Congress has long recognized that IT has the potential to enable federal agencies to accomplish their missions more quickly, effectively, and economically. However, fully exploiting this potential has presented longstanding challenges to agencies, and despite substantial IT investments, the federal government’s management of IT has produced mixed results. The CIO position was established by Congress to serve as a focal point for IT within an agency to address these challenges. Since l980, federal law has placed the management of IT under the umbrella of information resources management (IRM). Originating in a l977 recommendation to Congress from the Commission on Federal Paperwork, the IRM approach was first enacted into law in the Paperwork Reduction Act of l980. This act required OMB to oversee federal agency IRM areas, which combined IT with information management areas, including information collection, records management, and privacy. The law also gave agencies a more general responsibility to carry out their IRM activities in an efficient, effective, and economical manner and to comply with OMB policies and guidelines. To assist in this effort, the law required that each agency head designate a senior official who would report directly to the agency head to carry out the IRM responsibilities of the agency under the law. Amendments to the Paperwork Reduction Act in l986 and l995 were designed to strengthen agency and OMB implementation of the law. Most particularly, the act’s 1995 amendments provided detailed agency requirements for each IRM area, to match the specific OMB provisions. In addition, these amendments required agencies to develop, for the first time, processes to select, control, and evaluate the results of major information systems initiatives. Under the Paperwork Reduction Act, as amended through 1995, senior IRM officials were required to carry out the responsibilities of their agencies with respect to IRM and report directly to the head of the agency. In l996, the Clinger-Cohen Act supplemented the information technology management provisions of the Paperwork Reduction Act with detailed requirements for IT capital planning and investment control and performance and results-based management. The Clinger-Cohen Act also established the position of agency CIO by amending the Paperwork Reduction Act to rename the senior IRM officials “chief information officers” and specifying additional responsibilities for them. Accordingly, agency CIOs are required by law to carry out the responsibilities of their agencies with respect to information collection and control of paperwork; statistical policy and coordination;  privacy, including compliance with the Privacy Act; information security, including compliance with the Federal Information Security Management Act (FISMA); information disclosure, including compliance with the Freedom of Information Act (FOIA); and information technology management. Specifically, with regard to IT management, the CIO is responsible for implementing and enforcing applicable governmentwide and agency IT management policies, principles, standards, and guidelines;  assuming responsibility and accountability for IT investments;  assuming responsibility for maximizing the value and assessing and managing the risks of IT acquisitions through a process that, among other things, is integrated with budget, financial, and program management decisions, and provides for the selection, management, and evaluation of IT investments;  establishing goals for improving the efficiency and effectiveness of agency operations through the effective use of IT;  developing, maintaining, and facilitating the implementation of a sound, secure, and integrated IT architecture; and  monitoring the performance of IT programs and advising the agency head whether to continue, modify, or terminate such programs. Together, these statutory responsibilities require CIOs to be key leaders in managing IT and other information functions in a coordinated fashion in order to improve the efficiency and effectiveness of programs and operations. We have previously reported on the status of agency CIOs, including their roles and responsibilities, reporting relationships, backgrounds, and challenges. We have also reported on private-sector CIO roles and responsibilities and challenges and compared them with those of federal CIOs. In October l997, we testified on an OMB evaluation of the status of agency CIO appointments at 27 federal agencies shortly after enactment of the Clinger-Cohen Act. In that testimony, we noted that OMB had identified several agencies where the CIO’s duties, qualifications, and placement met the requirements of the Clinger-Cohen Act. According to OMB, these CIOs had experience, both operationally and technically, in leveraging the use of information technology, capital planning, setting and monitoring performance measures, and establishing service levels with technology users. However, OMB had expressed concerns about the number of other agencies that had acting CIOs, and about CIOs whose qualifications did not appear to meet the requirements of the Clinger- Cohen Act or who did not report directly to the head of the agency. We pointed out that OMB had also raised concerns about agencies where the CIOs had other major management responsibilities or where it was unclear whether the CIO’s primary duty was the IRM function. Our testimony emphasized the importance of OMB following through on its efforts to assess CIO appointments and resolve outstanding issues. We noted that, despite the urgent need to deal with major challenges, including poor security management, and the need to develop, maintain, and facilitate integrated systems architectures to guide agencies’ system development efforts, there were many instances of CIOs who had responsibilities beyond IRM. While some of these CIOs’ additional responsibilities were minor, in many cases they included major duties, such as financial operations, human resources, procurement, and grants management. We stressed that asking the CIO to shoulder a heavy load of responsibilities would make it extremely difficult, if not impossible, for that individual to devote full attention to IRM issues. In July 2004, we reported the results of our study, based on a questionnaire and interviews with CIOs at the same 27 major departments and agencies that OMB had previously evaluated. Our study examined 13 major areas of CIO responsibilities—7 areas predominantly in IT management and 6 areas predominantly in information management, as defined by the relevant laws or deemed critical to the effective management of IT. These areas are described in table 1, along with the relevant source. Our study found that CIOs were not responsible for all of the information and IT management areas. Specifically, all CIOs were responsible for only 5 of the 13 areas, while less than half of the CIOs were assigned responsibility for information disclosure and statistical policy and coordination. Overall, the views of these CIOs were mixed as to whether they could be effective leaders without having responsibility for each individual area. The 2004 study also examined the backgrounds and tenure of CIOs, noting that they had a wide variety of prior experiences, but generally had work or educational backgrounds in IT or IT-related fields, as well as business knowledge related to their agencies. The CIOs and former agency IT executives in the study believed it was necessary for a CIO to stay in office for 3 to 5 years to be effective. However, at the time of our study, the median tenure of permanent CIOs whose time in office had been completed was about 2 years. Based on the study, we also reported on major challenges that the federal CIOs said they faced in fulfilling their duties. In this regard, over 80 percent of the CIOs had cited implementing effective IT management and obtaining sufficient and relevant resources as challenges. We stressed that effectively tackling these reported challenges could improve the likelihood of a CIO’s success. Further, we highlighted the opportunity for Congress to consider whether the existing statutory requirements related to CIO responsibilities and reporting to the agency head reflected the most effective assignment of information and technology management responsibilities and reporting relationships. In September 2005, we reported on the results of our study of 20 CIOs of leading private-sector companies. We noted that most of the private- sector CIOs had full or shared responsibility for 9 of 12 functional areas that we had explored. For the most part, the responsibilities assigned to these private-sector CIOs were similar to those assigned to federal CIOs. In only three areas (information dissemination and disclosure, information collection, and statistical policy) did half or fewer of the CIOs have responsibility. In 4 of the 12 functional areas, the difference between the private-sector CIOs and federal CIOs was greater. Fewer of the private- sector CIOs had these responsibilities in each case. We also reported that private-sector CIOs faced challenges related to increasing IT’s contribution to their organization’s bottom line––such as controlling IT costs, increasing IT efficiencies, and using technology to improve business processes. Although agencies have taken constructive steps to improve IT and information management policies and practices, including through activities of CIOs, we have continued to identify and report on long- standing challenges in the key areas addressed in this report. IT strategic planning: In January 2004, we reported on the status of agencies’ plans for applying information resources to improve the productivity, efficiency, and effectiveness of government programs. At that time, we noted that agencies generally had IT strategic plans that addressed elements such as information security and enterprise architecture, but did not cover key areas specified in the Paperwork Reduction Act. Agencies cited a variety of reasons for not having addressed these areas, including that the CIO position had been vacant, that not including a requirement in guidance was an oversight, or that the process was being revised. We pointed out that, not only are these practices based on law, executive orders, OMB policies, and our guidance, but they are also important ingredients for ensuring effective strategic planning, performance measurement, and investment management, which, in turn, make it more likely that the billions of dollars in government IT investments will be wisely spent. We made a number of recommendations, including that each agency take action to address IT strategic planning, performance measurement, and investment management practices that were not fully in place. IT workforce planning: In 1994 and 2001, we reported on the importance that leading organizations placed on making sure they had the right mix of skills in their IT workforce. In our 2004 report on CIOs’ roles and responsibilities, about 70 percent of the agency CIOs reported on a number of substantial IT human capital challenges, including, in some cases, the need for additional staff. Other challenges included recruiting, retention, training and development, and succession planning. In February 2011, we identified strategic human capital management as a governmentwide high-risk area after finding that the lack of attention to strategic human capital planning had created a risk to the federal government’s ability to serve the American people effectively. As our previous reports have made clear, the widespread lack of attention to strategic human capital management in the past has created a fundamental weakness in the federal government’s ability to perform its missions economically and efficiently. Capital planning and investment management: Since 2002, using our investment management framework, we have reported on the varying extents to which federal agencies have implemented sound practices for managing their IT investments. In this regard, we identified agencies that have made significant improvements by using the framework in implementing capital planning processes. In contrast, however, we have continued to identify weaknesses at agencies in many areas, including immature management processes to support both the selection and oversight of major IT investments and the measurement of actual versus expected performance in meeting established performance measures. For example, in 2007, we reported that two agencies did not have the processes in place to effectively select and oversee their major investments. In June 2009, we reported that about half of the projects we examined at 24 agencies did not receive selection reviews (to confirm that they support mission needs) or oversight reviews (to ensure that they were meeting expected cost and schedule targets). Specifically, 12 of the 24 reviewed projects that were identified by OMB as being poorly planned did not receive a selection review, and 13 of 28 poorly performing projects we examined had not received an oversight review by a department-level oversight board. Accordingly, we made recommendations to multiple agencies to ensure that the projects identified in the report as not having received oversight reviews received them. Information security: Our reviews have noted significant information security control deficiencies that place agency operations and assets at risk. In addition, over the last several years, most agencies have not implemented controls to sufficiently prevent, limit, or detect access to computer networks, systems, or information. An underlying cause for information security weaknesses identified at federal agencies is that they have not yet fully or effectively implemented key elements for an agencywide information security program, as required by FISMA. To address these and other challenges, we have recommended that agencies fully implement comprehensive, agencywide information security programs by correcting shortcomings in risk assessments, information security policies and procedures, security planning, security training, system tests and evaluations, and remedial actions. Due to the persistent nature of information security vulnerabilities and the associated risks, we continue to designate information security as a governmentwide high-risk issue in our most recent biennial report to Congress, a designation we have made in each report since 1997. Enterprise architecture: We have reported on the status of major federal department and agency enterprise architecture efforts. We found that the state of the enterprise architecture programs at the major federal departments and agencies was mixed, with several having very immature programs, several having more mature programs, and most being somewhere in between. Collectively, agencies faced barriers or challenges in implementing their enterprise architectures, such as overcoming organizational parochialism and cultural resistance, having adequate resources (human capital and funding), and fostering top management understanding. To assist the agencies in addressing these challenges, we have made numerous recommendations aimed at ensuring that their respective enterprise architecture programs develop and implement plans for fully satisfying each of the conditions in our enterprise architecture management maturity framework. In addition, in our most recent high-risk update report we identified possible areas where enterprise architecture could help to alleviate some challenges. For example, we suggested that one agency align its corporate architecture and its component organization architectures to avoid investments that provide similar but duplicative functionality. Systems acquisition, development, and integration: Our work has shown that applying rigorous practices to the acquisition or development of IT systems or the acquisition of IT services can improve the likelihood of success. In addition, we have identified leading commercial practices for outsourcing IT services that government entities could use to enhance their acquisition of IT systems and services. We have evaluated several agencies’ software development or acquisition processes and reported that agencies are not consistently using rigorous or disciplined system management practices. For example, after reviewing the Department of Homeland Security’s Atlas investment, we recommended that the agency implement effective management controls and capabilities by, among other things, revising and updating its cost-benefit analysis; making the program office operational; developing and implementing rigorous performance program management practices; and ensuring plans fully disclose the system capabilities, schedule, cost, and benefits to be delivered. In addition, ensuring that effective system acquisition management controls are implemented on each agency business system investment remains a formidable challenge, as our recent reports on management weaknesses associated with individual programs have demonstrated. For example, we recently reported that the Department of Defense’s large-scale software- intensive system acquisitions continued to fall short of cost, schedule, and performance expectations. Specifically, our report noted that six of the department’s nine enterprise resource planning systems had experienced schedule delays ranging from 2 to 12 years, and five had incurred cost increases ranging from $530 million to $2.4 billion. E-government initiatives: In December 2004, we reported the results of our review of the implementation status of major provisions from the E- Government Act of 2002, which required a wide range of activities across the federal government aimed at promoting electronic government, such as providing the public with access to government information and services. We found that, although the government had made progress in implementing the act, the act’s requirements were not always fully addressed. Specifically, OMB had not (1) ensured that a study on using IT to enhance crisis preparedness and response had been conducted that addressed the content specified by the act, (2) established a required program to encourage contractor innovation and excellence in facilitating the development and enhancement of electronic government services and processes, or (3) ensured the development and maintenance of a required repository and website of information about research and development funded by the federal government. We made recommendations to OMB aimed at ensuring more consistent implementation of the act’s requirements. We have also reported on various challenges agencies faced in meeting information management requirements, including in the areas of privacy, information collection, records management, information disclosure, and information dissemination. In 2002 and 2003, we reported on agencies’ handling of the personal information they collect and whether this handling conforms to the Privacy Act and other laws and guidance. In the 2002 report, we made recommendations to selected agencies aimed at strengthening their compliance with privacy requirements. In the 2003 report, we made recommendations to OMB, which included directing agencies to correct compliance deficiencies, monitoring agency compliance, and reassessing OMB guidance. In 2005, we reviewed agency compliance with information collection clearance requirements under the Paperwork Reduction Act. In an analysis of 12 case studies, we found that while CIOs generally reviewed information collections and certified that they met the standards in the act, in a significant number of instances, agencies did not provide support for the certifications, as the law requires. We recommended that OMB and the agencies take steps to improve review processes and compliance with the act. In 2008, we reviewed the management of e-mail records at four agencies and found agency practices did not always conform to requirements. We recommended that the National Archives and Records Administration develop and implement an oversight approach that provides adequate assurance that agencies are following its guidance, including both regular assessments of agency records and records management programs and reporting on these assessments. Also in 2008, we reported on trends in Freedom of Information Act processing and agencies’ progress in addressing backlogs of overdue FOIA requests. We found weaknesses in agency reporting on FOIA processing and recommended, among other things, that guidance be improved for agencies to track and report on overdue requests and plans to meet future backlog goals. In July 2010, we identified and described current uses of web 2.0 technologies by federal agencies to disseminate information. Specifically, we found that the federal government may face challenges in determining how to appropriately limit collection and use of personal information as agencies utilize these technologies and how and when to extend privacy protections to information collected and used by third-party providers of web 2.0 services. In July 2011, we identified ways agencies are using social media to interact with the public and assessed the extent to which they had policies in place for managing and identifying records, protecting personal information, and ensuring the security of federal information and systems. We made recommendations to 21 agencies to improve their development and implementation of social media policies. On March 5, 2009, President Obama designated the Administrator of OMB’s Office of Electronic Government and Information Technology as the first Federal Chief Information Officer. The Federal CIO was given responsibility for directing the policy and strategic planning of federal information technology investments as well as for overseeing federal technology spending. Toward this end, in December 2010, the Federal CIO issued a 25 Point Implementation Plan to Reform Federal Information Technology Management. This 18-month plan specified five major goals: strengthening program management, streamlining governance and improving accountability, increasing engagement with industry, aligning the acquisition process with the technology cycle, and applying “light technology” and shared solutions. As part of this plan, OMB has initiatives under way to, among other things, strengthen agencies’ investment review boards and to consolidate federal data centers. The plan stated that OMB will work with Congress to consolidate commodity IT spending (e.g., e-mail, data centers, content management systems, web infrastructure) under agency CIOs. Further, the plan called for the role of federal agency CIOs to focus more on IT portfolio management. In March 2011, we testified on the efforts of OMB and the Federal CIO to improve the oversight and management of IT investments in light of the problems that agencies have continued to experience with establishing IT governance processes to manage such investments. These initiatives included increasing the accountability of agency CIOs through the use of the IT Dashboard, a public website established in June 2009 that provides detailed information, including performance ratings, for over 800 major IT investments at federal agencies. Each investment’s performance data are updated monthly, which is a major improvement from the quarterly reporting cycle used by OMB’s prior oversight mechanisms. However, in a series of reviews, we have found that the data on the Dashboard were not always accurate. Specifically, we found that the Dashboard ratings were not always consistent with agency performance data. OMB has also initiated efforts to improve the management of IT investments needing attention. In particular, in January 2010, the Federal CIO began leading TechStat sessions—a review of selected IT investments between OMB and agency leadership to increase accountability and transparency and improve performance. We noted that the full implementation of OMB’s 18-month roadmap should result in more effective IT management and delivery of mission-critical systems, as well as further reduction in wasteful spending on poorly managed investments. Similar to 2004, we found that the CIOs are not consistently responsible for all of the 13 areas assigned by statute or identified as critical to effective IT management; however, they are more focused on IT management than on the management of agency information. The majority of CIOs (between 23 and 27) reported they are responsible for the seven areas of IT management. In this regard, the CIOs reported being responsible for activities in managing IT that include the following:  managing capital planning and investment management processes to ensure that they were successfully implemented and integrated with the agency’s budget, acquisition, and planning processes;  developing, maintaining, and facilitating the implementation of sound and integrated enterprise architectures;  designating a senior department official who will have responsibility for departmentwide information security;  developing IT strategic plans to emphasize the role that IT can play in effectively supporting the department’s operations and goals;  developing, maintaining, and improving systems acquisition  managing e-government requirements and ensuring compliance with  developing strategies for development of a skilled IT workforce combined with strong succession planning. Fewer CIOs (between 6 and 22) reported being responsible for the six areas predominantly related to information management (information collection/paperwork reduction, records management, privacy, information dissemination, information disclosure, and statistical policy and coordination). Even those CIOs who indicated they had been assigned responsibility for these six information management areas reported they assigned a higher priority to their IT management responsibilities. CIOs who reported they were not responsible for their agencies’ information management functions said they provided input or other assistance to the organizational units within their agencies that were primarily responsible for these areas. The units with which they shared responsibilities varied, as did the roles the CIO played. For example, in the area of records management, one CIO reported working closely with the agency’s data manager and making recommendations regarding records management. In the privacy area, one CIO reported coordinating with the agency’s Chief Information Security Officer, general counsel, and human resources offices to address any privacy issues. To ensure accuracy of information disseminated, one CIO reported collaborating with the agency’s Office of Public Affairs. The areas in which the least number of CIOs reported they were responsible were statistical policy and coordination and information disclosure. In this regard, 21 CIOs stated that statistical policy and coordination was handled by other offices within their agencies, such as a policy or research office. This included components functioning as Principal Statistical Agencies. Eighteen CIOs reported that responsibility for information disclosure rested with another office, such as an agency’s FOIA office. In comparison to 2004, the number of CIOs assigned responsibility for each of the areas remained the same for all but five areas (systems acquisition, development, and integration; IT workforce planning; records management; information dissemination; and statistical policy and coordination). In each of these areas, the number of CIOs assigned responsibility decreased from 2004 to 2011. Figure 1 shows the number of CIOs with responsibility for the 13 areas in 2011 and 2004. The amount of time that CIOs spend in various areas of responsibility reflects their greater emphasis on IT management compared with the management of agency information. Specifically, CIOs reported they devote over two-thirds of their time to the seven IT management areas, which they generally viewed as more important to accomplishing their mission. Moreover, the majority of the CIOs were responsible for each of the areas. By contrast, the CIOs reported spending less than one-fifth of their tim the six information management areas. Specifically, CIOs reported spending 6 percent or less of their time on average in each of the privacy, e-government initiatives, records management, information dissemination, information collection/paperwork reduction, information disclosure, and statistical policy and coordination. As discussed previously, most CIOs reported they were not responsible for all of these areas and indicated they did not always place a high priority on them. ent with the views held by the panel of former federal CIOs, This is consist which generally did not place high priority on the information management areas. Table 2 shows the percentage of time CIOs reported allocating to the 13 areas. The CIOs also reported they spend a significant amount of time outside the 13 areas of responsibility. Specifically, CIOs indicated they spend about 14 percent of their time on other responsibilities outside these 13 areas—the same amount of time as they spend on information security, the area where CIOs reported spending the most time. These additional areas of responsibility included addressing infrastructure issues, participating in agencywide boards, or participating in external organizations, such as the federal CIO Council. In addition, CIOs reported they have begun to focus on emerging areas within IT such as cloud computing, data center consolidation, and commodity services. This is consistent with the recent emphasis of the Federal CIO on reforming IT, as reflected in OMB’s IT Reform Plan. As technology continues to evolve, CIOs are likely to be challenged in ensuring that agencies use new technologies efficiently and effectively. Despite the importance of focusing on their primary duties, the CIOs inour review reported holding a number of official agency job functions in addition to being CIO. Specifically, 14 of 30 CIOs reported serving in another position within their agency besides that of CIO. Of these, 11ction. Six of the 14 reported that serving as CIO was their primary job fun CIOs reported holding two or more positions besides CIO, with one holding five positions, including CIO. These positions included Chief Acquisition Officer and Chief Human Capital Officer. Federal law calls for agency CIOs to report to the head of their agency. With regard to this requirement, we reported in 2004 that only 19 of 27 CIOs reported to their agency head, and views were m such a direct reporting relationship was important. In our current study, even fewer—17 of 30—CIOs indicated that they report to their agency head, although 23 thought it was important to do so. Despite this, the views of agency CIOs and others suggested that a variety of reporting relationships between an agency head and the CIO can be effective. CIOs generally agreed that access to the agency head was important, but that they did not necessarily require a formal reporting relationship. One said that it was important to have a “seat at the table” allowing for direct interaction with the agency head in order to articulate any problems or issues in IT. However, other CIOs stated that it was important for the CIO to report to whomever is in charge of running the daily operations of the agency. On CIO did not believe it was ideal to report directly to the agency head because the agency head has too many other responsibilities. This CIO was able to meet with the agency’s deputy secretary frequently and felt this resulted in more input into decision ma reported to the agency head, believed there was not one ideal reporting king. Another CIO, who relationship for the entire federal government because of the differences in size and mission among the agencies. Two CIOs in our review indicated they did not have sufficient access to their agency head, even though they thought it was important to have such access. Accordingly, the CIOs felt they did not have sufficient influence on IT management decisions in their agency. The CIOs stated they had worked to gain greater influence over IT by establishing relationships with peers in their agencies such as the Chief Financial Officer or Chief Operating Officer. Overall, regardless of the reporting relationship between agency heads and agency CIOs, 28 of the CIOs reported they had adequate access to their agency head. Additionally, many of the agency CIOs who did not report directly to the agency head indicated having influence on IT management decisions within their agency because they had relationships with other senior agency officials. These included direct reporting relationships with an assistant secretary or the Chief Operating Officer. Based on their experiences, members of the panel of former C that it was important to report to the agency head on key issues, but als to work with other senior officials for day-to-day activities. In this regard, the former CIOs believed it was essential for the CIO to forge relationships with other senior officials in an agency, such as the Chief Financial Officer and members of the Office of General Counsel. Further, in discussing this matter, the Federal CIO stated that reporting relationships should be determined on an agency-by-agency basis, noting that agencies should determine how best to meet this requirement depending on how the agency is structured. Given the varying responsibilities of agency heads and other senior officials, some degree of flexibility in CIOs’ reporting relationships may be appropriate as long as CIO effectiveness is not impeded. Although the qualifications of a CIO can help determine whether he or she is likely to be successful, there is no general agreement on the optimal background (e.g., education, experience) that a prospective agency CIO should have. The conference report accompanying the Clinger-Cohen Act stated that CIOs should possess knowledge of and practical experience in the information and IT management practices of business or government. We found that when compared to CIOs in 2004, more current CIOs had served previously as a CIO or deputy CIO. As shown in table 3 below, 18 of the CIOs in our review had experience as either a CIO or deputy CIO, an increase of 6 compared to the CIOs that participated in our 2004 review. Also, 21 current CIOs had previously worked for the federal government, 14 had worked in private industry, 4 had been in academia, and 4 had worked in state and local government. Fifteen CIOs had worked in some combination of two or more of these sectors. Further, all of the current CIOs had work experience in IT or IT- related fields. We asked current and former CIOs what key attributes they had found necessary to be an effective CIO. In response, they noted the need for IT experience and an understanding of how IT can be used to transform agencies and improve mission performance. Of most importance, however, were leadership skills and the ability to communicate effectively. The Federal CIO noted that he valued CIOs who thought about the future of the agency and demonstrated an ability to successfully manage IT programs or projects. We noted previously that one element that influences the likely success of an agency CIO is the length of time the individual in the position has to implement change. For example, our prior work has noted that it can take 5 to 7 years to fully implement major change initiatives in large public and private sector organizations and to transform related cultures in a sustainable manner. Nonetheless, when we reported on this matter in 2004, the median tenure for permanent CIOs who had completed their time in office was just under 2 years. Tenure at the CIO position has remained almost the same since we last reported. Specifically, the median tenure for permanent federal agency CIOs was about 25 months for those who served between 2004 and 2011. However, the number of CIOs who stayed in office at least 3 years declined from 35 percent in 2004 to 25 percent in 2011. (See table 4 for a comparison of CIO tenures from 1996 to 2004 and 2004 to 2011; see app. V for figures depicting the tenure for each of the CIOs at the agencies in our review between 2004 and 2011 and a table showing various statistical analyses on CIO tenure.) We previously reported on factors that affected the tenure of CIOs, which included the stressful nature of the position and whether or not CIOs were political or career appointees. The panel of former CIOs for our current study agreed that high stress levels can lead to CIOs leaving the position, as can factors such as retirement and the opportunity to serve as a CIO at a larger agency. However, we found that during the period covered by our current review, political appointees stayed only 4 months less than those in career civil service positions, compared to 13 months less in our 2004 review. As previously discussed, a major goal of the Clinger-Cohen Act was to establish CIOs to advise and assist agency heads in managing IT investments. In this regard, the agency CIO was given the authority to administer a process to ensure that IT investments are selected, controlled, and evaluated in a manner that increases the likelihood they produce business value and reduce investment-related risk. As part of this process, CIOs are responsible for advising the agency head on whether IT programs and projects should be continued, modified, or terminated. In order to carry out these responsibilities, CIOs should be positioned within their agencies to successfully exercise their authority. Specifically, we have previously noted that CIOs should have a key role in IT investment decision making and budget control. In addition, CIOs require visibility into and influence over programs, resources, and decisions related to the management of IT throughout the agency. Our study did not find convincing evidence that specific legislative changes are needed to improve CIOs’ effectiveness. Rather, we found that CIOs’ ability to carry out their roles, as prescribed in law, has been limited by certain factors that have led to challenges. Specifically, CIOs reported they were hindered in exercising their authority over agency IT budgets, component IT spending, and staff, which our prior work has shown can lead to an inefficient use of funds. IT Budget authority: Although assigned by law with the authority to be accountable for IT management, we found that CIOs faced limitations in their ability to influence IT investment decision making at their agencies. For example, only 9 CIOs responded that their approval was required for the inclusion of all IT investments in their agency’s budget. The remaining 21 CIOs indicated that their explicit approval either was not required or it was required for major IT investments only. Ten of those 21 CIOs indicated they would be more effective if their explicit approval for IT investment decisions was sought by their agency head. CIOs said having this ability would reduce the number of unknown or “rogue” systems (i.e., systems not vetted by the CIO office), allow the CIO to identify and eliminate duplicative systems, and resolve technology and security issues earlier in an investment’s lifecycle. Further, 13 of the CIOs in our study did not have the power to cancel funding for IT investments. CIOs that did not have this power told us they would be more effective if they were able to cancel funding for investments because they would then be in a better position to consolidate investments and cut wasteful spending on failing projects. In our previous reviews, we have noted limitations in CIOs’ ability to influence IT investments, which have contributed to long-standing challenges in agencies’ management of IT. For instance, we previously reported that one agency did not provide the department’s CIO with the level of IT spending control that our research at leading organizations and past work at federal departments and agencies have shown is important for effective integration of systems across organizational components. We noted that control over the department’s IT budget was vested primarily with the CIO organizations within each of its component organizations. Consequently, there was an increased risk that component agencies’ ongoing investments would need to be reworked to be effectively integrated and maximize departmentwide value. Component-level IT spending: A significant portion of an agency’s IT funding can be allocated and spent at the component level on commodity IT systems—systems used to carry out routine tasks (e.g., e-mail, data centers, web infrastructure)—in addition to mission-specific systems. Multiple CIOs faced limitations in their ability to influence agency decisions on integrating commodity IT systems throughout their agencies because they did not have control over funding for these systems at the component level. According to CIOs, more control over component-level IT funding, including commodity IT and mission-specific systems, could help ensure greater visibility into and influence on the effective acquisition and use of IT. Further, the Federal CIO has called for agencies to place all commodity IT purchases under the purview of the agency CIO, while component mission-specific systems should remain with the component CIO. OMB included centralization of commodity funding under agency CIOs as part of its current IT reform initiatives. Consistent with this, we have reported on the importance of agency CIOs having adequate oversight to ensure that funds being spent on component agency investments will fulfill mission needs. Specifically, at one agency, we found a structured mechanism was not in place for ensuring that component agencies defined and implemented investment management processes that were aligned with those of the department. Because such processes, including reviews of component agency IT investments, were not in place, the agency CIO did not have visibility into a majority of the agency’s discretionary investments and could not ensure the agency’s IT investments were maximizing returns. IT workforce: CIOs also face limitations in their ability to provide input into hiring component-level senior IT managers and other IT staff. Many CIOs in our study faced limitations in performing certain workforce planning activities, such as having direct hiring capability for IT staff, providing input into the hiring of component CIOs, and influencing component agency CIOs’ performance ratings. For example, some CIOs indicated they did not have any input into the hiring of their own staff. In addition, CIOs did not always participate in selections for candidate component CIOs. Further, for a majority of the agencies with component CIOs, the agency CIO did not participate in the component CIOs’ performance reviews. Without sufficient influence over the hiring of IT staff or component CIOs’ performance, agency CIOs are limited in their ability to ensure appropriate IT staff are being hired to meet mission needs or component accountability for overall agency priorities and objectives. We have also previously reported on CIOs’ challenges related to IT workforce planning, noting there has been a lack of attention in this area, which has created weaknesses in the federal government’s ability to perform its missions economically, efficiently, and effectively. In addition, in our previous review of CIOs’ roles and responsibilities, we found that about 70 percent of CIOs reported IT workforce planning challenges within their agency. Without addressing CIOs’ lack of influence over IT workforce planning, the government will continue to face challenges in this area, risking further inefficiencies. Most CIOs included in our study and the panel of former CIOs agreed that legislative changes were not needed to improve effectiveness in IT management. However, several CIOs told us their agencies have completed or initiated efforts to increase the influence of the CIO. For example, one agency gave its CIO complete control over the entire IT budget and all IT staff. This CIO told us that this has allowed for rapid, effective changes to be made when necessary on IT issues. Another agency began an agencywide consolidation effort so that the CIO’s responsibility will be delegated to one person to centrally manage IT assets instead of multiple agency CIOs. This agency recently implemented a policy that has given one individual the title of CIO and stated that the CIO will assume oversight, management, ownership, and control of all departmental IT infrastructure assets. Another agency was centralizing decision-making authority in the office of the CIO for addressing troubled IT investments. In addition, one agency conducted a reorganization that placed component CIOs under the agency CIO. According to the CIO of that agency, the change has been a great asset to the organization, because it allowed the CIO office to work as a unit, created camaraderie among component CIOs, and reduced duplication of IT investments. In April 2011, the Federal CIO told us that agency CIOs should provide input to the component agency CIOs’ performance review. In addition to these agency-specific efforts, OMB has issued guidance to reaffirm and clarify the organizational, functional, and operational governance framework required within the executive branch for managing and optimizing the effective use of IT. More recently, OMB has taken additional steps to increase the effectiveness of agency CIOs by clarifying their roles and authorities under the current law. For example, its 25 Point Implementation Plan to Reform Federal Information Technology Management called for agency CIOs to shift their focus from policy making and maintaining IT infrastructure to IT portfolio management. According to the plan, agency CIOs will be responsible for identifying unmet agency needs to be addressed by new projects, holding TechStat reviews, and improving or terminating poorly performing projects. After we sent a draft of this report to agencies for comment, OMB issued a memorandum outlining the primary areas of responsibility for federal agency CIOs. The guidance outlines four areas in which the CIO should have a lead role: IT governance, program management, commodity services, and information security. It emphasizes the role of the CIO in driving the investment review process and the CIO’s responsibility over the entire IT portfolio for an agency. In a web log post about the memorandum, the Federal CIO stated that, next year, the administration will ask agencies to report through the President’s Management Council and the CIO Council on implementation of the memo. In our view, the guidance is a positive step in reaffirming the importance of the role of CIOs in improving agency IT management. Nonetheless, this guidance does not address the implementation weaknesses we have identified in this and our prior reviews—specifically that CIOs face significant limitations in their ability to influence IT investment decision making at their agencies and to exercise their statutory authority. The guidance generally instructs agency heads regarding the policies and priorities for CIOs in managing IT that we and others have stressed. However, the guidance does not state a specific requirement for agency heads to empower CIOs to carry out these responsibilities. Additionally, it does not require them to measure and report the progress of CIOs in carrying out these responsibilities and achieving the overall objectives of the IT Reform Plan. Such a requirement is essential to agencies empowering their CIOs to fully and effectively exercise their authority, and ultimately, ensuring that the CIOs are best positioned to be effective leaders in IT management. Without additional clarification and specific measures of accountability in OMB’s guidance, agency CIOs are likely to continue to be hindered in carrying out their responsibilities and achieving successful outcomes in IT management, thus increasing the risk that IT spending will continue to produce mixed results, as we have long reported. OMB guidance requires and best practices suggest that agencies document lessons learned, and we have previously reported on the importance of their collection and dissemination. The use of lessons learned is a principal component of an organizational culture committed to continuous improvement. Sharing such information serves to communicate acquired knowledge more effectively and to ensure that beneficial information is factored into planning, work processes, and activities. Lessons learned can be based on positive experiences or on negative experiences that result in undesirable outcomes. Documenting lessons learned can provide a powerful method of sharing successful ideas for improving work processes and increasing cost-effectiveness by aligning them to be utilized in the future. To facilitate the sharing of best practices and lessons learned relating to IT management across the federal government, the CIO Council established the Management Best Practices Committee. The committee works to identify successful information technology best practices being implemented in industry, government, and academia and shares them with agency CIOs. As part of its mission, in April 2011, the committee launched a best practices information-sharing platform in the form of a website to which agencies can contribute case studies of best practices. Federal agencies have begun to contribute by submitting examples depicting best practices relating to a range of topics including vendor communication and contract management; the consolidation of multiple systems into an enterprise solution through the use of cloud services; and program manager development. As of July 2011, the CIO Council website featured 10 case studies submitted by 10 agencies describing best practices. For example, one agency faced challenges with distributing technical support to 27 organizational units. After the agency head directed the consolidation of IT support services under the CIO, the agency gained a better understanding of spending on services and equipment needed to provide IT support. In another example, an agency had been operating under separate e-mail systems, which prevented it from maximizing operational efficiency and productivity. Specifically, the agency faced high costs for maintaining individual systems; difficulty sending broadcast e-mails across the entire department, thus preventing the e-mails from being received in a timely fashion; difficulty obtaining accurate and complete contact information for all employees in one global address list; and difficulty operating calendar appointments. In order to address these challenges, the agency utilized a cloud-based service solution, which the agency explained would result in lower costs per user, an improved security posture, and a unified communication strategy. In addition, agency CIOs told us their agency had implemented changes based upon lessons learned that have improved the effectiveness of the CIO. For example, while several CIOs implemented investment review boards or similar governance mechanisms, three CIOs explained that at their agency, senior-level officials, including deputy secretaries, and in one instance, an undersecretary, chaired these boards, which provided higher visibility over the selection, control, and evaluation of IT investments. Additionally, one CIO explained that implementing an enterprisewide licensing solution to optimize the agency’s buying power resulted in a savings of $200 million. One told us about improved effectiveness in information security through the use of a centralized information security center. Specifically, this CIO stated that all agency information went through this center, which provides real-time monitoring throughout agency systems. This CIO explained that the security center has helped to reduce the impact of intrusions to the agency’s systems. Nonetheless, although the CIO Council has established the management best practices committee and corresponding information-sharing platform to identify lessons learned, 19 CIOs said their agency did not have a process in place for capturing and documenting lessons learned and best practices. Two CIOs indicated that their agency did not have such a process due to a shortage of resources or because they did not see the development of such a process as being their responsibility. Without structured processes for capturing and documenting these lessons learned, agencies risk both losing the ability to share knowledge acquired with CIOs’ experience and increasing the time required for newly hired CIOs to become effective. Additionally, the lack of internal documented processes for capturing lessons learned within agencies has the potential to inhibit the Management Best Practices Committee’s ability to effectively identify, document, and disseminate individual agencies’ lessons learned and best practices throughout the federal government. By effectively identifying, documenting, and disseminating lessons learned internally and externally, agencies can mitigate risk and track successful ideas for improving work processes and cost-effectiveness that can be utilized in the future. As in 2004, federal agency CIOs currently are not consistently responsible for all of the 13 areas assigned by statute or identified as critical to effective IT management. While the majority of CIOs are primarily responsible for key IT management areas, they are less likely to have primary responsibility for information management duties. In this regard, CIOs spend two-thirds or more of their time in the IT management areas and attach greater importance to these areas compared with the information management areas. Notwithstanding the focus on IT management, CIOs have not always been empowered to be successful. Despite the broad authority given to CIOs in federal law, these officials face limitations that hinder their ability to effectively exercise this authority, which has contributed to many of the long-standing IT management challenges we have found in our work. These limitations, which include control and influence over IT budgets, commodity IT investments, and staffing decisions, are consistent with issues we have previously identified that prevented CIOs from advising and influencing their agencies in managing IT for successful outcomes. While OMB’s guidance reaffirms CIO authorities and responsibilities to influence IT outcomes, it does not establish measures of accountability. Having actionable measures would help ensure that CIOs are empowered to successfully carry out their responsibilities under the law and enable them to successfully carry out their responsibilities under the IT Reform Plan. Finally, while agency CIOs told us they had implemented practices they believed have improved the management of IT, they had not established processes to document agency-specific lessons learned that could be shared within the agency. Not doing so increases the likelihood of new CIOs making the same mistakes as those they are replacing, while establishing such a mechanism could better enable succession planning and knowledge transfer between CIOs. To ensure that CIOs are better able to carry out their statutory role as key leaders in managing IT, we recommend the Director of OMB take the following three actions: Issue guidance to agencies requiring that CIOs’ authorities and responsibilities, as defined by law and by OMB, are fully implemented, taking into account the issues raised in this report.  Establish deadlines and metrics that require agencies to demonstrate the extent to which their CIOs are exercising the authorities and responsibilities provided by law and OMB’s guidance.  Require agencies to identify and document internal lessons learned and best practices for managing information technology. We received comments on a draft of this report from OMB and from 5 of the 30 agencies included in our study. In oral comments, OMB’s Deputy Administrator for e-Gov and its Policy Analyst for e-Gov, within the Office of Electronic Government and Information Technology, generally agreed with our findings and stated that the agency had taken actions that addressed our recommendations. Specifically, with regard to our first recommendation, the officials said they believed OMB’s August 8, 2011, memorandum discussing CIOs’ authorities aligned with, and reflected the beginning of a process that would help address, the concerns noted in our report. Thus, they believed our recommendation had been addressed with OMB’s issuance of the memorandum. With regard to our second recommendation that called for OMB to establish an appropriate reporting mechanism to ensure compliance with the guidance, the officials pointed to a recent web log post about the August memorandum. In the post, the Federal CIO stated that, in 2012, the administration will ask agencies to report through the President’s Management Council and the CIO Council on implementation of the memorandum. We believe the guidance reflected in OMB’s August 2011 memorandum is a positive step in reaffirming the importance of the role of CIOs in improving agency IT management and toward addressing the concerns that are the basis for our first recommendation. It highlights the responsibilities of CIOs in the four areas of IT governance, program management, commodity services, and information security. These responsibilities are consistent with requirements in law and best practices. Further, OMB’s planned use of the councils for agency reporting on implementation of the memorandum could be a useful mechanism for helping to ensure CIOs’ accountability for effectively managing IT. However, neither the guidance nor the planned use of the councils, as referenced, identify requirements that would hold agencies accountable for ensuring effective CIO leadership in the four IT management areas. Specifically, as pointed out earlier in this report, the guidance does not articulate a requirement for agencies to measure and report the progress of CIOs in carrying out their responsibilities and authorities. Such a requirement is essential to ensuring that agency CIOs are best positioned to be effective leaders in IT management. As such, we stand by our second recommendation but have revised it to more explicitly highlight the need for OMB to establish deadlines and metrics that require agencies to demonstrate the extent to which CIOs are exercising their authorities and responsibilities. With regard to our third recommendation, that OMB require agencies to establish processes for documenting internal lessons learned and best practices, the officials believed this recommendation was addressed by existing guidance requiring agencies to document lessons learned for post-implementation reviews of IT projects. However, as discussed earlier, most of the agencies in our study reported that they had not established processes for documenting internal lessons learned. Further, the guidance to which OMB’s officials referred is limited to lessons learned for post- implementation reviews of specific IT projects and does not include the broader spectrum of IT management areas, such as program management and information security. As such, we continue to believe that agencies could benefit from having established internal processes for documenting lessons learned across the broader spectrum of IT management areas and, therefore, believe our recommendation is warranted. Although we made no specific recommendations to the 30 agencies included in our review, we sent each agency a draft of the report for comment. Twenty-five of the agencies told us they had no comments on the draft report, while five agencies provided e-mail or written comments on the report, as follows. In written comments from the Department of Defense CIO, the department concurred with our recommendations to OMB. However, the CIO also stated that, while our report did not identify legislative changes needed to enhance current CIOs’ authority and generally felt that existing law provides sufficient authority, the department believes there are legislative opportunities to clarify and strengthen CIO authorities that should be pursued, such as overlap in responsibilities between the CIO and other officials. The department stated that it was taking actions to address this issue internally. As discussed earlier in this report, the effectiveness of agency CIOs depends in large measure on their having clear roles and authorities. As noted, however, we found no evidence indicating that legislative changes are needed to achieve this. Rather, our study results determined that these officials face limitations that hinder their ability to effectively exercise their current authorities. Accordingly, agencies have an important opportunity to address these limitations by empowering the CIOs to fully and effectively exercise their authority and ensuring that the CIOs are best positioned to be effective leaders in managing IT. Our recommendations to OMB are aimed at ensuring that CIOs effectively exercise the authority and responsibilities that they have been given. DOD’s comments are reprinted in appendix VI.  The Department of Homeland Security’s Director of Departmental GAO/Office of Inspector General (OIG) Liaison Office provided written comments in which the department indicated agreement with our findings and recommendations. In the comments, the department said it is committed to working with OMB to address the challenges agency CIOs face and increase the effectiveness of its efforts. These comments are reproduced in appendix VII. In written comments from the CIO, the Office of Personnel Management agreed with our recommendations. The agency included examples of actions the agency has taken to elevate the CIO position and bring it into greater alignment with the Clinger-Cohen Act. The Office of Personnel Management’s written comments are reproduced in appendix VIII. In an e-mail response from the Office of the Chief Information Officer, the United States Agency for International Development said the recommendations were sound and would assist agencies in ensuring that CIOs are better able to carry out their statutory role as key leaders in managing IT. In an e-mail response from the Deputy CIO, the Department of Commerce stated that it had no major issues with the recommendations and conclusions and described the report as an informative assessment of the practices and challenges faced by federal agency CIOs. Beyond the aforementioned comments, two agencies—the Social Security Administration and the Department of Health and Human Services—provided technical comments on the report, which we incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to other interested congressional committees, the Director of the Office of Management and Budget, and the Secretaries of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Health and Human Services, Homeland Security, Housing and Urban Development, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, Small Business Administration, and U.S. Agency for International Development; the commissioners of the Nuclear Regulatory Commission and the Social Security Administration; the directors of the National Science Foundation and Office of Personnel Management; the Chief Executive Officer of the Corporation for National and Community Service; and the chairmen of the Federal Labor Relations Authority and Commodity Futures Trading Commission. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-6304 or by e-mail at melvinv@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs are on the last page of this report. Key contributors to this report are listed in appendix IX. Our objectives wer of federal agency Chief Information Officers (CIO) in managing information and technology; (2) determine what poten tial modifications to the Clinger-Cohen Act and related laws could be made to enhance CIOs’ authority and effectiveness; and (3) identify key lessons learned by federal agency CIOs in managing information and technology. e to (1) determine the current roles and responsibilities To address the objectives of this review, we collected and reviewed previous GAO reports, including our 2004 report on CIOs’ roles and responsibilities, as well as various other reports that discussed the status of agency CIOs’ roles and responsibilities. This included reports from Gartner and Deloitte on the role of federal CIOs and OMB’s 25 Point Implementation Plan to Reform Federal Information Technology Management. We also interviewed the Partnership for Public Service’s Director of the Strategic Advisors to Government Executives Program for mentoring federal executives, including agency CIOs. We then developed and administered a questionnaire to the CIOs of 27 major departments and agencies in our 2004 review and of three small, independent agencies. We selected the three independent agencies based on whether they had a CIO in place when our review began and the size of the agency’s 2011 budget estimates. Using the questionnaire, we requested information on whether each CIO was responsible for each of 13 information technology (IT) and information management areas that we identified as either required by statute or critical to effective IT management in our 2004 report. In addition, we asked about CIOs’ reporting relationships, professional and educational backgrounds, tenure, and lessons learned in managing information and techno logy. In addition, we collected and reviewed written position descriptions for for each agency’s CIO, deputy CIO, and other key officials responsible the 13 IT and information management areas; the resumes or c urricula vitae of the current CIOs; each agency’s current organization chart(s) depicting the CIO’s position relative to the head of the agency, other senior officials, and component CIOs, if applicable; and functional statements for offices that have responsibilities in IT and information management. We also asked each agency to supply the name, beginn and ending dates in office, and circumstances (e.g., whether they were an acting or permanent position) of each of the individuals who ha served as CIO at the agency since 2003. Further, we also collected and reviewed any supporting documentation of recent departmental changes. We then interviewed each of the CIOs who were in place at the time of our review (see app. II for a list of the CIOs) in order to validate responses from the questionnaire and to obtain an understanding of their views on the 13 IT and information management areas including roles and responsibilities, changes needed to enhance authority and effectiveness, and lessons learned for managing information and technology. From the questionnaire and interview responses, we analyzed CIO responses to determine their current roles and responsibilities and reporting relationships with agency heads. We then compared the responses to those identified in our 2004 report. Additionally, we assessed the CIOs’ reported time spent in the 13 IT and information management areas of responsibility and the importance of each area to them, as well as their views on changes needed to improve their authorit y and effectiveness. We also reviewed CIOs’ qualifications and current and former CIOs’ tenure. Further, we analyzed CIO responses to questions concerning changes needed to improve their authority and effectiveness and compared them to the authority described in federal IT laws. We supplemented our analysis by reviewing our prior reports related to s’ agency CIO authority and IT management challenges. We also ana CIOs’ comments related to lessons learned that they have used to improve IT management at their agency. Further, we analyzed OMB IT management reform efforts, including its August 2011 memorandum onCIO authorities, and status updates related to agency CIOs and lessons learned initiatives. To complement information we obtained from current CIOs, we held a panel discussion with nine former CIOs of federal agencies. The purpose of this discussion was to elicit views regarding the statutory responsibilities given to federal CIOs, lessons learned by CIOs in managing information and technology, and areas in which current legislation could be revised to enhance CIOs’ authority and effectiven Appendix III lists these panelists. Finally, we met with the Federal CIO to obtain his views on priorities and responsibilities for CIOs and to discuss potential modifications to the Clinger-Cohen Act and related laws that could enhance CIOs’ authority and effectiveness. ess. Appendix II: Chief Information Officers Interviewed Agency/department Commodity Futures Trading Commission (CFTC) Corporation For National and Community Service (CNCS) Department of Health and Human Services (HHS) Michael W. Carleton Department of Homeland Security (DHS) Department of Housing and Urban Development (HUD) Department of Transportation (DOT) Department of Veterans Affairs (VA) Environmental Protection Agency (EPA) Federal Labor Relations Authority (FLRA) General Services Administration (GSA) National Aeronautics and Space Administration (NASA) National Science Foundation (NSF) Nuclear Regulatory Commission (NRC) Office of Personnel Management (OPM) Small Business Administration (SBA) Social Security Administration (SSA) U.S. Agency for International Development (USAID) In March 2011, we convened a panel of former federal agency chief information officers, during which we discu sed CIOs’ roles and s responsibilities, reporting relationships, anial changes any potentd needed to legislation. Table 5 provides the former and current titles of these officials. The following summarizes information gathered from CIOs related to responsibilities in the 13 information management and information technology management areas discussed in this report. CIOs are responsible for strategic planning for all information and information technology management functions [Paperwork Reduction Act]. Of the 3 0 CIOs we surveyed, ensuring compliance with law agency. In 2004, all 27 CIOs strategic planning. all CIOs indicated they were responsible fo s related to IT strategic planning w surveyed also indicated re r ithin their sponsibility for IT All CIOs re strategic planning. Twenty-nine of the 30 CIOs reported that IT strategic planning was imporying out their mission.rtant to car The CIO who reported that IT strategic plning was not important said this area was an being executed properly and it did not require much attention or guidance. Table 6 provides a summary of CIO responses regarding IT strategic planning. t the CIO should be responsible for IT accountability and transparency in the linger-Cohen Act]. Of the 30 CIOs we surveyed, all of them indicated they were responsible for capital planning and investment management activities at their agency. This is consistent with the results of our 2004 report, which found that all 27 CIOs also indicated responsibility for capital planning and investment management. All 30 of the CIOs reported they thought the CIO should be responsible for capital planning and investment management. All 30 CIOs reported that capital planning and investment management was “very important” or “important” to carrying out their mission. Table 8 provides a summary of CIO responses regarding capital planning and investment management. CIOs are responsible for ensuring agency to In protect information and systems [Paperwork Reduction Act, Federal formation Security Management Act, and Clinger-Cohen Act]. All 30 CIOs indicated they were responsible for ensuring compliance with information security best practices and related laws at their agency. This is consistent with the results of our 2004 report, which found that all of the 27 CIOs surveyed indicated being responsible for information security. Of the 30 agencies that provided responses, all 30 CIOs reported that they thought the CIO should be responsible by law for information security. Twenty-nine of the 30 CIOs reported that information security was “very important” to carrying out their mission. Only one CIO ranked information security as “somewhat important” because his goal is to move the agency toward a risk-based approach that uses secure, reliable, and cost-effective technology. Table 9 provides a summary of CIO responses regarding information security. CIOs are responsible for developing and maintaining the business and technology blueprint that links an agency’s strategic plan to IT programs and supporting system implementations [Clinger-Cohen Act]. f the 30 CIOs we surveyed, all 30 indicated they were responsible for O enterprise architecture-related activities at their agency. This is consistent with the results of our 2004 report, which found that 27 of 27 CIOs also indicated responsibility for enterprise architecture. All 30 CIOs interviewed reported that they believed the CIO should be responsible for enterprise architecture. Twenty-eight of the 30 CIOs reported that enterprise architecture was “important” or “very important” to carrying out their mission with one of the remaining two identifying it as being “somewhat important” and the other labeling it as being “not very important.” For example, one CIO ranked enterprise architecture as being very important based on the maturity of the agency’s abilities within the area. The CIO explained that, since their enterprise architecture was no as mature as they would like it to be, they viewed it as being currently very important. The CIO who reported that enterprise architecture was somewhat important for his mission clarified that this was because the existing activities related to enterprise architecture were being properly executed and therefore required less focus. The remaining CIO who responded that enterprise architecture was “not very important” explained that enterprise architecture was not essential to completing the agency’s mission and therefore having a formal enterprise architecture was less important at the agency. Table 10 prov regarding enterprise architecture. ides a summary of CIO r Of the 30 CIOs we surveyed, 9 indicated that they were responsi ble for information disclosure at their agency. This is generally consistent with our 2004 findings in which 9 of 27 CIOs indicated responsibility for information disclosure. In addition to the contact named above, key contributions were made to this report by Cynthia J. Scott (Assistant Director); Michael Alexander; Cortland Bradford; Virginia Chanley; James Crimmer, Jr.; Neil Doherty; Ashfaq Huda; Lee McCracken; David Plocher; David A. Powner; Meredith R. Raymond; John M. Resser; Eric Trout; Christy Tyson; Walter Vance; and Merry Woo.

Summary: The federal government invests billions in information technology (IT) each year to help agencies accomplish their missions. Federal law, particularly the Clinger-Cohen Act of 1996, has defined the role of Chief Information Officer (CIO) as the focal point for IT management within agencies. Given the longstanding challenges the government faces in managing IT and the continued importance of the CIO, GAO was asked to (1) determine the current roles and responsibilities of CIOs, (2) determine what potential modifications to the Clinger-Cohen Act and related laws could be made to enhance CIOs' authority and effectiveness, and (3) identify key lessons learned by CIOs in managing IT. To do this, GAO administered a questionnaire to 30 CIOs, compared responses to legislative requirements and the results of a 2004 GAO study, interviewed current CIOs, convened a panel of former agency CIOs, and spoke with the Office of Management and Budget's (OMB) Federal CIO. CIOs do not consistently have responsibility for 13 major areas of IT and information management as defined by law or deemed as critical to effective IT management, but they have continued to focus more attention on IT management-related areas. Specifically, most CIOs are responsible for seven key IT management areas: capital planning and investment management; enterprise architecture; information security; IT strategic planning, "e-government" initiatives; systems acquisition, development, and integration; and IT workforce planning. By contrast, CIOs are less frequently responsible for information management duties such as records management and privacy requirements, which they commonly share with other offices or organizations within the agency. In this regard, CIOs report spending over two-thirds of their time on IT management responsibilities, and less than one-third of their time on information management responsibilities. CIOs also report devoting time to other responsibilities such as addressing infrastructure issues and identifying emerging technologies. Further, many CIOs serve in positions in addition to their role as CIO, such as human capital officer. In addition, tenure at the CIO position has remained at about 2 years. Finally, just over half of the CIOs reported directly to the head of their respective agencies, which is required by law. The CIOs and others have stressed that a variety of reporting relationships in an agency can be effective, but that CIOs need to have access to the agency head and form productive working relationships with senior executives across the agency in order to carry out their mission. Federal law provides CIOs with adequate authority to manage IT for their agencies; however, some limitations exist that impede their ability to exercise this authority. Current and former CIOs, as well as the Federal CIO, did not identify legislative changes needed to enhance CIOs' authority and generally felt that existing law provides sufficient authority. Nevertheless, CIOs do face limitations in exercising their influence in certain IT management areas. Specifically, CIOs do not always have sufficient control over IT investments, and they often have limited influence over the IT workforce, such as in hiring and firing decisions and the performance of component-level CIOs. More consistent implementation of CIOs' authority could enhance their effectiveness in these areas. OMB has taken steps to increase CIOs' effectiveness, but it has not established measures of accountability to ensure that responsibilities are fully implemented. CIOs identified a number of best practices and lessons learned for more effectively managing IT at agencies, and the Federal CIO Council has established a website to share this information among agencies. Agencies have begun to share information in the areas of vendor communication and contract management; the consolidation of multiple systems into an enterprise solution through the use of cloud services; and program manager development. However, CIOs have not implemented structured agency processes for sharing lessons learned. Doing so could help CIOs share ideas across their agencies and with their successors for improving work processes and increasing cost effectiveness. GAO is recommending that OMB update its guidance to establish measures of accountability for ensuring that CIOs' responsibilities are fully implemented and require agencies to establish internal processes for documenting lessons learned. In commenting on a draft of this report, OMB officials generally agreed with GAO's findings and stated that OMB had taken actions that they believed addressed the recommendations.