SBI is a comprehensive, multiyear, multibillion dollar program established in November 2005 by the Secretary of Homeland Security to secure U.S. borders and reduce illegal immigration. SBI’s mission is to promote border security strategies that help protect against and prevent terrorist attacks and other transnational crimes. Elements of SBI will be carried out by several organizations within DHS. One element of SBI is SBInet, the program within CBP that is responsible for developing a comprehensive border protection system. The SBInet program is managed by the SBInet Program Management Office (PMO). The PMO reports to the CBP SBI Program Executive Director. SBInet is a large and complex program that is responsible for leading the effort to ensure that the proper mix of personnel, tactical infrastructure, rapid response capability, and technology is deployed along the border. DHS defines control of the U.S. border as the ability to detect illegal entries into the United States, identify and classify these entries to determine the level of threat involved, efficiently and effectively respond to these entries, and bring events to a satisfactory law enforcement resolution. SBInet’s initial focus will be on the southwest border investments and areas between ports of entry that CBP has designated as having the highest need for enhanced border security due to serious vulnerabilities. In September 2006, CBP awarded an indefinite delivery/indefinite quantity systems integration contract for 3 years, with three additional 1-year options. The minimum dollar amount is $2 million; the maximum is stated as “the full panoply of supplies and services to provide 6,000 miles of secure U.S. border.” According to DHS, the SBInet solution is to include a variety of sensors, communications systems, information technology, tactical infrastructure (roads, barriers, and fencing), and command and control capabilities to enhance situational awareness of the responding officers. The solution is also to include the development of a common operating picture that provides uniform data, through a command center environment, to all DHS agencies and is interoperable with stakeholders external to DHS. See figure 1 for examples of existing technology along the border. Our statement will now focus on what type of information DHS has provided on explicit and measurable commitments relative to schedule and costs. The SBInet expenditure plan included general cost information for proposed activities and some associated milestone information. DHS estimates that the total cost for completing the acquisition phase for the southwest border is $7.6 billion for fiscal years 2007 through 2011. Of this total, approximately $5.1 billion is for the design, development, integration, and deployment of fencing, roads, vehicle barriers, sensors, radar units, and command, control, and communications and other equipment, and $2.5 billion is for integrated logistics and operations support during the acquisition phase for the southwest border. In addition, the SBInet expenditure plan and related documentation discussed generally how approximately $1.5 billion already appropriated will be allocated to SBInet activities (see table 1). For example, about $790 million is allocated for the Tucson Border Patrol sector and $260 million for the Yuma sector in Arizona. Table: 1 SBInet Funding Allocations Fiscal Years, 2005-2007 (dollars in thousands) Yma and Tcson tactical infrastrctre $325,000 $1,187,565 $1,549,365 nds were allocated to SBInet activities. des activities related to test and evalation, deployment and installation, and integrated logistics spport. The expenditure plan also includes certain milestones, such as starting and ending dates, for some but not all activities. For example, consistent with DHS’s task order approach to managing SBInet’s implementation, the task order for Project 28 includes detailed milestones. In other cases, such as the Tucson and Yuma sector activities, milestones and costs are preliminary and highly likely to change because they are still in the planning and requirement setting stage. According to SBInet officials, factors such as technological, environmental, and eminent domain constraints can affect the timetables and costs of these activities. Figure 2 illustrates the extent to which milestones were defined for selected activities. Despite including general cost information for proposed activities and some associated milestone information, the expenditure plan and related documentation did not include sufficient details about what will be done, the milestones involved, the performance capability expected, and the costs for implementing the program. For example, although the plan stated that about $790 million will be spent in the Tucson sector for such elements as fencing, ground sensors, radars, cameras, and fixed and mobile towers, the plan did not specify how the funds will be allocated by element and did not provide specific dates for implementation. According to DHS, each task order will define what will be done, when, the performance capability, and the total cost. The expenditure plan did not include costs incurred to date mainly because SBInet activities are in the early stages of implementation and costs had not yet been captured by DHS’s accounting system (e.g., the SBInet systems integration contract was awarded in September 2006 and the first two task orders were awarded in September and October 2006). Moreover, the expenditure plan did not include a baseline measure of miles under control of the border. While the plan did not discuss progress made to date by the program to obtain control of the border, related program documents, such as the bimonthly SBI reports to Congress, included information on the number of miles under control in the southwest border. Our statement will now focus on DHS’s use of federal acquisition requirements and related program management best practices. As of December 2006, SBInet was using several acquisition best practices. The extent to which these practices were in use varied, and outcomes were dependent on successful implementation. Specifically, SBInet was using several of the best practices or “Guiding Principles” in DHS Management Directive 1400, such as conducting a competition open to all qualified suppliers to award the systems integration contract, and using a performance-based approach where the agency identified the outcome it was seeking to achieve and allowed the competing companies to propose their specific solutions. SBInet plans to use a system for comparing costs incurred with progress achieved known as earned value management (EVM). However, we reported that the SBInet systems integration contract did fully satisfy an acquisition requirement to contain a specific number of units that may be ordered or a maximum dollar value. According to the Federal Acquisition Regulation (FAR), an agency may use an indefinite delivery/indefinite quantity contract, such as that used for SBInet, when it is not possible to determine in advance the precise quantities of goods or services that may be required during performance of the contract. Though these types of contracts are indefinite, they are not open-ended. The FAR requires that indefinite quantity contracts contain a limit on the supplies or services that may be ordered, stated in terms of either units or dollars. This limit serves a variety of purposes, including establishing the maximum financial obligation of the parties. According to DHS, the quantity stated in the contract, “6,000 miles of secure U.S. border,” is measurable and is therefore the most appropriate approach to defining the contract ceiling. We do not agree because the contract maximum used in the SBInet contract, “the full panoply of supplies and services to provide 6,000 miles of secure U.S. border,” does not allow anyone to calculate with certainty what the maximum financial obligation of the parties might turn out to be since the contract does not make clear the total amount of supplies or services that would be required to secure even 1 mile of U.S. border. In order to ensure that the contract is consistent with the FAR requirement, a maximum quantity or dollar value limit needs to be included in the contract. Managing major programs like SBInet also requires applying discipline and rigor when acquiring and accounting for systems and services, such as those requirements and practices embodied in OMB and related guidance. Our work and other best practice research have shown that applying such rigorous management practices improves the likelihood of delivering expected capabilities on time and within budget. In other words, the quality of information technology (IT) systems and services is largely governed by the quality of the management processes involved in acquiring and managing them. Some of these processes and practices are embodied in the Software Engineering Institute’s (SEI) Capability Maturity Models®, which define, among other things, acquisition process management controls that, if implemented effectively, can greatly increase the chances of acquiring systems that provide promised capabilities on time and within budget. Other practices are captured in OMB guidance, which establishes requirements for planning, budgeting, acquisition, and management of federal capital assets. As of December 2006, the SBInet program office had not fully defined and implemented critical acquisition processes, such as project planning, process and product quality assurance, measurement and analysis, and requirements management. To its credit, the program office has developed and begun implementing a draft risk management plan, dated September 29, 2006. The draft plan addresses, among other things, a process for identifying, analyzing, mitigating, tracking, and controlling risks. As part of this process, the program office developed a risk management database that identifies for each risk, among other things, the status, priority, probability of occurrence, the overall impact, consequence, and a mitigation strategy. The program office also established a governance structure, which includes a Risk Review Board (RRB) that is chaired by the SBInet Program Manager. According to the SBInet Risk Manager, a draft RRB charter has been developed. SBInet had not yet implemented other key management practices, such as developing and implementing a system security plan, employing an EVM system to help manage and control program cost and schedule, and following capital planning and investment control review requirements to help ensure that agencies investments achieve a maximum return on investment. According to a SBInet program office security specialist, as of December 2006, the program office had not developed a system security plan because it was too early in the system development life cycle. He stated that a plan is to be developed as part of the system certification and accreditation process. Regarding EVM, the program office is relying on the prime integrator’s EVM system to manage the prime contractor’s progress against cost and schedule goals. The prime integrator’s system has been independently certified as meeting established standards. However, the EVM system had not been fully implemented because, as of December 2006, the baselines against which progress can be measured for the two task orders that had been issued, as of early December (program management and Project 28) had not yet been established. According to program officials, these baselines were to be established for the program management task order and the Project 28 task order in mid-December 2006 and mid-January 2007, respectively. Further, it is unclear where SBInet is in the DHS capital planning and investment control review process. The SBInet expenditure plan did not describe the status of the program in the review process, but indicated that it is being managed using the DHS framework. However, a SBInet DHS Joint Requirements Council and Investment Review Board briefing document for fiscal year 2007, dated November 22, 2006, indicates that the program office plans to implement the review process on an annual basis. According to the SBInet Program Manager, SBInet projects are at various stages in the acquisition life cycle. As a result, the program office plans to combine multiple projects into a single decision milestone for purposes of investment review that is to occur on, at least, an annual basis. According to the SBInet Program Manager, the program had not fully defined and implemented critical management practices because priority was given to meeting an accelerated program implementation schedule. However, he stated that he was committed to putting these processes in place and further stated that the program plans to develop a plan for defining and implementing critical acquisition planning processes by the spring of 2007. Until the program office fully defines and implements these key program management practices, its efforts to acquire, deploy, operate, and maintain program capabilities will be at a higher risk of not producing promised performance levels and associated benefits on time and within budget. The SBInet PMO plans to execute SBInet activities through a series of concurrent task orders that will be managed by a mix of government and contractor staff. The PMO plans to nearly triple its current workforce, from about 100 to 270 personnel, by September 2007 in order to support and oversee this series of concurrent task orders. As of December 2006, SBInet personnel included 38 government employees and 60 contractor staff. By September 2007, personnel levels are projected to reach 113 government employees and 157 contractors. As of December 2006, SBInet officials told us that they have assigned lead staff for the task orders that have been awarded. However, SBI and SBInet officials expressed concerns about difficulties in finding an adequate number of staff with the required expertise to support planned activities. Staffing shortfalls could limit government oversight efforts. As shown in figure 2, SBInet’s acquisition approach calls for considerable concurrency among related planned tasks and activities. For example, according to DHS, lessons learned from the Project 28 task order are to be incorporated in the sector task orders. However, the task orders for the other sectors will be awarded prior to the completion and evaluation of Project 28. The program management task order is also to establish the capabilities to manage and oversee all of the other task orders. The risk of concurrency is further increased because, as discussed earlier, DHS does not have all the management processes in place to mitigate the risk and successfully manage the program. The greater the degree of concurrency among related and dependent program tasks and activities, the greater a program’s exposure to cost, schedule, and performance risks. SBI and SBInet officials told us that they understand the risks inherent in concurrency and are addressing these risks. However, as of December 2006, they had not provided evidence that identified the dependencies among their concurrent activities and that they were proactively managing the associated risk. The legislatively mandated expenditure plan for SBInet is a congressional oversight mechanism aimed at ensuring that planned expenditures are justified, performance against plans is measured, and accountability for results is ensured. We found that Congress and DHS are not in the best position to use the plan as a basis for measuring program success, accounting for the use of current and future appropriations, and holding program managers accountable for achieving effective control of the southwest border because the plan has not provided information on explicit and measurable commitments relative to the capabilities, schedule, costs, and benefits associated with individual SBInet program activities. Specifically, DHS needs to provide sufficient details on such things as planned activities and milestones, anticipated costs and staffing levels, and expected mission outcomes. DHS also needs to document that planned SBInet expenditures are justified, performance against plans is measured, and accountability for results is ensured. We recommended that DHS ensure that future expenditure plans include explicit and measurable commitments relative to the capabilities, schedule, costs, and benefits associated with individual SBInet program activities. DHS has not fully established the capabilities needed to effectively mitigate risks and to successfully manage the program. We reported that although the SBInet contract was generally competed in accordance with federal requirements, the contract does not fully satisfy federal regulations. Under the FAR, indefinite quantity contracts such as the SBInet contract must contain the specific number of units that may be ordered or a maximum dollar value. However, the SBInet contract merely contains the maximum number of miles to be secured. While SBInet officials consider this sufficient to satisfy the FAR requirement, a maximum quantity expressed in units other than the overall outcome to be achieved or expressed as a dollar value limit would help ensure that the contract is consistent with this requirement. We recommended that DHS modify the SBInet systems integration contract to include a maximum quantity or dollar value. DHS’s approach to SBInet introduces additional risk because the program’s schedule entails a high level of concurrency. With multiple related and dependent projects being undertaken simultaneously, SBInet is exposed to possible cost and schedule overruns and performance problems. Without assessing this level of concurrency and how it affects project implementation, SBInet runs the risk of not delivering promised capabilities and benefits on time and within budget. We recommended that DHS re-examine the level of concurrency and appropriately adjust the acquisition strategy. DHS generally agreed with our findings and conclusions, but did not agree with our assessment that the SBInet contract does not contain specific numbers of units that may be ordered or a maximum dollar value. In addition, DHS stated that CBP intends to fully satisfy each of the legislative conditions in the near future to help minimize the program’s exposure to cost, schedule, and performance risks. With respect to our recommendations, DHS concurred with two of our recommendations and disagreed with one. Specifically, DHS concurred with our recommendation for future expenditure plans to include explicit and measurable commitments relative to capabilities, schedule, costs, and benefits associated with individual SBInet program activities. According to DHS, future SBInet expenditure plans will include actual and planned progress, report against commitments contained in prior expenditure plans, and include a section that addresses and tracks milestones. DHS also concurred with our recommendation to re-examine the level of concurrency and appropriately adjust the acquisition strategy. In its written comments, DHS stated that CBP is constantly assessing the overall program as it unfolds, and adjusting it to reflect progress, resource constraints, refinements and changes in requirements, and insight gained from ongoing system engineering activities. DHS also stated that CBP recognizes the risk inherent in concurrency and has plans to address this risk. DHS did not agree with our recommendation to modify the SBInet integration contract to include a maximum quantity or dollar value. According to DHS, the quantity stated in the contract, “6,000 miles of secure U.S. border,” is measurable and is therefore the most appropriate approach to defining the contract ceiling. We do not agree. In order to ensure that the SBInet contract is consistent with the FAR, we continue to believe that it should be modified to include a maximum quantity, either units or a dollar value, rather than the total amount of miles to be secured. This concludes our prepared testimony. We would be happy to respond to any questions that members of the subcommittee may have. For questions regarding this testimony, please call Richard M. Stana at (202) 512-8816 or StanaR@gao.gov or Randolph C. Hite at (202) 512-3439 or HiteR@gao.gov. Other key contributors to this statement were William T. Woods, Director; Robert E. White, Assistant Director; Deborah Davis, Assistant Director; Richard Hung, Assistant Director; E. Jeanette Espínola; Frances Cook; Katherine Davis; Gary Delaney; Joseph K. Keener; Sandra Kerr; Raul Quintero; and Sushmita Srikanth. The SBInet December 2006 expenditure plan, including related documentation and program officials’ statements, satisfied four legislative conditions, partially satisfied four legislative conditions, and did not satisfy one legislative condition. The nine legislative conditions and the level of satisfaction are summarized in the table below. Satisfied This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony summarizes GAO's February 2007 report on SBInet, one element of the Department of Homeland Security's (DHS) Secure Border Initiative (SBI). SBInet is responsible for developing a comprehensive border protection system. By legislative mandate, GAO reviewed SBInet's fiscal year 2007 expenditure plan. This testimony focuses on (1) the extent that the plan provided explicit and measurable commitments relative to schedule and costs, (2) how DHS is following federal acquisition regulations and management best practices, and (3) concurrency in SBInet's schedule. GAO assessed the plan against federal guidelines and industry standards and interviewed program officials. SBInet's December 2006 expenditure plan offered a high-level and partial outline of a large and complex program that forms an integral component of the broader multiyear initiative. However, the SBInet expenditure plan, including related documentation and program officials' statements, lacked specificity on such things as planned activities and milestones, anticipated costs and staffing levels, and expected mission outcomes. This, coupled with the large cost and ambitious time frames, adds risk to the program. Without sufficient and reliable information on program goals, status and results, Congress and DHS are not in the best position to use the plan as a basis for assessing program outcomes, accounting for the use of current and future appropriations, and holding program managers accountable for achieving effective control of the border. As of December 2006, SBInet was using, at least to some extent acquisition best practices, but DHS had not fully established the range of capabilities needed to effectively mitigate risks and to successfully manage the program. To its credit, the SBInet contract was generally competed in accordance with federal requirements. However, the SBInet contract does not fully satisfy the federal regulatory requirement to specify a maximum dollar value or the number of units that may be ordered. We also reported that important management controls provided for in Office of Management and Budget (OMB) guidance and best practices were not yet in place, although the program manager stated that he was committed to doing so. Until they are in place, the program is at increased risk of failure. DHS's plan to execute SBInet activities through a series of concurrent task orders introduces additional risk. With multiple related and dependent projects being undertaken simultaneously, SBInet is exposed to possible cost and schedule overruns and performance problems. Without assessing this level of concurrency and how it affects project implementation, SBInet runs the risk of not delivering promised capabilities and benefits on time and within budget. SBI and SBInet officials told us that they understand the risks inherent in concurrency and are addressing these risks. However, as of December 2006, they had not provided evidence that identified the dependencies among their concurrent activities and that they were proactively managing the associated risk.