U.S. Attorneys prosecute criminal cases brought forward by the federal government, prosecute and defend civil cases in which the United States is a party, and collect debts owed to the federal government that are administratively uncollectible. EOUSA was established in 1953 as a component of the Department of Justice to, among other things, provide general executive assistance and administrative and operational support to the 93 USAOs located throughout the 50 states, the District of Columbia, Guam, the Marianas Islands, Puerto Rico, and the U. S. Virgin Islands and to coordinate with other Department of Justice organizational units and other federal agencies on behalf of the U.S. Attorneys. One of EOUSA’s key responsibilities is managing the USAOs’ IT resources, including preparing their annual IT budget submissions and supporting their acquisition and maintenance of IT assets. IT plays an important role in helping the USAOs meet their mission objectives and, according to EOUSA planning documents, the USAOs’ reliance on IT is to increase in response to expected growth in the number and complexity of their cases. Currently, EOUSA manages an IT environment consisting of central and distributed computing and communication resources in Washington, D.C., and 93 USAOs, respectively. Connectivity among these offices, Justice headquarters, and Justice’s Data Center in Rockville, MD, is through a virtual private network (VPN) connection on the Justice Consolidated Network (JCN), with such security safeguards as firewalls between USAO local area networks and JCN. The VPN/firewall combination, which provides the foundation for secure communications between EOUSA and the sites mentioned above, is currently being replaced. Figure 1 generally depicts EOUSA’s network topology. The USAOs’ support is also provided by such application systems as the Legal Information Office Network System, which is a case management system that compiles, maintains, and tracks information about defendants, crimes, criminal charges, court events, and witnesses, and the Victim Notification System, which notifies crime victims of the status of their cases and assists with checking compliance with regulations and policies concerning victim notification. Recognizing the importance of IT to achieving the USAOs’ mission, EOUSA appointed a Chief Information Officer (CIO) in May 2001 and assigned the CIO accountability and responsibility for managing central and distributed IT resources and services, including managing the IT budget for the office and all of the USAOs; developing and acquiring new systems, including case management systems, and providing support for existing systems; managing network, telephone, and video communications; and securing IT assets (data, applications, and supporting networks). In fiscal year 2003, EOUSA reports that it plans to spend approximately $125 million on about 20 initiatives. Roughly $110 million of this amount is to be spent on IT infrastructure and office automation projects (e.g., telecommunications programs). The remainder is to be spent on acquiring mission support systems (e.g., Enterprise Case Management System (ECMS), Victim Notification System) and maintaining existing ones. Figure 2 shows the breakdown of estimated expenditures for fiscal year 2003. Research into the IT management practices that are employed by leading public- and private-sector organizations has identified key institutional IT management disciplines that are interrelated and critical to ensuring, among other things, the integrity, security, and efficiency of IT systems. These disciplines are also addressed in legislation and federal guidance. 1. enterprise architecture management, which involves defining, maintaining, and implementing an institutional blueprint that defines both the business and the supporting technology of the organization’s current and target operating environments and a roadmap to achieve the target environment; 2. IT investment management, which involves selecting, controlling, and evaluating a portfolio of investments within the context of an enterprise architecture; 3. IT security management, which involves protecting the integrity, confidentiality, and availability of an organization’s IT assets (e.g., data, application systems, and networks) and reducing the risks of tampering, unauthorized intrusions and disclosures, and disruption of operations. 4. system acquisition management, which involves managing selected investments (system projects) in a manner that increases the probability of promised system capabilities being delivered on time and within budget. As we have previously reported, to successfully institutionalize these disciplines, organizations should develop integrated plans to guide their efforts that (1) specify measurable goals, objectives, and milestones; (2) specify needed resources; and (3) assign clear responsibility and accountability for accomplishing well-defined tasks. In addition, these plans should be approved by senior management. In implementing these plans, it is important that organizations allocate adequate resources and measure and report progress against planned commitments and that appropriate corrective actions be taken to address deviations. EOUSA has defined and implemented each of the four IT management disciplines mentioned above to some degree. However, none has been institutionalized, meaning that they are not fully defined in accordance with best practices and what has been defined has not been fully implemented. While these disciplines have been given attention since the recent appointment of the CIO, they have not been treated as priorities, in that action plans needed for successful institutionalization have not been developed or resourced. As a result, EOUSA is currently limited in its ability to meet Justice’s strategic goal of improving its IT systems, and the USAOs will be challenged in their ability to effectively and efficiently meet their mission goals and priorities. An enterprise architecture (EA) is an investment blueprint that defines, both in logical terms (including business functions and applications, work locations, information needs and users, and the interrelationships among these variables) and in technical terms (including hardware, software, data communications, and security) how an organization operates today (“as is”), how it intends to operate tomorrow (“to be”), and a roadmap for transitioning from today to tomorrow. The development, maintenance, and implementation of architectures are recognized hallmarks of successful public and private organizations. According to a guide published by the federal CIO Council,effective architecture management consists of a number of core elements. In February 2002, we published version 1.0 of our EA management maturity framework, which arranges the core elements of the CIO Council’s guide into five hierarchical stages. The framework provides an explicit benchmark for gauging the effectiveness of architecture management and provides a roadmap for making improvements. Table 1 summarizes the framework’s five stages of maturity. EOUSA has satisfied many of the framework’s core elements. Specifically, it has satisfied about 80 percent of the elements associated with building the EA management foundation—stage 2 of our EA management maturity framework—and half of the 12 core elements associated with higher maturity stages. At stage 2, it has established a chief architect and has selected a framework (the Federal Enterprise Architecture Framework) and, according to officials, selected a tool (the Enterprise Architecture Management System) to serve as a repository for its EA artifacts. At the higher stages of our framework, the CIO, for example, approved a version of an EA in May 2002 that describes the “as is” and “to be” environments for its core business functions. However, the office has yet to satisfy several of the core elements that are critical to effective EA management. For example, a committee or group representing the enterprise has not yet been established to guide and oversee the development of future versions of the architecture. Instead, the current version of its architecture has been primarily guided and directed by the CIO’s office. Until a committee or group representing the enterprise is established, there is increased risk that the architecture will not represent a corporate decision-making tool and will not be viewed and endorsed officewide as such a tool. Another example is the absence of a written or approved policy for maintaining the EA. Without a documented, approved policy for EA maintenance that, for example, assigns responsibility and accountability for configuration management and version control, EOUSA risks allowing its architecture to become outdated and irrelevant, thus limiting its effectiveness in selecting and guiding IT investments. EOUSA does not have a written plan of action for strengthening EA management and evolving the current version of its EA, because, according to the CIO, developing such a plan is not a priority. Table 2 shows EOUSA’s performance in addressing the core elements of our maturity framework. Effective IT investment management provides for evaluating each proposed and ongoing investment, based on EA alignment and measurable risks and returns and for selecting and controlling these investments as a portfolio of competing investment options. We have developed a framework that defines and measures an organization’s maturity in IT investment management (ITIM) and provides a basis for improving investment management. This framework, which is based on the IT investment management practices of leading private- and public-sector organizations, is structured to permit progression through five maturity stages (shown in table 3). Each maturity stage consists of critical processes and key practices that should be implemented for an organization to become more effective in managing its IT investments. According to the framework, the first key step toward an effective investment management process is to build the investment foundation. An organization with this foundation (stage 2 maturity) has attained repeatable, successful investment control processes and basic selection processes at the project level. Successful management at this level allows an organization to measure the progress of existing IT projects and to identify variances in cost, schedule, and performance expectations by following established, disciplined processes. The organization should also be able to take corrective action, if appropriate, and should possess basic capabilities for selecting new project proposals. To accomplish this level of basic control, an organization should establish an investment board, identify the business needs and opportunities to be addressed by each project, and use this knowledge in the selection of new proposals. The office has satisfied two of the critical processes for stage 2, but it has not satisfied the other three. Specifically, it has established an investment governing board, known as the Investment Review Board (IRB) and developed a guide to direct its operations. It is also defining project needs in alignment with the agency’s mission goals. However, the office has not, for example, defined procedures for project oversight. In addition, while an IT project and systems inventory exists as part of its “as is” architecture, a policy specifying how it will be used for investment management purposes has not been defined. Until EOUSA satisfies all critical processes for stage 2, it will not have the foundation it needs to build its investment management capability and it will not have an effective investment process. Table 4 summarizes our assessment of stage 2 capabilities. EOUSA has not demonstrated that maturing its IT investment management process is a priority by developing a plan for doing so and devoting resources to execute the plan. Until the office develops and implements a plan for establishing mature IT investment management processes (including all critical processes for building the investment management foundation), EOUSA will not have the full suite of capabilities it needs to ensure that project selection and control processes are repeatable or that it has the best mix of investments to meet agency priorities. Effective information security management is critical to EOUSA’s ability to ensure the reliability, availability, and confidentiality of its information assets, and thus it is fundamental to its ability to perform its mission. Our research into public- and private-sector organizations with strong information security programs shows that leading organizations’ programs include (1) establishing a central security focal point with appropriate resources, (2) continuously assessing business risks, (3) implementing and maintaining policies and controls, (4) promoting awareness, and (5) monitoring and evaluating the effectiveness of policies and controls. Currently, EOUSA is not fully satisfying any of these tenets of effective security. In addition, it has not demonstrated that institutionalizing effective security practices is a priority by developing a plan to guide its efforts to address security weaknesses and committing resources to perform essential security functions. Until such a plan is developed and effectively implemented, data, systems, and networks are at risk of inadvertent or deliberate misuse, fraud, improper disclosure, or destruction—possibly without detection. For example, the reliability and integrity of case information may be compromised, or sensitive crime victim information may be improperly disclosed. According to our framework, central management of key security functions is the foundation of an effective information security program, because it allows knowledge and expertise to be incorporated and applied on an enterprisewide basis. Having a central security focal point supported by appropriate resources is especially important for managing the increased risks associated with a highly connected computing environment, such as JCN, where security weaknesses in one segment of an organization’s network can compromise the security of another segment’s IT assets. In addition, centralizing the security management function provides a focal point for coordinating the activities associated with the other four elements of a strong information security program. In June 2001, EOUSA appointed a security officer with responsibility for centrally managing all aspects of IT security. However, EOUSA has not assigned sufficient staff to adequately carry out these responsibilities. For example, no staff has been assigned to monitor firewall logs or support the development of a centrally managed IT security training program— activities that fall under the security officer’s purview. Each of these activities is discussed further in the following sections. Officials said that they recognize the need for additional staff resources to perform these activities. They also stated that they were in the process of hiring two people to support security functions, but they agreed that this would still not allow for performance of key security responsibilities. Without an appropriately resourced security program, security breaches may not be detected or addressed in a timely manner, awareness of security requirements across the organization may be inconsistent, and vulnerabilities in the current IT environment may not be appropriately addressed. According to our framework, identifying and assessing business risks is an essential step in determining what IT security controls are needed and what resources should be invested in these controls. Federal guidance advocates performing risk assessments at least once every 3 years—or when a significant change in a system or the systems environment (e.g., new threats) has occurred. These assessments should address the risks that are introduced through connections to other networks and the impact on an organization’s mission should network security be compromised. In line with this guidance, EOUSA’s certification and accreditation process requires that a risk assessment be completed for each system before any office can use it. According to EOUSA, a major system that recently underwent EOUSA’s certification and accreditation process is the replacement for the existing firewall/VPN system. This system is intended to be the foundation for secure communications between EOUSA, Justice, and the geographically dispersed USAOs. Accordingly, we analyzed this system and found that while the firewall/VPN replacement system has been certified and accredited, the existing firewall/VPN system—which was deployed in 1996 and, as of May 9, 2003, was operating at 75 of the 240 sites—had not had a risk assessment performed and had not been certified and accredited. Officials told us that they have not performed such an assessment on this network because (1) it is not cost-effective to use limited resources to perform an assessment on a network that is to be fully replaced by June 30, 2003, and (2) the risks inherent in the network are minimal, given that it resides on Justice’s JCN, for which they said they assume Justice had performed risk assessments. We agree that it does not make sense at this point to perform a risk assessment on the existing firewall/VPN system given that the replacement system is expected to be fully deployed by the end of June 2003. However, this does not change the fact that EOUSA has operated the network for about 7 years without understanding its exposure to risk. This is particularly important, because EOUSA officials could not provide us with evidence to support the assumption that Justice had performed a risk assessment for JCN. Moreover, previous studies have shown that Justice has had long-standing weaknesses in several aspects of its IT security program. According to EOUSA, its recently established certification and accreditation program will not allow this to happen again. According to our framework, risk-based, cost-effective security policies and related technology controls (such as firewalls configured to explicit rules and intrusion detection devices located to monitor key network assets) and procedural controls (such as contingency plans) are needed to protect a system from compromise, subversion, and tampering. Federal and Justice guidance also advocate establishing these policies and controls. While EOUSA is guided by many Justice security policies, it has not yet implemented key security controls that are needed to satisfy them. For example, CIO officials told us that the existing firewall/VPN system, which, as of May 9, 2003, was operating at 75 sites, is not based on explicit firewall rules. Moreover, according to these officials, no intrusion detection devices monitor the wide-area network (WAN) routers, firewalls, and VPN devices. Rather, the intrusion detection devices that are currently implemented are located only within the local area network environment (i.e., within a USAO). Also, the contingency plan developed for the replacement firewall/VPN system was not prepared according to federal guidelines. For example, the contingency plan does not specify procedures for notifying recovery personnel or assessing damage to systems. CIO officials told us that they had not implemented these security controls because, as previously noted, they believe the risks inherent in the network are minimal given that it resides on Justice’s JCN, for which they said they assumed Justice had performed risk assessments. However, as previously stated, EOUSA provided no evidence to support this assumption, and Justice has had longstanding security weaknesses. Until EOUSA implements security controls, it may be unaware of vulnerabilities, increasing the risk that intruders may take control of network devices or that data passing through its firewalls can be read or manipulated. In addition, EOUSA may not be able to respond to security breaches adequately and in a timely manner. This is particularly threatening given the sensitivity of the information used by the USAOs in performing their work. According to our framework, promoting user awareness through education and training is essential to successfully implementing information security policies, achieving user understanding of security policies, and ensuring that security controls are instituted properly. This is because computer users—and others with access to information resources—are not able to comply with policies of which they are unaware or which they do not fully understand. Our framework suggests that a central group be tasked with educating users about current information security risks and helping to ensure consistent understanding and administration of policies. As previously mentioned, the security officer is responsible for promoting awareness of computer security. However, the security officer does not carry out this responsibility because provision of the resources to do so has not been viewed as an agency priority. According to the security officer, each district is thus responsible for managing its own IT training program, and the security officer does not know to what extent these programs address awareness of computer security. Without a centralized approach to security education and training, the security officer cannot adequately ensure that users are consistently aware of or fully understand the organizational policies and procedures with which they are expected to comply, thus risking the integrity, reliability, and confidentiality of data and systems. According to EOUSA officials, they plan to hire staff to develop and implement a centralized program by August 2003. Our framework recognizes the need to continuously monitor controls, through tests and evaluations, to ensure that the controls have been appropriately implemented and are operating as intended. Further, Justice’s policy requires annual testing of security controls and requires EOUSA to (1) verify that the policies and procedures in component organizations are consistent with this policy and (2) enforce compliance with component and Justice security policies, including identifying sanctions and penalties for noncompliance. In addition, our framework and related best practices—as well as Justice’s own policy—advocate keeping summary records of security incidents, to allow measurement of the frequency of various types of violations and the damage suffered from these incidents. This type of oversight is critical because it enables management to identify problems and their causes—and to make the necessary corrections. CIO officials told us that testing has never been conducted to determine whether EOUSA’s policies and procedures are consistent with Justice’s and whether security controls are generally effective. According to these officials, testing has not been a priority because they assumed that Justice was performing tests of the WAN environment. However, Justice officials told us that, although they had evaluated the contractor’s management of the WAN’s circuits, they had not performed any tests to determine the effectiveness of technical and other controls associated with the WAN. The lack of testing heightens the risk that individuals both within and outside Justice could compromise EOUSA’s external and internal security controls to gain extensive unauthorized access to its networks and to networks to which it is connected. EOUSA officials also told us that, contrary to Justice’s policy, they do not maintain summary records of security incidents. Specifically, the production firewall/VPN software and routers at over 240 locations do not have audit logs that are activated, and the replacement routers, firewalls, and VPN devices are being implemented with no audit logs activated. According to these officials, they have not activated the audit logs because resources have not been allocated to provide for this security control. This lack of auditing heightens the risk of undetected intruders using EOUSA’s systems to modify, bypass, or negate its firewalls and routers. Additionally, without these audit logs the office would be unable to reconstruct security- related incidents. Rigorous and disciplined system acquisition processes and practices can reduce the risk of fielding systems that do not perform as intended, are delivered late, or cost more than planned. The Software Engineering Institute (SEI), recognized for its expertise in acquiring software-intensive systems, has published models and guides for determining an organization’s acquisition process maturity. One of those models, referred to as the Software Acquisition Capability Maturity Model (SA-CMM), addresses an organization’s acquisition management ability. The SA-CMM model defines organizational maturity according to five levels (see table 5). According to SEI, level 2 (the repeatable level) demonstrates that basic management processes, known as key process areas, have been established to track performance, cost, and schedule, and that the organization has the means to repeat earlier successes on similar projects. An organization that has these processes in place is in a much better position to successfully acquire software-intensive systems than an organization that does not. As a Justice component, EOUSA must comply with all departmental policies and procedures, including Justice’s system development life-cycle management guidance. Since EOUSA officials told us that the Enterprise Case Management System (ECMS), which is intended to be the enterprise solution for managing and tracking case workload within the USAOs, is the first acquisition effort to follow Justice guidance from its inception, we compared this project, and the Justice guidance used to manage it, against SEI’s SA-CMM, and we found that the project was being managed in accordance with the majority of the applicable level 2 practices. Table 6 represents a summary of our findings for this acquisition (see app. I for an expanded analysis). More specifically, the office has performed all of the key practices in the requirements development and management and project management key process areas. These include (1) establishing a written policy for developing and managing system-related contractual requirements; (2) having bi-directional traceability between the contractual requirements and the contractor’s work products and services; (3) measuring and reporting to management on the status of requirements development and management activities; (4) designating responsibility for project management; (5) keeping plans current during the life of the project as re- planning occurs, issues are resolved, requirements are changed, and new risks are discovered; and (6) tracking the risks associated with cost, schedule, resources, and the technical aspects of the project. EOUSA has also performed the majority of the key practices in the remaining four process areas. However, it does not have written policies for either the contract tracking and oversight or the software acquisition planning key process areas. Policies in general are key to establishing well-defined and enduring processes and procedures. In these two areas, policies would ensure that the office’s approach to tracking and overseeing contractors and planning the acquisition is defined in a repeatable and measurable fashion. In addition, during the solicitation process, the office did not document its plans for solicitation activities, which would provide those involved with objectives for the solicitation process and a defined way to manage and control solicitation activities and decisions. In evaluation, the office has yet to satisfy 9 of the 15 required practices. Officials told us that they intend to satisfy them but that they do not have a plan for addressing those practices or for implementing all of the required practices on future system acquisitions. According to these officials, developing such a plan is currently not a priority. By developing and implementing a plan for satisfying all of these key process areas on ECMS and future acquisitions, EOUSA can increase its chances of successfully acquiring needed system capabilities on time and within budget. EOUSA has taken important steps to define and implement four key IT management disciplines. Nevertheless, key aspects of each discipline have yet to be institutionalized, leaving the office challenged in its ability to achieve the department’s strategic goal of improving the integrity, security, and efficiency of its IT systems. Critical to the office’s success going forward will be treating institutionalization of each of these management disciplines as priority matters by developing integrated plans of action for addressing the weaknesses that we identified in each and effectively implementing these plans—including assignment of appropriate resources and measurement and reporting of progress. Without taking these steps, EOUSA is unlikely to fully establish the IT management capabilities it needs. To strengthen the office’s IT management capacity and increase its chances of improving the integrity, security, and efficiency of its IT systems, we recommend that the Attorney General direct the EOUSA Director to treat institutionalization of EA management, IT investment management, IT security management, and system acquisition management as priorities by developing and implementing action plans to address the weaknesses in each discipline that are identified in this report. These plans should, at a minimum, provide for accomplishing the following: establish a committee or group representing the enterprise that is responsible for directing, overseeing, or approving the EA; ensure that EA products are under configuration management; define, approve, and implement a policy for IT investment compliance specify metrics for measuring EA benefits; and define, approve, and implement a policy for maintaining the EA. For IT investment management, regularly oversee each IT project’s progress toward cost and schedule milestones, using established criteria, and require corrective actions when milestones have not been achieved; define and implement a policy for using the IT project and systems inventory for managerial decision making; and ensure that an established, structured process is used to select new IT proposals. For IT security management, allocate the appropriate resources to enable the responsibilities of the security officer to be fully performed; ensure that risk assessments are performed on all existing and future implement intrusion detection devices to monitor activity at the routers, firewalls, and VPN devices, and implement other network security controls as noted in the report; develop and implement a centralized approach to security education and training; and perform regular tests to determine compliance with policies and procedures and the effectiveness of security controls. For system acquisition management, develop and implement a policy for contract tracking and oversight; develop and implement a policy for system acquisition planning; and address the remaining key practices associated with evaluation as ECMS progresses in the life cycle; and ensure that the Software Engineering Institute acquisition practices identified in this report are used in future system acquisitions. In developing these plans, the Director should ensure that each plan (1) is integrated with the other three plans; (2) defines clear and measurable goals, objectives, and milestones; (3) specifies resource needs; and (4) assigns clear responsibility and accountability for implementing the plan. In implementing each plan, the Director should ensure that the needed resources are provided and that progress is measured and reported periodically to the Attorney General. In written comments on a draft of this report signed by the EOUSA Director (reprinted in app. III), the office agreed with our findings relative to enterprise architecture management, IT investment management, and system acquisition management. EOUSA also agreed with our recommendations in these three areas and stated that it intends to implement the recommendations. However, EOUSA stated that it disagreed with our findings and our recommendations regarding information security management, although at the same time it cited certain actions that it intends to take, such as implementing a centralized security training program and monitoring security audit logs, that are consistent with our security findings and associated recommendations. Further, the office disagreed that the state of its efforts to institutionalize best management practices in the four areas is due to it not treating each area as an office priority. It also disagreed with our conclusion that the state of its efforts to institutionalize best practices currently limits its ability to meet Justice’s strategic goal of improving its IT systems, and that the USAOs will be challenged in their ability to effectively and efficiently meet mission goals and priorities. Each of these three areas of disagreement is addressed below. First, with respect to information security management, EOUSA stated that it has one of the strongest security programs in Justice, and perhaps the federal government. To support this statement, the office cited 10 security initiatives it has implemented, such as certification and accreditation of more than eight systems, real-time encryption of all data in laptops and handheld devices, and conduct of vulnerability assessments and penetration testing. It also noted, among other things, that it had added 10 field security positions and 2 headquarters positions, and that its data are monitored 24 hours a day, seven days a week, and have never been compromised. We do not question these statements concerning the office’s information security program and associated activities because (1) the purpose and scope of our review was not to compare EOUSA to other Justice component organizations or other federal agencies, and thus EOUSA’s relative standing is not relevant to the findings in our report and (2) the message of our report is not that EOUSA has not taken steps to improve its information security posture, but rather that the office’s information security management efforts, including ongoing and complete improvement steps, are weak in a number of areas relative to information security management best practices. Accordingly, we make recommendations aimed at addressing identified weaknesses, including a recommendation to implement network intrusion detection devices and other security controls. While EOUSA’s comments cited plans that are consistent with many of our security-related recommendations, it disagreed with the recommendation relative to its wide area network on the grounds that this network is managed, secured, and monitored by Justice and Sprint. We understand that the WAN is not managed by EOUSA, and accordingly our recommendation was aimed at actively monitoring the network routers, firewalls, and VPN devices, which are managed by EOUSA. To avoid any confusion about this recommendation, we have clarified its wording to better reflect our intentions. Similarly, in light of the recent progress that EOUSA has made replacing its VPN system, we have adjusted our finding and recommendation concerning the office’s exposure to risk from its old VPN system. Second, with respect to our statements that EOUSA has not treated institutionalization of each of the four IT management disciplines— enterprise architecture management, IT investment management, system acquisition management, and information security management—as agency priorities, the office stated that these statements were unfair and that it did not agree with them. To support its position, EOUSA made the following two points: (1) it has made tremendous progress, as evidenced by our report recognizing those best practices that it is satisfying, and (2) it has received the highest level of support from Justice, as evidenced by the establishment of the EOUSA CIO position in 2001, the progress that has been made in the last 2 years compared to other Justice component organizations, and EOUSA’s being viewed by Justice senior management as a leader in IT management. We do not challenge EOUSA’s two points because they are not relevant to our position regarding treating institutionalization of each of the four IT management disciplines as agency priorities. Our position is based on two facts that EOUSA did not dispute: (1) plans for addressing the weaknesses cited in our report do not exist and (2) limitations in resources to address these weaknesses were cited by EOUSA officials as the reason why the weaknesses exist. In our view, if each of these areas were an agency priority, then plans would be in place to address the weaknesses, and resources to execute the plans would be committed. Third, with respect to our conclusion that EOUSA is currently limited in its ability to meet Justice’s strategic goal of improving its IT systems, and that the USAOs are thereby challenged in their ability to effectively and efficiently meet their mission goals and objectives, the office disagreed but did not offer any comments to counter our conclusion beyond those cited above. Given that any organization’s ability to effectively leverage technology is determined in large part by its institutionalized capabilities in these four IT disciplines, we have not modified our conclusion. EOUSA provided additional comments that have been incorporated in the report as appropriate. EOUSA’s written comments are reproduced in appendix III, along with our detailed evaluation of each comment. As arranged with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after the date of this letter. At that time, we will send copies of this report to interested congressional committees. We will also send copies to the Director of the Office of Management and Budget, the Attorney General of the United States, the EOUSA Director, and the EOUSA CIO. We will also send copies to others upon request. In addition, copies will be available at no charge on our Web site at www.gao.gov. Should you or your offices have questions on matters discussed in this report, please contact me at (202) 512-3439. I can also be reached by E-mail at hiter@gao.gov. An additional GAO contact and staff acknowledgments are listed in appendix IV. Our objective was to determine the extent to which the Executive Office for United States Attorneys (EOUSA) has institutionalized key information technology (IT) management capabilities to achieve the Department of Justice’s strategic goal of improving the integrity, security, and efficiency of its IT systems. To meet this objective, we focused on whether EOUSA had institutionalized four key IT management disciplines: enterprise architecture management, IT investment management, information security management, and system acquisition management. To evaluate EOUSA’s enterprise architecture (EA) management, we first solicited responses to an EA management questionnaire, reviewed EA plans and products, and interviewed officials to verify their responses. Next, we compared the information that we had collected with GAO’s February 2002 EA management maturity framework to determine the extent to which EOUSA was employing effective EA management practices. This framework is based on the Practical Guide to Federal Enterprise Architecture, published by the Chief Information Officers’ (CIO) Council. We did not use the revised framework issued in April 2003 because, by then, we had already completed our work. To evaluate EOUSA’s IT investment management (ITIM), we used GAO’s ITIM framework and assessed the extent to which EOUSA had satisfied the critical processes associated with stage 2 of the five-stage framework—building the investment foundation. We focused on stage 2 processes because officials told us that they had only recently begun defining and implementing the specific practices that are associated with this stage. To conduct our assessment, we reviewed relevant EOUSA and Justice policies, procedures, guidance, and documentation—including the office’s investment management guide and associated memorandums, project proposals, and budget documents. We also interviewed the CIO and the senior official who is responsible for implementing IT investment management. We then compared this information with our maturity framework to determine the extent to which the office was employing effective IT investment management practices. To evaluate EOUSA’s information security management, we used our executive guide for information security management, as well as Justice policy and guidance and relevant EOUSA U.S. Attorney Procedures.We reviewed internal Justice and other reports identifying security weaknesses at Justice and EOUSA and information on how these weaknesses will be addressed. We also reviewed the certification and accreditation package and the deployment schedule for the virtual private networkthat the office is currently deploying, because EOUSA and the USAOs rely on this network to carry out its mission. We interviewed Justice officials and EOUSA officials within the Office of the CIO about the office’s security management. To evaluate EOUSA’s system acquisition management, we used the Software Engineering Institute’s Software Acquisition Capability Maturity Model, focusing on six of the seven key process areas that are defined for level 2 of the model’s five-level maturity scale. We focused on level 2 processes because they represent the minimum level of maturity needed to effectively manage system acquisition projects. We used the office’s acquisition of the Enterprise Case Management System as a case study because officials stated that it is representative of how they intend to acquire systems. In addition, this system will be critical in providing fundamental support to the U.S. Attorneys as they work to achieve mission goals. We reviewed key project documentation, such as the concept of operations, project plan, and requirements traceability matrix, and we interviewed system acquisition officials. We also reviewed the Justice guidance used to manage the project. We then compared this information to the Software Acquisition Capability Maturity Model to determine the extent to which the office was employing effective system acquisition management practices. We performed our work at EOUSA headquarters in Washington, D.C., from November 2002 to May 2003, in accordance with generally accepted government auditing standards. The following are GAO’s comments on the Department of Justice’s letter dated June 16, 2003. 1. We disagree. Our position that institutionalization has not been a priority is based on two facts that EOUSA did not dispute: (1) plans for addressing the weaknesses cited in our report do not exist and (2) limitations in resources to address these weaknesses were cited by EOUSA officials as the reason why the weaknesses exist. If each of these areas were an agency priority, then plans would be in place to address the weaknesses, and resources to execute the plans would be committed. 2. We do not question EOUSA’s statement that it has made “tremendous progress.” Our work focused on determining the extent to which EOUSA currently satisfies key practices in the four IT management disciplines. It did not include developing a baseline from which to measure progress. To EOUSA’s credit, our review showed that the office has satisfied many key practices in each discipline, and we have noted this in our report. 3. We agree and include both of these facts in our report. 4. We disagree. EOUSA’s comments did not include any information to refute our conclusion. Given that it did not have a plan for fully implementing best practices for each discipline, and had not allocated adequate resources to support such a plan, we have not modified our conclusion. 5. We do not question these statements about the position of EOUSA and the USAOs relative to other Justice components. Such a comparison was not part of the scope of our work. 6. We disagree. EOUSA has not gained this maturity level. Rather, according to EOUSA, the contractor that maintains its LIONS application is certified as a level 3 software developer. In contrast, our work focused on EOUSA’s capabilities as a software acquirer, and thus addresses a different organization, discipline, and maturity model. 7. See comment 1. 8. We do not question this statement because the position of EOUSA and the USAOs relative to other Justice components or other law enforcement entities was not part of the scope of our work. 9. As noted in our report, EOUSA satisfied about 80 percent of the elements of just stage 2 of the EA management framework. It has satisfied about 60 percent of the elements (12 out of 19) of the entire framework. 10. We have modified the report to reflect this comment. 11. We agree. However, according to GAO’s IT Investment Management Framework, to satisfy the proposal selection critical process, EOUSA would need to demonstrate the use of the criteria it has defined. Because it has not yet done so, it is not satisfying the critical process and thus has met two out of five elements of stage 2 of the framework. 12. We disagree. Our assessment is based on EOUSA’s satisfaction of key practices laid out in our executive guide for information security management. This assessment showed that EOUSA has not fully satisfied any of these key practices. For example, EOUSA does not (1) have a central security focal point with appropriate resources, (2) adequately promote user awareness, and (3) regularly monitor the effectiveness of security controls. Until EOUSA addresses these and other security weaknesses we identify in our report, it will not have implemented effective security practices. 13. See comment 8. 14. We do not question this statement because determining whether the data of the United States Attorneys have never been compromised and are monitored 24 hours a day, 7 days a week was not within the scope of our work and EOUSA did not provide any evidence supporting its assertions. 15. See comment 1. Additionally, our finding is that the institutionalization of information security management has not been an agency priority. 16. We do not question these security initiatives. Additionally, we emphasize that our message is not that EOUSA has not taken steps to improve its information security posture, but rather that the office’s information security management efforts, including ongoing and completed improvement steps, are weak in a number of areas relative to information security management best practices. 17. We agree, but would add that our recommendation could be addressed by actively monitoring activity at the routers, firewalls, and wide area network devices, which we understand are remotely managed by EOUSA. To avoid any potential confusion on this point, we have clarified our recommendation. Implementing an intrusion detection system to monitor activity at the routers, firewalls, and other network devices would enable EOUSA to detect hostile attempts to manage those devices. 18. We do not question EOUSA’s statement that it has been working to resolve vulnerabilities identified during a security audit conducted by the Justice Inspector General. The scope of the Inspector General’s audit, however, was narrower than ours in that it focused on EOUSA’s local area network environment. 19. We agree that given EOUSA’s recent progress in deploying the replacement network its exposure to risk is currently limited. We have modified the security risk assessment section of the report and the associated recommendation to reflect this change in circumstances. 20. We agree and thus do not conclude that EOUSA’s risk assessment program is inadequate. Rather, based on the fact that a risk assessment was not performed on the network that EOUSA has operated since 1996 and, until recently, relied exclusively on, we conclude that EOUSA has not always performed risk assessments. Additionally, to recognize the recent change in circumstances we have modified our recommendation concerning risk assessments. 21. We do not question these statements. We support the use of automated tools to review audit logs, particularly because these logs were not being reviewed, and EOUSA attributed this to a lack of resources. We also support EOUSA’s plan to conduct regular tests to determine compliance with policies and procedures. Both of these planned actions are consistent with our recommendations. 22. We do not question this statement. However, as noted in our report, the office did not have a plan to address the issues that are discussed in our report. 23. We do not question these statements because our review did not address contingency plans for all certified and accredited systems. As stated in the report, while a contingency plan was developed for the replacement network, it was not prepared in accordance with federal guidelines. For example, the plan did not specify procedures for notifying recovery personnel. To clarify our position, we have added examples to the report of this plan’s noncompliance with federal guidelines. 24. We support EOUSA’s stated commitment to establish a centralized security training program. Establishing such a program is consistent with our recommendations. 25. We have modified the report to reflect that the Enterprise Case Management System is the first acquisition to follow the Justice life- cycle methodology from its inception. 26. See comment 6. 27. We have modified the report to reflect that EOUSA’s acquisitions are processed through the department and must comply with all departmental policies and procedures. In addition to the individual named above, Nabajyoti Barkakati, Jamey Collins, Joanne Fiorino, Anh Q. Le, Sabine R. Paul, and William F. Wadsworth made key contributions to this report. The General Accounting Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older products. The Web site features a search engine to help you locate documents using key words and phrases. You can print these documents in their entirety, including charts and other graphics. Each day, GAO issues a list of newly released reports, testimony, and correspondence. GAO posts this list, known as “Today’s Reports,” on its Web site daily. The list contains links to the full-text document files. To have GAO e-mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to e-mail alerts” under the “Order GAO Products” heading.

Summary: The Executive Office for United States Attorneys (EOUSA) of the Department of Justice is responsible for managing information technology (IT) resources for the United States Attorneys' Offices. GAO was asked to determine the extent to which EOUSA has institutionalized key IT management capabilities that are critical to achieving Justice's strategic goal of improving the integrity, security, and efficiency of its IT systems. To varying degrees, EOUSA has partially defined and implemented certain IT management disciplines that are critical to successfully achieving the Justice Department's strategic goal of improving the integrity, security, and efficiency of its IT systems. However, it has yet to institutionalize any of these disciplines, meaning that it has not defined existing policies and procedures in accordance with relevant guidance, and it has yet to fully implement what it has defined. In particular, while EOUSA has developed an enterprise architecture--a blueprint for guiding operational and technological change--the architecture was not developed in accordance with certain best practices. In addition, while the office has implemented certain process controls for selecting, controlling, and evaluating its IT investments, it has not yet implemented others that are necessary in order to develop an effective foundation for investment management. Further, it has not implemented important management practices that are associated with an effective security program. In contrast, it has defined--and is implementing on a major system that we reviewed--most, but not all, of the management practices associated with effective systems acquisition. Institutionalization of these IT management disciplines has not been an agency priority and is not being guided by plans of action or sufficient resources. Until each discipline is given the priority it deserves, EOUSA will not have the IT management capabilities it needs to effectively achieve the department's strategic goal of improving the integrity, security, and efficiency of its IT systems.