As you know, the cost of the Decennial Census has steadily increased during the past 40 years, in part because the nation’s population has steadily grown larger, more diverse, and increasingly difficult to enumerate. For example, at about $13 billion, the 2010 Census was the costliest U.S. census in history and was 56 percent more costly than the $8.1 billion 2000 Census (in constant 2010 dollars). To help save costs, in preparing for the 2020 Census, the Bureau has been researching and testing new methods and technologies to redesign the Census to more cost-effectively count the population while maintaining high-quality results. The Bureau’s research and testing has focused on four redesign areas: Reengineering address canvassing: This involves reengineering processes for updating the Bureau’s address list and maps of the nation to reduce the need for employing field staff to walk every street in the nation to verify addresses. Optimizing self-response: Includes efforts to maximize the self- response of households by, among other things, offering an Internet response option. As we have previously reported, to deliver the Internet response option, the Bureau would need to, among other things, design and develop an Internet response application, develop and acquire the IT infrastructure to support a large volume of data processing and storage, and plan communication and outreach strategies to motivate households to respond via the Internet. Using administrative records: This includes expanding the use of data previously obtained by other federal and state government agencies and commercial sources to reduce the need for costly and labor-intensive follow-up work. My colleague will address the Bureau’s progress on using administrative records in his statement today. Reengineering field operations: This includes reducing the number of visits to households, automating the management of enumerator work to conduct non-response follow-up, and automating and optimizing case assignment and routing for enumerators to reduce the staffing, infrastructure, and field offices required for the 2020 Census. The Bureau has conducted several major field tests to examine the potential for each of these redesign areas: In mid-2014 the Bureau conducted the 2014 Census Test in the Maryland and Washington, D.C., areas to test new methods for conducting self-response and non-response follow-up. In early 2015 the Bureau completed the Address Validation Test, which was used to examine new methods for updating the Bureau’s address list. In mid-2015 the Bureau conducted the 2015 Census Test in Arizona to test, among other things, the use of a field operations management system to automate data collection operations and provide real-time data and the ability to reduce the non-response follow-up workload using data previously provided to the government, as well as enabling enumerators to use their personally owned mobile devices to collect census data. Also in mid-2015, the Bureau conducted an optimizing self-response test in Savannah, Georgia, and the surrounding area, which was intended to further explore methods of encouraging households to respond using the Internet, such as using advertising and outreach to motivate respondents, and enabling households to respond without a Bureau-issued identification number. More recently, the Bureau began its National Content Test, which is currently ongoing and intended to, among other things, continue to test self-response modes and contact strategies and refine estimates of national self-response and Internet response rates. These tests were intended to inform the first version of the Bureau’s 2020 Census Operational Plan, which is intended to outline design decisions that drive how the 2020 Census will be conducted. As part of these decisions, the Bureau has committed to aspects of the 2020 Census redesign. The operational plan articulated 326 total design decision points, which vary widely in their complexity, importance, and urgency. As of October 6, 2015, the Bureau had made decisions for about 47 percent of them related to each of the four redesign areas. For example, the Bureau has decided to conduct 100 percent of address canvassing (i.e., identifying all addresses where people could live) in the office, and target a subset of up to 25 percent for in-the-field address canvassing; offer an Internet self-response option, as well as alternative response options via telephone and paper for limited circumstances; allow people to respond without a unique census identification use mobile devices for enumerators to conduct field data collection; use administrative records to enumerate vacant units; use enterprise solutions to support the 2020 Census, when practicable; and reduce the field footprint by half in comparison to the 2010 Census (e.g., 6 regional census centers instead of 12 and up to 250 field offices instead of nearly 500). Figure 1 provides an overview of the Bureau’s current plans and assumptions for the 2020 Census, resulting from the October 2015 operational plan. As a result of these decisions, the Bureau estimates saving $5.2 billion. Specifically, the Bureau estimated that repeating the design of the 2010 Census for 2020 would cost approximately $17.8 billion (in constant 2020 dollars), while successfully implementing the four redesign areas is expected to result in an overall 2020 Census cost of $12.5 billion (in constant 2020 dollars). Table 1 illustrates the estimated cost savings associated with each redesign area. Moving forward, the Bureau plans to conduct additional research and testing and further refine the design through 2018. By August 2017, the Bureau plans to begin preparations for end-to-end testing, which is intended to test all systems and operations to ensure readiness for the 2020 Census. Figure 2 shows the timeline for planned 2020 Census research and testing. Concurrent with redesigning the decennial census, the Bureau has also begun a significant effort to modernize and consolidate its survey data collection and processing functions. This is being undertaken through an enterprise-wide IT initiative called Census Enterprise Data Collection and Processing (CEDCAP). This initiative is a large and complex modernization program intended to deliver a system-of-systems for all the Bureau’s survey data collection and processing functions—rather than continuing to rely on unique, survey-specific systems with redundant capabilities. For the 2020 Census, CEDCAP is expected to deliver the systems and IT infrastructure needed to implement the Bureau’s redesign areas. For example: To reengineer field work, CEDCAP is expected to implement a new dynamic operational control system to track and manage field work. This system is to be able to make decisions about which visits enumerators should attempt on a daily basis using real-time data, as well as provide automated route planning to make enumerator travel more efficient. CEDCAP also includes testing the use of mobile devices, either government-furnished or employee-owned, to automate data collection in the field. To maximize self-response with the Internet response option, CEDCAP is responsible for developing and testing a web-based survey application and exploring options for establishing the IT infrastructure to support the increased volume of data processing and storage that will be needed. CEDCAP consists of 12 projects that are to deliver capabilities incrementally, over the course of at least 10 releases. The Bureau plans to roll out capabilities for the 2020 Census incrementally through 6 of these releases, while also deploying capabilities for other surveys such as the American Community Survey and Economic Census. The Bureau expects to reuse selected systems, make modifications to other systems, and develop or acquire additional systems and infrastructure. As of August 2015, the CEDCAP program was projected to cost about $548 million through 2020. However, the Bureau’s past efforts to implement new approaches and systems have not always gone well. As one example, during the 2010 Census, the Bureau planned to use handheld mobile devices to support field data collection for the census, including following up with nonrespondents. However, due to significant problems identified during testing of the devices, cost overruns, and schedule slippages, the Bureau decided not to use the handheld devices for non-response follow-up and reverted to paper-based processing, which increased the cost of the 2010 Census by up to $3 billion and significantly increased its risk as it had to switch its operations to paper-based operations as a backup. Last month’s issuance of the 2020 Census Operational Plan, which documents many key decisions about the redesign of the 2020 Census, represents progress; however, the Bureau faces critical challenges in delivering the IT systems needed to support the redesign areas. Specifically, with preparations for end-to-end testing less than 2 years away, the window to implement CEDCAP, which is intended to be the backbone of the 2020 Census, is narrow. Additionally, while the Bureau has demonstrated improvements in IT management, as we have previously reported, it faces critical gaps in its IT workforce planning and information security. Until it takes actions we have previously recommended to address these challenges, the Bureau is at risk of cost overruns, schedule delays, and performance shortfalls, which will likely diminish the potentially significant cost savings that it estimates will result from redesigning the census for 2020. The Bureau has not prioritized key IT-related decisions, which is a trend we have reported for the past few years. Specifically, in April 2014, we reported the Bureau had not prioritized key IT research and testing needed for the design decisions planned for the end of 2015. In particular, the Bureau had not completed the necessary plans and schedules for research and testing efforts and had not prioritized what needed to be done in time for the 2015 design decisions—a milestone that had already been pushed back by a year (see fig. 3). We concluded that, given the current trajectory and the lack of supporting schedules and plans, it was unlikely that all planned IT-related research and testing activities would be completed in time to support the 2015 design decisions—which ultimately came to fruition (as discussed later). In light of these ongoing challenges, we recommended in our April 2014 report that the Bureau prioritize its IT-related research and testing projects that need to be completed to support the design decisions and develop schedules and plans to reflect the new prioritized approach. The Bureau agreed with our recommendations and has taken steps to address them. For example, in September 2014, the Bureau released a plan that identified inputs, such as research questions, design components, and testing, that were needed to inform the operational design decisions expected in the fall of 2015. However, as we reported in February 2015, the Bureau had not yet determined how key IT research questions that had been identified as critical inputs into the design decisions—estimating the Internet self- response rate and determining the IT infrastructure for security and scalability needed to support Internet response—were to be answered. We therefore recommended that the Bureau, among other things, develop methodologies and plans for answering key IT-related research questions in time to inform key design decisions. While the recent 2020 Census Operational Plan documents many key IT- related decisions about the redesign of the census, other critical questions, including the ones identified in our February 2015 report, remain unanswered. Of greater concern, the Bureau does not intend to answer these and other questions until 2016 through 2018. Specifically, there are several significant IT decisions that are being deferred, which have implications on the CEDCAP program’s ability to have production- ready systems in place in time to conduct end-to-end testing. For example, the Bureau does not plan to decide on the projected demand that the IT infrastructure and systems would need to accommodate or whether the Bureau will build or buy the needed systems until June 2016, at the earliest; the high-level design and description of the systems (referred to as the solutions architecture) until September 2016—leaving about a year to, among other things, build or acquire, integrate, and test the systems that are intended to serve as the backbone to the 2020 Census before preparations for end-to-end testing begins in August 2017; and the strategy for the use of mobile devices for field work until October 2017. Figure 4 illustrates several key IT-related decisions that have been deferred which will impact preparations for the end-to-end test and 2020 Census. Unless the Bureau makes these key decisions soon, it will likely run out of time to put CEDCAP systems in place. Institutionalizing key IT management controls, such as IT governance, system development methodology, and requirements management processes, helps establish a consistent and repeatable process for managing and overseeing IT investments and reduces the risk of experiencing cost overruns, schedule slippages, and performance shortfalls, like those that affected the previous census. However, in September 2012, we reported that the Bureau lacked a sufficiently mature IT governance process to ensure that investments are properly controlled and monitored, did not have a comprehensive system development methodology, and continued to have long-standing challenges in requirements management. We made several recommendations to address these issues, and the Bureau took actions to fully implement each of the recommendations. For example, the Bureau addressed gaps in policies and procedures related to IT governance, such as establishing guidelines on the frequency of investment review board meetings and thresholds for escalation of cost, risk, or impact issues; finalized its adoption of an enterprise system development life-cycle methodology, which included the short incremental development model, referred to as Agile, and a process for continuously improving the methodology based on lessons learned; and implemented a consistent requirements development tool that includes guidance for developing requirements at the strategic mission, business, and project levels and is integrated with its enterprise system development life-cycle methodology. As a result, the Bureau has established a consistent process for managing and overseeing its IT investments. Effective workforce planning is essential to ensure organizations have the proper skills, abilities, and capacity for effective management. While the Bureau has made progress in IT workforce planning efforts, many critical IT competency gaps remain to be filled. In September 2012 we reported, among other things, that the Bureau had not developed a Bureau-wide IT workforce plan; identified gaps in mission-critical IT occupations, skills, and competencies; or developed strategies to address gaps. Accordingly, we recommended that the Bureau establish a repeatable process for performing IT skills assessments and gap analyses and establish a process for directorates to coordinate on IT workforce planning. In response, in 2013 the Bureau completed an enterprise-wide competency assessment and identified several mission-critical gaps in technical competencies. In 2014, the Bureau established documents to institutionalize a strategic workforce planning process, identified actions and targets to close the competency gaps by December 2015, and established a process to monitor quarterly status reports on the implementation of these actions. However, as we reported in February 2015, while these are positive steps in establishing strategic workforce planning capabilities, the Bureau’s workforce competency assessment identified several mission-critical gaps that would challenge its ability to deliver IT-related initiatives, such as the IT systems that are expected to be delivered by CEDCAP. For example, the Bureau found that competency gaps existed in cloud computing, security integration and engineering, enterprise/mission engineering life- cycle, requirements development, and Internet data collection. The Bureau also found that enterprise-level competency gaps existed in program and project management, budget and cost estimation, systems development, data analytics, and shared services. The Bureau has taken steps to regularly monitor and report on the status of its efforts to close competency gaps and has completed several notable actions. For example, in August 2015, the Bureau filled the position of Decennial IT Division Chief and in September 2015 awarded an enterprise-wide IT services contract for systems engineering and integration support. However, more work remains for the Bureau to close competency gaps critical to the implementation of its IT efforts. Most significantly, in July 2015, the Chief Information Officer resigned. As of October 2015, the Bureau was working to fill that gap and had an acting Chief Information Officer temporarily in the position. Additionally, there are other gaps in key positions, such as the Chief of the Office of Information Security and Deputy Chief Information Security Officer, Big Data Center Chief, Chief Cloud Architect, and the CEDCAP Assistant Chief of Business Integration, who is responsible for overseeing the integration of schedule, risks, and budget across the 12 projects. According to Bureau officials, they are working to address these gaps. Critical to the Bureau’s ability to perform its data collection and analysis duties are its information systems and the protection of the information they contain. A data breach could result in the public’s loss of confidence in the Bureau, thus affecting its ability to collect census data. To ensure the reliability of their computerized information, agencies should design and implement controls to prevent, limit, and detect unauthorized access to computing resources, programs, information, and facilities. Inadequate design or implementation of access controls increases the risk of unauthorized disclosure, modification, and destruction of sensitive information and disruption of service. In January 2013, we reported on the Bureau’s implementation of information security controls to protect the confidentiality, integrity, and availability of the information and systems that support its mission. We concluded that the Bureau had a number of weaknesses in controls intended to limit access to its systems and information, as well as those related to managing system configurations and unplanned events. We attributed these weaknesses to the fact that the Bureau had not fully implemented a comprehensive information security program, and made 115 recommendations aimed at addressing these deficiencies. The Bureau expressed broad agreement with the report and said it would work to find the best ways to address our recommendations. As of October 29, 2015, the Bureau had addressed 66 of the 115 recommendations we made in January 2013. Of the remaining open recommendations, we have determined that 30 require additional actions by the Bureau, and for the other 19 we have work under way to evaluate if they have been fully addressed. The Bureau’s progress toward addressing our security recommendations is encouraging. However, more work remains to address the recommendations. A cyber incident recently occurred at the Bureau, and while it appears to have had limited impact, it demonstrates vulnerabilities at the Bureau. Specifically, in July 2015, the Bureau reported that it had been targeted by a cyber attack aimed at gaining access to its Federal Audit Clearinghouse, which contains non-confidential information from state and local governments, nonprofit organizations, and Indian tribes to facilitate oversight of federal grant awards. According to Bureau officials, the breach was limited to this database on a segmented portion of the Bureau’s network that does not touch administrative records or sensitive respondent data protected under Title 13 of the U.S. Code, and the hackers did not obtain the personally identifiable information of census and survey respondents. Given that the Bureau is planning to build or acquire IT systems to collect the public’s personal information for the 2020 Census in ways that it has not for previous censuses (e.g., web-based surveys, cloud computing, and enabling mobile devices to collect census data), continuing to implement our recommendations and apply IT security best practices as it implements CEDCAP systems must be a high priority. As a result of the Bureau’s challenges in key IT internal controls and its looming deadline, we identified CEDCAP as an IT investment in need of attention in our February 2015 High-Risk report. We recently initiated a review of the CEDCAP program for your subcommittees, and expect to issue a report in the spring of 2016. In conclusion, the Bureau is pursuing initiatives to significantly reform its outdated and inefficient methods of conducting decennial censuses. However, with less than 2 years remaining until the Bureau plans to have all systems and processes for the 2020 Census developed and ready for end-to-end testing, it faces challenges that pose significant risk to 2020 Census program. These include the magnitude of the planned changes to the design of the census, the Bureau’s prior track record in executing large-scale IT projects, and the current lack of a permanent Chief Information Officer, among others. Moreover, the Bureau’s preliminary decision deadline has come and gone, and many IT-related decisions have been deferred to 2016 through 2018. Consequently, it is running out of time to develop, acquire, and implement the production systems it will need to deliver the redesign and achieve its projected $5.2 billion in cost savings. The Bureau needs to take action to address the specific challenges we have highlighted in prior reports. If these actions are not taken, cost overruns, schedules delays, and performance shortfalls may diminish the potentially significant cost savings that the Bureau estimates will result from redesigning the census for 2020. Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have. If you have any questions concerning this statement, please contact Carol Cha, Director, Information Technology Acquisition Management Issues, at (202) 512-4456 or chac@gao.gov. Other individuals who made key contributions include Shannin O’Neill, Assistant Director; Andrew Beggs; Lee McCracken; and Jeanne Sung. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The cost of the nation's decennial census has steadily increased over the past 40 years; the 2010 Census was the most expensive to date, at about $13 billion. To achieve cost savings while still conducting an accurate count of the population, the U.S. Census Bureau is planning significant changes for the design of the 2020 Decennial Census, including major efforts to implement new technologies and IT systems supporting its surveys. For example, the Bureau is planning to offer an option for households to respond via the Internet, which requires developing new applications and IT infrastructure. This statement summarizes the critical challenges the Bureau faces in successfully delivering IT systems in time for testing redesigned 2020 Census operations. To develop this statement, GAO relied on previously published work, as well as information on steps the Bureau has taken to implement prior GAO recommendations. GAO has previously reported that the U.S. Census Bureau (Bureau) faces a number of critical challenges in developing and deploying the information technology (IT) systems and infrastructure it plans to rely on to conduct the significantly redesigned 2020 Census. Specifically, the Bureau has a major IT program under way to modernize and consolidate the multiple, duplicative systems it currently uses to carry out survey data collection and processing functions; however, with less than 2 years before preparations begin for end-to-end testing of all systems and operations to ensure readiness for the 2020 Census, there is limited time to implement it. While the Bureau documented many key decisions about the redesigned 2020 Census in the 2020 Census Operational Plan, released in October 2015, several key IT-related decisions have not been made. Specifically, the Bureau has not yet made decisions about the projected demand that the IT infrastructure would need to meet or whether it will build or buy the needed systems. This lack of prioritization of IT decisions has been a continuing trend, which GAO has previously identified. For example: In April 2014, GAO reported that the Bureau had not prioritized key IT research and testing needed for its design decisions. Accordingly, GAO recommended that the Bureau prioritize its IT-related research and testing projects. The Bureau had taken steps to address this recommendation, such as releasing a plan in September 2014 that identified research questions intended to inform the operational design decisions. In February 2015, however, GAO reported that the Bureau had not determined how key IT research questions that were identified in the September 2014 plan would be answered—such as the expected rate of respondents using its Internet response option or the IT infrastructure that would be needed to support this option. GAO recommended that the Bureau, among other things, develop methodologies and plans for answering key IT-related research questions in time to inform design decisions. However, this has not yet happened. In addition, while the Bureau has made improvements in some key IT management areas, it still faces challenges in the areas of workforce planning and information security. Specifically: It has taken steps to develop an enterprise-wide IT workforce planning process, as GAO recommended in 2012. However, the Bureau has yet to fill key positions. Most concerning, it is currently without a permanent chief information officer. The Bureau has taken steps to implement the majority of the 115 recommendations GAO made in 2013 to address information security weaknesses; however, completing this effort is necessary to ensure that sensitive information it will collect during the census is adequately protected. With the deferral of key IT-related decisions, the Bureau is running out of time to develop, acquire, and implement the systems it will need to deliver the redesign and achieve its projected $5.2 billion in cost savings. In its prior work, GAO made recommendations to the Census Bureau to prioritize IT testing and research and determine how key decisions for the 2020 Census were to be answered. GAO also made recommendations to improve IT management, workforce planning, and information security. The Bureau has taken steps to address selected recommendations, but more actions are still needed to fully address these recommendations.