SSA projects that its current data center will not be adequate to support the demands of its growing workload. In fiscal year 2008, SSA's benefit programs provided a combined total of approximately $650 billion to nearly 55 million beneficiaries. According to the agency, the number of beneficiaries is estimated to increase substantially over the next decade. In addition, SSA's systems contain large volumes of medical information, which is used in processing disability claims. About 15 million people are receiving federal disability payments, and SSA has been contending with backlogs in processing disability claims. According to SSA officials, the agency plans to use a large portion of the $1 billion in funding that it was allocated by the Recovery Act primarily to help build a large-scale data center and to develop new software to reduce the backlog of disability claims. The act provides $500 million from the stimulus package for data center expenses, of which $350 million is slated for the building infrastructure and part of the remaining funding for IT-related upgrades. This is not the entire projected cost: SSA has indicated that it needs a total of about $800 million to fund a new IT infrastructure, including the new data center--the physical building, power and cooling infrastructure, IT hardware, and systems applications. The Recovery Act's goals, among other things, include creating or saving more than 3.5 million jobs over the next two years and encouraging renewable energy and energy conservation. According to the Office of Management and Budget (OMB), the act's requirements include unprecedented levels of transparency, oversight, and accountability for various aspects of Recovery Act planning and implementation. These requirements are intended to ensure, among other things, that * funds are awarded and distributed in a prompt, fair, and reasonable * the recipients and uses of all funds are transparent to the public, and the public benefits of these funds are reported clearly, accurately, and in a timely manner; * funds are used for authorized purposes and instances of fraud, waste, error, and abuse are mitigated; * projects funded under the act avoid unnecessary delays and cost * program goals are achieved, including specific program outcomes and improved results on broader economic indicators. An effort as central to SSA's ability to carry out its mission as its planned new data center requires effective IT management. As our research and experience at federal agencies has shown, institutionalizing a set of interrelated IT management capabilities is key to an agency's success in modernizing its IT systems. These capabilities include, but are not limited to * strategic planning to describe an organization's goals, the strategies it will use to achieve desired results, and performance measures; * developing and using an agencywide enterprise architecture, or modernization blueprint, to guide and constrain IT investments; * establishing and following a portfolio-based approach to investment implementing information security management that ensures the integrity and availability of information. The Congress has recognized in legislation the importance of these and other IT management controls, and OMB has issued guidance. We have observed that without these types of capabilities, organizations increase the risk that system modernization projects will (1) experience cost, schedule, and performance shortfalls and (2) lead to systems that are redundant and overlap. They also risk not achieving such aims as increased interoperability and effective information sharing. As a result, technology may not effectively and efficiently support agency mission performance and help realize strategic mission outcomes and goals. All these management capabilities have particular relevance to the data center initiative. * IT strategic planning. A foundation for effective modernization, strategic planning is vital to create an agency's IT vision or roadmap and help align its information resources with its business strategies and investment decisions. An IT strategic plan, which might include the mission of the agency, key business processes, IT challenges, and guiding principles, is important to enable an agency to consider the resources, including human, infrastructure, and funding, that are needed to manage, support, and pay for projects. For example, a strategic plan that identifies interdependencies within and across modernization projects helps ensure that these are understood and managed, so that projects--and thus system solutions--are effectively integrated. Given that the new data center is to form the backbone of SSA's automated operations, it is important that the agency identify goals, resources, and dependencies in the context of its strategic vision. * Enterprise architecture. An enterprise architecture consists of models that describe (in both business and technology terms) how an entity operates today and how it intends to operate in the future; it also includes a plan for transitioning to this future state. More specifically, it describes the enterprise in logical terms (such as interrelated business processes and business rules, information needs and flows, and work locations and users) as well as in technical terms (such as hardware, software, data, communications, and security attributes and performance standards). It provides these perspectives both for the enterprise's current environment and for its target environment, as well as a transition plan for moving from one to the other. In short, it is a blueprint for organizational change. Using an enterprise architecture is important to help avoid developing operations and systems that are duplicative, not well integrated, unnecessarily costly to maintain and interface, and ineffective in supporting mission goals. Like an IT strategic plan (with which an enterprise architecture should be closely aligned), an enterprise architecture is an important tool to help SSA ensure that its data center initiative is successful. Using an enterprise architecture will help the agency ensure that the planning and implementation of the initiative take full account of the business and technology environment in which the data center and its systems are to operate. * IT investment management. An agency should establish and follow a portfolio-based approach to investment management in which IT investments are selected, controlled, and monitored from an agencywide perspective. In this way, investment decisions are linked to an organization's strategic objectives and business plans. Such an approach helps ensure that agencies allocate their resources effectively. In 2008, we evaluated SSA's investment management approach and found that it was largely consistent with leading investment management practices. SSA had established most practices needed to manage its projects as investments; however it had not applied its process to all of its investments. For example, SSA had not applied its investment management process to a major portion of its IT budget. We recommended that for full accountability, SSA should manage its full IT development and acquisitions budget through its investment management board. We also made several recommendations for improving the evaluation of completed projects, including the use of quantitative measures of project success. Going forward, ensuring that best practices in investment management are applied to the data center initiative will help the agency effectively use funds appropriated under the Recovery Act. For example, projects funded under the act are to avoid unnecessary delays and cost overruns and are to achieve specific program outcomes and improved results on broader economic indicators. Robust investment management controls are important tools for achieving these goals. For example, developing accurate cost estimates--an important aspect of investment management-- helps an agency evaluate resource requirements and increases the probability of program success. We have issued a cost estimating guide that provides best practices that agencies can use for developing and managing program cost estimates that are comprehensive, well-documented, accurate, and credible, and that provide management with a sound basis for establishing a baseline to formulate budgets and measure program performance. The guide also covers the use of earned value management (EVM), a technique for comparing the value of work accomplished in a given period with the value of the work expected. EVM metrics can alert program managers to potential problems sooner than tracking expenditures alone. Finally, the Recovery Act emphasizes the importance of energy efficiency and green building projects. Applying rigorous investment management controls to the planning and implementation of the data center design will help SSA determine the optimal approach to aligning its initiative with these goals. Because of the large power requirements and the heat generated by the equipment housed in data centers, efficient power and cooling are major concerns, particularly in light of evolving technology and increasing demand for information. To optimize their power and cooling requirements, agencies need to quantify cooling requirements and model these into data center designs. Such considerations affect the choice of locations for a new data center, facility requirements, and even floor space designs. Ways to improve energy efficiencies in data center facilities could include such cost-effective practices as reducing the need for artificial light by maximizing the use of natural light and insulating buildings more efficiently. For example, installing green (planted) roofs can insulate facilities and at the same time absorb carbon dioxide. * Information security. For any organization that depends on information systems and computer networks to carry out its mission or business, information security is a critical consideration. It is especially important for government agencies like SSA, where maintaining the public's trust is essential. Information security covers a wide range of controls, including general controls that apply across information systems (such as access controls and contingency planning) and business process application-specific controls to ensure the completeness, accuracy, validity, confidentiality, and availability of data. For the data center initiative, security planning and management will be important from the earliest stages of the project through the whole life cycle. In today's environment, in which security threats are both domestic and international, operational and physical security is required to sustain the safety and reliability of the data center's services on a day-to-day basis. An agency needs to have well-established security polices and practices in place and provide periodic assessments to ensure that the information and the facility are protected. Organizations must design and implement controls to detect and prevent unauthorized access to computer resources (e.g., data, programs, equipment, and facilities), thereby protecting them from unauthorized disclosure, modification, and loss. Specific access controls could include means to verify personnel identification and authorization. Further, because a data center is the backbone of an organization's operations and service delivery, continuity of operations is a key concern. Data centers need to be designed with the ability to efficiently provide consistent processing of operations. Even slight disruptions in power can adversely affect service delivery. Data centers are vulnerable to a variety of service disruptions, including accidental file deletions, network failures, systems malfunctions, and disasters. In the design of a data center, continuity of operations needs to be addressed at every level--including applications, systems, and businesses. An agency needs to articulate, in a well defined plan, how it will process, retrieve, and protect electronically maintained information in the event of minor interruptions or a full- blown disaster. Disaster recovery plans should address all aspects of the recovery, including where to move personnel and how to maintain the business operations. Agency leaders need to prioritize business recovery procedures and to highlight the potential issues in such areas as application availability, data retention, speed of recovery, and network availability. ____________________________________________________________ In summary, given the projected increase in beneficiaries and the exceptional volume of medical data processed, these IT management capabilities will be imperative for SSA to follow as it pursues the complex data center initiative. Mr. Chairman, this completes my prepared statement. I would be pleased to respond to any questions you or other Members of the Subcommittee may have. If you should have any questions about this statement, please contact me at (202) 512-6304 or by e-mail at melvinv@gao.gov. Other individuals who made key contributions to this statement are Barbara Collier, Christie Motley, and Melissa Schermerhorn. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
The American Recovery and Reinvestment Act of 2009 (Recovery Act) provides resources to the Social Security Administration (SSA) to help replace its National Computer Center. This data center, which is 30 years old, houses the backbone of the agency's automated operations, which are critical to providing benefits to nearly 55 million people, issuing Social Security cards, and maintaining earnings records. The act makes $500 million available to SSA for the replacement of its National Computer Center and associated information technology (IT) costs. In this testimony, GAO was asked to comment on key IT management capabilities that will be important to the success of SSA's data center initiative. To do so, GAO relied on previously published products, including frameworks that it has developed for analyzing IT management areas. GAO has not performed a detailed examination of SSA's plans for this initiative, so it is not commenting on the agency's progress or making recommendations. For an effort as central to SSA's mission as its planned new data center, effective practices in key IT management areas are essential. For example: (1) Effective strategic planning helps an agency set priorities and decide how best to coordinate activities to achieve its goals. For example, a strategic plan identifying interdependencies among modernization project activities helps ensure that these are understood and managed, so that projects--and thus system solutions--are effectively integrated. Given that the new data center is to form the backbone of SSA's automated operations, it is important that the agency identify goals, resources, and dependencies in the context of its strategic vision. (2) An agency's enterprise architecture describes both its operations and the technology used to carry them out. A blueprint for organizational change, an architecture is defined in models that describe (in business and technology terms) an entity's current operation and planned future operation, as well as a plan for transitioning from one to the other. An enterprise architecture can help optimize SSA's data center initiative by ensuring that its planning and implementation take full account of the business and technology environment. (3) For IT investment management, an agency should follow a portfoliobased approach in which investments are selected, controlled, and monitored from an agencywide perspective. By helping to allocate resources effectively, robust investment management processes can help SSA meet the accountability requirements and align with the goals of the Recovery Act. For example, projects funded under the act are to avoid unnecessary delays and cost overruns and are to achieve specific program outcomes. Investment management is aimed at precisely such goals: for example, accurate cost estimating (an important aspect of investment management) provides a sound basis for establishing a baseline to formulate budgets and measure program performance. Further, the act emphasizes energy efficiency--also a major concern for data centers, which have high power and cooling requirements. Investment management tools are important for evaluating the most cost-effective approaches to energy efficiency. (4) Finally, information security should be considered throughout the planning, development, and implementation of the data center. Security is vital for any organization that depends on information systems and networks to carry out its mission--especially for government agencies like SSA, where maintaining the public's trust is essential. One part of information security management is contingency and continuity of operations planning--vital for a data center that is to be the backbone of SSA's operations and service delivery. Data centers are vulnerable to a variety of service disruptions, including accidental file deletions, network failures, systems malfunctions, and disasters. Accordingly, it is necessary to define plans governing how information will be processed, retrieved, and protected in the event of minor interruptions or a full-blown disaster. These capabilities will be important in helping to ensure that SSA's data center effort is successful and effectively uses Recovery Act funds.