NASA was created by the National Aeronautics and Space Act of 1958 to undertake civilian research, development, and flight activities in aeronautics and space. Since its creation, the agency has achieved significant scientific and technical accomplishments in carrying out its mission. The agency depends heavily upon IT—hardware, software, and telecommunications—to support its programs and administrative operations at its headquarters in Washington, D.C., and at its 10 field centers and associated facilities across the United States. In late 1995, the agency had a workforce of approximately 21,000 civil servants and 190,000 contract employees. As an IT-dependent organization, NASA is also one of the federal government’s top IT investors. NASA estimates that it spent about $1.6 billion of its total appropriation of approximately $14 billion in fiscal year 1995 on information technology. From 1994 to 1995, the agency’s IT program ranked as the sixth largest in the United States government, after the Departments of Defense, Energy, Transportation, the Treasury, and Health and Human Services. In 1993, the agency ranked third, after Defense and Health and Human Services. NASA has been criticized in the past for its IRM practices. Reviews by GAO, the NASA Office of the Inspector General (OIG), and NASA itself have identified various problems, including a lack of strong leadership, authority, and oversight; fragmented and overlapping responsibilities; redundant operations; unintegrated planning and budgeting processes; poorly managed systems development efforts; nonstandard and obsolescent systems; and multiple communications networks. Many of the problems cited in previous reviews derive from the lack of IRM leadership and authority. In a study leading to establishment of its CIO, the agency acknowledged that “the lack of focus and leadership at NASA headquarters, the lack of a common stimulus for vision and direction in IT, elements, at all levels of NASA, to evolve independently of each other.” For example: In 1995, NASA’s OIG reported that neither NASA headquarters nor any of its centers had complete inventories of information systems for which they were responsible. This led to managers spending limited resources to purchase or develop information systems which were already available elsewhere within the agency. In an internal 1993 report, NASA found that its IRM decision-making and planning were not being undertaken in a deliberate manner. IRM responsibilities were found to be fragmented, duplicative, and lacking adequate oversight. In addition, offices and managers accountable for IRM responsibilities often lacked either enforcement authority, resources, or both.In 1992, we reported that NASA’s decentralized program management structure, including a lack of management controls, inadequate software standards, and the use of different software tool sets in different locations, increased the agency’s costs and risks in developing critical space station software.In 1990, we reported that NASA had allowed its culture of autonomy and decentralization to dictate its approach to managing its administrative information systems, and, as a result, the agency could not ensure that the systems were being operated in the most efficient and cost-effective manner. In the currently constrained budget environment, and amid efforts to increase the economy and efficiency of government operations, NASA has increasingly been called upon to correct such management weaknesses, streamline operations, and reduce costs. The administration has proposed that the agency’s budget, which was estimated at $13.8 billion in fiscal year 1996, be reduced by $4 billion for fiscal years 1997 to 2000. To meet such a cut, the agency has undertaken a series of internal assessments to determine what support functions, parts of the “infrastructure,” can be consolidated or otherwise streamlined across NASA centers to achieve the necessary savings. The agency has adopted a strategy of attempting to minimize reductions to its major space and aeronautics programs by taking the deepest cuts in support functions. As one such support item, the approximately $1.6 billion NASA annually spends on IT has been targeted for reduction. Specifically, NASA plans to reduce IT budgets for fiscal years 1997 through 2000 by about $400 million. NASA appointed its first CIO in February 1995 to meet both the documented need for greater central leadership and authority in the IRM area, and the increasing pressure to streamline IT activities in order to save scarce resources. Recent reports, official policy guidance, and legislative acts identify CIOs as critical to ensuring agencywide commitment to and successful implementation of IRM improvement initiatives. Specifically, our Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology (GAO/AIMD-94-115, May 1994), which was based on case studies of 10 leading organizations, outlines 11 fundamental IRM “best practices,” including establishing a CIO and ensuring agencywide commitment to and involvement in new processes for improved IRM. Our report noted that it is crucial to implement all of the practices as an integrated group. Implementing only some of the practices but not others could leave weaknesses in an organization’s IRM activities and hinder the potential for obtaining significant benefits through the application of information resources. Further, the Office of Management and Budget’s (OMB) Evaluating Information Technology Investments: A Practical Guide, published in November 1995, provides a systematic approach to managing the risks and returns of IT investments. Finally, the Information Technology Management Reform Act of 1996 (ITMRA), effective August 8, 1996, requires that each federal department and agency appoint a CIO with responsibility for providing information and advice to senior officials on IRM issues. ITMRA also identifies the operative principles for establishing a supporting management framework to improve the planning and control of information technology investments. In April 1996, OMB issued preliminary guidance to clarify CIO responsibilities under ITMRA. This act amends the Paperwork Reduction Act of 1995, which requires a number of IRM practices to improve the productivity, efficiency, and effectiveness of government operations. Together, the two laws, the OMB guidance, and our Executive Guide identify a number of characteristics that are key to effective management of agencywide information resources. For example: (1) An agency should place its CIO at a senior management level, making the CIO an equal partner with other senior officials in decision-making with regard to IRM issues, and supporting the position with an effective organizational framework for leading agencywide IRM initiatives. Specifically, agencies should appoint a CIO with expertise and practical experience in information and position the CIO as a senior management partner reporting directly to the agency head; ensure that the CIO is primarily responsible for IRM activities; task the CIO to serve as a bridge between top management, line management, and information management support professionals; establish a deputy CIO at the agency level and assign other CIOs as necessary in major organizational subcomponents to represent their IRM interests; and develop strategies and specific plans for hiring, training, and professional development of personnel to achieve a highly qualified IRM workforce. (2) The CIO should be supported with effective management controls, including a sound and integrated information technology architecture to provide a framework for evolving or maintaining existing information technology and for acquiring new information technology to achieve the agency’s strategic and IRM goals; an inventory of all agency information resources to facilitate management of these resources and support decision-making concerning additional investments; management systems and procedures to ensure, in conjunction with the Chief Financial Officer (CFO), a full and accurate account of information technology resources and related expenses; appropriate IRM policies, guidelines, and standards and a means of ensuring agencywide compliance with and effective implementation of them; and a means of assessing and upgrading the skills of all agency personnel with regard to IRM. (3) The CIO should be responsible for working with other agency officials to ensure the effective acquisition and management of information resources to support agency programs and missions. This includes promoting effective agency operations by implementing budget-linked capital planning for information technology investments to support the agency’s strategic plan; actively participating with other agency managers in IT planning, budgeting, and investment decision-making; promoting improvements in agency administrative and mission-related work processes before making significant IT investments; developing performance indicators to measure the extent to which information resource investments support agency programs and missions; and monitoring the performance of agency IT programs, evaluating them on the basis of applicable performance measures, and advising the agency head regarding whether to continue, modify, or terminate individual programs or projects. While the CIO is to play an active role in managing and overseeing IT investments, it is the agency head’s responsibility under the Paperwork Reduction Act and ITMRA to establish an agencywide process and framework within which such IT management and oversight is conducted. In our view, this involves the creation of a high-level forum or board composed of the CIO, the CFO, and senior line managers, with responsibility for selecting, controlling, and evaluating information technology investments against established criteria. Since it is unrealistic to expect that this agencywide board would review all IT investments across the organization, the agency head should establish criteria or thresholds for designating which investments could be delegated to the subcomponent level for approval. The agency may want to consider establishing investment boards within the major subcomponents similar to the agencywide board to further facilitate investment management and decision-making. While recognizing the need for a CIO to address long-standing IRM problems and to promote streamlining of IRM functions, NASA has been reluctant to limit the authority of its field centers and program offices to make independent decisions about how best to use information technology to carry out their space and aeronautics missions. Accordingly, NASA made compromises in setting the CIO’s power and authority. On the one hand, the CIO was given senior status and supported by a management framework for carrying out IRM policies and initiatives. On the other hand, the agency set specific limitations on the CIO’s authority over field center activities. CIO responsibilities and accomplishments within the established management framework, as well as the limitations on his power and authority, are discussed in detail below. In February 1995, the NASA Administrator instituted the CIO position as an executive-level manager within his office. IRM is the primary responsibility of the CIO, who reports directly to the Administrator on information and technology management issues, initiatives, and progress. Unlike the predecessor Designated Senior Official for IRM, the CIO is a peer of the Chief Scientist and the Chief Engineer and is positioned above the center Directors and Associate Administrators—heads of the various NASA field and headquarters offices—to promote leadership and authority for agencywide IRM. (See figure 1 for a chart illustrating the CIO’s organizational placement.) By establishing the CIO at a senior level, NASA effectively met one of the major requirements of the CIO guidance discussed above. The CIO’s specific responsibilities include developing a high-level approach to planning and managing IT investments to support mission priorities; providing broad oversight of information systems and processes across the agency; leading in planning and coordinating the acquisition of information resources to carry out cross-functional programs; establishing and monitoring agencywide use of general information technology policies, architectures, and standards to achieve interoperability, interconnectivity, and security in IRM; and assisting program organizations in planning and implementing their IRM activities. To support the CIO in carrying out these responsibilities, a deputy CIO, a staff of six, and 23 center-level CIOs were designated at the various headquarters offices and field centers. The CIO also chartered an Information Technology Management Steering Council (ITMSC) to coordinate IRM activities across programs and to help define information technology strategies, policies, and standards at the agency level. The ITMSC, chaired by the CIO, had oversight of a network of subboards and intercenter committees responsible for IRM activities, such as planning, technology and data management, communications networking, and security. In their comments on a draft of this report, NASA officials informed us of recent revisions to this CIO management structure. Specifically, on July 16, 1996, NASA created a CIO Council to establish high-level policies and standards, approve IRM plans, address issues and initiatives, and serve as the IT capital investment advisory group to the proposed NASA Capital Investment Council. The NASA Capital Investment Council will be chaired by the Associate Deputy Administrator and have responsibility for looking at all capital investments across NASA, including those for IT. Membership on the CIO Council includes the CFO and Associate Administrators for headquarters operations and the various program offices. The CIO, or in his absence, the Deputy CIO, will chair this group. NASA also replaced the ITMSC and its four subboards with the Information Technology Standards/Architecture Integration Council to better coordinate and integrate institutional and programmatic IT requirements and recommend IT policies, standards, practices, and procedures. “Lead centers,” designated to manage specific IRM systems and projects for agencywide benefit, will assume some responsibilities of the former subboards. The lead centers will also oversee the intercenter committees formed to coordinate IRM activities at the operational level. NASA took several steps to ensure that its program offices and field centers would retain broad flexibility in managing their own IRM activities. For example, based on recommendations of the working group chartered to formulate the CIO position, NASA made the following decisions: The 23 CIO representatives would continue to officially report through their normal chains of command and remain accountable to senior management at their own offices or centers, while working on a collaborative basis with the CIO. This created a dual reporting chain for the CIO representatives. The working group devised this approach so that the CIO representatives would remain “customer-focused,” viewing CIO standards and policies in the context of their agency programs and operations. The group also wanted to avoid creating the CIO structure as an independent management system and instead have the CIO and his representatives depend on the ITMSC and its subboards as a vehicle for coordination and cooperation with the rest of the agency. The CIO would use a memorandum of understanding (MOU) to reach agreement with each of the designated lead centers. By not establishing direct reporting links to the CIO, the head of the working group told us, NASA aimed to keep the CIO “dependent upon operational units below him for support ensure ’friendly tension’ and checks and balances” in their management relationships. This was also done to keep the CIO at a high, policy level rather than at an operational level. The CIO would not control any part of the NASA budget because he would not be responsible for funding individual systems or programs. NASA also accepted the working group’s position that the CIO did not need budget authority as a mechanism for enforcing policy and standards. As the head of the working group asserted, “once the CIO issues a policy decision, the rest of the agency is to adhere to it.” The CIO would not take part in individual program decisions and would not have responsibility for setting priorities, making trade-offs, or forming investment decisions among NASA-wide IT systems and programs. The head of the working group believed that the CIO would not be familiar with detailed program requirements and, thus, should not be involved in such decision-making. Because of these restrictions, the CIO’s responsibility was essentially limited to formulating high-level policy and managing cooperative initiatives to consolidate and achieve efficiencies among administrative and cross-cutting IRM resources. In contrast, NASA’s 10 field centers and related program offices retained responsibility for (1) deciding which IT projects to pursue, (2) developing supporting budgets, and (3) managing and overseeing implementation of IRM initiatives. The field centers were not specifically required to comply with CIO guidance. Consequently, the success of the CIO position has been dependent upon their cooperation. Despite the limitations imposed on his authority, the NASA CIO has taken some important first steps to improve IRM at NASA. One of the first areas the CIO targeted was administrative information resources used in day-to-day management of NASA operations. Initiatives in this area include instituting software and hardware standards and developing a technical architecture to achieve interoperability among administrative systems at the desktop and file server levels. As part of this initiative, the CIO called for restrictions on the acquisition of nonstandard desktop computers and related equipment. Specifically, the CIO set a NASA policy of not buying new equipment unless it is (1) necessary to replace obsolete equipment or (2) critical to fulfilling mission-related requirements. The policy also allows exceptions for renewal of existing software licenses. Other related administrative systems initiatives include projects to standardize electronic mail capability, consolidate management of work station hardware and software, and collaborate with the CFO to acquire commercial software for an integrated financial management system. A second major CIO effort has been to direct the consolidation of various larger elements of NASA’s IT infrastructure that are shared by components across the agency. In one case, this effort has led to physical consolidation of some IT equipment and facilities at a single site, while in other cases consolidation of management functions or support contracts is being planned or beginning implementation. The NASA Automated Data Processing Consolidation Center (NACC) at Marshall Space Flight Center, for example, is the site designated by the CIO for physically collocating all NASA administrative IBM and IBM-compatible mainframe systems and selected mission-related applications, such as the External Tank Computer Aided Productivity system. According to agency information, since the consolidation began, NACC has saved over $6 million by economizing on software licenses, labor, hardware maintenance, and capacity management. NASA estimates a total savings of $75 to $90 million from the NACC over the next 5 years. There are also plans underway for Ames Research Center to be the consolidated manager of supercomputers used for science and engineering purposes beginning in October 1996. Officials in charge of the project report that they expect to save about $228 million from fiscal years 1994 through 2000. Further, the CIO had some early involvement, in conjunction with the Office of Space Communications, in directing the consolidation of the management, engineering, and operations of NASA’s wide area telecommunications networks at Marshall. NASA expects this effort to save $236 million over the next 6 years. The CIO also has revised management processes to accompany these IT systems initiatives. These revisions include: integrating IRM planning and budgeting processes to coordinate data collection and reporting requirements; revising and updating IRM policy to reflect organization changes and meet simplifying IRM self-assessment procedures, with greater emphasis on continuous improvement and risk management. Standardization and consolidation efforts undertaken so far have been to some degree successful. Nevertheless, they have been slowed in some areas by a lack of consensus among the field centers that the CIO has been unable to overcome. Furthermore, there are additional opportunities for achieving efficiencies and savings among mission-related systems that the CIO has not yet pursued, principally because of his limited ability to influence the program offices and field centers that have direct responsibility for NASA’s space and aeronautics missions. As discussed above, the CIO has had some involvement in three major consolidation efforts undertaken to date: the NACC project to consolidate IBM mainframe systems at Marshall, the network consolidation effort being managed by Marshall, and the supercomputer consolidation project to be managed by Ames. While all three projects are likely to realize increased efficiencies and savings, at least two have experienced delays and other shortcomings that could have been resolved by a CIO who had greater authority and control over agencywide IT resources and activities. Regarding the NACC effort, a significant dispute developed among the field centers that prevented full implementation of the consolidation as originally planned by the CIO. In June 1995, the CIO requested that all IBM-type mainframes used for mission-related or administrative purposes be moved to the NACC at Marshall. However, Goddard Space Flight Center chose to exempt its mainframes used for mission-related purposes, such as monitoring the flight dynamics of unmanned space missions, from this consolidation. Goddard officials argued that it was unnecessary to transfer these machines because they were planning to invest in more advanced computer technology, which they could continue to manage and operate at Goddard. NACC officials at Marshall, as well as the CIO, however, believed the systems should be included in the consolidation. The dispute remained unresolved for several months. In July 1996, we were told by an NACC official at NASA Headquarters that the matter had been resolved. According to the official, NACC officials at Marshall agreed not to include mission-related systems in the NACC consolidation as originally envisioned. Thus, Goddard would be allowed to continue to independently maintain its mission-related systems. Lacking the necessary CIO authority to effectively organize this agencywide consolidation, the centers reduced the scope of the effort to include only administrative systems. Similar problems occurred in the context of NASA’s effort to consolidate wide area networks. In this case, the Office of Space Communications decided to begin consolidation by designating Marshall as the lead center and adopting Marshall’s approach to consolidation, despite proposals by Goddard and Ames Research Center that suggested that more economical approaches could be adopted. The CIO’s proposal that a competition be conducted among NASA centers to determine the best network consolidation strategy was not adopted by the Office of Space Communications. However, as we discussed in our recent report, the consolidation approach chosen by NASA may not result in the greatest possible savings. The approach also did not include all five of NASA’s wide area networks. Since our report was issued, NASA has accepted our recommendation to conduct an independent study of how best to consolidate its networks and has said that it may amend its approach, based on the study’s findings. In our opinion, a CIO with greater authority could have directed a more comprehensive approach from the outset. According to the CIO and other officials, the consolidation initiatives undertaken to date were chosen because they were relatively easy to identify and implement, and offered quick savings and improvements. These officials acknowledged, however, that there are additional opportunities for streamlining, consolidating, or standardizing mission-critical, scientific, or engineering systems. These opportunities could result in significant savings, especially given the fact that NASA spends as much as 91 percent of its IT budget on mission-related activities. Typical mission-related systems are used for project and data management, mission control, computer-aided design, and flight management. Often custom-designed or acquired to meet specific project requirements, these systems are managed on a decentralized basis. As such, little attention has been paid to issues of systems duplication or inefficiency among the various program offices and field centers. Several officials, including the former CIO, indicated that NASA has traditionally not concerned itself with the cost-effectiveness or return-on-investment potential of its mission-related systems. While no comprehensive effort has been undertaken to identify the full range of opportunities for consolidating and standardizing mission-related IT systems and their associated cost savings, based on discussions with various NASA officials, the following are examples of areas that could be streamlined: Project management, configuration management, action tracking, and other systems that are actually administrative in nature but are managed as mission-related program components. According to the former deputy CIO, such systems are often independently acquired and implemented from mission to mission, even though the need for them could be filled by shared or commercial systems. At least four types of software in use across the agency for orbit determination—a mathematical process to track past orbits and project future paths of NASA satellites. According to space operations officials, there is a clear opportunity to standardize operations in this area so that NASA does not continue to build redundant systems to meet similar requirements. Engineering tools, such as computer aided design/computer aided engineering (CAD/CAE) systems. According to the former deputy CIO, the Space Shuttle and Space Station programs are using incompatible CAD/CAE products. As a result, engineers from one program can view documents but cannot manipulate data in the other program’s engineering system. Multiple data archival and storage systems. In March 1995, the Information Systems Cross-Cutting Team recommended developing a standard approach for acquiring software used in data storage systems to promote sharing, interoperability, and cost reductions. NASA has more than 20 systems to archive and store scientific, engineering, and administrative data relative to spaceflight planning and analysis. However, improving the efficiency of data storage has not been part of the CIO’s improvement program. The recently enacted Information Technology Management Reform Act of 1996, which supplements the Paperwork Reduction Act, requires NASA to strengthen its CIO position. The new law’s requirements will take effect in August 1996. For example, ITMRA requires agencies to design and implement a strategic process for maximizing the value and assessing and managing the risks of IT acquisitions. As elaborated by our Executive Guide and OMB’s investment guide, a key component of this process is an investment review board to select, control, and evaluate IT investments. However, we found during the course of our audit that NASA lacked such an agencywide process and instead, as discussed above, allowed IT investment decisions to be made by individual field centers and program offices. NASA’s proposed Capital Investment Council may fill this need; however, the council has not yet been formally established. The lack of an agencywide process for overseeing investments means that NASA has no systematic means of ensuring that particular IT systems and projects do not duplicate other efforts underway and are an appropriate use of diminishing funds. Accordingly, the individual centers have developed redundant and unintegrated accounting and reporting systems and have acquired mission-related systems and tools on a project by project basis, often without considering opportunities for sharing or consolidation. ITMRA also requires that CIOs monitor the performance of existing information technology programs on the basis of applicable performance measurements and advise the agency head regarding whether to continue, modify, or terminate projects or programs. However, NASA’s CIO has no program in place to measure IRM performance. As discussed above, CIO efforts have focused on consolidating and achieving efficiencies among administrative and cross-cutting IRM resources. The CIO does not have the authority to conduct systems review and oversight. Existing processes for oversight of systems and programs are fragmented, conducted through various channels at various levels, depending upon the dollar amounts involved. For example, the Program Management Council chaired by the Deputy Administrator is in some ways a corporate investment review board for NASA. The Council is a high-level board responsible for planning, implementation, and management of major programs costing more than $200 million. However, the Council does not review all NASA programs and does not specifically review IT programs. Only a few IT projects, such as the Earth Observing System Data and Information System, may receive review at this level. Further, while information technology investments over $100 million may be reviewed at the headquarters level, NASA’s individual field centers and corresponding program offices are responsible for independently managing all IT investments below this threshold. More effective systems review and oversight, including consistent investment management processes and procedures agencywide, could help preclude past problems, such as costly, poorly managed, and high-risk software development efforts, from continuing in the future. NASA’s proposed Capital Investment Council, which is intended to supplement the Program Management Council by reviewing major capital investments, may address this concern once it is implemented. Further, the Paperwork Reduction Act requires agencies to develop and maintain complete inventories of their computer equipment. Knowing what information resources an organization has is necessary to effectively manage them, and further, is necessary to make decisions regarding the investment in additional resources. As we previously indicated, NASA’s Office of the Inspector General reported in its Survey of NASA Information Systems (JP-95-003, March 29, 1995) that the agency does not have a complete systems inventory, resulting in the unnecessary expenditure of limited resources to purchase or develop information systems already available elsewhere within the agency. NASA’s IRM Director said that his office keeps an inventory of major systems for reporting purposes, but conceded that it is incomplete. Though an automated standard tool is being put in place to generate an inventory of systems at the desktop and file server levels, NASA has no means of centrally identifying mission-related information systems, except to the extent that programs include desktop and file server equipment. NASA does not have a process for collecting and maintaining accurate information on its IT resources. No comprehensive agencywide budget for IT exists, and individual program offices compile separate IT budgets to support the mission requirements of field centers under their purview. Funding for administrative and institutional IT is spread among these individual budgets and cannot be accurately consolidated, given the nonstandard funding categories that the various program offices use. Data on funding for mission-related information technology must be extracted from budget subtotals for individual programs and projects and also is not very accurate. Existing summaries of agencywide IT investments are merely estimates derived from gathering and analyzing budget numbers submitted by the program offices for reporting purposes. Given such budget processes, there is no accurate means of keeping track of NASA IT financial resources and how they are spent. IRM officials told us, for example, that savings resulting from IRM improvement initiatives are not systematically tracked or visible to senior managers on an agencywide basis. Further, the CIO has no effective means of ensuring that agencywide IT expenditures are made in accordance with newly instituted effectiveness and efficiency goals. Specifically, the CIO requires that center representatives report to his office on their efforts to implement his policies regarding managing IT obsolescence, freezing procurements, and standardizing administrative systems across the agency. However, as previously discussed, the centers do not have adequate management processes or inventory systems in place for meeting such requirements. For example, the database of the NASA Equipment Management System that the centers would ordinarily rely upon to meet this need is out-of-date, and the information it contains is not detailed enough to fulfill CIO requirements. Instituting an effective IT resource tracking system will be an essential step toward ensuring the effectiveness of IT investments and meeting the requirements of ITMRA and related legislation. The CIO has initiated some efforts to facilitate center reporting, but it is still too soon to determine their impact. For example, the CIO said that he has a project underway to define a set of data that the centers will need to meet reporting requirements that are expected to begin this summer. The centers are also in the process of implementing a new system—Norton Administrator—to provide standard inventories of agencywide technology and facilitate the required reporting. However, this system only accounts for equipment connected to local area networks and does not address the existence of unique, standalone equipment. Further, the new CIO management structure recently established in July 1996 is designed to address other IT management issues, such as the need for an investment review mechanism and performance measures for evaluating progress in achieving agency objectives. However, it is too early at this point to assess the effectiveness of this management structure and the level of commitment afforded to it. NASA has gained some initial IRM improvements through its appointment of a CIO. By establishing a CIO Council to help select, control, and evaluate its systems investments, NASA is beginning to conform to the Paperwork Reduction Act and ITMRA and should be in a position to better manage its information resources in the future. However, as currently chartered, the CIO is limited in achieving substantial additional economies and efficiencies in IRM. Clear opportunities exist for a CIO with more authority to pursue greater consolidation and standardization of agency systems. Additional improvements, such as instituting effective mechanisms for IT inventorying and accounting, will also be critical. We recommend that the Administrator of the National Aeronautics and Space Administration strengthen the agency’s IT management processes by strengthening the requirement that NASA organizations abide by IRM policies, guidelines, standards, and architectures instituted by the CIO and establishing clear and consistent procedures for granting waivers and resolving conflicts. In addition, we recommend that the NASA Administrator direct the CIO to establish and maintain a complete and accurate inventory of agencywide IT resources for investment management and decision-making purposes, work with the CFO to develop the systems and procedures necessary to accurately account for all IT-related expenditures, define and implement IT performance measures in order to assess the effectiveness of the agency’s systems investments in meeting program and mission requirements, identify opportunities for greater efficiencies and cost reductions among mission-related IT resources and include these in ongoing standardization and consolidation efforts, and promote improvements in agency administrative and mission-related work processes through the increased use of IT. In its written comments on a draft of our report, NASA acknowledged that there was room for improvement in its IRM activities and stated that it generally supported the report’s recommendations and had activities underway to address all of them. Because it has these initiatives underway, NASA criticized the report as out-of-date and unjustifiably negative. Based on its comments, we have updated the information in our report as appropriate and believe that NASA’s actions may ameliorate our concerns over time. However, we do not believe that our findings are either out-of-date or invalid. Many of the initiatives cited by NASA were only recently implemented, and it is still too early to determine their effectiveness. The establishment of the new CIO Council, for example, was not made official until after NASA submitted its comments to us. However, as discussed in our more detailed evaluation of NASA’s comments, which are reprinted in appendix II, we deleted two proposals because of these recent initiatives. These proposals focused on establishing an IT investment review forum and clarifying the relationship between the CIO and the IRM office. As discussed in the report, we believe that NASA has taken some good first steps towards addressing past problems and improving IRM. We support NASA’s efforts to address our recommendations. We also believe that our findings and recommendations can provide a useful framework for measuring continued progress. We are sending copies of this report to the Administrator of NASA; the Director of the Office of Management and Budget; the Ranking Minority Member of your Subcommittee; and the Chairmen and Ranking Minority Members of the House and Senate Committees on Appropriations; the House Committee on Science; the Senate Committee on Commerce, Science, and Transportation; and the Senate Committee on Governmental Affairs. We will send copies to other interested parties upon request. Please contact me at (202) 512-6240 if you have any questions concerning this report. Major contributors to this report are listed in appendix III. To accomplish our review objectives, we focused on (1) assessing the CIO’s placement, leadership, and authority for agencywide IRM, (2) evaluating the CIO’s approach to instituting standards and initiatives for more strategic and cost-effective IRM, and (3) examining processes and controls to support the CIO in managing information technology investments and identifying areas for improvement. We based our review on criteria from three sources: (1) the requirements of ITMRA, (2) guidance prepared by OMB on implementing ITMRA and evaluating IT investments, and (3) our Executive Guide: Improving Mission Performance Through Strategic Information Management and Technology (GAO/AIMD-94-115, May 1994). To obtain background information on the long-standing IRM problems at NASA, we reviewed reports from the General Services Administration, the NASA Office of the Inspector General, NASA, and GAO. We also discussed these reports with OIG and NASA officials. To assess the CIO’s placement, leadership, and authority for agencywide IRM, we met with the CIO, his successor, the Deputy CIO, and other officials in their organization. From these officials, we obtained documentation on their vision for more strategic management of NASA-wide information resources. We examined organization charts, position descriptions, steering council minutes, and committee charters to learn about the newly instituted CIO management framework and to identify the agencywide IRM chain of command. We interviewed officials in the headquarters IRM office, program offices, and selected centers to learn about accountability to the CIO for information technology management. We also reviewed existing IRM plans and guidance and newly-issued CIO policy directives to determine their breadth of coverage and to identify oversight and control mechanisms for ensuring agencywide application. To evaluate the CIO’s approach to instituting standards and initiatives for more strategic and cost-effective IRM, we met with officials of four IRM steering council subboards and discussed their efforts to improve in the areas of planning, technology standardization, data management, and information resources consolidation. We obtained and reviewed briefing documents, plans, and correspondence that summarized these and other standardization efforts. Members of an evaluation team discussed with us the criteria and analysis they used to help the CIO select and establish lead centers to help standardize and consolidate supercomputers, mainframes, communications networks, and workgroup technology. IRM and financial management officials told us about efforts to upgrade and integrate management information systems for agencywide use. Relevant technical officials provided information on approaches to building hardware, information, and data architectures. IRM officials and information technology users in various program offices and centers told us about their commitment and steps taken to implement centrally-directed standards and initiatives. To determine whether NASA has adequate processes and controls in place to support the CIO in managing agencywide information technology investments and to identify areas for improvement, we discussed with key officials NASA’s processes for selecting, funding, and overseeing management of its information technology acquisitions and whether there are opportunities for greater CIO involvement. For this review, we also relied on the results of a separate GAO review of information technology investment management at five agencies, including NASA. We conducted our review from September 1995 through April 1996 in accordance with generally accepted government auditing standards. We performed our work at NASA headquarters in Washington, D.C.; the Ames Research Center in Moffett Field, California; the Goddard Space Flight Center in Greenbelt, Maryland; and the Marshall Space Flight Center in Huntsville, Alabama. The following are GAO’s comments on the National Aeronautics and Space Administration’s letter dated June 28, 1996. 1. NASA asserts that GAO relied on “out-of-date reports” to develop its audit findings rather than directly investigating the current activities of the CIO. This is not the case. Although we reviewed previous reports in order to obtain background information on past IRM problems at NASA, all of our audit findings were derived from a thorough data collection activity and numerous interviews with senior officials at NASA headquarters and key field centers from September 1995 through April 1996. The details of our methodology are explained in appendix I. Our background review of prior reports was used, both in our audit and in the report, chiefly as a means to establish the context of long-standing IRM problems that the newly-appointed CIO faced when he began work. We note in our report that the CIO has already made significant improvements over past NASA IRM practices, such as instituting a management framework for enhanced IRM coordination and initiating projects to standardize or consolidate agencywide information resources. NASA mentions several initiatives that it says have been underway over the past year. However, several of these activities are very recent and were not mentioned by IRM officials during our interviews. For example, the reassignment of IRM policy, planning, and oversight staff to the office of the CIO was first announced in May 1996 and has not yet been completed. Further, the CIO Council, intended to be responsible for overseeing investment strategies and decisions, was just established on July 16, 1996. Given the newness of these actions, we believe that our findings and recommendations remain useful as a framework for measuring continued progress in improving IRM. 2. Due to the recent organizational changes discussed above, the chart on the CIO Management Structure has been deleted from the report. In addition, we deleted from our draft report a proposal that NASA clarify the linkage of the IRM organization to the CIO office since NASA is in the process of addressing this relationship. We have made other changes throughout the report to include updated information where appropriate. 3. NASA states that it does not believe that the agency CIO must have budget authority over all agency IT investments in order to be effective. We agree with NASA on this point. In fact, we are not making any recommendation to give the CIO such authority. Rather, we believe that a more authoritative CIO, participating in the budget process, would be in a better position both to advise an investment review board on potential IT investments and to coordinate implementation of the prioritized decisions of the board. The new CIO Council, intended to be responsible for IT investment review and oversight, may address this concern. Accordingly, we have not included our earlier proposal that NASA establish such a council. 4. NASA states that GAO used previous reports on NASA’s IRM activities to substantiate its findings in the current report. This is not true. The previous reports are referenced in order to characterize the problems that NASA has faced in the IRM area in the past. In order to avoid confusion, we have deleted the reference to the 1994 General Services Administration report, which did not contribute substantially to characterizing NASA’s past IRM problems. Further, we disagree with NASA that the OIG’s 1995 report findings were unsubstantiated and believe that the report’s findings are relevant. For example, based on our own independent audit work, we also found that an accurate systems inventory was lacking and was needed. The findings in our report, which address the effectiveness of the CIO since inception in early 1995, are all based on recent audit work conducted by GAO. 5. The data center consolidation effort is one of the CIO activities that we cite as an example of a good first step. We believe that the consolidation effort has been beneficial. However, its implementation has been slowed by unresolved differences in approaches and opinions among the field centers and headquarters. These resulted in genuine disputes rather than merely “open, candid dialogue” as NASA has asserted. Without anyone to take charge and direct a solution, the consolidation effort was ultimately redefined to not include mission-related systems. We continue to believe that stronger leadership from the CIO could have led to a solution that would not have resulted in such a significant reduction in the scope of the effort. Reginia S. Grider, Evaluator The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the National Aeronautics and Space Administration's (NASA) efforts to implement a chief information officer (CIO) position, focusing on: (1) CIO initiatives to improve information resources management (IRM); and (2) opportunities for NASA to strengthen the CIO position and improve its IRM program. GAO found that: (1) NASA CIO has taken some action to address longstanding IRM problems including the lack of strong leadership, authority, and oversight, fragmented and overlapping responsibilities, redundant operations, unintegrated planning and budgeting processes, multiple communications networks, and poorly managed systems development efforts; (2) although NASA recognizes the need to address these IRM problems, it has been reluctant to limit the authority of its field centers and program offices to make independent decisions on how best to use information technology (IT) to carry out their missions; (3) despite these limitations, NASA CIO is instituting software and hardware standards to achieve interoperability among administrative systems, integrating IRM planning and budgeting processes, and revising IRM policies to reflect organizational changes; (4) strengthening the CIO position would enable NASA to achieve efficiencies and savings among mission-related systems; (5) agencywide investments in mission-related systems and related contractor services constitute as much as 91 percent of the annual NASA IRM budget; (6) funding for IT investments cannot be accurately consolidated given the nonstandard funding categories that various program offices use; and (7) instituting an effective IT resource tracking system is essential to ensuring the effectiveness of IT investments.