For over 20 years, Congress has enacted various laws, and federal agencies have issued guidance, that call for agencies to perform workforce planning activities to help ensure the timely and effective acquisition of IT. These laws and guidance focus on the importance of (1) setting the strategic direction for workforce planning, (2) analyzing the workforce to identify skill gaps, (3) developing strategies to address skill gaps, and (4) monitoring and reporting on progress in addressing skill gaps. For example: The Clinger-Cohen Act of 1996 requires agency chief information officers (CIO) to annually (1) assess the requirements established for agency personnel regarding knowledge and skills in information resource management and the adequacy of such requirements for facilitating the achievement of performance goals; (2) assess the extent to which the positions and personnel at executive and management levels meet those requirements; (3) develop strategies and specific plans for hiring, training, and professional development to address any deficiencies; and (4) report to the head of the agency on the progress made in improving information resources management capability. The E-Government Act of 2002 requires the Director of OPM, in consultation with the Director of OMB, the CIO Council, and the Administrator of General Services to (1) analyze, on an ongoing basis, the personnel needs of the federal government related to IT and information resource management; and (2) identify where current IT and information resource management training do not satisfy personnel needs. In addition, the law requires the Director of OMB to ensure that agency heads collect and maintain standardized information on their IT and information resources management workforce. In 2010, OMB issued its 25-point plan for IT reform and outlined several action plans to build workforce capabilities, including capabilities for acquisition and program management. For example, the plan directed OPM to create a specialized career path for IT program managers. In addition, OMB stated that it would work with OPM to provide agencies with direct hiring authority for program managers. OMB also tasked agencies with identifying program management competency gaps and reporting to OMB on those gaps. Subsequent to the 25-point plan, in July 2011, OMB released guidance for agencies to develop specialized IT acquisition cadres. Among other things, this guidance required agencies to analyze current acquisition staffing challenges; determine if developing or expanding the use of cadres would improve program results; and outline a plan to pilot or expand cadres for an especially high-risk area, if the agency determined that such an effort would improve performance. Further, in November 2011, OPM issued guidance for developing career paths for IT program managers. OPM’s career path guide was to build upon its IT Program Management Competency Model released in July 2011 by serving as a roadmap for individuals interested in pursuing a career in this area. In addition, the roadmap was to provide employees and their supervisors with a single-source reference to determine appropriate training opportunities for career advancement. In December 2014, Congress enacted legislation commonly referred to as FITARA. Among other things, the law aims to ensure timely progress by federal agencies toward developing, strengthening, and deploying IT acquisition cadres consisting of personnel with highly specialized skills in IT acquisition, including program and project managers. Almost all of the 24 CFO Act agencies (other than the Department of Defense (Defense)) are required to update their annual acquisition human capital plans to address how they are meeting their human capital requirements to support timely and effective acquisitions. To assist agencies in implementing the provisions of FITARA and to build upon agency responsibilities under the Clinger-Cohen Act of 1996, OMB issued guidance to agencies in June 2015. In doing so, OMB directed agencies (other than Defense) to, among other things, (1) develop a set of competency requirements for staff, including leadership positions; and (2) develop and maintain a current workforce planning processes to ensure that agencies can anticipate and respond to changing mission requirements, maintain workforce skills in a rapidly developing environment, and recruit and retain the talent needed to accomplish their missions. Each agency is to conduct an annual self-assessment of its conformity with these requirements and develop an implementation plan describing the changes it will make. The Federal Cybersecurity Workforce Assessment Act of 2015 required OPM, with support from the National Institute of Standards and Technology, to establish a coding structure to be used in identifying all federal civilian and noncivilian positions that require the performance of IT, cybersecurity, or other cyber-related functions. The act also required agencies, in consultation with OPM, the National Institute of Standards and Technology, and the Department of Homeland Security (DHS), to then utilize this coding structure to annually assess, among other things, the IT, cybersecurity, and other cyber-related work roles of critical need in their workforce. In April 2016, OPM issued an update to agency chief human capital officers stating that it had recently revalidated the need to continue working to close skill gaps in certain government-wide high-risk mission critical occupations, including those in the cybersecurity and the science, technology, engineering and mathematics functional area. OMB released its Federal Cybersecurity Workforce Strategy in July 2016. Among other things, the strategy cited the need for agencies to examine specific IT, cybersecurity, and cyber-related work roles, and identify personnel skills gaps, rather than merely examining the number of vacancies by job series. The strategy identified several actions that agencies could take to identify workforce needs, expand the cybersecurity workforce through education and training, recruit and hire highly skilled talent, and retain and develop highly skilled talent. In July 2016, OMB issued updated policy for the planning, budgeting, governance, acquisition, and management of federal information, personnel, equipment, funds, IT resources, and supporting infrastructure and services. Among other things, OMB’s updated policy requires an agency’s chief human capital officer, CIO, chief acquisition officer, and senior agency official for privacy to develop a set of competency requirements for staff and develop and maintain a current workforce planning process. Further, in September 2016, OPM updated its guidance regarding the annual submission of agencies’ mission critical occupation resource charts. These charts are to identify current staffing levels, staffing targets, projected attrition, actual attrition, and retirement eligibility in government-wide and selected agency-specific mission critical occupations. While these laws and guidance focus on IT workforce planning, other broader initiatives have also been undertaken to improve federal human capital management. For example, we and OPM have developed human capital management models that call for implementing workforce planning practices that can facilitate the analysis of gaps between current skills and future needs. In addition, the models call for the development of strategies for filling the gaps, as well as planning for succession. Further, our Standards for Internal Control in the Federal Government stress that management should consider how best to retain valuable employees, plan for their eventual succession, and ensure continuity of needed skills and abilities. Based on the aforementioned laws, guidance, and initiatives, in November 2016, GAO issued an evaluation framework to support the assessment of whether selected federal agencies are adequately assessing and addressing gaps in IT knowledge and skills. The framework identifies four workforce planning steps and supporting activities that address (1) setting the strategic direction for IT workforce planning, (2) analyzing the IT workforce to identify competency and staffing gaps, (3) developing and implementing strategies to address the gaps, and (4) monitoring and reporting progress in addressing the gaps. We have previously reported that effectively addressing mission critical skill gaps in IT requires a multifaceted response from OPM and agencies. Specifically, our high-risk update in February 2013 noted that OPM and agencies would need to use a strategic approach that (1) involves top management, employees, and other stakeholders; (2) identifies the critical skills and competencies that will be needed to achieve current and future programmatic results; (3) develops strategies that are tailored to address skill gaps; (4) builds the internal capability needed to address administrative, training, and other requirements important to support workforce planning strategies; and (5) includes plans to monitor and evaluate progress toward closing skill gaps and meeting other human capital goals using a variety of appropriate metrics. In January 2015, we reported that the Chief Human Capital Officers Council had identified skill gaps in six government-wide occupations including IT/cybersecurity and contract specialist/acquisition. We noted, however, that the effort had shortcomings, and that it would be important for the council to use lessons learned from these initial efforts to inform subsequent ones to identify skill gaps. We also reported that key features of OPM’s efforts to predict emerging skill gaps beyond those already identified were in the early planning stages, and OPM and selected agencies could improve the manner in which they address skill gaps by strengthening their use of quarterly data-driven reviews. Further, we reported that individual agencies across the federal government have not always effectively planned for IT workforce challenges. For example, In May 2014, we concluded that the Social Security Administration’s (SSA) IT human capital program had identified skills and competencies to support certain workforce needs, but lacked adequate planning for the future. The agency had developed IT human capital planning documents, such as an Information Resources Management plan, and skills inventory gap reports that identified near-term needs, such as skill sets for the following 2 years. Nevertheless, SSA had not adequately planned for longer-term needs because its human capital planning and analysis were not aligned with long-term goals and objectives and the agency did not have a current succession plan for its IT efforts. Accordingly, we recommended that SSA identify long-term IT needs in its updated human capital operating plan. The agency agreed with, and subsequently implemented the recommendation. In August 2016, we determined that the Department of Veterans Affairs (VA) had performed key steps, such as documenting an IT human capital strategic plan and regularly analyzing workforce data. However, the agency had not tracked and reviewed historical and projected leadership retirements and had not identified gaps in future skill areas. We recommended that the agency track and review historical workforce data and projections related to leadership retirements, and identify IT skills needed beyond the current fiscal year, to assist in identifying future skills gaps. The agency concurred with our recommendations and has partially implemented them by identifying the IT skills it needed beyond the current fiscal year. In November 2016, as a part of the review in which we developed the IT workforce planning framework discussed previously, we assessed five agencies—the Departments of Commerce (Commerce), Defense, Transportation (Transportation), the Treasury (Treasury), and Health and Human Services (HHS)—against the eight key workforce planning activities. While all five agencies had demonstrated important progress in either partially or fully implementing key workforce planning activities, each had shortfalls. For example, only one agency (Defense) had implemented a workforce planning process, none had identified IT competency gaps for their entire workforce, and three (Defense, Transportation, and Treasury) were performing some level of monitoring toward the closure of identified skill gaps. We reported that, until the agencies fully implemented key workforce planning activities, they would have a limited ability to assess and address gaps in knowledge and skills that are critical to the success of major IT acquisitions. As a result, we recommended that the agencies implement the eight IT workforce planning activities to facilitate the analysis of gaps between current skills and future needs, the development of strategies for filling the gaps, and succession planning. Defense partially agreed with our recommendations and the other four agencies agreed with our recommendations. An updated assessment of actions to implement our recommendations is described in our evaluation of agencies’ implementation of key IT workforce planning activities in appendix II. In May 2018, as part of a review of the National Aeronautics and Space Administration’s (NASA) approach to overseeing and managing IT, we found that the agency had partially implemented five of the eight key IT workforce planning activities and had not implemented three. For example, NASA had not assessed competency and staffing needs regularly or reported progress to agency leadership. We reported that, until the agency implemented the key IT workforce planning activities, it would have difficulty anticipating and responding to changing staffing needs. As a result, we recommended that NASA fully implement the eight key IT workforce planning activities. The agency disagreed with our recommendation stating that its workforce improvement activities were already underway. Nevertheless, implementing the workforce planning activities discussed in this report could enhance and complement the agency’s ongoing and future efforts. In a June 2018 report on the progress of agencies’ efforts to implement the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, we noted that most CFO Act agencies had developed baseline assessments to identify cybersecurity personnel within their agencies that held certifications. However, because agencies had not consistently defined the workforce and the National Initiative for Cybersecurity Education had not developed a list of appropriate certifications, efforts such as conducting the baseline assessment to determine the percentage of cybersecurity personnel that hold appropriate certifications had yielded inconsistent and potentially unreliable results. Further, we reported that, while most CFO Act agencies had developed procedures for assigning cybersecurity codes to positions, several agencies had not addressed activities required by OPM to implement the requirements of the Federal Cybersecurity Workforce Assessment Act. As a result, we made 30 recommendations to 13 agencies to develop and submit their baseline assessments and to fully address the required activities in OPM’s guidance in their procedures for assigning employment codes to cybersecurity positions. Of the 13 agencies, seven agreed with the recommendations made to them, four did not state whether they agreed or disagreed, one agency agreed with one of the two recommendations made to it, and one did not provide comments on the report. As of July 2019, the agencies had implemented 20 of the recommendations. In August 2018, as part of a government-wide review of CIO responsibilities, we reported that CIOs are responsible for assessing agency IT workforce needs and developing strategies and plans for meeting those needs. However, we noted that the majority of the agencies minimally addressed or did not address the role of their CIOs in the area of IT workforce and reported major challenges related to their IT workforce. Specifically, 19 agencies’ policies had not addressed their CIOs’ role in conducting annual assessments of IT management and skill requirements and the remaining five agencies had only partially addressed this responsibility. We noted that the shortcomings in agencies’ policies were attributable, at least in part, to incomplete guidance from OMB. Consequently, we recommended that OMB issue guidance that addresses the IT workforce responsibilities of CIOs that were not included in existing guidance. OMB partially agreed with the recommendation and has not yet implemented it. We also recommended that 24 agencies ensure that their IT management policies address the role of their CIOs in the IT workforce management area. Of the 24 agencies, 14 agreed with the recommendations, five had no comments, five partially agreed, and one disagreed. We are monitoring the status of the agencies’ actions to implement our recommendations. In March 2019, as part of an update on the status of agencies’ progress in implementing the requirements of the Federal Cybersecurity Workforce Assessment Act, we reported, among other things, that most of the 24 CFO Act agencies had not completely or accurately categorized work roles for IT positions within the 2210 IT management occupational series (IT management). The agencies reported that this was, in part, because they may have assigned the associated codes in error or had not completed validating the accuracy of the assigned codes. We noted that, by assigning work roles that are inconsistent with the IT, cybersecurity, and cyber-related positions, the agencies were diminishing the reliability of the information they needed to improve workforce planning. We made recommendations to 22 agencies to take steps to address the inaccuracies. Of these agencies, 20 agreed with the recommendations, one partially agreed, and one did not agree with one of the two recommendations. As of August 2019, three of the agencies have implemented their recommendation, and two of the agencies have implemented one of their two recommendations. We continue to believe that all of the recommendations are warranted. As previously noted, GAO issued an IT workforce planning framework that includes eight key activities, based on federal laws, guidance, and best practices. Implementing these activities is critical to adequately assessing and addressing gaps in IT knowledge, skills, and abilities that are needed to execute a range of management functions that support agencies’ missions and goals. The eight key workforce planning activities are identified in table 1. None of the 24 agencies that we reviewed had fully implemented all eight IT workforce planning activities. In this regard, nearly all of the agencies had partially implemented, substantially implemented, or fully implemented three of the workforce planning activities (develop competency and staffing requirements, assess competency and staffing needs regularly, and assess gaps in competencies and staffing). However, most agencies had minimally implemented or did not implement the five other workforce planning activities (including efforts to establish a workforce planning process and address staffing gaps). Figure 1 shows the agencies’ overall implementation of each of the eight key IT workforce planning activities, as of May 2019. Further, some agencies had made more progress than others. Specifically, while five agencies (Defense, Department of State (State), VA, Small Business Administration (SBA), and SSA) fully implemented or substantially implemented three or more activities, 11 agencies did not fully implement any of the activities, and 15 agencies did not implement three or more activities. Figure 2 identifies the extent to which each of the 24 agencies had implemented the eight workforce planning activities. In addition, appendix II provides our assessment of each agency’s implementation of the activities. To fully implement the establish and maintain an IT workforce planning process activity, an agency should have a documented IT workforce planning process that describes how the agency will implement key IT workforce planning activities, including those identified in the IT workforce planning framework. The process should also define the CIO’s and others’ roles and responsibilities for implementing the activities; align with mission goals and objectives; and address both the agency-level and component-level workforce, including how the agency is to maintain visibility and oversight into component-level workforce planning efforts (as applicable). In addition, the agency should periodically update the process. Only one of the 24 CFO Act agencies had fully implemented this activity. Specifically, one agency had fully implemented the activity (Nuclear Regulatory Commission (NRC)); one agency had substantially implemented the activity (Defense); two agencies had partially implemented the activity (Department of Housing and Urban Development (HUD), and SBA); 12 agencies had minimally implemented the activity (U.S. Department of Agriculture (Agriculture), Commerce, Department of Energy (Energy), HHS, DHS, Department of the Interior (Interior), Department of Labor (Labor), State, Transportation, Treasury, VA, and SSA); and eight agencies did not implement the activity (Department of Education (Education), Department of Justice (Justice), Environmental Protection Agency (EPA), General Services Administration (GSA), NASA, National Science Foundation (NSF), OPM, and U.S. Agency for International Development (USAID)). NRC fully implemented the activity. In February 2016, NRC developed a strategic workforce plan that addressed all key IT workforce planning activities in our framework. In addition, the process was aligned with the agency’s goals and objectives. Further, the process included general roles and responsibilities, including for the Office of the Chief Human Capital Officer, Senior Management, and its component offices. Moreover, the agency’s Management Directive 9.22 further defined the Chief Information Officer’s roles and responsibilities with regards to IT workforce planning. In addition, NRC has periodically updated the process. For example, the agency updated the process in July 2017 to better integrate its workload projection, skills identification, human capital management, individual development, and workforce management activities. Defense substantially implemented the activity. The agency’s June 2018 Human Capital Operating Plan addressed how Defense plans to implement the workforce planning activities for its functional communities, including the IT functional community. In addition, the plan defined the CIO’s roles and responsibilities and was aligned with the agency’s goals and objectives. Further, the plan documented how the agency will maintain oversight of and visibility into functional community planning efforts. However, it called for the functional communities to develop strategic workforce plans to further define their workforce planning process and the IT functional community has not yet completed its plan or provided a time frame for completion. With respect to maintaining the process, Defense periodically updated its IT workforce process—the June 2018 plan replaced the process identified in the agency’s previous workforce plans. SBA partially implemented the activity. In April 2018, SBA released its IT Workforce Plan for fiscal years 2018 through 2020 that addressed how the agency intends to implement all of its IT workforce planning activities, and was aligned with the agency’s mission goals and objectives. In addition, in April 2018, the agency released its IT Change Management and Communication Plan that defined the CIO’s IT workforce planning roles and responsibilities and was aligned with the agency’s mission goals and objectives. However, as it is a new process, SBA had not updated it as of May 2019. Interior minimally implemented the activity. Interior issued a policy in 2016 that directed its bureaus to develop IT workforce plans, which the agency stated that it intends to use to develop an agency-wide IT workforce plan. The policy identified efforts that should be addressed in the plans, including most of the IT workforce planning activities. However, as of May 2019, the bureaus’ plans and the agency-wide plan had not been completed. Officials in the Office of the CIO stated that they expect to finalize all of the plans by the end of fiscal year 2019. GSA did not implement the activity. Officials in the Human Capital Strategic Planning Division stated that GSA followed the process described in OPM’s IT workforce planning guidance; however, the agency did not document this in policy and had not developed any other documentation to guide its implementation of workforce planning activities. To fully implement the develop competency and staffing requirements activity, an agency should develop a set of competency requirements for all or most of its IT workforce, including leadership positions. In addition, the agency should develop staffing requirements, which include projections over several years. Most of the agencies had fully or substantially developed competency and staffing requirements. Specifically, 12 agencies had fully implemented the activity (Defense, Education, HUD, State, Transportation, Treasury, VA, GSA, NASA, SBA, SSA, and USAID), four agencies had substantially implemented the activity (Agriculture, Commerce, HHS, and DHS), and eight agencies had partially implemented the activity (Energy, Interior, Justice, Labor, EPA, NSF, NRC, and OPM). State fully implemented the activity. State developed competency requirements for its IT workforce, including for both its foreign and civil services. In addition, State developed staffing requirements for its IT staff, including projections over several years. Specifically, it developed staffing requirements for its mission critical occupations, which include IT management, in response to OPM’s requirement to submit this information annually. DHS substantially implemented the activity. DHS developed competency requirements for two of the agency’s four IT functional groups. According to officials in the Office of the CIO, the agency expects to finalize competency requirements for the remaining two groups by the end of fiscal year 2019. In addition, DHS developed staffing requirements for its IT staff, including projections over several years. Specifically, it developed staffing requirements for its mission critical occupations, which include IT management, in response to OPM’s requirement to submit this information annually. OPM partially implemented the activity. OPM did not develop competency requirements. However, the agency developed staffing requirements for its IT staff, including projections over several years. Specifically, it developed staffing requirements for its mission critical occupations, which include IT management. To fully implement the assess competency and staffing needs regularly activity, an agency should periodically assess competency needs for all or most of its IT workforce. In addition, the agency should periodically assess staffing needs for all or most of its IT workforce. Most of the agencies periodically assessed staffing needs, but did not assess competency needs. Specifically, three agencies had fully implemented the activity (Defense, VA, and SSA); 20 agencies had partially implemented the activity by periodically assessing IT staffing needs; however, these agencies did not periodically assess competency needs (Agriculture, Commerce, Education, Energy, HHS, DHS, HUD, Interior, Justice, Labor, State, Transportation, Treasury, GSA, NASA, NSF, NRC, OPM, SBA, and USAID); and one agency did not implement the activity (EPA). VA fully implemented the activity. VA assessed competency needs annually as a part of its professional development planning process. For example, the agency performed an assessment in fiscal year 2017, which led it to add project management as a competency for all IT staff. In addition, in fiscal year 2018, VA’s assessment resulted in adding two new competencies—data analytics and risk management. Further, VA annually assessed staffing needs for its IT staff in response to the annual OPM reporting requirement to do so. Commerce partially implemented the activity. The agency initially developed its competency requirements in January 2016, but had not since updated its needs. On the other hand, Commerce annually assessed staffing needs for its IT staff in response to the OPM reporting requirement to do so. EPA did not implement the activity. EPA did not develop competency needs for its IT workforce. In addition, the agency could not provide documentation showing that it had regularly assessed staffing needs for its IT staff. To fully implement the assess gaps in competencies and staffing activity, an agency should periodically assess gaps in competencies for all or most of its IT workforce. Further, the assessment should be performed based on the agency’s current competency needs. In addition, the agency should periodically assess gaps in staffing for all or most of its IT workforce. Most agencies took steps to assess competency and staffing gaps. Specifically, two agencies had fully implemented the activity (VA and SSA); nine agencies had substantially implemented the activity (Agriculture, Defense, DHS, HUD, State, Transportation, GSA, NASA, and SBA); 12 agencies had partially implemented the activity by periodically assessing IT staffing gaps, but not periodically assessing competency gaps (Commerce, Education, Energy, HHS, Interior, Justice, Labor, Treasury, NSF, NRC, OPM, and USAID); and one agency had minimally implemented the activity (EPA). SSA fully implemented the activity. SSA assessed gaps in its competencies for its IT management staff biennially starting in fiscal year 2014. In addition, SSA annually assessed staffing gaps for its IT staff in response to the OPM reporting requirement. HUD substantially implemented the activity. HUD assessed competency gaps for its IT management staff biennially; it began doing so in fiscal year 2014. However, HUD did not assess competency needs regularly; thus, it could not ensure that the gap assessments reflect the agency’s current competency needs. HUD annually assessed staffing gaps for its IT staff in response to the OPM reporting requirement. Education partially implemented the activity. Education did not assess gaps in competencies for its IT staff. However, the agency annually assessed staffing gaps for its IT staff in response to the OPM reporting requirement. EPA minimally implemented the activity. EPA did not assess competency gaps because, as previously stated, the agency did not develop competency requirements. In addition, while EPA assessed staffing gaps in 2018, it did not provide documentation showing that it had assessed staffing gaps prior to or since then. To fully implement the develop strategies and plans to address gaps in competencies and staffing activity, an agency should develop strategies and plans, including specific actions and milestones, to address identified competency gaps. In addition, the agency should develop strategies and plans, including specific actions and milestones, to address identified staffing gaps. Most agencies did not develop strategies and plans to address competency and staffing gaps. Specifically, four agencies had substantially implemented the activity (Defense, State, VA, and SBA), one agency had partially implemented the activity (Agriculture), six agencies had minimally implemented the activity (HUD, Transportation, EPA, GSA, SSA, and USAID), and 13 agencies did not implement the activity (Commerce, Education, Energy, HHS, DHS, Interior, Justice, Labor, Treasury, NASA, NSF, NRC, and OPM). State substantially implemented the activity. State identified strategies to address high-priority IT competency gaps, including developing additional training, conducting quarterly reviews of IT workforce issues, and improving hiring processes; however, it had not developed plans, including actions and milestones, for how it would carry out the strategies. With respect to staffing, State identified strategies and plans to address them in its Five-Year Workforce and Leadership Success Plan for Fiscal Years 2016 through 2020. For example, State identified using special hiring initiatives, such as its Pathways Programs, to address staffing gaps. In addition, State developed the Foreign Affairs IT Fellowship Program, which is intended to recruit students by offering internships. Agriculture partially implemented the activity. In 2019, Agriculture developed strategies, which included providing training and developing career paths, to address competency gaps identified for two of 13 IT functional roles; however, the agency did not develop associated plans, including actions and milestones. Further, Agriculture did not develop strategies to address gaps for the other 11 IT functional roles because the agency had not assessed gaps for those roles. With respect to staffing, in 2019, Agriculture identified strategies to address staffing gaps identified for two of its IT functional roles, including collaborating with universities. However, it did not develop plans to carry out the strategies. In addition, Agriculture did not develop strategies and plans to address gaps in staffing for its other 11 IT functional roles. HUD minimally implemented the activity. HUD’s Office of the CIO developed a training plan for fiscal years 2017 through 2018, which identified training courses to address specific technical competency gaps. However, HUD has not updated its competency needs regularly to ensure that the plan and underlying gap assessment reflect the agency’s current competency needs. With respect to staffing, HUD did not develop strategies and plans to address gaps. DHS did not implement the activity. DHS did not develop strategies and plans to address either competency or staffing gaps. To fully implement the implement activities that address gaps activity, an agency should execute its strategies and plans to address identified gaps in competencies and staffing. In addition, the agency should implement other efforts to assist with addressing competency and staffing needs, including the following efforts identified in FITARA: IT acquisition cadres, cross-functional training of acquisition and program personnel, career paths for program managers, plans to strengthen program management, and the use of special hiring authorities. Most of the agencies minimally implemented strategies and plans to address competency and staffing gaps. Specifically, two agencies had substantially implemented this activity (Defense and VA), seven agencies had partially implemented the activity (HHS, DHS, State, Treasury, SBA, SSA, and USAID), and 15 agencies had minimally implemented the activity by implementing workforce efforts identified in FITARA, but not implementing strategies and plans to address its identified competency and staffing gaps primarily because they had not developed strategies and plans to address identified gaps (Agriculture, Commerce, Education, Energy, HUD, Interior, Justice, Labor, Transportation, EPA, GSA, NASA, NSF, NRC, and OPM). VA substantially implemented the activity. VA implemented strategies and plans to address gaps in competencies. For example, in its Office of Information and Technology Training Gap Analysis report, VA identified actions taken to address the prior year’s competency gaps. These actions included developing additional training courses, as well as providing on-the-job training activities. However, VA did not provide documentation showing that it had implemented strategies and plans to address identified staffing gaps. With respect to the efforts identified in FITARA that can assist with addressing competency and staffing needs, VA implemented an IT acquisition cadre, developed plans to strengthen program management, developed a career path for program managers, and used special hiring authorities to hire IT staff. SSA partially implemented the activity. SSA implemented strategies to address gaps in competencies. For example, according to its gap closure report, the agency closed competency gaps by providing training to existing staff, hiring new staff, and hiring contractors with needed skills. However, SSA did not implement strategies and plans to address staffing gaps because it had not yet developed them. With respect to the efforts identified in FITARA that can assist with addressing competency and staffing needs, SSA used special hiring authorities to hire eight IT specialists in fiscal year 2018. However, SSA did not implement others, including IT acquisition cadres, cross- functional training of acquisition and program personnel, career paths for program managers, and plans to strengthen program management. GSA minimally implemented the activity. GSA did not develop strategies and plans to address identified gaps in competencies or staffing. With respect to the efforts identified in FITARA that can assist with addressing competency and staffing needs, GSA implemented efforts to provide cross-functional training for acquisition and program personnel and used special hiring authorities to hire IT staff. However, the agency did not implement others, including plans to strengthen program management or career paths for program managers. To fully implement the monitor the agency’s progress in addressing competency and staffing gaps activity, an agency should track progress in implementing strategies and plans to address competency gaps. In addition, the agency should track progress in implementing strategies and plans to address staffing gaps. Most agencies did not establish processes for monitoring progress in addressing competency and staffing gaps. Specifically, three agencies had partially implemented the activity (Defense, VA, and SBA), five agencies had minimally implemented the activity (HUD, State, Transportation, SSA, and USAID), and 16 agencies did not implement the activity (Agriculture, Commerce, Education, Energy, HHS, DHS, Interior, Justice, Labor, Treasury, EPA, GSA, NASA, NSF, NRC, and OPM). SBA partially implemented the activity. SBA established an IT Workforce Steering Committee which monitored progress made in implementing, among other things, strategies and plans to address competency and staffing gaps. However, the agency did not monitor whether the strategies and plans led to a closure in gaps. State minimally implemented the activity. While State monitored its progress in implementing recommended actions to address competency gaps, the agency did not monitor whether the actions led to closing gaps. With respect to staffing, State did not monitor progress in addressing gaps because it did not develop strategies and plans to close staffing gaps. GSA did not implement the activity. GSA did not track progress in addressing competency gaps because the agency did not assess competencies to identify such gaps. Further, GSA did not monitor its progress in addressing staffing gaps because it did not develop strategies and plans to close the gaps. To fully implement the report to agency leadership on progress activity, an agency should periodically report to agency leadership on progress in implementing strategies and plans to address gaps in competencies. In addition, the agency should periodically report to leadership on progress in implementing strategies and plans to address gaps in staffing. However, most of the agencies did not establish processes for reporting their progress in addressing competency and staffing gaps. Specifically, three agencies had partially implemented the activity (Defense, VA, and SBA), three had minimally implemented the activity (HUD, SSA, and USAID), and 18 did not implement the activity (Agriculture, Commerce, Education, Energy, HHS, DHS, Interior, Justice, Labor, State, Transportation, Treasury, EPA, GSA, NASA, NSF, NRC, and OPM). VA partially implemented the activity. VA reported to agency leadership on its progress in addressing competency gaps, including the closure of gaps, and the actions planned and taken to address the gaps. However, VA did not report on progress in addressing staffing gaps because it did not implement strategies and plans to address such gaps. HUD minimally implemented the activity. HUD reported to agency leadership on the closure of competency gaps from fiscal year 2014 through fiscal year 2016. However, the agency did not monitor or report on its progress in implementing strategies and plans to address gaps in competencies. With respect to staffing, HUD did not report on its progress in addressing gaps because it did not implement strategies and plans to close staffing gaps. DHS did not implement the activity. DHS did not periodically report to agency leadership on its progress in addressing competency or staffing gaps. The agency did not do so because it did not develop strategies and plans to address competency and staffing gaps. Agency officials cited various factors that limited their progress in implementing the key IT workforce planning activities. For example, six agencies, including DHS and NRC, reported that they had not completed key activities because they were reliant on finishing other prerequisite activities. For example, officials in DHS’s Office of the CIO stated that they had not updated their IT competency needs because they had not yet finished identifying competency requirements for all of the agency’s role-based groups; four agencies, including HHS and NASA, reported that they had other workforce related priorities, including those related to the Cybersecurity Workforce Assessment Act; three agencies, including GSA and USAID, reported that they lacked resources to perform the activities; and two agencies (OPM and Interior) reported that leadership turnover affected their implementation of workforce planning activities. Until agencies make it a priority to implement all of the key IT workforce planning activities, they will likely have a limited ability to assess and address gaps in the knowledge and skills that are critical to the success of major acquisitions. As a result, it will be difficult for agencies to anticipate and respond to changing staffing needs and control human capital risks when developing, implementing, and operating critical IT systems. The majority of the agencies made significant progress implementing three activities—develop competency and staffing requirements, assess competency and staffing needs regularly, and assess gaps in competencies and staffing—and in doing so took important steps towards identifying the workforce they need to help them achieve their mission, and the gaps that need to be addressed. In contrast, most agencies only minimally implemented or did not implement the remaining five activities, increasing the risk that they will not address the gaps. Agencies’ limited implementation of the IT workforce planning activities has been due, in part, to not making IT workforce planning a priority, despite the laws and guidance which have called for them to do so for over 20 years. Until this occurs, agencies will likely not have the staff with the necessary knowledge, skills, and abilities to support the agency’s mission and goals. We are making a total of 18 recommendations to federal agencies—one recommendation to 18 agencies. The Secretary of Agriculture should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 1) The Secretary of Education should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 2) The Secretary of Energy should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 3) The Secretary of Homeland Security should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 4) The Secretary of Housing and Urban Development should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 5) The Secretary of the Interior should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 6) The Attorney General should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 7) The Secretary of Labor should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 8) The Secretary of State should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 9) The Secretary of Veterans Affairs should ensure that the agency fully implements each of the five key IT workforce planning activities it did not fully implement. (Recommendation 10) The Administrator of the Environmental Protection Agency should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 11) The Administrator of the General Services Administration should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 12) The Director of the National Science Foundation should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 13) The Chairman of the Nuclear Regulatory Commission should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 14) The Director of the Office of Personnel Management should ensure that the agency fully implements each of the eight key IT workforce planning activities it did not fully implement. (Recommendation 15) The Administrator of the Small Business Administration should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 16) The Commissioner of the Social Security Administration should ensure that the agency fully implements each of the five key IT workforce planning activities it did not fully implement. (Recommendation 17) The Administrator of the U.S. Agency for International Development should ensure that the agency fully implements each of the seven key IT workforce planning activities it did not fully implement. (Recommendation 18) We are not making new recommendations to six agencies—Commerce, Defense, HHS, Transportation, Treasury, and NASA—because we previously made recommendations to these agencies to address the key IT workforce planning activities. We provided a draft of the report to the 24 CFO Act agencies for their review and comment. Of the 18 agencies to which we made a recommendation in this report, 13 agencies (Energy, DHS, HUD, Interior, Labor, State, VA, GSA, NSF, OPM, SBA, SSA, and USAID) agreed with the recommendation; one agency (Education) partially agreed with the recommendation; three agencies (Agriculture, Justice, EPA) neither agreed nor disagreed with the recommendation; and one agency (NRC) did not agree with our findings. We also received technical comments from a number of the agencies, which we have incorporated into the report, as appropriate. In addition, of the six agencies to which we did not make recommendations in this report, two (Defense and the Treasury) provided comments on the report and the remaining four (Commerce, HHS, Transportation, and NASA) responded that they did not have any comments on the report. The following 13 agencies agreed with our recommendations: In written comments (reprinted in appendix III), Energy concurred with our recommendation. The agency stated that it plans to fully implement all of the IT workforce planning activities, and described recently completed and intended efforts to do so. For example, the agency stated that it completed the development of competency and staffing requirements in May 2019. In addition, the agency said it expects to finish developing an IT workforce planning process in December 2020. While the efforts described represent positive steps toward fully implementing the IT workforce planning activities, Energy did not provide supporting documentation for the activities it said were completed. As a result, we did not change our ratings for these activities. In its written comments (reprinted in appendix IV), DHS concurred with our recommendation and stated that it remains committed to fully implementing all of the IT workforce planning activities. Further, the agency stated that it had completed developing competency requirements and assessing gaps for its two remaining IT role based groups. However, the agency did not provide documentation to support its completion of these activities. As a result, we did not change our ratings for the activities. DHS also stated that the Office of the Chief of Staff Workforce Engagement Division, within the Office of the CIO, plans to work with the agency’s Chief Information Officer Council and the Office of Chief Human Capital Officer to form an integrated project team by January 30, 2020. According to DHS, this project team will be charged with discussing the agency’s IT workforce planning strategy and outlining an action plan to ensure the strategy addresses all of the key IT workforce planning activities. DHS also provided technical comments which we incorporated, as appropriate. In written comments (reprinted in appendix V), HUD concurred with our recommendation and stated that it plans to fully implement the remaining workforce planning activities. In its written comments (reprinted in appendix VI), Interior agreed with our recommendation. The agency stated that it has begun taking steps to implement the IT workforce planning activities and plans to fully implement the remaining activities. In its written comments (reprinted in appendix VII), Labor concurred with our recommendation. The agency stated that it had made significant progress since the completion of our review and had fully implemented seven of the eight IT workforce planning activities. For example, the agency described efforts to review position descriptions, including identifying key IT competency areas. In addition, the agency stated that it assessed competency and skills needs, and critical IT skill gaps, as part of an IT workforce supply analysis. Further, Labor stated that, in June 2019, it developed hiring approval and prioritization templates, which require a current workforce and competency assessment, and identified IT competencies with each hiring request. The agency added that hiring managers perform a job analysis prior to posting open positions, and that this includes identifying key IT competencies for each position. Moreover, Labor stated that, in June 2019, the Secretary approved the use of direct hire authority for IT Specialists. In addition, the agency said that the Office of the CIO and the Chief Human Capital Officer finalized an action plan in March 2019 that identified strategies to address IT workforce gaps. Further, it stated that progress had been monitored in weekly discussions with and oversight from the Chief Information Officer and Chief Human Capital Officer. However, while the actions described indicate progress toward fully implementing the workforce planning activities, the agency did not provide evidence to support the actions it said it had taken. As a result, we did not change our ratings for the activities. In written comments (reprinted in appendix VIII), State agreed with our recommendation and described steps it said the agency is taking to implement the IT workforce planning activities. These steps included developing an IT strategic workforce plan that it expected to finalize by the end of fiscal year 2019. Further, the agency stated that it had substantially implemented the report to agency leadership on progress in addressing the competency and staffing gaps activity, which we assessed as not implemented. As evidence, the agency stated that departmental leadership is briefed regularly on efforts made to address IT competency gaps. However, State did not provide supporting documentation for these activities. As a result, we did not change our rating for the activities. In written comments (reprinted in appendix IX), VA concurred with our recommendation. However, the agency said it believed that it had fully implemented each of the five IT workforce planning activities we rated as less than fully implemented. Specifically, With regard to establishing and maintaining an IT workforce planning process, VA stated that its Office of Information and Technology had fully implemented a workforce planning process, including developing and implementing strategies to address gaps in competencies and staffing. The agency submitted two documents as supporting evidence: the Office of Information and Technology’s Human Capital Management Recruitment Strategy, which we reviewed during our engagement and determined did not sufficiently address the criteria; and the Office of Information and Technology’s Human Capital Strategic Plan for fiscal years 2014 through 2020, a document that it had not previously provided to us. We reviewed this document but have questions we need to follow up on with VA to determine whether the agency has fully implemented the activity. As a result, we did not change our rating for this activity. With regard to developing strategies and plans to address gaps in competencies and staffing, VA stated that, for projected staffing gaps, it has developed initial plans for deploying internal employee growth mechanisms. In addition, the agency stated that, because it anticipates no authorized staffing growth for fiscal years 2020 and 2021, the primary focus of its workforce strategies will be on delivering IT services in a growing environment while experiencing no authorized staff growth. Further, the agency stated that, due to its low vacancy rate, its emphasis will change from filling gaps to sustaining services while controlling workforce attrition. While the actions described may be sufficient to fully implement the activity, VA did not provide documented plans to address projected staffing gaps; as a result, we did not change our rating for this activity. With regard to implementing activities that address gaps, the agency stated that its Office of Information and Technology Human Capital Management Recruitment Strategy outlines talent acquisition approaches leveraged within the office to address staffing gaps. We analyzed this document during our review and, as noted in our report, found that it identified actions taken to address the prior year’s gaps, but it did not provide documentation showing that VA had implemented strategies and plans to address projected staffing gaps. As a result, we did not change our rating for this activity. With regard to monitoring the agency’s progress in addressing competency and staffing gaps, the agency stated that it has fully implemented the activity because it believes it has fully implemented the aforementioned dependent activities. However, as previously stated, we did not change our ratings for the other activities based on information that VA provided. Accordingly, we did not change our rating for this activity. With regard to reporting to agency leadership on progress in addressing competency and staffing gaps, VA stated that, in June 2019, its Office of Information and Technology briefed the agency’s Chief Information Officer and senior leadership on the preliminary results of data collection that is expected to ultimately result in a staffing model which accurately depicts the current array of the office’s workforce, requirements to perform the mission, functions, task assigned, and the associated staffing gap. However, the agency did not provide documentation supporting this activity. As a result, we did not change our partially implemented rating designation for the activity. In written comments (reprinted in appendix X), GSA agreed with our recommendation and stated that it has established a project team to implement the remaining workforce planning activities. In comments provided via email on September 12, 2019, the Liaison to GAO in NSF’s Office of the Director, Office of Integrative Activities, stated that the agency agreed with our recommendation. The liaison added that NSF had recently completed an iteration of an IT workforce plan that is to inform its processes going forward, and address many of the IT workforce planning activities. The liaison also stated that NSF recognizes the importance of IT workforce planning and will continue to implement improvements to its processes in this area. OPM provided written comments (reprinted in appendix XI) in which the agency stated that it concurred with the recommendation. In addition, the agency stated that, to address its shortcomings, it has partnered with GSA’s IT Modernization Center of Excellence to assess the current state of its IT workforce planning activities. The agency stated that this effort is intended to assist with identifying and addressing gaps. In its written comments (reprinted in appendix XII), SBA agreed with the recommendation. The agency stated that its Office of Human Resource Solutions and the Office of the CIO will continue unified efforts to fully implement the remaining seven key IT workforce planning activities noted in our report. SBA added that it expects to complete the efforts by the end of fiscal year 2021. SBA also provided technical comments which we incorporated, as appropriate. SSA provided written comments (reprinted in appendix XIII) in which it agreed with the recommendation. The agency stated that it planned to finish developing an IT Workforce Strategy by the end of fiscal year 2019, which is to provide a framework to address its future IT workforce needs. In addition, the agency stated that, in fiscal year 2020, it expects to begin implementation of activities to address our findings. SSA also provided technical comments which we incorporated, as appropriate. In written comments (reprinted in appendix XIV), USAID stated that it concurred with the recommendation. The agency said that it was taking actions to fully implement each of the seven IT workforce planning activities that we identified as not fully implemented. USAID added that it expects to complete these actions by the end of the first quarter of fiscal year 2021. One agency—Education—partially agreed with the recommendation. Specifically, in written comments (reprinted in appendix XV), Education stated that it has taken actions to address the workforce planning activities. For example, with regard to the assess competency and staffing needs regularly activity, the agency stated that, in fiscal years 2018 and 2019, it conducted assessments of competency and staffing needs for employees coded as cybersecurity employees. However, the agency did not provide supporting documentation, including documentation showing that it had assessed or updated competency needs since they were originally developed. As a result, we did not change our rating for the activity. For the assess gaps in competencies and staffing activity, Education stated that it conducted a two-part competency assessment of all employees with cybersecurity responsibilities in March 2019. However, the agency did not provide documentation of the assessment. As a result, we did not change our rating for the activity. With regard to developing strategies and plans to address gaps in competencies and staffing, Education stated that, in April 2019, it submitted to OPM its action plan to address competency and staffing gaps identified in its Cybersecurity Work Roles of Critical Need report. However, the agency did not provide documentation of the plan. As a result, we did not change our rating for the activity. In addition, the agency described its planned efforts to fully implement the remaining IT workforce planning activities, including developing an IT workforce planning process and monitoring and reporting on progress in addressing competency and staffing gaps. Three agencies commented on our findings but did not state whether they agreed or disagreed with our recommendations: In comments provided via email on September 6, 2019, the Director of Strategic Planning, Policy, E-government and Audits in Agriculture’s Office of the CIO stated that the agency concurred with our findings. In addition, the agency provided technical comments, which we have incorporated in the report as appropriate. In comments provided via email on August 26, 2019, an official from Justice’s Office of the CIO stated that the agency concurred with our findings. In comments provided via email on September 5, 2019, the GAO liaison coordinator for EPA’s Office of Mission Support provided comments on the findings. The agency stated that, in April 2019, it submitted two action plans to address Cybersecurity Work Roles of Critical Need to OPM which it believes address the eight IT workforce planning activities. For example, with regard to the establish and maintain a workforce planning process activity, the agency stated that the workforce action plans present a model on how the agency plans to fill critical needs related to IT and application project management, and information systems security. While the action plans describe efforts to be performed to address gaps for specific work roles of critical need, they do not describe an overall IT workforce planning process for the agency, to include how the agency will continue to develop its competency and staffing requirements, assess for gaps, and develop strategies and plans to address the gaps. As a result, we did not change our rating for the activity. Further, with regard to the remaining workforce planning activities, the agency stated that the action plans, which it had not previously provided during the course of our review, include actions and milestones focusing on evaluating skill gaps and assessing current training and development opportunities. However, the agency did not provide documentation of the underlying IT competency requirements or competency gap assessments used to identify the gaps. As noted in our report, if an agency has not developed competency requirements, it is not able to implement the subsequent activities relating to competencies. On the other hand, the agency has developed staffing requirements, and as a result we have updated our rating for the staffing evaluation criteria within the develop strategies and plans to address gaps in competencies and staffing activity. However, EPA did not provide documentation showing that it had implemented the strategies and plans to address staffing gaps, or monitored and reported on progress in addressing staff gaps. As a result, we did not change our ratings for these activities. One agency did not agree with our findings. Specifically, in its written comments (reprinted in appendix XVI), NRC stated that it did not agree with the findings that it had not developed an IT workforce planning process or IT competency requirements. With regard to the IT workforce planning process, we noted in our report that NRC had developed a workforce planning process that addressed all the key IT workforce planning activities; however, we stated that the process did not define the Chief Information Officer’s roles and responsibilities for implementing the activities or how the plan aligns with mission goals and objectives. In its response, the agency stated that its Management Directive 9.22, which was not provided to us during our review, defines the Chief Information Officer’s roles and responsibilities for implementing activities, including workforce planning by developing and maintaining the agency’s IT/Information Management Strategic Plan and enterprise IT/Information Management roadmap in alignment with the NRC Strategic Plan, and reviewing all positions with IT responsibilities requested in the budget request to ensure the positions meet the ongoing requirements of the agency. We reviewed the directive and determined that it addresses the Chief Information Officer’s roles and responsibilities. In addition, NRC identified parts of its workforce planning process, that it believes addresses alignment with mission and goals. We reviewed these parts, and agree with NRC that the plan addresses alignment with mission and goals. We have incorporated the change into this report, including changing the rating from partially implemented to fully implemented for this activity. As a result, we modified the recommendation from fully implementing eight activities NRC did not implement to fully implementing seven activities it did not fully implement. With regard to developing competency requirements, the agency stated that it specifies competencies for all IT positions in its position descriptions. However, NRC did not provide documentation of the position descriptions or the related competencies. As a result, we are not changing our not implemented rating for this activity. NRC also noted that it has joined other federal agencies to develop career paths and competency models for 64 IT security roles across the federal government, and that this effort is scheduled to be completed in October, at which time the agency will decide which of the models to adopt. In addition, the following two agencies to which we made recommendations in prior reports provided comments. In its written comments (reprinted in appendix XVII), Defense stated that it concurred with the overall contents of the report. In comments provided via email on September 5, 2019, an official from Treasury’s Office of the CIO stated that the agency agreed with all but two of our findings in this report, associated with three of the activities. First, the agency disagreed with our finding that it minimally implemented the establish and maintain a workforce planning process activity, stating that it has a department-wide workforce planning process that includes the IT workforce. However, while the agency issued a policy in 2013, which we reviewed during our engagement, that directs bureaus to annually conduct workforce planning, it did not define a process for doing so. In addition as we further note, in 2018, the agency issued guidance addressing workforce planning issues for bureaus to consider in developing their own processes. However, this does not constitute an IT workforce planning process. Since Treasury did not provide any additional evidence of an IT workforce process, we are not changing our rating for this activity. Second, Treasury disagreed with our finding that it did not implement the activities associated with monitoring and reporting on its progress in addressing competency and staffing gaps. Specifically the agency stated that it has designed and begun implementing a new governance structure for workforce management that reinforces the monitoring and reporting of workforce related issues to agency leadership during quarterly performance reviews. However, as we note in our report, the monitoring and reporting activities are dependent on the developing strategies and plans to address competency and staffing gaps activity which Treasury has yet to implement. Until Treasury develops such strategies and plans, it cannot monitor and report on their progress. We are sending copies of this report to interested congressional committees, the Director of the Office of Management and Budget, the secretaries and agency heads of the departments and agencies addressed in this report, and other interested parties. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. Should you or your staffs have any questions on information discussed in this report, please contact me at (202) 512-4456 or HarrisCC@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix XVIII. Our objective was to examine the extent to which federal agencies are effectively implementing information technology (IT) workforce planning activities. To address this objective, we relied on practices from GAO’s IT workforce planning framework as criteria. The framework identifies eight key IT workforce planning activities that, when effectively implemented, can facilitate the success of major acquisitions. These activities are listed in table 2. To ensure consistent understanding and application of the activities in our evaluations, we reviewed the supporting laws, policy, and guidance for each activity and identified specific evaluation criteria. The criteria are listed in table 3. We reviewed IT workforce planning policies and other workforce planning documentation for each of the 24 Chief Financial Officers Act of 1990 agencies, including workforce planning processes; competency requirements; annual mission critical occupation resource charts required by the Office of Personnel Management (OPM) which document staffing requirements and gap assessments; strategies and plans to address gaps; and reports on progress in addressing gaps. For the six agencies for which we previously performed IT workforce planning assessments, we reviewed the previously reported information and obtained and analyzed updates, as appropriate. We compared the information obtained to our evaluation criteria and identified gaps and their causes. We also interviewed cognizant officials from each of the 24 agencies, to discuss their implementation of the IT workforce planning activities and causes for any gaps. Our review focused on the agency’s IT workforce planning efforts at the agency level, including the extent to which the agency maintained visibility and oversight into component-level IT workforce planning. Based on our assessment of the documentation and discussions with agency officials, we assessed each agency’s implementation of our evaluation criteria as: fully implemented—the agency provided evidence which showed that it fully or largely addressed the elements of the criteria. partially implemented—the agency provided evidence that showed it had addressed at least part of the criteria. not implemented—the agency did not provide evidence that it had addressed any part of the criteria. To determine an overall rating for each of the eight key workforce planning activities, we summarized the results of our assessments of the evaluation criteria. Specifically, we assessed each activity as: fully implemented—the agency fully implemented both of an activity’s evaluation criteria. substantially implemented—the agency fully implemented one of an activity’s evaluation criteria and partially implemented the other evaluation criteria. partially implemented—the agency fully implemented one of an activity’s evaluation criteria and did not implement the other criteria, or partially implemented both of an activity’s evaluation criteria. minimally implemented—the agency partially implemented one of an activity’s evaluation criteria and did not implement the other evaluation criteria. not implemented—the agency did not implement either of an activity’s evaluation criteria. We assessed the staffing evaluation criteria for the develop competency and staffing requirements, assess competency and staffing needs regularly, and assess gaps in competencies and staffing activities as fully implemented if agencies provided evidence of a complete mission critical occupation resource chart to meet OPM reporting requirements and were able to demonstrate that the mission critical staff represented most or all of their IT workforce. In addition, we assessed the competency evaluation criteria for these activities as fully implemented if agencies provided evidence that they performed them for most or all of their IT workforce. For the implement activities that address gaps activity, we assessed agencies as having fully implemented the evaluation criteria on other efforts if they provided evidence as having implemented at least four of the efforts identified in the Federal Information Technology Acquisition Reform Act (FITARA). We rated this evaluation criteria as partially implemented if agencies provided evidence of having implemented fewer than four of the efforts. Finally, in making our assessments, we also considered the extent to which an agency had implemented prerequisite activities. For example, to implement the competency evaluation criteria for the develop strategies and plans to address gaps activity, the agency needed to have also implemented the competency evaluation criteria for the assess gaps in competencies and staffing activity. We did not assess any activity higher than the prerequisite activity. We also determined if there was a common factor which led to the rating for a particular activity. For example, we noted whether most agencies partially implemented an activity because they had fully implemented one of the evaluation criteria, but had not implemented the other criteria. To determine the reliability of staffing data in the mission critical occupation resource charts, we reviewed the charts for obvious errors and for completeness and obtained clarification from agencies on identified errors. We determined that the data were sufficiently reliable for the purpose of this report, which was to determine the extent to which agencies had implemented the key activities. We conducted this performance audit from January 2018 to October 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. This appendix contains assessments of the extent to which the 24 Chief Financial Officers Act of 1990 agencies implemented each of the eight key IT workforce planning activities identified in GAO’s information technology (IT) workforce planning framework. In addition to the individual named above, the following staff made key contributions to this report: Sabine Paul (Assistant Director), Scott Borre (Analyst in Charge), Rebecca Eyler, Cassaundra Pham, Thomas B. Rackliff, and Marshall Williams, Jr.

Summary: The federal government annually spends over $90 billion on IT. Despite this large investment, projects too frequently fail or incur cost overruns and schedule slippages while contributing little to mission-related outcomes. Effectively implementing workforce planning activities can facilitate the success of major acquisitions. GAO was asked to conduct a government-wide review of IT workforce planning. The objective was to determine the extent to which federal agencies effectively implemented IT workforce planning practices. To do so, GAO compared IT workforce policies and related documentation from each of the 24 Chief Financial Officers Act of 1990 agencies to activities from an IT workforce planning framework GAO issued. GAO rated each agency as having fully, substantially, partially, minimally, or not implemented for each activity. GAO supplemented its reviews of agency documentation by interviewing agency officials. Federal agencies varied widely in their efforts to implement key information technology (IT) workforce planning activities that are critical to ensuring that agencies have the staff they need to support their missions. Specifically, at least 23 of the 24 agencies GAO reviewed partially implemented, substantially implemented, or fully implemented three activities, including assessing gaps in competencies and staffing. However, most agencies minimally implemented or did not implement five other workforce planning activities (see figure). Agencies provided various reasons for their limited progress in implementing workforce planning activities, including competing priorities (six agencies), and limited resources (three agencies). Until agencies make it a priority to fully implement all key IT workforce planning activities, they will likely have difficulty anticipating and responding to changing staffing needs and controlling human capital risks when developing, implementing, and operating critical IT systems. GAO is making recommendations to 18 of the 24 federal agencies to fully implement the eight key IT workforce planning activities. Of the 18 agencies, 13 agreed with the recommendations, one partially agreed, three neither agreed nor disagreed, and one disagreed with the findings and provided evidence which led to a modification to its recommendation, as discussed in this report. For all of the remaining recommendations, GAO continues to believe that they are all warranted.