Management, the CIO is only responsible for assessing these investments against one of OMB’s criteria.

Further, while the Office of Program Accountability and Risk Management is responsible for facilitating the development of the risk ratings that are reported to the IT Dashboard for these 30 IT investments, as of December 2016, according to DHS officials, OCIO was also conducting a separate evaluation on these investments. Specifically, OCIO officials stated that they have continued to conduct their own evaluations in order to meet OCIO’s other investment oversight responsibilities.

As such, the Under Secretary for Management’s October 2016 assignment of responsibility for facilitating the assessment of these investments to the Office of Program Accountability and Risk Management is not only in conflict with FITARA, but also in conflict with guidance the Acting Deputy Under Secretary for Management issued in April 2015 in response to our prior recommendation to the department. Specifically, in March 2015, we reported that there were overlapping responsibilities and duplicative efforts between the Office of Program Accountability and Risk Management and the OCIO in the oversight and management of IT investments on the Master Acquisition Oversight List. We recommended in our 2015 report that DHS develop written guidance to clarify the roles and responsibilities of the Office of Program Accountability and Risk Management and OCIO for conducting oversight of major acquisition programs.

In response to our recommendation, in April 2015, the Acting Deputy Under Secretary for Management issued guidance that clarified that the CIO is responsible for performing the program assessments for the IT investments on the Master Acquisition Oversight List, which then are to be reported on the IT Dashboard. Accordingly, the Under Secretary for Management’s recent change suggests that the issue of overlapping responsibilities and duplicative efforts between the Office of Program Accountability and Risk Management and the OCIO in the oversight and management of certain IT investments that we raised 2 years ago has not yet been adequately addressed within the department.

Thus, rather than elevating the CIO’s role per the goal of FITARA, the recent change in DHS’s evaluation of these IT investments is achieving the opposite effect by reducing the CIO’s role and creating a barrier for this official to appropriately report investment risk ratings to the Dashboard. According to EBMO officials, the department’s goal is to use one evaluation process that covers all major IT investments in order to ensure consistency across all evaluations reported on the Dashboard. However, as of December 2016, DHS officials did not know when the department would begin using only one evaluation process for its major IT investments, or who would be responsible for those reviews under that single process. Until the Under Secretary for Management updates and implements the process that the department uses for assessing the risks of major IT investments to ensure that the ratings reported fully reflect the CIO’s assessment of each major IT investment, Congress’ and the public’s insight into the assessment of each major investment’s risk and performance will be limited.

DHS Faces Challenges in Developing and Strengthening Its IT Acquisition Cadre

FITARA requires agencies to update their acquisition human capital plans to address how the agencies are meeting their human capital requirements. In particular, the act requires agencies to consider, among other things, establishing cross-functional groups trained in IT program management and IT acquisition—referred to as IT acquisition cadres. In July 2011 (prior to the enactment of FITARA), OMB’s Office of Federal Procurement Policy issued guidance that identified key knowledge areas essential for such a cadre, including, among other things, IT strategic planning, acquisition planning, information security requirements, risk management, requirements definition, and contract management. We have also previously issued a human capital guide that stresses the importance of federal agencies ensuring that their employees have the skills needed to perform effectively and achieve agency goals. Our guidance states that, among other things, federal agencies need to determine what skills and competencies are necessary in order to meet current and future challenges, assess any gaps in current skills and competencies, and address those gaps.

Although DHS has taken certain actions toward implementing an IT acquisition cadre and developing an acquisition human capital plan, the department has experienced challenges in fully implementing this FITARA provision. Specifically,

DHS has not defined its IT acquisition cadre. While DHS updated its acquisition human capital plan in April 2016 to address its use of the procedures required by FITARA, the department faces challenges in strengthening its IT acquisition cadre because it has not yet identified the specific positions or personnel that are to be included in the cadre. To its credit, the department identified the number of acquisition personnel that it has in multiple functional areas, such as its project/program managers, contracting officers, and system engineering staff. However, it has not determined how many of those staff are knowledgeable in IT investment management and whether they should be considered a part of the IT acquisition cadre.

The department also reported in its April 2016 acquisition human capital plan that directors and project/program managers within OCIO are required to maintain appropriate certifications to oversee IT acquisitions. However, it has not determined whether this group of workforce professionals has the specialized skills and knowledge needed in all of the areas outlined in OMB’s Office of Federal Procurement Policy’s guidance.

EBMO officials told us that they hope to define the entire IT acquisition cadre through a survey and/or skills assessment during fiscal year 2017; however, specific plans for doing so had not been established. Until the CIO establishes time frames and implements a plan for (1) identifying the specific staff or positions currently within its IT acquisition cadre; and (2) assessing whether these staff and positions address all of the specialized skills needed, as outlined in the Office of Federal Procurement Policy’s cadre guidance, the department risks not having the critical skills needed to effectively acquire IT services. In addition, the department will continue to be challenged in its ability to meet FITARA’s intent of making timely progress toward developing and strengthening its IT acquisition cadre.

DHS lacks clarity on the acquisition skills needed to support its new IT delivery model. DHS’s IT Strategic Plan for fiscal years 2015 through 2018 calls for a paradigm shift in the department’s IT delivery model—from acquiring IT assets to acquiring services, and acting as a service broker (e.g., an intermediary between the purchaser of a service and the seller of that service). According to OCIO officials, this shift will require a significant change in the skillsets of DHS’s employees.

However, the department has faced challenges in implementing this new IT delivery model because it has not identified its future skillset needs or determined the gaps, if any, between its employees’ current skillsets and its future needs. DHS awarded a workforce management contract in July 2016 to, among other things, assist with the implementation of the new IT delivery model at headquarters, including defining future IT skill sets needed and conducting a skills gap analysis. However, while EBMO officials stated in December 2016 that they would conduct these activities by the end of fiscal year 2017, the department did not have a specific plan for when it would identify its future IT skillset needs, or analyze and address the skills gaps resulting from the new delivery model.

Until the CIO establishes time frames and implements a plan for (1) identifying future IT skillset needs to support DHS’s new delivery model, (2) conducting a skills gap analysis, and (3) resolving any skills gaps identified, the department will continue to be challenged in its ability to ensure that it has the skillsets necessary to perform the new responsibilities associated with the shift.

Conclusions

In response to FITARA, DHS has taken several key steps toward improving the department-level CIO’s role in IT acquisitions, including updating the department’s acquisition governance process and associated guidance to require greater participation by the CIO. However, additional actions are needed by the CIO. Specifically, related to the department’s incomplete implementation of its action plan to use the updated DHS TechStat process to provide support to failing or troubled programs, until the CIO finalizes the department’s TechStat policy, DHS will be limited in its ability to help such programs. In addition, the DHS CIO’s lack of review of certain contracts and agreements puts the department at risk of awarding duplicative or unnecessary contracts and agreements. As such, until the CIO updates the department’s IT Acquisition Review governance process to increase the number of contracts and agreements (associated with both major and non-major investments) that are reviewed by the CIO and appropriate delegates, the CIO will continue to have limited visibility into the department’s planned IT expenditures.

Further, the department’s lack of knowledge about the specific staff or positions in its IT acquisition cadre; the skillsets it currently has; and the skills it needs to implement its new IT delivery model, reduces OCIO’s ability to ensure that it has all of the skillsets required. Without the CIO establishing time frames and implementing a plan for (1) identifying the specific staff or positions currently within its IT acquisition cadre; and (2) assessing whether these staff and positions address all of the specialized skills needed, as outlined in the Office of Federal Procurement Policy’s cadre guidance, the department risks not having the critical skills needed to effectively acquire IT services. Moreover, without the CIO establishing time frames and implementing a plan for (1) identifying future IT skillset needs to support DHS’s new delivery model, (2) conducting a skills gap analysis, and (3) resolving any skills gaps identified, the department will continue to be challenged in its ability to ensure that it has the skillsets necessary to perform the new responsibilities associated with the shift.

DHS’s Under Secretary for Management has also taken actions aimed at implementing FITARA by updating the department’s acquisition policies and guidance documents. However, until the Under Secretary for Management makes additional updates to these acquisition policies and guidance documents to be consistent in identifying that the DHS CIO is to certify investments’ incremental development activities (as required by one of the department’s FITARA action plans), the CIO is at risk of not being included in important investment oversight activities.

In addition, the contracts and interagency agreements for which DHS officials could not determine whether they were associated with a major investment is concerning. Until the Under Secretary for Management updates DHS headquarters’, Customs and Border Protection’s, and the U.S. Coast Guard’s processes to track, for all contracts and agreements, the IT investment with which each is associated (as applicable), the Under Secretary has limited assurances that these contracts and agreements will be reviewed by the appropriate officials. Lastly, the Under Secretary for Management’s recent policy change that limited the CIO’s input into risk ratings for certain major IT investments has devalued the CIO’s role. Until the Under Secretary updates and implements the process that the department uses for assessing the risks of major IT investments to ensure that the ratings reported to the IT Dashboard fully reflect the CIO’s assessment of each major IT investment, Congress’ and the public’s insight into the assessment of each major investment’s risk and performance will be limited.

Recommendations for Executive Action

To ensure that DHS effectively implements FITARA, we are making seven recommendations to the Secretary of Homeland Security.

Specifically, we are recommending that the Secretary of Homeland Security direct the Under Secretary for Management to direct the Chief Information Officer to take the following actions: finalize the department’s TechStat policy; update the department’s IT Acquisition Review governance process to increase the number of contracts and agreements (associated with both major and non-major investments) that are reviewed by the CIO and appropriate delegates; establish time frames and implement a plan for (1) identifying the specific staff or positions currently within the department’s IT acquisition cadre; and (2) assessing whether these staff and positions address all of the specialized skills and knowledge needed, as outlined in OMB’s Office of Federal Procurement Policy’s guidance for developing an IT acquisition cadre; and establish time frames and implement a plan for (1) identifying the department’s future IT skillset needs as a result of DHS’s new delivery model, (2) conducting a skills gap analysis, and (3) resolving any skills gaps identified.

Further, we are recommending that the Secretary of Homeland Security direct the Under Secretary for Management to update the department’s acquisition policies and guidance to be consistent in identifying that the DHS CIO is to certify investments’ incremental development activities; update DHS headquarters’, Customs and Border Protection’s, and U.S. Coast Guard’s processes to track, for all contracts and agreements, the IT investment with which each is associated (as applicable); and update and implement the process DHS uses for assessing the risks of major IT investments to ensure that the CIO rating reported to the Dashboard fully reflects the CIO’s assessment of each major IT investment.

Agency Comments and Our Evaluation

DHS provided written comments on a draft of this report, which are reprinted in appendix II. In its comments, the department concurred with all seven of our recommendations and provided estimated completion dates for implementing each of them. For example, the department stated that, by June 30, 2017, its headquarters OCIO intends to develop a department-level plan for identifying the staff included in DHS’s IT acquisition cadre. Further, it said the DHS OCIO plans to require the components to develop associated component-level plans for identifying their IT acquisition cadres.

In response to our recommendation that the Under Secretary for Management update DHS headquarters’ processes to track, for all contracts and agreements, the IT investment with which each is associated (as applicable), the department described recent actions that it had taken to implement this recommendation. Specifically, it stated that OCIO had updated the tool used as part of the IT Acquisition Review governance process to require that the contract number be provided for all acquisitions reviewed by headquarters OCIO. The department further noted that the tool also links each acquisition to the associated funding investment. The department reported that these updates were completed on January 31, 2017. We will follow-up with the department to obtain documentation demonstrating that the tool tracks this information.

In response to oral comments that were also provided by DHS officials on a draft of this report, we clarified one of our recommendations. The department concurred with this clarified recommendation in its written comments.

In addition, we received technical comments from DHS headquarters and component officials, which we have incorporated, as appropriate.

We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, and other interested parties. In addition, this report is available at no charge on the GAO website at http://www.gao.gov.

Should you or your staffs have any questions on information discussed in this report, please contact Carol Harris at (202) 512-4456 or Harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III.

Appendix I: The Department of Homeland Security’s (DHS) Action Plans to Implement Information Technology Acquisition Reform

The table below lists DHS’s 131 Federal Information Technology Acquisition Reform Act (FITARA) action plans and the respective Office of Management and Budget (OMB) common baseline sections with which they are associated. Additionally, the table lists DHS’s planned implementation dates for each of the department’s FITARA action plans, as of April 2016, and identifies the 31 action plans that were included in GAO’s review.

Appendix II: Comments from the Department of Homeland Security

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contacts named above, the following staff also made key contributions to this report: Shannin O’Neill (Assistant Director); Emily Kuhn (Analyst-in-Charge); Mathew Bader; Ronalynn (Lynn) Espedido; Rebecca Eyler; Javier Irizarry; and Corey Rodriguez.