IT can enrich people’s lives and improve organizational performance. For example, during the last two decades the Internet has matured from being a means for academics and scientists to communicate with each other to a national resource where citizens can interact with their government in many ways, such as by receiving services, supplying and obtaining information, asking questions, and providing comments on proposed rules. While investments in IT have the potential to improve lives and organizations, some federally funded IT projects can—and have— become risky, costly, unproductive mistakes. As we have described in numerous reports and testimonies, federal IT projects too frequently incur cost overruns and schedule slippages while contributing little to mission- related outcomes. Further, while IT should enable government to better serve the American people, the federal government has not achieved expected productivity improvements—despite spending more than $600 billion on IT over the past decade. Over the last two decades, Congress has enacted several laws to assist agencies and the federal government in managing IT investments. Key laws include the Paperwork Reduction Act of 1995, the Clinger-Cohen Act of 1996, and the E-Government Act of 2002. Also, the GPRA (Government Performance and Results Act) Modernization Act of 2010 includes IT management as a priority goal for improving the federal government. Paperwork Reduction Act of 1995. The act specifies OMB and agency responsibilities for managing information resources, including the management of IT. Among its provisions, this law establishes agency responsibility for maximizing the value and assessing and managing the risks of major information systems initiatives. It also requires that OMB develop and oversee policies, principles, standards, and guidelines for federal agency IT functions, including periodic evaluations of major information systems. Clinger-Cohen Act of 1996. The act places responsibility for managing investments with the heads of agencies and establishes CIOs to advise and assist agency heads in carrying out this responsibility. Additionally, this law requires OMB to establish processes to analyze, track, and evaluate the risks and results of major capital investments in information systems made by federal agencies and report to Congress on the net program performance benefits achieved as a result of these investments. E-Government Act of 2002. The act establishes a federal e- government initiative, which encourages the use of web-based Internet applications to enhance the access to and delivery of government information and services to citizens, business partners, employees, and agencies at all levels of government. The act also requires OMB to report annually to Congress on the status of e- government initiatives. In these reports, OMB is to describe the administration’s use of e-government principles to improve government performance and the delivery of information and services to the public. GPRA (Government Performance and Results Act) Modernization Act of 2010. The act establishes a new framework aimed at taking a more crosscutting and integrated approach to focusing on results and improving government performance. It requires OMB, in coordination with agencies, to develop long-term, outcome-oriented goals for a limited number of crosscutting policy areas at least every four years. The act specifies that these goals should include five areas: financial management, human capital management, IT management, procurement and acquisition management, and real property management. On an annual basis, OMB is to provide information on how these long-term crosscutting goals will be achieved. As set out in these laws, OMB is to play a key role in helping federal agencies manage their investments by working with them to better plan, justify, and determine how much they need to spend on projects and how to manage approved projects. Within OMB, the Office of E-government and Information Technology, headed by the Federal CIO, directs the policy and strategic planning of federal IT investments and is responsible for oversight of federal technology spending. In addition, the Office of Federal Procurement Policy (OFPP) is responsible for shaping the policies and practices federal agencies use to acquire the goods and services they need to carry out their missions. Agency CIOs are also expected to have a key role in IT management. Federal law, specifically the Clinger-Cohen Act, has defined the role of the CIO as the focal point for IT management, requiring agency heads to designate CIOs to lead reforms that would help control system development risks; better manage technology spending; and achieve real, measurable improvements in agency performance. In addition, the CIO Council—comprised of the CIOs and Deputy CIOs of 28 agencies and chaired by OMB’s Deputy Director for Management—is the principal interagency forum for improving agency practices related to the design, acquisition, development, modernization, use, sharing, and performance of federal information resources. The CIO Council is responsible for developing recommendations for overall federal IT management policy, sharing best practices, including the development of performance measures, and identifying opportunities and sponsoring cooperation in using information resources. After assessing the most persistent challenges in acquiring, managing, and operating IT systems, in December 2010, the Federal CIO established a 25-point IT Reform Plan designed to address challenges in IT acquisition, improve operational efficiencies, and deliver more IT value to the American taxpayer. The actions were planned to be completed in three different time frames: (1) within 6 months (by June 2011), (2) between 6 and 12 months (by December 2011), and (3) between 12 and 18 months (by June 2012). Several different organizations were assigned ownership of the key action items, including the Federal CIO, the CIO Council, the General Services Administration (GSA), Office of Personnel Management (OPM), OFPP, the Small Business Administration, and other federal agencies. Table 1 contains detailed information on the action items in the IT Reform Plan. Shaded items are those selected for review in this report. Given the challenges that federal agencies have experienced in acquiring and managing IT investments, we have issued a series of reports aimed at improving federal IT management over the last decade. Our reports cover a variety of topics, including data center consolidation, cloud computing, CIO responsibilities, system acquisition challenges, and modular development. Key reports that address topics covered in the IT Reform Plan include: Data center consolidation. In July 2011, we reported on the status of OMB’s federal data center consolidation initiative. Under this initiative, OMB required 24 participating agencies to submit data center inventories and consolidation plans by the end of August 2010. However, we found that only one of the agencies submitted a complete data center inventory and no agency submitted a complete data center consolidation plan. We concluded that until these inventories and plans are complete, agencies might not be able to implement their consolidation activities and realize expected cost savings. We recommended that agencies complete the missing elements in their plans and inventories. In response to our recommendations, in October and November 2011, the agencies updated their inventories and plans. We have ongoing work assessing the agencies’ revised plans, and in February 2012, we reported that our preliminary assessment of the updated plans showed that not all agency plans were updated to include all required information. Cloud computing. In May 2010, we reported on multiple agencies’ efforts to ensure the security of governmentwide cloud computing. We noted that while OMB, GSA, and the National Institute of Standards and Technology (NIST) had initiated efforts to ensure secure cloud computing, significant work remained to be completed.OMB had not yet finished a cloud computing strategy; GSA had begun a procurement for expanding cloud computing services, but had not yet developed specific plans for establishing a shared information security assessment and authorization process; and NIST had not yet issued cloud-specific security guidance. We made several recommendations to address these issues. Specifically, we recommended that OMB establish milestones to complete a strategy for federal cloud computing and ensure it addressed information security challenges. OMB subsequently published a strategy which addressed the importance of information security when using cloud computing, but did not fully address several key challenges confronting agencies. We also recommended that GSA consider security in its procurement for cloud services, including consideration of a shared assessment and authorization process. GSA has since developed an assessment and authorization process for systems shared among federal agencies. Finally, we recommended that NIST issue guidance specific to cloud computing security. NIST has since issued multiple publications which address such guidance. More recently, in October 2011, we testified that 22 of 24 major federal agencies reported that they were either concerned or very concerned about the potential information security risks associated with cloud computing. These risks include being dependent on the security practices and assurances of vendors and the sharing of computing resources. We stated that these risks may vary based on the cloud deployment model. Private clouds, whereby the service is set up specifically for one organization, may have a lower threat exposure than public clouds, whereby the service is available to any paying customer. Evaluating this risk requires an examination of the specific security controls in place for the cloud’s implementation. We also reported that the CIO Council had established a cloud computing Executive Steering Committee to promote the use of cloud computing in the federal government, with technical and administrative support provided by GSA’s Cloud Computing Program Management Office, but had not finalized key processes or guidance. A subgroup of this committee had developed the Federal Risk and Authorization Management Program, a governmentwide program to provide joint authorizations and continuous security monitoring services for all federal agencies, with an initial focus on cloud computing. The subgroup had worked with its members to define interagency security requirements for cloud systems and services and related information security controls. Best practices in IT acquisition. In October 2011, we reported on best practices in IT acquisitions in the federal government. Specifically, we identified nine factors critical to the success of three or more of The factors most commonly identified include seven IT investments.active engagement of stakeholders, program staff with the necessary knowledge and skills, and senior department and agency executive support for the program. We reported that while these factors will not necessarily ensure that federal agencies will successfully acquire IT systems because many different factors contribute to successful acquisitions, they may help federal agencies address the well- documented acquisition challenges they face. IT spending authority. In February 2008, we reported that the Department of Veterans Affairs had taken important steps toward a more disciplined approach to ensuring oversight of and accountability for the department’s IT budget and resources. These steps included providing the department’s CIO responsibility for ensuring that there are controls over the budget and for overseeing all capital planning and execution, and designating leadership to assist in overseeing functions such as portfolio management. GAO, Information Technology: VA Has Taken Important Steps to Centralize Control of Its Resources, but Effectiveness Depends on Additional Planned Actions, GAO-08-449T (Washington, D.C.: Feb. 13, 2008). Investment review and oversight. During the past several years, we issued numerous reports and testimonies on OMB’s initiatives to highlight troubled IT projects. We made multiple recommendations to OMB and federal agencies to enhance the oversight and transparency of federal IT projects. For example, in 2005 we recommended that OMB develop a central list of projects and their deficiencies, and analyze that list to develop governmentwide and agency assessments of the progress and risks of the investments, identifying opportunities for continued improvement. In 2006, we recommended that OMB develop a single aggregate list of high-risk projects and their deficiencies and use that list to report to Congress on progress made in correcting high-risk problems. As a result, OMB started publicly releasing aggregate data on its internal list of mission-critical projects that needed to improve (called its Management Watch List) and disclosing the projects’ deficiencies. The agency also established a High-Risk List, which consisted of projects identified as requiring special attention from oversight authorities and the highest levels of agency management. Two different budget submissions, called exhibit 53s and exhibit 300s, provide the data accessible through the IT Dashboard. Exhibit 53s list all of the IT investments and their associated costs within a federal organization. An Exhibit 300, also called the Capital Asset Plan and Business Case, is used to justify resource requests for major IT investments and is intended to enable an agency to demonstrate, to its own management and to OMB, that a major investment is well planned. Federal CIO. We have since completed three successive reviews of the data on the IT Dashboard and reported that while it is an important tool for reporting and monitoring major IT projects, the cost and schedule ratings were not always accurate for selected agencies. We made recommendations to improve the accuracy of the data and, in our most recent report, found that the accuracy had improved. GAO, Information Technology: OMB Needs to Improve Its Guidance on IT Investments, GAO-11-826 (Washington, D.C.: Sept. 29, 2011). that OMB update its guidance to establish measures of accountability for ensuring that CIOs’ responsibilities are fully implemented and require agencies to establish internal processes for documenting lessons learned. OMB officials generally agreed with our recommendations and, in August 2011, issued a memo to agencies emphasizing the CIO’s role in driving the investment review process and responsibility over the entire IT portfolio for an agency. The memo identified four areas in which the CIO should have a lead role: IT governance, program management, commodity services, and information security. OMB and key federal agencies have made progress on selected action items identified in the IT Reform Plan, but there are several areas where more remains to be done. Of the 10 key action items we reviewed, 3 were completed and the other 7 were partially completed by December 2011. The action items that are behind schedule share a common reason for the delays: the complexity of the initiatives. In all seven of the cases, OMB and the federal agencies are still working on the initiatives. In a December 2011 progress report on its IT Reform Plan, OMB reported that it made greater progress than we determined. The agency reported that of the 10 action items, 7 were completed and 3 were partially completed. OMB officials from the Office of E-government and Information Technology explained that the reason for the difference in assessments is that they believe that the IT Reform Plan has served its purpose in acting as a catalyst for a set of broader initiatives. They noted that work will continue on all of the initiatives even after OMB declares the related action items to be completed under the IT Reform Plan. We disagree with this approach. In prematurely declaring the action items to be completed, OMB risks losing momentum on the progress it has made to date. Table 2 provides both OMB’s and our assessments of the status of the key action items, with action items rated as “completed” if all of the required activities identified in the reform plan were completed, and “partially completed” if some, but not all, of the required activities were completed. Until OMB and the agencies complete the action items called for in the IT Reform Plan, the benefits of the reform initiatives—including increased operational efficiencies and more effective management of large-scale IT programs—may be delayed. With the last of the action items in the IT Reform Plan due to be completed by June 2012, it will be important for OMB and the agencies to ensure that the action items due at earlier milestones are completed as soon as possible. According to leading practices in industry and government, effective planning is critical to successfully managing a project. Effective project planning includes taking corrective actions when project deliverables fall behind schedule and defining time frames for completing the corrective actions. As noted earlier in this report, we identified seven action items that are behind schedule or falling short of the IT Reform Plan’s requirements. OMB and the agencies have plans for addressing all seven of the action items that we identified as behind schedule, but lack time frames for completing five of them. The seven action items we identified are: Data center consolidation. We noted that agencies’ data center consolidation plans do not include all required elements. In July 2011, OMB directed agencies to complete the missing elements in their plans. The agencies are expected to provide an update on their plans in September 2012. Cloud-first policy. We noted that agencies’ migration plans were missing selected elements. An OMB official stated while OMB did not review the quality of agency migration plans in order to close the reform plan action item, the official responsible for the cloud-first initiative would continue to work with agencies to ensure that the initiative was successful. There are no time frames for agencies to complete their migration plans. Best practice collaboration portal. We found that the best practices collaboration platform is missing key features that would allow the information to be accessible and useable. A CIO Council official noted that the council plans to improve the portal over time by adding the ability to load artifacts, allow users to chat online, contain an expertise repository, and allow or encourage labeling of information to improve the search for artifacts within the platform. However, the CIO Council has not established a time frame for providing additional functionality to the web-based collaboration portal. Guidance and templates for modular contracting. OFPP has not issued guidance or the required templates and samples supporting modular development. It plans to continue developing guidance and templates to support modular development, and the first draft of this guidance is currently undergoing initial review. OFPP plans to issue its guidance and templates in spring 2012. Obtaining new IT budget authorities. OMB is behind schedule in obtaining new IT budget authorities. OMB officials stated that it plans to propose new authorities as part of the 2013 President’s Budget, and intends to work with congressional committees throughout the budget rollout process. However, OMB has not yet established time frames for completing this activity. Consolidating commodity IT under the agency CIO. OMB is behind schedule in consolidating commodity IT spending under agency CIOs. OMB plans to propose new spending models for commodity IT in the 2013 President’s Budget, and to work with Congress to implement these new models. However, OMB has not established a time frame for completing this activity. Redefining roles of agency CIOs and the CIO Council. OMB acknowledges that not all agency CIOs have authority for a full portfolio of IT investments and plans to collect data from agencies during spring 2012 to determine the extent to which the CIOs have this authority. At that point, OMB should be better positioned to determine what more needs to be done to ensure CIO roles are redefined. However, there is no time frame for completing this activity. Until OMB and the agencies establish time frames for completing corrective actions, they increase the risk that key actions will not be effectively managed to closure. For example, without cloud migration plans, agencies risk maintaining legacy systems long after the system has been replaced by one operating in the cloud. Further, these incomplete actions reduce the likelihood of achieving the full range of benefits promised by the IT reform initiatives. The importance of performance measures for gauging the progress of programs and projects is well recognized. In the past, OMB has directed agencies to define and select meaningful outcome-based performance measures that track the intended results of carrying out a program or activity. Additionally, as we have previously reported, aligning performance measures with goals can help to measure progress toward those goals, emphasizing the quality of the services an agency provides or the resulting benefits to users. Furthermore, industry experts describe performance measures as necessary for managing, planning, and monitoring the performance of a project against plans and stakeholders’ needs. According to government and industry best practices, performance measures should be measurable, outcome-oriented, and actively tracked and managed. Recognizing the importance of performance measurement, OMB and GSA have established measures for 4 of the 10 action items we reviewed: data center consolidation, shifting to cloud computing, using contract vehicles to obtain Infrastructure-as-a-Service, and reforming investment review boards. Moreover, OMB reported on three of these measures in the analytical perspectives associated with the President’s fiscal year 2013 budget. Specifically, regarding data center consolidation, OMB reported that agencies were on track to close 525 centers by the end of 2012 and expected to save $3 billion by 2015. On the topic of cloud computing, OMB reported that agencies had migrated 40 services to cloud computing environments in 2011 and expect to migrate an additional 39 services in 2012. Regarding investment review boards, OMB reported that agency CIOs held 294 TechStat reviews and had achieved more than $900 million in cost savings, life cycle cost avoidance, or reallocation of funding. However, OMB has not established performance measures for 6 of the 10 action items we reviewed. For example, OMB has not established measures related to the best practices collaboration platform, such as number of users, number of hits per query, and customer satisfaction. Further, while OMB has designed the guidance and curriculum for developing a cadre of IT acquisition professionals, it has not established measures for tracking agencies development of such a cadre. Table 3 details what performance measures and goals, if any, are associated with the action item. OMB officials, including two policy analysts within the Office of E- government and Information Technology who are responsible for the IT Reform Plan, stated that they do not believe that it is appropriate for OMB to establish measures for the action items in the IT Reform Plan. The officials explained that they believe that the purpose of the IT Reform Plan is to act as a catalyst for initiatives that are expected to continue outside of the plan. For example, the IT Reform Plan called for OMB and agencies to complete several discrete activities to push forward on data center consolidation, but the Federal Data Center Consolidation Initiative will continue on well after the deliverables noted in the reform plan are completed. They acknowledged that it would be appropriate to have performance measures for each of the broader initiatives outside of the IT Reform Plan, but noted that this should be the responsibility of the group running each initiative. We disagree with OMB’s view and believe that performance measures are a powerful way to motivate people, communicate priorities, and improve performance. In our assessment, we sought any available performance measures associated with either the action item or the broader initiative, and in cases like the data center consolidation initiative, gave credit for the measures that were established for the initiative. However, we found that most action items and initiatives lacked any performance measures. Moreover, if OMB encourages individual agencies to establish measures, there will likely be multiple different measures for the action items and it would be more difficult to demonstrate governmentwide progress. Therefore, we believe that it is appropriate for OMB to establish performance measures for each of the action items in order to effectively measure the results of the IT Reform Plan. Until OMB establishes and begins tracking measurable, outcome- oriented performance measures for each of the action items, the agency will be limited it its ability to evaluate progress that has been made and whether or not the initiative is achieving its goals. OMB and selected agencies have made strides in implementing the IT Reform Plan, including pushing agencies to consolidate data centers, migrating federal services to cloud computing, improving the skills of IT acquisition professionals, and strengthening the roles and accountability of CIOs. However, several key reform items are behind schedule and OMB lacks time frames for completing most of them. Despite reporting that selected actions are completed, OMB and federal agencies are still working on them. This sends an inconsistent message on the need to maintain focus on these important initiatives. Moving forward, it will be important for OMB to accurately characterize the status of the action items in the IT Reform Plan in order to keep agencies’ focus and momentum on these important reform initiatives. OMB has not established performance measures for gauging the success of most of its reform initiatives. For example, while OMB is tracking the number of services that agencies move to a cloud computing environment and the number of data center closures, it is not tracking the usefulness of its efforts to develop a best practices collaboration portal or a cadre of IT acquisition professionals. Until OMB and the agencies complete the action items called for in the IT Reform Plan, establish time frames for completing corrective actions, and establish performance measures to track the results of the reform initiatives, the government may not be able to realize the full promise of the IT Reform Plan. The IT Reform Plan’s goals of improving government IT acquisitions and the efficiency of government operations are both ambitious and important, and they warrant a more structured approach to ensure actions are completed and results are achieved. To help ensure the success of IT reform initiatives, we are making four recommendations to OMB. Specifically we are recommending that the Director of the Office of Management and Budget direct the Federal Chief Information Officer to ensure that the action items called for in the IT Reform Plan are completed by the responsible parties prior to the completion of the IT Reform Plan’s 18 month deadline of June 2012, or if the June 2012 deadline cannot be met, by another clearly defined deadline; provide clear time frames for addressing the shortfalls associated with the IT Reform Plan action items; accurately characterize the status of the IT Reform Plan action items in the upcoming progress report in order to keep momentum going on action items that are not yet completed; and establish outcome-oriented measures for each applicable action item in the IT Reform Plan. We are also making two recommendations to the Secretaries of Homeland Security and Veterans Affairs and to the Attorney General of the Department of Justice to address action items in the IT Reform Plan where the agencies have fallen behind. Specifically, we are recommending that they direct their respective agency CIOs to complete elements missing from the agencies’ plans for migrating services to a cloud computing environment, as applicable, and identify and report on the commodity services proposed for migration to shared services. We received comments on a draft of our report from OMB; the Departments of Homeland Security, Justice, and Veterans Affairs; and GSA. OMB agreed with two recommendations and disagreed with two recommendations; the Departments of Homeland Security, Justice, and Veterans Affairs generally agreed with our recommendations; and GSA did not agree or disagree with our recommendations. Each agency’s comments are discussed in more detail below. OMB’s Federal CIO provided written comments on a draft of this report, as well as supplementary comments via e-mail. The written comments are provided in appendix II. The Federal CIO stated that OMB believes our analysis and findings have been critical to driving IT reforms across the federal government, and that OMB plans to use this report to continue the positive momentum on the IT Reform Plan. In addition, the Federal CIO stated that despite agreeing with many of the observations and recommendations in the draft report, OMB had concerns with selected recommendations, observations, and the scope of our review. The agency’s comments and, where applicable, our evaluation follow: OMB agreed with our recommendation to ensure that action items called for in the IT Reform Plan are completed by the end of the IT Reform Plan’s 18-month deadline of June 2012 and stated that OMB intends to complete the action items by the deadline. OMB agreed with our recommendation to provide clear time frames for addressing the shortfalls associated with the IT Reform Plan action items and stated that OMB will provide clear time frames where applicable. OMB disagreed with our recommendation that the agency accurately characterize the status of IT Reform Plan action items in the upcoming progress report. The agency stated that it has accurately characterized the completeness of the action items, and therefore, the recommendation does not apply. As stated in this report, we do not agree with OMB’s characterization of four action items: data center consolidation, cloud-first policy, best practices collaboration portal, and redefining roles of agency CIOs and the CIO Council. OMB considers these action items to be completed. We do not. While OMB has made progress in each of these areas, we found activities specified in the IT Reform Plan that have not yet been completed. Specifically, in the area of data center consolidation, we found that selected agency plans are still incomplete; in the move to cloud computing, selected agency migration plans lack key elements; in the area of the best practices portal, we found that the portal lacks key features that would allow the information to be accessible and useful to program managers; and in revising CIO roles, we identified an agency that does not yet have the envisioned authority over IT acquisitions. Further, in a recent memorandum to agency CIOs, the Federal CIO acknowledged that agency data center consolidation plans are incomplete and required agencies to provide an annual update to the plans. In addition, our assessment that the cloud migration plans are incomplete was affirmed by the three agencies we reviewed agreeing with our recommendation that they complete cloud migration plans. Thus, we believe that our recommendation to OMB to accurately characterize the status of IT Reform action items is valid. OMB disagreed with our recommendation to establish outcome- oriented measures for each applicable action item in the IT Reform Plan, noting that the agency measured the completeness of the IT Reform actions and not the performance measures associated with broader initiatives. OMB also suggested that we erroneously gave the agency credit for performance measures associated with broader initiatives on data center consolidation, cloud computing, and investment review boards. We acknowledge that some of the action items in the IT Reform Plan are subsets of broader initiatives, and where applicable, we gave credit for having measures associated with the broader initiatives. We continue to believe that this approach is appropriate because the action items and the broader initiatives are intrinsically intertwined. For instance, it would have been unfair to state that there are no measures associated with consolidating federal data centers when such measures clearly exist. Moreover, the point remains that there are multiple action items in the IT Reform Plan that are not aligned with broader initiatives and for which there are no measures. Examples include the best practices portal, development of a cadre of specialized IT acquisition professionals, and establishing budget models that align with modular development. Given that the purpose of the IT Reform Plan is to achieve operational efficiencies and improve the management of large-scale IT programs, we continue to assert that it is appropriate to establish performance measures to monitor the IT Reform Plan’s results. According to the administration’s public website intended to provide a window on efforts to deliver a more effective, smarter, and leaner government, performance measurement is a necessary step in improving performance and that it helps set priorities, tailor actions, inform on progress, and diagnose problems. Until OMB establishes and tracks measureable, outcome-oriented performance measures for each of the action items in the IT Reform Plan, the agency will be limited in its ability to evaluate progress that has been made and whether or not the initiative is achieving its goals. OMB stated that the title of our draft report (Information Technology Reform: Progress is Mixed; More Needs to Be Done to Complete Actions and Measure Results) did not accurately capture the substantial and overwhelmingly positive progress made to date. Moreover, OMB stated that the responsible entities have completed 81.5 percent of the required activities associated with the 10 action items we reviewed. We acknowledge the progress OMB and agencies have made on IT Reform Plan items in this report and have modified the title of our report to reflect that progress. However, our analysis of the percentage of completed activities differs from OMB’s calculations. The 10 action items we reviewed include 31 distinct required activities (see table 1). We found that the responsible entities completed 18 of these activities—a 58 percent completion rate. OMB also stated that our assessment should acknowledge that OMB does not have the statutory authority to carry out certain action items without congressional action. These action items involved creating IT budget models to align with modular development and consolidating commodity IT spending under the agency CIOs. The Federal CIO stated that although OMB has taken steps to engage with Congress, the agency cannot unilaterally grant budget flexibilities or consolidate spending. While it is true that completing these items depends upon congressional action, according to the IT Reform Plan, it is the responsibility of OMB and the federal agencies to work with Congress to propose budget models to address these items. In general, OMB stated that it will continue to drive reform throughout the federal government via the completion of the remaining actions in the IT Reform Plan, as well as continuing to work with agencies as they implement broader initiatives such as data center consolidation and the transition to cloud computing. In supplementary comments provided via e-mail, the Federal CIO also expressed concerns with the scope of our report, stating that the intent of the IT Reform Plan was not to reform all federal IT, but to establish some early wins to garner momentum for OMB’s broader initiatives. The Federal CIO also noted that OMB has been consistent in publicizing the IT Reform Plan as an 18-month plan with discrete goals designed to augment and accelerate broader initiatives that existed before the IT Reform Plan was launched and would continue after the plan has been completed. We believe that the scope of our review is appropriate. Since its inception, the scope of our review has focused on the action items and supporting activities noted in the IT Reform Plan. All of the required activities listed in table 1 in the background section of this report are listed in the IT Reform Plan. Moreover, we did not evaluate activities that are outside of the IT Reform Plan, such as OMB’s efforts to establish a cost model for agencies to use in estimating the costs and savings of data center consolidation. Further, we agree that to completely reform IT, OMB and agencies must undertake activities beyond the IT Reform Plan’s 18-month time frame. The activities within the IT Reform Plan are essential building blocks that will carry on well beyond the IT Reform Plan’s end. In written comments, the Department of Homeland Security’s Director of Departmental GAO-Office of Inspector General Liaison Office concurred with our recommendations and identified steps that the agency is undertaking to address them. The department’s written comments are provided in appendix III. In written comments, the Department of Justice’s Assistant Attorney General for Administration generally agreed with our recommendations and identified steps that the agency has undertaken to address them. The department’s written comments are provided in appendix IV. In written comments, the Chief of Staff at the Department of Veterans Affairs agreed with our recommendations and identified steps that the department is taking to implement them. The department’s written comments are provided in appendix V. In comments provided via e-mail, a Management and Program Analyst within GSA’s Office of Administrative Services stated that the agency had no official response or technical comments on the draft report. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to interested congressional committees, the secretaries and administrators of the departments and agencies addressed in this report, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions on the matters discussed in this report, please contact me at (202) 512-9286 or pownerd@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI. Our objectives were to (1) evaluate the progress the Office of Management and Budget (OMB) and key federal agencies have made on selected action items in the Information Technology (IT) Reform Plan, (2) assess the plans for addressing any action items that are behind schedule, and (3) assess the extent to which sound measures are in place to evaluate the success of the IT reform initiatives. In establishing the scope of our engagement, we selected ten action items for review, focusing on action items that (1) were due at the 6 or 12 month milestones because these were expected to be completed during our review, (2) covered multiple different topic areas, and (3) were considered by internal and OMB subject matter experts to be the more important items. These action items are: Complete detailed implementation plans to consolidate 800 data centers by 2015. Shift to a “cloud first” policy. Stand-up contract vehicles for secure Infrastructure-as-a-Service solutions. Launch a best practices collaboration platform. Design a cadre of specialized IT acquisition professionals. Issue contracting guidance and templates to support modular development. Work with Congress to create IT budget models that align with modular development. Work with Congress to consolidate Commodity IT spending under agency Chief Information Officers (CIO). Reform and strengthen Investment Review Boards. Redefine the role of agency CIOs and the CIO Council. In addition, in the seven cases where multiple agencies are identified as a responsible entity for the action item, we selected three civilian agencies (the Departments of Homeland Security, Veterans Affairs, and Justice) based on factors including (1) high levels of IT spending in fiscal year 2011, (2) poor performance on the IT Dashboard, (3) high number of major IT investments in fiscal year 2011, and (4) coverage of agencies that were not included on other GAO reviews of IT reform initiatives. To evaluate OMB and federal agencies progress in implementing the IT Reform Plan, we evaluated efforts by the entities responsible for each of the action items, including OMB, the General Services Administration (GSA), the Chief Information Officers (CIO) Council, and selected agencies. For each of the 10 action items in the IT Reform Plan, we reviewed OMB’s guidance and identified required activities. We compared agency documentation to these requirements, and identified gaps and missing elements. We rated each action item as “completed” if the responsible agencies demonstrated that they completed the required activities on or near the due date, and “partially completed” if the agencies demonstrated that they completed part of the required activities. We interviewed agency officials to clarify our initial findings and to determine why elements were incomplete or missing. To assess the plans for addressing any action items that are behind schedule, we identified the agencies’ plans for addressing the schedule shortfalls and compared these to sound project planning practices identified by organizations recognized for their experience in project management and acquisition processes. We also interviewed relevant agency officials regarding the reasons that their activities were behind schedule and the impact of any shortfalls in their mitigation plans. To assess the extent to which sound measures are in place to evaluate success, we determined whether performance measures were applicable for each of the selected action items, and if so, how agencies were tracking these measures. We compared these measures to best practices in IT performance management identified by leading industry and government organizations and assessed other options for measuring performance. In addition, we interviewed OMB and selected agency officials regarding progress, plans, and measures. As we were completing our audit work, OMB reported making progress in its efforts to consolidate data centers, transition to a cloud computing environment, and strengthen investment review boards, and provided data on specific measures within each of these areas. We assessed the reliability of the data provided on these measures by obtaining information from agency officials and from the CIO Council regarding their efforts to ensure the reliability of the data. While we identified limitations in the quality of the data that agencies reported, we determined that this data was sufficiently reliable for the purpose of presenting a general overview of progress in establishing performance measures. We conducted our work at multiple agencies’ headquarters in the Washington, D.C., metropolitan area. We conducted this performance audit from August 2011 to April 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, individuals making contributions to this report included Colleen Phillips (Assistant Director), Cortland Bradford, Rebecca Eyler, Kathleen S. Lovett, and Jessica Waselkow. Information Technology: Critical Factors Underlying Successful Major Acquisitions. GAO-12-7. Washington, D.C.: October 21, 2011. Federal Chief Information Officers: Opportunities Exist to Improve Role in Information Technology Management. GAO-11-634. Washington, D.C.: September 15, 2011. Information Technology: VA Has Taken Important Steps to Centralize Control of Its Resources, but Effectiveness Depends on Additional Planned Actions. GAO-08-449T. Washington, D.C.: February 13, 2008. Information Security: Additional Guidance Needed to Address Cloud Computing Concerns. GAO-12-130T. Washington, D.C.: October 6, 2011. Information Security: Governmentwide Guidance Needed to Assist Agencies in Implementing Cloud Computing. GAO-10-855T. Washington, D.C.: July 1, 2010. Information Security: Federal Guidance Needed to Address Control Issues with Implementing Cloud Computing. GAO-10-513. Washington, D.C.: May 27, 2010. Data Center Consolidation: Agencies Need to Complete Inventories and Plans to Achieve Expected Savings. GAO-11-565. Washington, D.C.: July 19, 2011. Follow-up on 2011 Report: Status of Actions Taken to Reduce Duplication, Overlap, and Fragmentation, Save Tax Dollars, and Enhance Revenue. GAO-12-453SP. Washington, D.C.: February 28, 2012. 2012 Annual Report: Opportunities to Reduce Duplication, Overlap and Fragmentation, Achieve Savings, and Enhance Revenue. GAO-12- 342SP. Washington, D.C.: February 28, 2012. Information Technology: Departments of Defense and Energy Need to Address Potentially Duplicative Investments. GAO-12-241. Washington, D.C.: February 17, 2012. Information Technology: Potentially Duplicative Investments Exist at the Departments of Defense and Energy. GAO-12-462T. Washington, D.C.: February 17, 2012. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. Investment Management: IRS Has a Strong Oversight Process but Needs to Improve How It Continues Funding Ongoing Investments. GAO-11- 587. Washington, D.C.: July 20, 2011. Information Technology: Investment Oversight and Management Have Improved but Continued Attention Is Needed. GAO-11-454T. Washington, D.C.: March 17, 2011. Information Technology: Treasury Needs to Strengthen Its Investment Board Operations and Oversight. GAO-07-865. Washington, D.C.: July 23, 2007. Information Technology: DHS Needs to Fully Define and Implement Policies and Procedures for Effectively Managing Investments. GAO-07- 424. Washington, D.C.: April 27, 2007. Information Technology: OMB Needs to Improve Its Guidance on IT Investments. GAO-11-826. Washington, D.C.: September 29, 2011. Information Technology: Management and Oversight of Projects Totaling Billions of Dollars Need Attention. GAO-09-624T. Washington, D.C.: April 28, 2009. Information Technology: OMB and Agencies Need to Improve Planning, Management, and Oversight of Projects Totaling Billions of Dollars. GAO- 08-1051T. Washington, D.C.: July 31, 2008. Information Technology: Further Improvements Needed to Identify and Oversee Poorly Planned and Performing Projects. GAO-07-1211T. Washington, D.C.: September 20, 2007. Information Technology: Improvements Needed to More Accurately Identify and Better Oversee Risky Projects Totaling Billions of Dollars. GAO-06-1099T. Washington, D.C.: September 7, 2006. Information Technology: Agencies and OMB Should Strengthen Processes for Identifying and Overseeing High Risk Projects. GAO-06- 647. Washington, D.C.: June 15, 2006. IT Dashboard: Accuracy Has Improved, and Additional Efforts Are Under Way To Better Inform Decision Making. GAO-12-210. Washington, D.C.: November 7, 2011. Information Technology: Continued Attention Needed to Accurately Report Federal Spending and Improve Management. GAO-11-831T. Washington, D.C.: July 14, 2011. Information Technology: Continued Improvements in Investment Oversight and Management Can Yield Billions in Savings. GAO-11-511T. Washington, D.C.: April 12, 2011. Information Technology: OMB Has Made Improvements to Its Dashboard, but Further Work Is Needed by Agencies and OMB to Ensure Data Accuracy. GAO-11-262. Washington, D.C.: March 15, 2011. Information Technology: OMB’s Dashboard Has Increased Transparency and Oversight, but Improvements Needed. GAO-10-701. Washington, D.C.: July 16, 2010. Information Technology: Federal Agencies Need to Strengthen Investment Board Oversight of Poorly Planned and Performing Projects. GAO-09-566. Washington, D.C.: June 30, 2009. Federal Housing Administration: Improvements Needed in Risk Assessment and Human Capital Management. GAO-12-15. Washington, D.C.: November 7, 2011. Information Technology: HUD’s Expenditure Plan Satisfies Statutory Conditions and Implementation of Management Controls Is Under Way. GAO-11-762. Washington, D.C.: September 7, 2011. Information Technology: FBI Has Largely Staffed Key Modernization Program, but Strategic Approach to Managing Program’s Human Capital Is Needed. GAO-07-19. Washington, D.C.: October 16, 2006.

Summary: While investments in IT have the potential to improve lives and organizations, federal IT projects too often experience cost overruns, schedule slippages, and performance shortfalls. To address acquisition challenges, improve operational efficiencies, and deliver more value to the American taxpayer, in December 2010, OMBs Federal CIO issued a 25-point IT Reform Plan. GAO was asked to (1) evaluate the progress OMB and key federal agencies have made on selected action items in the IT Reform Plan, (2) assess the plans for addressing action items that are behind schedule, and (3) assess the extent to which sound measures are in place to evaluate the success of the IT reform initiatives. To do so, GAO selected 10 of the 25 action items from the IT Reform Plan, focusing on the more important activities due to be completed by December 2011; analyzed agency documentation; and interviewed agency officials. The Office of Management and Budget (OMB) and key federal agencies have made progress on action items in the Information Technology (IT) Reform Plan, but there are several areas where more remains to be done. Of the 10 key action items GAO reviewed, 3 were completed and 7 were partially completed by December 2011, in part because the initiatives are complex. OMB reported greater progress than GAO determined, stating that 7 of the 10 action items were completed and that 3 were partially completed. While OMB officials acknowledge that there is more to do in each of the topic areas, they consider the key action items to be completed because the IT Reform Plan has served its purpose as a catalyst for a set of broader initiatives. They explained that work will continue on all of the initiatives even after OMB declares that the related action items are completed under the IT Reform Plan. We disagree with this approach. In prematurely declaring the action items to be completed, OMB risks losing momentum on the progress it has made to date. Until OMB and the agencies complete the action items, the benefits of the reform initiativesincluding increased operational efficiencies and more effective management of large-scale IT programswill likely be delayed. OMB and key agencies plan to continue efforts to address the seven items that GAO identified as behind schedule, but lack time frames for completing most of them. For example, OMB plans to work with congressional committees during the fiscal year 2013 budget process to assist in exploring legislative proposals to establish flexible budget models and to consolidate certain routine IT purchases under agency chief information officers (CIO). However, OMB has not established time frames for completing five of the seven IT Reform Plan action items that are behind schedule. Until OMB and the agencies establish time frames for completing these corrective actions, they increase the risk that key action items will not be completed or effectively managed to closure. Further, they diminish the likelihood of achieving the full benefits of IT reform. OMB has not established performance measures for evaluating the results of most of the IT reform initiatives GAO reviewed. Specifically, OMB has established performance measures for 4 of the 10 action items, including data center consolidation and cloud computing. However, no performance measures exist for 6 other action items, including establishing the best practices collaboration platform and developing a cadre of IT acquisition professionals. Until outcome-oriented performance measures are in place for each of the action items, OMB will be limited in its ability to evaluate progress that has been made and to determine whether or not the initiative is achieving its intended results. GAO is making recommendations to three agencies to complete key IT Reform action items; the agencies generally concurred. GAO is also making recommendations to OMB to complete key action items, accurately characterize the items status, and establish measures for IT reform initiatives. OMB agreed to complete key action items, but disagreed with the latter recommendations, noting that the agency believes it is characterizing the items status correctly and that measures are not warranted. GAO maintains that its recommendations are valid.