Although the American people expect world-class public services and are demanding more of government, the public’s confidence in the government’s ability to address its demands remains all too low. The government’s successful implementation of information technology could improve this confidence. Indeed, according to the Council for Excellence in Government, “Electronic government can fundamentally recast the connection between people and their government. It can make government far more responsive to the will of the people and greatly improve transactions between them. It can also help all of us to take a much more active part in the democratic process.” Government use of Internet-based services is broadening and becoming more sophisticated. In particular, public sector agencies are increasingly turning to the Internet to conduct paperless acquisitions (electronic malls), provide interactive electronic services to the public, and tailor or personalize information. However, the government must still overcome several major challenges to its cost-effective use of information technology. At the beginning of this year we issued a series of reports—our Performance and Accountability Series—devoted to framing the actions needed to support the transition to a more results-oriented and accountable federal government. To the extent that the billions of dollars in planned IT expenditures can be spent more wisely and the management of such technology improved, federal programs will be better prepared to meet mission goals and support national priorities. However, we identified seven continuing IT challenges that are key to achieving this goal: strengthening agency information security, improving the collection, use, and dissemination of government information, pursuing opportunities for electronic government, constructing sound enterprise architectures, fostering mature systems acquisition, development, and operational practices, ensuring effective agency IT investment practices, and developing IT human capital strategies. Until these challenges are overcome, agencies are likely to continue to have fundamental weaknesses in their information resources and technology management and practices, which can negatively affect mission performance. Since 1990, we have also periodically reported on government operations that we have assessed as high risk because of their greater vulnerability to waste, fraud, abuse, or mismanagement. In January of this year, in the information resources and technology management area, we designated information security and three agency IT modernization efforts as high risk. We have reported governmentwide information security as high risk since 1997, and the three major modernization efforts since 1995. The federal government’s information resources and technology management structure has its foundation in six laws: the Federal Records Act, the Privacy Act of 1974, the Computer Security Act of 1987, the Paperwork Reduction Act of 1995, the Clinger-Cohen Act of 1996, and the Government Paperwork Elimination Act of 1998. Taken together, these laws largely lay out the information resources and technology management responsibilities of the Office of Management and Budget (OMB), federal agencies, and other entities, such as the National Institute of Standards and Technology. In general, under the government’s current legislative framework, OMB has important responsibilities for providing direction on governmentwide information resources and technology management and overseeing agency activities in these areas, including analyzing major agency information technology investments as part of the federal budget process. Among OMB’s responsibilities are ensuring agency integration of information resources management plans, program plans, and budgets for acquisition and use of information technology and the efficiency and effectiveness of interagency information technology initiatives; developing, as part of the budget process, a mechanism for analyzing, tracking, and evaluating the risks and results of all major capital investments made by an executive agency for information systems;directing and overseeing implementation of policy, principles, standards, and guidelines for the dissemination of and access to public information; encouraging agency heads to develop and use best practices in information technology acquisition; reviewing proposed agency information collections to minimize information collection burdens and maximize information utility and benefit; and developing and overseeing implementation of privacy and security policies, principles, standards, and guidelines. Federal departments and agencies, in turn, are accountable for the effective and efficient development, acquisition, and use of information technology in their organizations. For example, the Paperwork Reduction Act of 1995 and the Clinger-Cohen Act of 1996 require agency heads, acting through agency CIOs, to better link their information technology planning and investment decisions to program missions and goals; develop and implement a sound information technology architecture; implement and enforce information technology management policies, procedures, standards, and guidelines; establish policies and procedures for ensuring that information technology systems provide reliable, consistent, and timely financial or program performance data; and implement and enforce applicable policies, procedures, standards, and guidelines on privacy, security, disclosure, and information sharing. Another important organization in federal information resources and technology management—the CIO Council—was established by the President in July 1996—shortly after the enactment of the Clinger-Cohen Act. Specifically, Executive Order 13011 established the CIO Council as the principal interagency forum for improving agency practices on such matters as the design, modernization, use, sharing, and performance of agency information resources. The Council, chaired by OMB’s Deputy Director for Management with a Vice Chair selected from among its members, is tasked with (1) developing recommendations for overall federal information technology management policy, procedures, and standards, (2) sharing experiences, ideas, and promising practices, (3) identifying opportunities, making recommendations for, and sponsoring cooperation in using information resources, (4) assessing and addressing workforce issues, (5) making recommendations and providing advice to appropriate executive agencies and organizations, and (6) seeking the views of various organizations. Because it is essentially an advisory body, the CIO Council must rely on OMB’s support to see that its recommendations are implemented through federal information management policies, procedures, and standards. With respect to Council resources, according to its charter, OMB and the General Services Administration are to provide support and assistance, which can be augmented by other Council members as necessary. The information issues confronting the government in the new Internet- based technology environment rapidly evolve and carry significant impact for future directions. To effectively address these issues, we believe that the government’s current information resources and technology management framework could be strengthened by establishing a central focal point, such as a federal CIO. Increasingly, the challenges the government faces are multidimensional problems that cut across numerous programs, agencies, and governmental tools. Clearly, departments and agencies should have the primary responsibility and accountability for decisions related to IT investments and spending supporting their missions and statutory responsibilities. But governmentwide issues need a strong catalyst to provide substantive leadership, full-time attention, consistent direction, and priority setting for a growing agenda of government issues, such as critical infrastructure protection and security, e-government, and large-scale IT investments. A federal CIO could serve as this catalyst, working in conjunction with other high-level officials, to ensure that information resources and technology management issues are addressed within the context of the government’s highest priorities and not in isolation from these priorities. During the period of the legislative deliberations on the Clinger-Cohen Act, we supported strengthened governmentwide management through the creation of a formal CIO position for the federal government. In September 2000 we also called for the Congress to consider establishing a formal CIO position for the federal government to provide central leadership and support. As we noted, a federal CIO would bring about ways to use IT to better serve the public, facilitate improving access to government services, and help restore confidence in our national government. With respect to specific responsibilities, a federal CIO could be responsible for key functions, such as overseeing federal agency IT activities, managing crosscutting issues, ensuring interagency coordination, serving as the nation’s chief IT spokesman internationally, and maintaining appropriate partnerships with state, local, and tribal governments and the private sector. A federal CIO could also participate in establishing funding priorities, especially for crosscutting e-government initiatives, such as the President’s recently proposed e-government fund (estimated to include $100 million over three years), which is expected to support interagency e-government initiatives. Consensus has not been reached within the federal community on the need for a federal CIO. Department and agency responses to questions developed by the Chairman and Ranking Minority Member of the Senate Committee on Governmental Affairs regarding opinions about the need for a federal CIO found mixed reactions. In addition, at our March 2000 Y2K Lessons Learned Summit, which included a broad range of public and private-sector IT managers and policymakers, some participants did not agree or were uncertain about whether a federal CIO was needed. Even individuals or organizations that support a federal CIO disagree on the structure and authorities of this office. For example, as you know, the last Congress considered two proposals to establish a federal CIO: H.R. 4670, the Chief Information Officer of the United States Act of 2000, introduced by Representative Turner, and H.R. 5024, the Federal Information Policy Act of 2000, which you introduced. These bills shared a common call for central IT leadership from a federal CIO but they differed in how the roles, responsibilities, and authorities of the position would be established. H.R. 5024 vested in the federal CIO the information resources and technology management responsibilities currently assigned to OMB, as well as oversight of related activities of the General Services Administration and promulgation of information system standards developed by the National Institute of Standards and Technology. On the other hand, H.R 4670 generally did not change the responsibilities of these agencies; instead, it called on the federal CIO to advise agencies and the Director of OMB and to consult with nonfederal entities, such as state governments and the private sector. Senator Lieberman also plans to introduce an e-government bill, which is expected to include a provision establishing a federal Chief Information Officer. Different federal CIO approaches have also been suggested by other organizations. For example, in February, the Council for Excellence in Government recommended that the President (1) name an Assistant to the President for Electronic Government with cabinet-equivalent rank, who would chair a Public/Private Council on Electronic Government and (2) designate OMB’s Deputy Director for Management as Deputy Director for Management and Technology. The Council also called for the Deputy Director for Management and Technology, in turn, to create an Office of Electronic Government and Information Policy to be headed by a presidentially appointed, senate-confirmed federal CIO. In March, the GartnerGroup—a private research firm—called on the President to appoint a cabinet-level federal CIO within the Executive Office of the President. Some key areas that the GartnerGroup stated that the federal CIO should focus on include (1) advising the President on technology-related public policy, (2) developing and implementing federal e-government plans, (3) managing appropriated “seed money” for cross- agency e-government initiatives, and (4) developing standards for e- government interoperability and other IT-related transformation initiatives. CIOs or equivalent positions exist at the state level but no single preferred model has emerged. The specific roles, responsibilities, and authorities assigned to the CIO or CIO-type position vary, reflecting the needs and priorities of the particular government. However, some trends are apparent. Namely, according to the National Association of State Information Resource Executives (NASIRE), half the states have a CIO in place who reports directly to the governor. (Only eight states reported such an arrangement in a 1998 survey.) All but one of the remaining CIOs report to a cabinet-level officer or an IT board. In addition, some state CIOs work in conjunction with an advisory board or commission, and many of them serve as chair of a council of agency-level CIOs. As a former president of the National Association of State Information Resource Executives noted in prior testimony, “IT is how business is delivered in government; therefore, the CIO must be a party to the highest level of business decisions . . . needs to inspire the leaders to dedicate political capital to the IT agenda.” With respect to CIOs’ responsibilities, according to the NASIRE, the vast majority of states have senior executives with statewide authority for IT. In addition, state CIOs are usually in charge of developing statewide IT plans and approving statewide technical IT standards, budgets, personnel classifications, salaries, and resource acquisitions, although the CIO’s authority depends on the specific needs and priorities of the governors. In some cases, the CIO is guided by an IT advisory board. Examples of the diversity in CIO structures that states reported in 2000 to the Government Performance Project—administered by the Maxwell School of Citizenship and Public Affairs of Syracuse University in partnership with Governing Magazine—are as follows. A model in which the CIO has a strong link to the state’s highest official is Missouri’s Chief Information Officer who reports to the Governor’s office. Missouri’s CIO is responsible for, among other things, IT strategic planning and policy, IT procurement, e-government, and facilitating IT resource sharing across agencies. The CIO is also the liaison representing Missouri on national issues affecting IT functions of the state. Kansas uses a model in which the CIO has multiple reporting responsibilities, including reporting to an IT council and the Governor. The Kansas Chief Information Officer serves as the Executive Branch Chief Information Technology Officer reporting to the Information Technology Executive Council, Governor and the Secretary of Administration. The Kansas CIO (1) establishes project management standards, (2) approves bid specifications, (3) approves IT projects over $250,000, (4) reports project status, and (5) manages the Strategic Information Management 3-year plan. Kansas also has Chief Information Technology Officers for its legislative and judicial branches that also report to the Information Technology Executive Council, as well as to the Legislative Coordinating Council and Office of Judicial Administration, respectively. Finally, in the model used by Michigan, the CIO reports to the head of an executive agency—the Department of Management and Budget. The duties of the Michigan CIO include developing a statewide information technology architecture and standards, developing and managing a statewide telecommunications network, and coordinating and reengineering business processes throughout the state government. Certain key principles and success factors can provide insight into the establishment of a successful CIO organization—including at the federal level. In February we issued an executive guide that includes a framework of critical success factors and leading principles (see figure 1). We developed this framework based on interviews with prominent private- sector and state CIOs, as well as other research. Mr. Chairman, what may be of particular interest to this Subcommittee is that CIOs of leading organizations we interviewed described a consistent set of key principles of information management that they believed contributed to the successful execution of their responsibilities. These principles touch on specific aspects of their organizational management, such as formal and informal relationships among the CIO and others, business practices and processes, and critical CIO functions and leadership activities. While focused on the use of CIOs within organizations, many of the principles of the framework are applicable to a federal CIO position. Let me explain some of the key characteristics of the six fundamental principles described by CIOs we interviewed and important parallels that can be made to the establishment of a federal CIO. Recognizing the business transformation potential of IT, executives of leading organizations position their CIOs as change agents with responsibility for applying technology to achieve major improvements in fundamental business processes and operations. With CEO support, the CIOs are in a good position to significantly affect not only IT, but the entire business enterprise. Similarly, it is important that a federal CIO be assigned a prominent role in the government’s decisionmaking to create and set a clear agenda and expectations for how information management and information technologies can be effectively used to help improve government operations and performance. Diversities in corporate missions, structures, cultures, and capabilities prohibit a prescriptive approach to information management leadership. Instead, executives in leading organizations ensure that their CIO models are consistent with the business, technical, and cultural contexts of their enterprises. In conjunction with determining their CIO models, senior executives of leading organizations clearly define up front the roles, responsibilities, and accountability of their CIOs for enterprisewide information management, better enabling their CIOs to operate effectively within the parameters of their positions vis-à-vis those of their senior management counterparts (i.e., CFO, COO). These senior executives also provide their CIOs with the authority they need to effectively carry out their diverse responsibilities. The federal government is large, complex, and diverse. Indeed, many federal departments and agencies easily rival in size and complexity some of our nation’s largest corporations. In addition, virtually all the results that the federal government strives to achieve require the concerted and coordinated efforts of two or more agencies. These are the types of issues that are important to consider when establishing a federal CIO. For example, while it may not be realistic for a federal CIO to have explicit responsibility for agency IT investments, a federal CIO could be an important broker of solutions that require cross-agency cooperation and coordination. CIOs in leading organizations recognize that providing effective information management leadership and vision is a principal means of building credibility for their CIO positions. In addition, CIOs often outline plans of attack or roadmaps to help guide them in effectively implementing short- and long-term strategies. Further, CIOs participate on executive committees and boards that provide forums for promoting and building consensus for IT strategies and solutions. These types of responsibilities can effectively translate to a federal CIO as well. A federal CIO can help set and prioritize governmentwide IT goals, provide leadership for the governmentwide CIO Council, and actively participate in other advisory organizations, such as the CFO Council, the Procurement Executives Council, and the President’s Information Technology Advisory Committee. While there is no standardized approach to performance measurement, leading organizations strive to understand and measure what drives and affects their businesses and how to best evaluate results. Leading organizations use performance measures that focus on business outcomes such as customer satisfaction levels, service levels, and, in some instances, total requests satisfied. In addition, to properly collect and analyze information, leading organizations develop measurement systems that provide insight into their IT service delivery and business processes. Establishing an information feedback system allows organizations to link activities and functions to business initiatives and management goals. The Government Performance and Results Act is results-oriented legislation that is intended to shift the focus of government decisionmaking, management, and accountability from activities and processes to the results and outcomes achieved by federal programs. A key role for a federal CIO could be to help formulate consensus and direction on performance and accountability measures pertinent to information management in the federal government. Moreover, a federal CIO could help establish goals and measures for major governmentwide efforts, including for the CIO Council, and create a mechanism to report on the government’s progress in meeting these goals. This is a particularly important role since managers at the organizations we studied cautioned that IT performance measurement is in its infancy and measurement techniques are still evolving, partly due to changes in technology. In lieu of establishing either completely centralized or decentralized CIO organizations, leading organizations manage their information resources through a combination of such structures. In this hybrid, the CEO assigns central control to a corporate CIO and supporting CIO organization, while delegating specific authority to each business unit for managing its own unique information management requirements. This model is particularly appropriate for the federal government since the Clinger-Cohen Act of 1996 requires executive agencies to appoint CIOs to carry out the IT management provisions of the act and the broader information resources management requirements of the Paperwork Reduction Act. Accordingly, a federal CIO could help ensure overall IT policy direction and oversight for the government, and agency CIOs would be responsible for carrying out these policies, as appropriate for their agencies. In addition, a federal CIO could play a role in suggesting, through formal and informal means, how the government information resources and technology management structure should be organized, with particular emphasis on how such a structure can achieve cross-cutting functionally oriented government services. High-performance organizations have long understood the relationship between effective “people management” and organizational success. Accordingly, we found that leading organizations develop human capital strategies to assess their skill bases and recruit and retain staff who can effectively implement technology to meet business needs. Such strategies are particularly important since studies forecast an ever-increasing shortage of IT professionals, presenting a great challenge for both industry and the federal government. Complicating the issue further, serious concerns are emerging about the aging of the federal workforce, the rise in retirement eligibility, and the effect of selected downsizing and hiring freeze initiatives. Since human capital concerns are a governmentwide concern, this is one area in which a federal CIO could have a tremendous impact. Working with the Office of Personnel Management and OMB, the CIO could explore and champion initiatives that would aid agencies in putting in place solid IT workforce management and development strategies. In conclusion, Mr. Chairman, while information technology can help the government provide services more efficiently and at lower costs, many challenges must be overcome to increase the government’s ability to use the information resources at its disposal effectively, securely, and with the best service to the American people. A central focal point such as a federal CIO can serve in the essential role of ensuring that attention to information technology issues is sustained and improves the likelihood that progress is charted and achieved. Although our research has found that there is no one right way to establish a CIO position, critical success factors we found in leading organizations, such as aligning the position for value creation, are extremely important considerations. Finally, the experiences of statewide CIOs offer a rich set of experiences to draw on for ideas and innovation. As a result, it is critical that a federal CIO, as well as agency-level CIOs, develop effective working relationships with state CIOs to discuss and resolve policy, funding, and common systems and technical infrastructure issues. Such relationships are of growing importance as public entities work to establish effective e- government initiatives. Mr. Chairman, this concludes my statement. I would be pleased to respond to any questions that you or other members of the Subcommittee may have at this time. For information about this testimony, please contact me at (202) 512-6240 or by e-mail at mcclured@gao.gov. Individuals making key contributions to this testimony include Felipe Colon, Jr., and Linda Lambert. (310411)

Summary: The rapid pace of technological change and innovation has offered unprecedented opportunities for both the government and commercial sectors to use information technology (IT) to improve performance, reduce costs, and enhance service. A range of issues have emerged about how to best manage and integrate complex information technologies and management processes so that they are aligned with mission goals, strategies, and objectives. Although IT can help the government provide services more efficiently and at lower costs, many challenges must be overcome to increase the government's ability to use the information resources at its disposal effectively, securely, and with the best service to the American people. A central focal point such as a federal Chief Information Officer (CIO) can help ensure that attention to IT issues is sustained and increase the likelihood that progress is charted and achieved. Although GAO's research has found that there is no one right way to establish a CIO position, critical success factors GAO found in leading organizations, such as aligning the position for value creation, are extremely important considerations. Finally, the experiences of statewide CIOs offer a rich set of experiences to draw on for ideas and innovation. A federal CIO, as well as agency-level CIOs, must develop effective working relationships with state CIOs to discuss and resolve policy, funding, and common systems and technical infrastructure issues.