To help manage its multi-billion dollar acquisition investments, DHS has established policies and processes for acquisition management, requirements development, test and evaluation, and resource allocation. The department uses these policies and processes to deliver systems that are intended to close critical capability gaps, helping enable DHS to execute its missions and achieve its goals. DHS policies and processes for managing its major acquisition programs are primarily set forth in its Acquisition Management Directive 102-01 and Acquisition Management Instruction 102-01-001. DHS issued the initial version of this directive in November 2008 in an effort to establish an acquisition management system that effectively provides required capability to operators in support of the department’s missions. DHS’s Under Secretary for Management is currently designated as the department’s Chief Acquisition Officer and, as such, is responsible for managing the implementation of the department’s acquisition policies. DHS’s Under Secretary for Management serves as the acquisition decision authority for the department’s largest acquisition programs, those with LCCEs of $1 billion or greater. Component Acquisition Executives—the most senior acquisition management officials within each of DHS’s components—may be delegated acquisition decision authority for programs with cost estimates between $300 million and less than $1 billion. Table 1 identifies how DHS has categorized the 28 major acquisition programs we review in this report, and table 7 in appendix III specifically identifies the programs within each level. DHS acquisition management policy establishes that a major acquisition program’s decision authority shall review the program at a series of predetermined acquisition decision events to assess whether the major program is ready to proceed through the acquisition life-cycle phases. Depending on the program, these events can occur within months of each other, or be spread over several years. Figure 1 depicts the acquisition life cycle established in DHS acquisition management policy. An important aspect of an acquisition decision event is the decision authority’s review and approval of key acquisition documents. See table 2 for a description of the type of key acquisition documents requiring department-level approval before a program moves to the next acquisition phase. DHS acquisition management policy establishes that the APB is the agreement between program, component, and department-level officials establishing how systems will perform, when they will be delivered, and what they will cost. Specifically, the APB establishes a program’s schedule, costs, and key performance parameters. DHS defines key performance parameters as a program’s most important and non- negotiable requirements that a system must meet to fulfill its fundamental purpose. For example, a key performance parameter for an aircraft may be airspeed and a key performance parameter for a surveillance system may be detection range. The APB schedule, costs, and key performance parameters are defined in terms of an objective and minimum threshold value. According to DHS policy, if a program fails to meet any schedule, cost, or performance threshold approved in the APB, it is considered to be in breach. Programs in breach are required to notify their acquisition decision authority and develop a remediation plan that outlines a time frame for the program to return to its APB parameters, re-baseline—that is, establish new schedule, cost, or performance goals—or have a DHS-led program review that results in recommendations for a revised baseline. In addition to the acquisition decision authority, other bodies and senior officials support DHS’s acquisition management function: The Acquisition Review Board reviews major acquisition programs for proper management, oversight, accountability, and alignment with the department’s strategic functions at acquisition decision events and other meetings as needed. The board is chaired by the acquisition decision authority or a designee and consists of individuals who manage DHS’s mission objectives, resources, and contracts. The Office of Program Accountability and Risk Management (PARM) is responsible for DHS’s overall acquisition governance process, supports the Acquisition Review Board, and reports directly to the Under Secretary for Management. PARM develops and updates program management policies and practices, reviews major programs, provides guidance for workforce planning activities, provides support to program managers, and collects program performance data. Components, such as U.S. Customs and Border Protection, the Transportation Security Administration, and the U.S. Coast Guard sponsor specific acquisition programs. The head of each component is responsible for oversight of major acquisition programs once the programs complete delivery of all planned capabilities to end users. Component Acquisition Executives within the components are responsible for overseeing the execution of their respective portfolios. Program management offices, also within the components, are responsible for planning and executing DHS’s individual programs. They are expected to do so within the cost, schedule, and performance parameters established in their APBs. If they cannot do so, programs are considered to be in breach and must take specific steps, as noted above. Figure 2 depicts the relationship between acquisition managers at the department, component, and program level. DHS established a Joint Requirements Council (JRC) to develop and lead a component-driven joint requirements process for the department. The JRC has issued policies outlining a process for analyzing and validating capability gaps, needs, and requirements. The JRC consists of a chair and 14 members who are senior executives or officers that represent key DHS headquarters offices and seven of the department’s operational components. The JRC chair rotates annually among the seven operational components. JRC members represent the views of their components or office leadership, endorse and prioritize validated capability needs and operational requirements (user-defined performance parameters outlining what a system must do), and make recommendations that are supported by analytical rigor. Figure 3 depicts the current headquarters and component members of the JRC. The JRC provides input to two senior-level entities: The Acquisition Review Board—as a member, the JRC chair advises the board on capability gaps, needs, and requirements at key milestones in the acquisition life cycle. The Deputy’s Management Action Group, which the Secretary established in April 2014, is a decision-making body that is chaired by the Deputy Secretary. Its membership consists of the DHS Chief of Staff, DHS Under Secretaries, senior operational component deputies and select support component deputies, and the Chief Financial Officer. The group provides recommendations to the Deputy Secretary for consideration in the annual resource allocation process that reflects DHS’s investment priorities. The group reviews JRC- validated capability needs and recommendations, provides direction and guidance to the JRC, and endorses or directs related follow-on JRC activities. The JRC is responsible for validating proposed capability needs and requirements for all major acquisitions, as well as for programs that are joint or of interest to the Deputy’s Management Action Group, regardless of level. See table 3 for a description of the key requirements documents requiring JRC validation. In general, the DHS requirements development process moves from broad mission needs and capability gaps to operational requirements. See figure 4. In May 2009, DHS established policies that describe processes for testing the capabilities delivered by the department’s major acquisition programs. The primary purpose of test and evaluation is to provide timely, accurate information to managers, decision makers, and other stakeholders to reduce programmatic, financial, schedule, and performance risks. We provide an overview of each of the 28 programs’ test activities in the individual program assessments presented in appendix I. DHS testing policy assigns specific responsibilities to particular individuals and entities throughout the department: Program managers have overall responsibility for planning and executing their programs’ testing strategies, including scheduling and funding test activities and delivering systems for testing. They are also responsible for controlling developmental testing, which is used to assist in the development and maturation of products, manufacturing, or support processes. Developmental testing includes engineering- type tests used to verify that design risks are minimized, substantiate achievement of contract technical performance, and certify readiness for operational testing. Operational test agents are responsible for planning, conducting, and reporting on operational test and evaluation, which is intended to identify whether a system can meet its key performance parameters and provide an evaluation of the operational effectiveness, suitability, and cybersecurity of a system in a realistic environment. Operational effectiveness refers to the overall ability of a system to provide a desired capability when used by representative personnel. Operational suitability refers to the degree to which a system can be placed into field use and sustained satisfactorily. The operational test agents may be organic to the component, another government agency, or a contractor, but must be independent of the developer in order to present credible, objective, and unbiased conclusions. The Director, Office of Test and Evaluation is responsible for approving major acquisition programs’ operational test agent and test and evaluation master plans, among other things. A program’s test and evaluation master plan must describe the developmental and operational testing needed to determine technical performance and operational effectiveness, suitability, and cybersecurity. As appropriate, the Director is also responsible for observing operational tests, reviewing operational test agents’ reports, and assessing the reports. Prior to a program’s acquisition decision event 3, the Director provides the program’s acquisition decision authority a letter of assessment that includes an appraisal of the program’s operational test, a concurrence or non-concurrence with the operational test agent’s evaluation, and any further independent analysis. As an acquisition program proceeds through its life cycle, the testing emphasis moves gradually from developmental testing to operational testing. See figure 5. DHS has established a planning, programming, budgeting, and execution process to allocate resources to acquisition programs and other entities throughout the department. DHS uses this process to produce the department’s annual budget request and multi-year funding plans presented in the FYHSP, a database that contains, among other things, 5-year funding plans for DHS’s major acquisition programs. According to DHS guidance, the 5-year plans should allow the department to achieve its goals more efficiently than an incremental approach based on 1-year plans. DHS guidance also states that the FYHSP articulates how the department will achieve its strategic goals within fiscal constraints. At the outset of the annual resource allocation process, the department’s Offices of Policy and Chief Financial Officer provide planning and fiscal guidance, respectively, to the department’s components. In accordance with this guidance, the components should submit 5-year funding plans to the Chief Financial Officer. These plans are subsequently reviewed by DHS’s senior leaders, including the DHS Secretary and Deputy Secretary. DHS’s senior leaders are expected to modify the plans in accordance with their priorities and assessments, and they document their decisions in formal resource allocation decision memorandums. DHS submits the revised funding plans to the Office of Management and Budget, which uses them to inform the President’s annual budget request—a document sent to Congress requesting new budget authority for federal programs, among other things. In some cases, the funding appropriated to certain accounts in a given fiscal year can be carried over to subsequent fiscal years. Figure 6 depicts DHS’s annual resource allocation process. Federal law requires DHS to submit an annual FYHSP report to Congress at or about the same time as the President’s budget request. This report presents the 5-year funding plans in the FYHSP database at that time. Two offices within DHS’s Office of the Chief Financial Officer support the annual resource allocation process: The Office of Program Analysis and Evaluation (PA&E) is responsible for establishing policies for the annual resource allocation process and overseeing the development of the FYHSP. In this role, PA&E develops the Chief Financial Officer’s planning and fiscal guidance, reviews the components’ 5-year funding plans, advises DHS’s senior leaders on resource allocation issues, maintains the FYHSP database, and submits the annual FYHSP report to Congress. The Cost Analysis Division is responsible for reviewing, analyzing, and evaluating acquisition programs’ LCCEs to ensure the cost of DHS programs are presented accurately and completely, in support of resource requests. This division also supports affordability assessments of the department’s budget, in coordination with PA&E, and develops independent cost estimates for major acquisition programs upon request by DHS’s Under Secretary for Management or Chief Financial Officer. Of the 24 programs we assessed with approved schedule and cost goals, 10 were on track to meet those goals during 2017. The other 14 programs were not on track because they changed or breached their schedule goals, cost goals, or both. We found that most programs updated their cost estimates in response to requirements DHS established in January 2016 that are intended to provide decision makers with more timely information. These actions are in accordance with GAO’s best practice to regularly update cost estimates and we plan to use these updated estimates to measure programs’ cost changes going forward. Based on our April 2014 recommendation, DHS revised the format of its fiscal year 2018–2022 FYHSP report to Congress to include acquisition affordability tables for select major acquisition programs. However, the report shows—and our analysis of programs’ current cost estimates confirms— that some programs face acquisition funding gaps in fiscal year 2018. We also reviewed 4 programs that were early in the acquisition process and planned to establish department-approved schedule and cost goals in calendar year 2017. However, these programs were delayed in getting department approval for their initial APBs for various reasons and, therefore, we excluded them from our assessment of whether programs were on track to meet their schedule and cost goals during 2017. DHS leadership subsequently approved initial APBs for 2 particularly complex and costly programs—a border wall system along the southwest U.S. border and the Coast Guard’s Heavy Polar Icebreaker—in January 2018. We plan to assess these programs in next year’s review, but provide more details on all 4 additional programs we reviewed in the individual assessments in appendix I. Table 4 summarizes our findings and we present more detailed information after the table. From January 2017 to January 2018, 10 of the 24 programs we assessed with department-approved APBs were on track to meet their schedule and cost goals. This is fewer than our last annual review in which we found that 17 of the 26 programs we assessed were on track during 2016. Three of the 10 programs on track during 2017 were on track against initial schedule and cost goals; that is, the schedule and cost estimates in the baseline DHS leadership initially approved after the department’s acquisition management policy went into effect in November 2008. The other 7 programs had re-baselined prior to January 2017 and were on track against revised schedules and cost estimates that reflected past schedule slips, cost growth, or both. However, some of the programs on track in 2017 identified risks that may lead to schedule slips or cost growth in the future. For example, officials from the Technology Infrastructure Modernization program told us that staffing challenges may impede their ability to execute the program in accordance with its current APB. We also identified 2 programs that are in the process of re-baselining or plan to re-baseline in the near future to account for significant program changes or to add capabilities. For example, the Next Generation Networks Priority Services program plans to update its APB to establish schedule, cost, and performance goals for the next increment, which is intended to address landline capabilities for providing government officials emergency telecommunication services. During 2017, 14 of the 24 programs we assessed with department- approved APBs were not on track. Twelve of these programs had at least one major acquisition milestone that slipped, including 6 of these programs that also changed or breached their cost goals. Two additional programs changed or breached only their cost goals. As of January 2018, 6 of the 12 programs that experienced a schedule slip were in breach and had not yet revised their goals. Therefore, the magnitude of the schedule slips is unknown. For the remaining 6 programs, the change in schedule during 2017 ranged from a delay of 6 months to 66 months. Figure 7 identifies the programs that experienced schedule slips and the extent to which their major milestones slipped in 2017, as well as—for additional context—in prior years. While there are various reasons for schedule delays, the result is that end users may not get needed capabilities when they originally anticipated. Examples of the reasons why these key milestones slipped in 2017 include the following: New requirements: For example, the Passenger Screening Program re-baselined in May 2017 for the fifth time since its initial APB was approved in January 2012. This latest re-baseline was to remediate a 17-month breach caused by delays in incorporating new cybersecurity requirements in one of the program’s transportation security equipment technologies, known as the Credential Authentication Technology. The program now plans to achieve full operational capability for this system by December 2023—more than 9 years later than it initially planned. In another example, the Tactical Communications Modernization program re-baselined in November 2017—4 months after the program notified DHS leadership that it would not achieve full operational capability as planned. The reason for this re-baseline was to resolve issues related to federal information security requirements. The program now plans to achieve this milestone by March 2019, which is more than a year later than its initial APB threshold. Technical challenges: For example, the Continuous Diagnostics and Mitigation program re-baselined in June 2017 to account for significant coverage gaps identified during the deployment of phase 1 sensors and to establish cost, schedule, and performance goals for phase 3 tools. The program’s full operational capability date slipped almost 4 years after this milestone was redefined as the point in time at which phase 1–3 tools are available to all participating civilian agencies. Additionally, the Automated Commercial Environment program declared a schedule breach in April 2017—its second in less than a year—after encountering difficulties developing its remaining functionality. These difficulties have caused further delays to the program’s final acquisition milestone decision. External factors: Officials from the Logistics Supply Chain Management System program notified DHS leadership in September 2017 that the program would not complete all required activities to achieve acquisition decision event 3 and subsequent events, including full operational capability. The primary reason for the delay was because program staff were deployed to support response and recovery efforts during the 2017 hurricane season. Additionally, the Medium Lift Helicopter program experienced delays in getting key acquisition documents approved in time to achieve its acquisition decision event 3. These delays were attributed, in part, to DHS leadership directing Customs and Border Protection to develop a comprehensive border plan that included the helicopter’s capabilities. We elaborate on the reasons for all 12 programs’ schedule slips in the individual assessments in appendix I. Of the 14 programs not on track during 2017, 8 revised or breached their established cost goals. Four of these 8 programs revised their cost goals when they re-baselined to address new requirements and technical challenges, among other things. When the Passenger Screening Program re-baselined in May 2017, the program’s APB threshold for its life-cycle costs increased $418 million (8 percent) over its previous APB. However, the revised threshold is $1 billion below the threshold established in the program’s initial APB, which was approved in January 2012. From 2012 to 2015, the program’s scope was reduced in response to funding constraints. However, emerging threats drove the program to increase capability requirements, which has subsequently increased costs. When the Continuous Diagnostics and Mitigation program re- baselined in June 2017, the APB threshold for life-cycle costs decreased by $15 million (1 percent). However, the program shifted some acquisition costs to operations and maintenance (O&M) to be consistent with DHS’s new common appropriations structure. This, in addition to other changes, increased the APB threshold for O&M by $631 million (3,712 percent). When the National Security Cutter program re-baselined in November 2017 to account for a ninth ship—as directed by Congress—the APB cost thresholds for acquisition and O&M increased by $453 million (8 percent) and $123 million (1 percent), respectively. When the Immigration and Customs Enforcement’s TECS Modernization program re-baselined in November 2017 in preparation for acquisition decision event 3, the APB cost thresholds increased overall. Specifically, the acquisition cost threshold decreased by $14 million (6 percent) when the program included actual costs through fiscal year 2016, among other things, and the O&M cost threshold increased by $147 million (92 percent) when the program extended the estimate by 4 years and included support costs for an additional 11 years. The other 4 programs breached their established cost goals during 2017. The Medium Lift Helicopter and Electronic Baggage Screening programs breached certain APB cost thresholds when they shifted costs between categories, such as O&M to acquisitions or vice versa, to be consistent with DHS’s new common appropriations structure. The Tactical Communications Modernization program experienced a cost breach primarily because of increases in costs for contractor labor and support for facilities and infrastructure. The program’s APB cost threshold for O&M increased by $110 million (23 percent) when it re-baselined in November 2017. The Automated Commercial Environment program experienced a cost breach because it had to extend its contracts to address the development difficulties discussed above. The magnitude of the program’s cost goal changes is not yet known because the program does not plan to revise its APB until August 2018. We elaborate on the reasons for all 8 programs’ cost goal changes or breaches in the individual program assessments in appendix I. In January 2016, based on several of our past recommendations, DHS required major acquisition programs to begin submitting to headquarters (1) detailed data on program affordability, such as updates to the program’s LCCE and funding source information, to help inform the department’s annual resource allocation process, and (2) an annual LCCE update. These requirements are intended to provide more timely information that may improve DHS’s efforts to address acquisition program affordability issues, as well as internal and external oversight of programs’ progress against its cost goals. These actions are in accordance with GAO’s cost estimating best practices, which state that cost estimates should be updated with actual costs so that they are always relevant and current. As a result, we have used these sources to provide the programs’ current estimate in the individual assessments in appendix I, as appropriate, and plan to use these data sources to measure programs’ cost changes going forward. According to officials from the Cost Analysis Division, a program’s annual LCCE update should inform the affordability submission to support the annual resource allocation process and can be completed at any point during the fiscal year leading up to this process. We examined documentation to ascertain whether the programs we reviewed complied with the two requirements. For the 24 programs we assessed with department-approved APBs, we found the following: All 24 programs submitted the detailed data on program affordability to headquarters by June 2017 to inform the fiscal year 2019 resource allocation cycle. Most programs’ submissions accounted for changes since the program’s last LCCE was approved by DHS’s Chief Financial Officer, except three. For example, the Long Range Surveillance Aircraft program’s submission reflected no updates from its November 2011 LCCE because the program was in the process of re-baselining to account for significant changes. The program began re-baselining nearly 3 years ago and has been delayed for various reasons, including challenges with the vendor hired to complete a revision of the program’s LCCE. Eighteen of the 24 programs submitted annual LCCE updates. Three programs—Automated Commercial Environment, H-65, and Transformation—did not submit an annual LCCE update because they were in breach. The other 3 programs—all within the Coast Guard—did not submit an annual LCCE because, according to Coast Guard officials, they have limited internal cost estimating capability and rely on outside sources for this service, which led to delays in completing the annual LCCEs for these programs. Coast Guard officials said they are reviewing options to resolve these delays and improve the Coast Guard’s cost estimating capability. Cost Analysis Division officials anticipate the Coast Guard will increase compliance with the annual LCCE requirement in fiscal year 2018. They also plan to update the annual LCCE template to include additional information, such as comparisons of the updated estimates to the program’s APB cost goals and projected funding. In addition, DHS revised the format of its FYHSP report to Congress, improving insight into major programs’ acquisition funding, but decreasing insight into O&M funding. In April 2014, we found that DHS could better communicate its funding needs for acquisition programs to Congress and recommended that DHS enhance the content for future FYHSP reports by presenting programs’ annual cost estimates and any anticipated funding gaps, among other things. DHS concurred with the recommendation and, for the first time, included acquisition affordability tables that presented programs’ annual acquisition cost estimates compared to projected acquisition funding for select major acquisition programs in its FYHSP report for fiscal years 2018–2022. However, DHS no longer reported O&M funding for individual programs. DHS reported in the FYHSP that it focused on acquisition information because O&M funding estimates are generally stable year-to-year and components manage O&M in various ways, such as by individual program or across a portfolio of programs. By removing O&M funding information in the FYHSP for all programs, DHS presents an incomplete picture of programs’ full funding needs and affordability. In April 2018, we assessed the extent to which DHS had accounted for O&M costs and funding in greater detail and recommended that DHS reverse the exclusion of O&M funding at the acquisition program level in its FYHSP report to Congress for all components. DHS officials stated that they plan to re-introduce O&M funding for major acquisition programs in the FYHSP report for fiscal years 2019–2023 based on multiple internal discussions about the best way to present a more comprehensive view of programs’ total costs and feedback from key stakeholders, such as the Office of Management and Budget. Based on the information presented in the FYHSP report for fiscal years 2018–2022, DHS’s acquisition portfolio is not affordable over the next 5 years. For example, the report contained acquisition affordability tables for 18 of the 24 programs we assessed that have approved APBs. Of these 18 programs, 9 were projected to have an acquisition affordability gap in fiscal year 2018. However, some of these projections are outdated since the FYHSP report—which was issued in September 2017—relied on cost information as of April 2016. Therefore, we updated these tables using the programs’ current acquisition cost estimate presented in the individual assessments in appendix I. Based on our assessment of programs’ current cost estimates, we also found that a total of 9 programs are projected to have an acquisition affordability gap in fiscal year 2018. However, 3 of these 9 programs were different programs than those identified based on the FYHSP report. Of the 9 programs we identified with a projected acquisition affordability gap in fiscal year 2018, we found the following: Five programs identified other funding, such as funding from previous fiscal years that remained available for obligation—known as carryover funding—which would address their projected acquisition funding gap. For example, in the FYHSP report, DHS projected allocating approximately $16 million in funding for the Technology Infrastructure Modernization program in fiscal year 2018 to cover an estimated $16 million in acquisition costs. However, in its November 2017 annual LCCE update, this program’s acquisition cost increased to almost $30 million, resulting in a projected acquisition affordability gap of almost 45 percent. The program plans to realign $57 million in O&M carryover funding to cover this and any future acquisition shortfalls. Four programs did not identify other funding that would address their projected acquisition funding gap, which increases the likelihood that they will cost more and take longer to deliver capabilities to end users than expected. For example, in the FYHSP report, DHS projected allocating $109 million in funding for the Non-Intrusive Inspection Systems program in fiscal year 2018 to cover an estimated $103 million in acquisition costs. However, in its April 2017 annual LCCE update, this program’s acquisition costs increased to nearly $186 million, resulting in a projected acquisition affordability gap of 41 percent. The program identified only $2.5 million in fiscal year 2017 acquisition carryover funding. Further, 5 of the 24 programs we assessed were not included in the fiscal years 2018–2022 FYHSP report because they were no longer expected to receive acquisition funding. Officials from 3 of these 5 programs projected funding gaps that could cause future program execution challenges, such as schedule slips or cost growth. For example, the National Bio and Agro-Defense Facility anticipates a projected funding shortfall of approximately $90 million over the next 5 years, which officials said could delay a number of activities to make the facility operational. We elaborate on programs’ affordability over the next 5 years in the individual program assessments in appendix I. We assessed DHS’s policies outlining the department’s processes for acquisition management, resource allocation, and requirements and found that, when considered collectively, they generally reflect key portfolio management practices. In March 2007, we examined the practices that private sector entities use to achieve a balanced mix of new projects and found that successful commercial companies use a disciplined and integrated approach to prioritize needs and allocate resources when making investments. This approach, known as portfolio management, requires companies to view each of their investments as contributing to a collective whole, rather than as independent and unrelated. With this perspective, companies can effectively (1) identify and prioritize opportunities, and (2) allocate available resources to support the highest priority—or most promising—opportunities. Based on this and other work, we identified four key practice areas for portfolio management in September 2012. We previously assessed DHS’s acquisition management and resource allocation policies against our key portfolio management practices in September 2012 and April 2014, respectively. We found that the policies in place at the time of our reviews did not fully reflect all of the key portfolio management practices and recommended that DHS revise its policies to do so. DHS concurred with our recommendations and subsequently took actions to mature and solidify the department’s portfolio management processes and policies. In April 2014, the Secretary of Homeland Security issued a memorandum titled Strengthening Departmental Unity of Effort, which aimed to strengthen DHS’s structures and processes to improve departmental cohesiveness and operational effectiveness, among other things. The memorandum identified several initial focus areas intended to build organizational capacity, one of which centered on improving and integrating the department’s processes for acquisition oversight, resource allocation, and joint requirements analysis. To improve these processes, the memorandum directed senior DHS leaders to update the existing acquisition management and resource allocation processes, as well as lead an expedited review to provide alternatives for developing and facilitating a component-driven joint requirements process, which ultimately led to the re-establishment of the JRC. In response to our recommendations and the Unity of Effort memorandum, DHS issued new policies outlining the acquisition management, resource allocation, and requirements processes in 2016. We assessed these policies and found that, when considered collectively, they generally reflect the key portfolio management practices, as shown in table 5. Because DHS’s new policies were issued in 2016, we did not specifically assess DHS’s implementation of them. However, we did review documentation resulting from the acquisition management, resource allocation, and requirements processes since January 2016 to get a sense of how the department began implementation. Examples of how DHS’s policies reflect the key portfolio management practices and their implementation status are outlined below. Clearly define and empower leadership: the policies identify the roles and responsibilities for decision makers in the acquisition management, resource allocation, and requirements processes, as well as establish cross-functional teams to support those decision makers. For example, to fulfill the role of acquisition decision authority, the Under Secretary for Management is supported by the Acquisition Review Board, which consists of key DHS senior leaders responsible for managing the department’s finances, contracts, and testing, among other things. We reviewed the memorandums issued since January 2016 that document Acquisition Review Board decisions and found that, through this group, DHS has taken steps to manage across programs through its acquisition management process. For example, after reviewing the status of several individual Customs and Border Protection programs in 2016, the Acquisition Review Board identified the need for a comprehensive border plan that depicts the component’s current land, maritime, and air domain awareness capabilities. In October 2016, the Deputy Under Secretary for Management—who was serving as acquisition decision authority at the time—directed Customs and Border Protection to develop such a plan. The plan is to consist of separate analyses for each of the three domains—starting with land— that reflect end users’ capability requirements for systems, such as Integrated Fixed Towers, Multi-Role Enforcement Aircraft, and Medium Lift Helicopter, that address relevant domain threats. As of February 2018, Customs and Border Protection had not yet completed the analysis for land domain awareness capabilities. Establish standard assessment criteria and demonstrate comprehensive knowledge of the portfolio: the policies establish standard criteria for assessing major acquisition programs through the acquisition management, resource allocation, and requirements processes. For example, the updated resource allocation handbook established that PA&E conduct annual assessments of all major investments using standard criteria in five main categories— contribution to DHS’s mission, program health, risk, resources, and governance—to assess the portfolio of investments and present alternatives for leadership decision. PA&E officials told us they used these criteria when assessing components’ resource allocation requests during development of the President’s fiscal year 2018 budget to develop funding options for the Deputy’s Management Action Group, which is responsible for making resource allocation recommendations for the Secretary’s approval. PA&E presented its funding options by DHS mission, which, according to officials associated with the Deputy’s Management Action Group, allowed the group to make cross-component allocation decisions that directly aligned with the department’s strategic goals. We could not verify these officials’ assertions based on the documentation we were provided, but will continue to monitor PA&E’s assessment of major acquisition programs against the standard criteria as the department’s implementation of its resource allocation policies matures. In addition, PARM formally established its Acquisition Program Health Assessments in October 2016 after more than a year of development and pilot efforts. These assessments are intended to monitor major acquisition programs quarterly (both on an individual program level and in aggregate) by rating programs against standard criteria in several categories—such as program management, financial management, and human capital—that DHS deemed important for successful program execution. We reviewed the quarterly reports issued from January 2016 to April 2017 and found that they primarily focused on individual programs. The portfolio-level information contained in these reports was limited to program results grouped in various categories, such as by component, by acquisition life-cycle phase, and by investment type (e.g., information technology). PARM officials said they plan to use the health assessments as a portfolio management tool in the future and are working to determine how to best to analyze and present portfolio-level data. We will continue to track PARM’s implementation of the health assessment process moving forward through GAO’s High Risk work to determine DHS’s progress in demonstrating that major acquisition programs are on track to achieve their established goals. Prioritize investments by integrating the requirements, acquisition, and budget processes: the policies identify areas where DHS’s requirements, acquisition management, and resource allocation processes are integrated and establish processes for prioritizing investments. For example, the updated resource allocation policies require reviews of DHS’s major acquisition portfolio during this annual process. When the portfolio faces a funding gap, programs are to be returned to their respective components for scope or funding adjustments, or prioritized by department leadership to identify an affordable set of programs. For the fiscal year 2018 resource allocation cycle, PA&E officials provided an example where DHS leadership directed components to identify funding from alternative sources to fund specific purposes related to DHS’s mission to prevent terrorism and enhance security. However, as previously discussed, the resulting FYHSP report for fiscal years 2018–2022 showed that DHS’s portfolio of major acquisition programs is not affordable over the next 5 years. In addition, the requirements policies established the Joint Assessment of Requirements, an annual process to prioritize emerging and existing requirements to inform the department’s resource allocation decisions. As we found in October 2016, the JRC plans to implement the Joint Assessment of Requirements through a 3-year phased approach that is expected to be fully implemented in time to inform DHS’s fiscal year 2021 budget request. In fiscal year 2016, the JRC completed the first phase, which included (1) developing initial criteria to evaluate emerging requirements, and (2) evaluating and prioritizing a sample of those requirements against the initial criteria. Based on these results, JRC officials told us in September 2017 that they are working to develop assessment metrics for the criteria as part of the next phase. We will continue to track the JRC’s progress through GAO’s High Risk work to determine DHS’s progress to effectively operate the JRC. Continually make go/no go decisions to rebalance the portfolio: the requirements policies outlining the Joint Assessment of Requirements process also reflected the key practices to conduct reviews (1) annually to make requirement scoping adjustments as priorities change and (2) when new investments are identified. However, as previously discussed, the JRC is still in the process of implementing this process. We consider this overall key practice area to be partially met because DHS’s policies do not reflect the key practice (3) to reassess programs that breach established thresholds within the context of the portfolio to determine if the program remains relevant and affordable. PARM officials told us that—in practice—DHS reassesses programs in the context of their component’s overall acquisition portfolio based on a certification of funds memorandum submitted to DHS’s Chief Financial Officer when programs re-baseline as a result of a cost, schedule, or performance breach. The memorandum is intended to enable the Acquisition Review Board to discuss affordability by certifying a program’s funding levels and identifying trade-offs necessary to address any projected funding gaps. We previously found that the certification of funds memorandum was an effective tool for DHS leadership to assess program affordability. However, DHS’s acquisition management policy requires components to submit this memorandum prior to most acquisition decision events, but not when a program re-baselines as a result of a cost, schedule, or performance breach. During our review of programs’ progress against schedule and cost goals in 2017, we found one instance where a component did not follow the practice to submit this memorandum when one of its programs re-baselined as a result of a breach. Specifically, Customs and Border Protection did not submit a certification of funds memorandum when the Tactical Communications Modernization program re-baselined in November 2017 as a result of a schedule and cost breach. Nevertheless, DHS leadership approved the program’s revised APB and removed it from breach status, even though DHS’s Chief Financial Officer identified that the program’s revised LCCE was not affordable. PARM officials stated that this instance was an oversight because, at the time, the department was still determining when certification of funds memorandums should be submitted. According to the federal standards for internal control, documentation of internal control practices is necessary so that they can be implemented effectively. By amending its acquisition management policy to require a certification when a program re-baselines as a result of a cost, schedule, or performance breach, DHS can ensure that leadership receives the necessary information to reassess that program’s affordability in the context of a larger portfolio. PARM officials stated that, moving forward, components will be required to submit a certification of funds memorandum for each program when a new APB is submitted for DHS leadership approval. In contrast, the acquisition management policy does reflect the key practice (4) to use information gathered from post-implementation reviews to fine tune investment processes and the portfolio to achieve strategic outcomes. For example, DHS’s acquisition management policy requires programs to conduct post-implementation reviews 6 to 18 months after initial operational capability to identify and document any deployment or implementation and coordination issues, how they were resolved, and how they could be prevented in the future. These reviews are intended to help identify capability gaps that may inform future acquisitions, among other things. However, PARM officials said that they do not consider the results of the post-implementation reviews when managing the department’s current acquisition portfolio because these reviews are typically conducted after program oversight shifts from PARM to the component. While post-implementation reviews are conducted later in the acquisition life cycle, the insights they provide could be leveraged by other programs in the acquisition portfolio, not just the program under review. For example, the Integrated Fixed Towers program completed a post-implementation review in June 2016 after its initial deployment of capabilities to the Arizona border. The review found that changes in illegal traffic patterns as a result of the program’s deployment may be predicted, and other technologies may be able to compensate for changes in these patterns. This information could help other programs under development plan for similar outcomes or enable DHS to change deployment plans for existing programs to address changes in threats. PARM has an opportunity to use the results from programs’ post- implementation reviews since it is responsible for overseeing the department’s acquisition portfolio by monitoring each investment’s cost, schedule, and performance against established baselines. Federal standards for internal control state that management should obtain data on a timely basis so that they can be used for effective monitoring and that separate evaluations may provide feedback on the effectiveness of ongoing monitoring. By leveraging the results from post-implementation reviews in its monitoring efforts, PARM may be better able to ensure that programs in the current acquisition portfolio achieve their baselines. PARM officials stated they have generally focused on leveraging information gathered from canceled acquisition programs, such as where and why plans went wrong. However, they agreed that they could better leverage post- implementation review information gathered from programs that complete planned capability deployments. DHS’s mission to safeguard the American people and homeland requires a broad portfolio of acquisitions. However, the performance of DHS’s major acquisition portfolio during 2017 did not improve compared to our last review because we found that more programs will require more time and may require more money to complete than initially planned. DHS is collecting more timely cost estimate information on its acquisition programs to make more informed investment decisions. Yet DHS continues to face challenges in funding its acquisition portfolio, which highlights the need for disciplined policies that reflect best practices to ensure that the department does not pursue more programs than it can afford. DHS leadership has taken positive steps in recent years by strengthening its policies for acquisition management and resource allocation, and establishing policies related to requirements. Collectively, these policies reflect an integrated approach to managing investments. However, opportunities remain to further strengthen the acquisition management policy by documenting DHS’s current practice to reassess programs that breach their established cost, schedule, or performance thresholds to ensure they are still worth pursuing within the context of the portfolio. Additionally, leveraging information learned once programs complete deployment across the acquisition portfolio could help ensure that programs stay on track against their baselines in the first place. This is particularly relevant because DHS is initiating a number of complex and costly acquisition programs, such as development of a wall system along the southwest border and the Coast Guard’s Heavy Polar Icebreaker, which could benefit from this type of information. We are making the following two recommendations to DHS: The Under Secretary for Management should update DHS’s acquisition management policy to require components to submit a certification of funds memorandum when a major acquisition program re-baselines in response to a breach. (Recommendation 1) The Under Secretary for Management should require PARM to assess the results of major acquisition programs’ post-implementation reviews and identify opportunities to improve performance across the acquisition portfolio. (Recommendation 2) We provided a draft of this report to DHS for review and comment. In its comments, reproduced in appendix IV, DHS concurred with both of our recommendations and identified actions it planned to take to address them. DHS also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees and the Secretary of Homeland Security. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-4841 or makm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V. This appendix presents individual assessments for each of the 28 programs we reviewed. Each assessment presents information current as of January 2018. They include standard elements, such as an image, a program description, and summaries of the program’s progress in meeting cost and schedule goals, performance and testing activities, and program management-related issues, such as staffing. Each assessment also includes the following figures: Fiscal Years 2018–2022 Affordability. This figure compares the funding plan presented in the Future Years Homeland Security Program report to Congress for fiscal years 2018–2022 to the program’s current cost estimate. We use this funding plan because the data are approved by the Department of Homeland Security (DHS) and Office of Management and Budget, and was submitted to Congress to inform the fiscal year 2018 budget process. The figure only presents acquisition funding because DHS did not report operations and maintenance (O&M) funding for individual programs in its funding plan to Congress. In addition, the data do not account for other potential funding sources, such as carryover. Acquisition Program Baseline (APB) vs. Current Estimate. This figure compares the program’s cost thresholds from the initial APB approved after DHS’s acquisition management policy went into effect in November 2008 and the program’s current DHS-approved APB to the program’s expected costs as of January 2018. The source for the current estimate is the most recent cost data we collected (i.e., a department-approved life-cycle cost estimate, updated life-cycle cost estimates submitted during the resource allocation process to inform the fiscal year 2019 budget request, or a fiscal year 2017 annual life- cycle cost estimate update). Schedule Changes. This figure consists of two timelines that identify key milestones for the program. The first timeline is based on the initial APB DHS leadership approved after the department’s current acquisition management policy went into effect. The second timeline identifies when the program expected to reach its major milestones as of January 2018 and includes milestones introduced after the program’s initial APB. Dates shown are based on the program’s APB threshold dates or updates provided by the program office. Test Status. This table identifies key recent and upcoming test events. It also includes DHS’s Director, Office of Test and Evaluation’s assessment of programs’ test results, if an assessment was conducted. Staffing Profile. This figure identifies the total number of staff a program needs (measured in full time equivalents) including how many are considered critical and how many staff the program actually has. Lastly, each program assessment summarizes comments provided by the program office and identifies whether the program provided technical comments. AUTOMATED COMMERCIAL ENVIRONMENT (ACE) CUSTOMS AND BORDER PROTECTION (CBP) The ACE program is developing software that will electronically collect and process information submitted by the international trade community. ACE is intended to provide private and public sector stakeholders access to information, enhance the government’s ability to determine whether cargo should be admitted into the United States, and increase the efficiency of operations at U.S. ports by eliminating manual and duplicative trade processes, and enabling faster decision making. Final deployment and operational testing of ACE functionality delayed. Program plans to identify an approach to address collections functionality in March 2018. We last reported on this program in March 2018 and April 2017 (GAO-18-271, GAO-17-346SP). CBP declared a cost and schedule breach in April 2017—5 months after re-baselining the program in response to a prior breach—because of difficulties developing the collections aspect of ACE’s remaining functionality, which collects and processes duties owed on imported goods. CBP reported that its officials were not versed in the complexities of collections in the legacy system and underestimated the level of effort required to integrate collections capabilities into ACE. As a result, the program delayed final deployment of ACE functionality several times and missed the deadlines for completing the remaining milestones in its current acquisition program baseline (APB), including achieving acquisition decision event (ADE) 3 and full operational capability (FOC) by the revised dates of June 2017 and September 2017, respectively. Additional coding and testing to complete ACE development also required contract extensions that exceeded the current APB cost thresholds. The program subsequently decoupled collections from ACE’s remaining functionality to permit deployment of the other post-release capabilities—such as liquidations and reconciliation—using a phased approach between September 2017 and February 2018. In November 2017, CBP officials estimated that efforts to decouple collections from post-release functionality would be an additional $32 million in acquisition costs. CBP officials plan to cover these costs with $18 million in fiscal year 2017 carryover funding and by reprogramming $14 million from ACE disaster recovery funding. CBP is in the process of determining a path forward for collections, which is due to Department of Homeland Security (DHS) leadership by the end of March 2018. CBP then plans to update the program’s acquisition documentation, including APB and life- cycle cost estimate, by August 2018. Until then, the time frame for completing ACE’s remaining milestones and true cost of the program, including the cost to complete collections development is unknown. The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs. CBP officials anticipate receiving approximately $535 million in O&M funding over this 5-year period. Customs and Border Protection (CBP) AUTOMATED COMMERCIAL ENVIRONMENT (ACE) When DHS leadership re-baselined ACE’s cost, schedule, and performance parameters in 2013, the program adopted an agile software development methodology to accelerate software creation and increase flexibility in the development process. As of October 2017, the ACE program office oversees 11 agile teams that conduct development and O&M activities. CBP officials said they extended the program’s agile development contracts in 2017 to permit further development of the collections function. In identifying a path forward for collections, CBP officials stated there are three main options: 1. leave collections in the legacy system, 2. continue to pursue development and deployment in ACE, or 3. move collections to a different program altogether. The program previously experienced a schedule breach in June 2016 because it delayed events to address external stakeholders’ concerns about transitioning to ACE. According to CBP officials, CBP has signed a memorandum of understanding with each of the 22 partner agencies responsible for clearing or licensing cargo that provides access to ACE. As of February 2018, 21 of the partner agencies had transitioned to ACE and the program was piloting a solution for the remaining partner. In September 2017, CBP reported that ACE continued to lack a director of testing and evaluation. CBP officials said they do not plan to fill this vacancy despite plans to conduct further testing because existing staff have successfully covered the workload and a large portion of testing has already been completed. CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. CUSTOMS AND BORDER PROTECTION (CBP) The Biometric Entry-Exit Program is developing capabilities to enhance traveler identification upon departure from the U.S. at air, land, and sea ports of entries by collecting biometric data, such as fingerprints and facial recognition. The program plans to match this data to biometric data obtained from travelers upon their arrival into the U.S. to identify foreign nationals that stay in the U.S. beyond their authorized periods of admission and verify the identities of travelers leaving the U.S. CBP completed four biometric pilot programs and selected a solution for development. DHS has explored biometric exit capabilities since 2009, but was directed to expedite implementation in March 2017. GAO last reported on this program in February 2017 (GAO- 17-170). In June 2017, the Department of Homeland Security’s (DHS) Under Secretary for Management (USM) granted the Biometric Entry-Exit Program acquisition decision event (ADE) 1 approval after CBP completed several pilot initiatives to study the feasibility of proposed biometric exit solutions at air and land ports of entry. The USM also authorized the program to continue testing a pilot exit solution at Hartsfield-Jackson Atlanta International Airport and conduct technology demonstrations as needed, but directed the program to achieve ADE 2A prior to deploying a solution to the 20 U.S. airports with the most international flights. CBP officials initially planned to achieve ADE 2A approval in September 2017—the point at which the program would establish cost, schedule, and performance goals in a DHS-approved acquisition program baseline (APB)—and pursue separate ADE 2B decisions to initiate development of a biometric solution for each type of port of entry, starting with air. As of December 2017, the program had yet to conduct its ADE 2A because CBP officials have had to resolve several issues identified by the Joint Requirements Council that has delayed approval of the program’s operational requirements document (ORD). In January 2018, CBP officials said the program plans to conduct ADE 2A in February or March 2018 and is aiming for ADE 2B for the biometric air solution in December 2018. In December 2015, Congress established an account to be used for the development and implementation of the biometric entry-exit system starting in 2017. Specifically, Congress provided that half the amount collected from fee increases for certain visa applications from fiscal years 2016 through 2025—up to $1 billion—would be available to DHS until expended. In February 2017, DHS leadership approved the program to use about $73 million of this funding in fiscal year 2017 for information technology investments and programmatic and operational support, among other things. In September 2017, DHS’s Chief Financial Officer approved the program’s life-cycle cost estimate (LCCE), which CBP expects to refine as the program progresses to meet the fee-funding limit. According to CBP officials, the current funding structure poses challenges because the fees will fluctuate based on immigration rates. Customs and Border Protection (CBP) of a traveler to different sources—one technology compared the photo to the traveler’s passport upon entrance to the U.S.; the other technology compared the photo to a gallery of photos based on the outbound flight manifest during an airline’s boarding process. According to CBP officials, the facial recognition technology that matched photos during an airline’s boarding process was the most viable approach and served as the foundation for its development of the ADE 2A acquisition documents. Officials stated a similar approach may be feasible for land border crossings, but will require further planning. In January 2018, CBP officials stated they were developing a test and evaluation master plan—which will outline the developmental and operational test approach—for the biometric exit air solution. DHS’s Director, Office of Test and Evaluation will need to review and approve this plan prior to the program’s ADE 2B. Since 1996, several federal statutes have required development of an entry and exit system for foreign nationals. DHS has been exploring biometric exit capabilities since 2009 and an Executive Order issued in March 2017 directed DHS to expedite the implementation of the biometric entry-exit system. The Biometric Entry-Exit Program plans to develop a capability to match a traveler’s biometric data against data contained in existing DHS biometric data repositories— primarily the National Protection and Program Directorate’s IDENT system. DHS is in the process of replacing and modernizing IDENT through the Homeland Advanced Recognition Technology (HART) program because IDENT is at risk of failure. However, HART has experienced delays, which could affect the Biometric Entry-Exit Program’s development progress. For the air biometric solution, CBP plans to pursue a public/private partnership in which airlines and airports invest in the equipment to collect biometric data. According to CBP officials, this approach could reduce program costs and improve the passenger boarding process. In August 2017, CBP officials told GAO that several airlines have expressed interest in partnering with the program, including one that expanded CBP’s pilot of facial recognition matching for outbound flights to additional gates at the Hartsfield-Jackson Atlanta International Airport. CBP officials reported a staffing gap of 14 full time equivalent staff which the program plans to fill once partnerships with airlines are established. CBP officials stated that authorized funds are collected from visa fee increases that expire in fiscal year 2025. Beyond 2025, officials stated that additional funding will need to be appropriated or the fee increases extended to continue the program. They added that fee collections are currently below forecasted levels and may come under the current $1 billion limit. CBP officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. CUSTOMS AND BORDER PROTECTION (CBP) The border wall system is intended to prevent the illegal entry of people, drugs, and other contraband by enhancing and adding to the 654 miles of existing barriers along the U.S. southwest border. CBP plans to create a border enforcement zone between a primary barrier—such as a fence—and a secondary barrier. To establish the enforcement zone, the wall system may also include detection technology, surveillance cameras, lighting, and roads for maintenance and patrolling. CBP has evaluated prototypes for new barrier designs, but risks with planned detection technologies exist. CBP is leveraging staff and the contracting strategy from prior border fencing programs. GAO last reported on the existing Southwest border barriers in February 2017 (GAO-17-331). In April 2017, Department of Homeland Security (DHS) leadership granted CBP permission to procure barrier prototypes to inform new design standards and approved the construction of the first segment of the wall system. CBP subsequently awarded 8 task orders with a total value of over $3 million for the development of prototypes and selected San Diego as the first segment. CBP plans to replace an existing 14 miles of primary and secondary barriers in San Diego. DHS plans to use fiscal year 2017 funding for the replacement of the primary barrier, which it plans to rebuild to existing design standards. DHS has requested funding for replacement of the secondary barrier beginning in fiscal year 2018 that it plans to rebuild to new design standards once established. DHS leadership plans to approve acquisition documentation—including an acquisition program baseline (APB) and a life-cycle cost estimate (LCCE)—for each segment to determine affordability prior to authorizing construction. However, CBP officials said they do not plan to develop an APB for the San Diego segment because DHS already approved construction. In January 2018, DHS leadership approved an APB establishing cost, schedule, and performance goals for a second segment in the Rio Grande Valley (RGV), which will extend an existing barrier by 60 miles. To inform leadership’s decision, DHS headquarters conducted an independent cost estimate, which CBP adopted as the program’s LCCE. The LCCE includes costs for both the San Diego and RGV segments. However, DHS officials stated that the amounts in the LCCE are not releasable until CBP evaluates the prototypes, determines, and designs a final solution for the San Diego secondary barrier, and updates the LCCE—which is not expected to be complete until June 2018. The costs presented here are only for the RGV segment. CBP reported that construction of the RGV segment would be sufficiently funded if it receives $1.3 billion of acquisition funding in fiscal year 2018. However, CBP identified a shortfall in operations and maintenance (O&M) funding from fiscal years 2019 to 2022 that it plans to cover with existing funding from the Tactical Infrastructure program, which will be responsible for maintenance of the wall system as segments are complete. If funded, the program expects to achieve full operational capability for the RGV segment in March 2023. Customs and Border Protection (CBP) The Border Wall System Program was initiated in response to an Executive Order issued in January 2017 stating that the executive branch is to secure the southern border through the immediate construction of a physical wall on the southern border of the U.S. To expedite the acquisition planning process, CBP officials said they leveraged expertise from staff that worked on previous border fencing programs and were familiar with implementation challenges, such as land access. CBP intends to prioritize segments based on threat levels, land ownership, and geography, among other things. From fiscal years 2007 to 2015, CBP spent approximately $2.3 billion to construct pedestrian and vehicle fencing along the southwest border. CBP’s Tactical Infrastructure program is responsible for sustaining this fencing and other infrastructure—such as gates, roads, and bridges— over its lifetime. CBP plans to continue coordinating with the U.S. Army Corps of Engineers (USACE) for engineering support and for awarding and oversight of construction contracts. CBP anticipates that all contract awards issued by USACE in support of the RGV segment will be firm fixed price. If appropriations are received, the program plans to award construction contracts for the first portion of RGV in May 2018 and for the secondary barrier in San Diego in August 2018. In February 2018, CBP officials stated that staffing the program office is a challenge because funding has not yet been received. CBP officials said that existing work for the program is being handled by current CBP staff. CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. INTEGRATED FIXED TOWERS (IFT) CUSTOMS AND BORDER PROTECTION (CBP) The IFT program helps the Border Patrol detect, track, identify, and classify illegal entries in remote areas. IFT consists of fixed surveillance tower systems equipped with ground surveillance radar, daylight and infrared cameras, and communications systems linking the towers to command and control centers. CBP plans to deliver or upgrade approximately 53 IFT systems across six areas of responsibility (AoR) in Arizona: Nogales, Douglas, Sonoita, Ajo, Tucson, and Casa Grande. System acceptance test completed in Douglas AoR and requirements were met. Program is adequately staffed, but simultaneous deployments in the future may have a negative impact. GAO last reported on this program in November and April 2017 (GAO-18-119, GAO-17-346SP). In December 2017, CBP declared a schedule breach of the IFT program’s current acquisition program baseline (APB) because the program did not receive the funding needed to complete planned deployments on time to achieve its full operational capability (FOC) date of September 2020. The program’s FOC date previously slipped 5 years because of delays in the initial contract award process and funding shortfalls. CBP completed IFT deployments to the Douglas AoR in June 2017 and anticipates completing deployments to the Sonoita AoR in December 2017, as scheduled. However, in September 2017, CBP officials stated that they requested—but did not receive—additional funding from the Department of Homeland Security (DHS) to address new IFT requirements, including camera upgrades and replacement of existing tower systems deployed under a legacy program. In January 2015, Border Patrol requested the program prioritize replacement of the legacy systems in the Tucson and Ajo AoRs because the technology was obsolete and more expensive to maintain than the IFT technology planned for deployment in other AoRs. Without additional funding, CBP officials stated that they would be unable to exercise the contract options for the remaining AoRs on time. In June 2017, the program updated its life-cycle cost estimate (LCCE), which is slightly less than its current APB cost thresholds. This LCCE update includes estimated costs for the new requirements. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs. CBP identified $8 million in acquisition carryover funding for fiscal year 2018 and officials anticipate receiving $126 million in O&M funding to cover $100 million in O&M costs over the next 5 years. The program plans to submit a revised APB to DHS leadership by June 2018. However, the FOC date may be further delayed because of land access issues. CBP officials told GAO that they have not yet reached an agreement with the Tohono O’odham Nation—a sovereign Native American Nation—to access tribal lands, which these officials said is necessary for the construction of IFTs in the Ajo and Casa Grande AoRs. 10/15 Initial operational capability (Nogales) Customs and Border Protection (CBP) INTEGRATED FIXED TOWERS (IFT) When CBP initiated the IFT program, it decided to procure a non-developmental system, and it required that prospective contractors demonstrate their systems prior to CBP awarding the contract. The program awarded the contract to EFW, Inc. in February 2014, but the award was protested. GAO sustained the protest and CBP had to reevaluate the offerors’ proposals before it again decided to award the contract to EFW, Inc. As a result, EFW, Inc. could not initiate work at the deployment sites until fiscal year 2015. According to CBP officials, the number of IFT systems deployed to a single AoR is subject to change based on assessments by the Border Patrol. DHS leadership directed CBP to develop a comprehensive border plan in October 2016 that includes IFT capabilities and—when preparing for the last budget cycle—the program estimated costs for expansion to the southwest border beginning in fiscal year 2019. In September 2017, CBP officials told GAO that they did not have any current staffing gaps. However, CBP officials added that if the program receives full funding and reaches an agreement with the Tohono O’odham Nation to initiate IFT deployments to the Ajo and Casa Grande AoRs, while concurrently deploying capability to the Sonoita and Tucson sectors, they will be short on government and contracted staff. CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. MEDIUM LIFT HELICOPTER (UH-60) CUSTOMS AND BORDER PROTECTION (CBP) UH-60 is a medium-lift helicopter that CBP uses for law enforcement and border security operations, air and mobility support and transport, search and rescue, and other missions. CBP’s UH-60 fleet consists of 20 aircraft acquired from the U.S. Army in three different models. CBP previously acquired 4 modern UH-60M aircraft and converted 6 of its older 16 UH-60A aircraft into more capable UH-60L models. CBP is replacing the remaining 10 UH-60A with reconfigured Army HH-60L aircraft. CBP test agent and the Army completed testing of reconfigured HH-60L prototype. CBP has initiated efforts to acquire additional converted HH-60L aircraft from the Army. GAO last reported on this program in April 2017 (GAO-17-346SP). The program breached the cost and schedule goals in its acquisition program baseline (APB) and, as of December 2017, CBP officials stated they were in the process of developing the breach notification required under the Department of Homeland Security’s (DHS) acquisition policy. In its annual life-cycle cost estimate (LCCE) update, the program shifted some operations and maintenance (O&M) costs to acquisitions to be consistent with DHS’s new appropriation structure. For example, the program shifted costs for recurring upgrades from O&M to acquisition because these upgrades require development and production. As a result, the program’s updated acquisition cost estimate exceeded the APB acquisition cost threshold, which constitutes a cost breach under DHS’s acquisition policy. CBP officials stated that they did not initially declare a cost breach because the program’s total LCCE was within the APB threshold. The program also did not hold its acquisition decision event (ADE) 3 by the APB deadline of September 2017. The ADE 3 is intended to approve the transfer of CBP’s remaining UH-60A aircraft for reconfigured Army HH60-L aircraft based on an evaluation of a reconfigured prototype. According to CBP officials, the program did not complete the required acquisition documentation by the ADE 3 deadline, in part, because DHS leadership directed CBP to develop a comprehensive border plan in October 2016 that includes UH-60 capabilities. It is unclear when the ADE 3 will occur because, as of December 2017, several documents were pending validation by the Joint Requirements Council. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs. In addition, CBP officials previously told GAO that UH-60 O&M is funded through a separate, central funding account for all of CBP’s air and marine assets. CBP officials stated that the projected acquisition funding gap in fiscal years 2019 and 2020 is primarily for replacing obsolete parts that were previously considered O&M. According to these officials, the Army conducts an annual obsolescence study that will help CBP identify and prioritize replacements across the UH-60 fleet based on available funding levels. Customs and Border Protection (CBP) MEDIUM LIFT HELICOPTER (UH-60) CBP previously acquired UH-60 as a part of its Strategic Air and Marine Program (StAMP). In July 2016, DHS leadership designated UH-60 as a separate and distinct major acquisition program. CBP initially planned to convert all 16 of its UH-60A aircraft into UH-60L models, but changed its strategy once it learned the Army planned to divest several HH-60L aircraft that could more easily be converted into UH-60L aircraft for CBP missions. CBP officials anticipated the new strategy could reduce the program’s costs by an estimated $70 million, accelerate its schedule, and result in newer aircraft since the Army’s HH-60L airframes had fewer operating hours than CBP’s existing UH-60A aircraft. In September 2017, CBP officials told GAO they had initiated efforts to acquire additional HH-60L aircraft by conducting a study of current capability gaps and drafting a mission need statement. As of September 2017, program officials confirmed that they maintain a consolidated program office where the same staff from StAMP continue to support all remaining acquisitions, including the UH-60. However, these officials stated that they plan to realign staff to a dedicated asset over time. Program officials also stated that the program has hired a dedicated cost estimator and would like to hire additional staff to focus on procuring spare parts and common component issues, such as radio replacements, for CBP’s air and marine assets. CBP officials reiterated that the changes in acquisition costs were primarily a result of cost realignment and that the program’s total life-cycle cost is still within the initial APB LCCE goals. CBP officials also stated that—to supplement Army test data—the program’s OTA participated in the flight tests and will provide a formal report on the results. MULTI-ROLE ENFORCEMENT AIRCRAFT (MEA) CUSTOMS AND BORDER PROTECTION (CBP) MEA are fixed-wing, multi-engine aircraft that can be configured to perform multiple missions including maritime, air, and land interdiction, as well as signals detection to support law enforcement. The current MEA configuration is equipped with marine search radar and an electro-optical/infrared sensor to support maritime and land surveillance and airborne tracking missions. MEA will replace CBP’s fleet of aging C-12, PA-42, and BE-20 aircraft. Testing of new configuration planned for May 2018, but requirements not yet defined. Began retrofitting accepted MEA with new mission system in fiscal year 2017. GAO last reported on this program in April 2017 (GAO-17- 346SP). According to CBP officials, the program is on track to meet the cost and schedule goals in its current acquisition program baseline (APB) for 16 maritime interdiction MEA and is actively pursuing additional aircraft. In April 2016, CBP developed a report that identified capability needs in three mission areas and proposed increasing the program’s total to 38 aircraft by adding 13 air and 6 land interdiction MEA, and 3 signals detection MEA. The Joint Requirements Council endorsed CBP’s findings, but recommended CBP develop a number of requirements documents—including an operational requirements document—to fully validate the findings. As of September 2017, CBP officials told GAO they were in the process of updating these documents to focus on air interdiction capabilities—the next MEA configuration. These officials stated that completing these documents has been delayed, in part, because Department of Homeland Security (DHS) leadership directed CBP to develop a comprehensive border plan in October 2016 that includes MEA capabilities. Despite not yet completing all the updated documents, DHS leadership approved CBP’s request to procure MEA 17 in September 2017 after the congressional conferees agreed to an additional aircraft beyond DHS’s budget request. CBP anticipates delivery of MEA 17 by September 2018, which is within the program’s full operational capability (FOC) date. However, if the program receives approval to acquire additional aircraft, the FOC date will be extended. The program completed an annual life-cycle cost estimate update, which exceeds the program’s current APB cost thresholds, because it reflects costs for all 38 aircraft, among other reasons. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs. In addition, CBP officials previously told GAO that MEA’s O&M is funded through a separate, central funding account for all of CBP’s air and marine assets. In September 2017, CBP officials said that the program was fully funded for 17 aircraft but had some affordability challenges with spare parts, which they are working with CBP and DHS headquarters to address. Customs and Border Protection (CBP) MULTI-ROLE ENFORCEMENT AIRCRAFT (MEA) CBP is replacing the mission system processor on the MEA with a system used by the U.S. Navy and U.S. Coast Guard that is intended to enhance operator interface and sensor management, as well as replace obsolete equipment. CBP’s OTA tested a prototype of the processor during an operational assessment in July 2015. The OTA found that the MEA had resolved issues found during prior testing, but also made 29 additional recommendations and findings to improve the aircraft and new mission system’s effectiveness. DHS’s Director, Office of Test and Evaluation (DOT&E) concurred with the OTA’s findings. CBP previously acquired MEA as a part of its Strategic Air and Marine Program (StAMP). In July 2016, DHS leadership designated MEA as a separate and distinct major acquisition program. CBP initially planned to procure 50 MEA and awarded the first production contract in September 2009. However, the aircraft did not perform well during testing. In October 2014, DHS leadership said CBP could not procure or accept transfer of additional MEA without approval. CBP procured 12 aircraft under the initial contract and—with DHS approval—CBP awarded a new indefinite delivery, indefinite quantity contract in September 2016 for 1 base year and four 1-year options to support procurement of additional aircraft. In December 2017, CBP officials said the program had received 12 aircraft and awarded contracts for 5 more. According to program officials, MEA 13-16 will be delivered with the new mission system and CBP began retrofitting previously delivered aircraft in fiscal year 2017. As of September 2017, program officials confirmed that they maintain a consolidated program office where the same staff from StAMP continue to support all remaining acquisitions, including MEA. However, these officials stated that they plan to re-align staff to a dedicated asset over time. Program officials also stated that the program has hired a dedicated cost estimator and would like to hire additional staff to focus on procuring spare parts and common component issues, such as radio replacements, for CBP’s air and marine assets. CBP officials stated that delays in receiving approval of the program’s requirements documents may pose a risk to exercising options for additional MEA on an existing contract, which could stop production and increase contract costs associated with procuring future aircraft. CBP officials added that air and marine requirements officers continue to produce documentation requested by the Joint Requirements Council to provide sufficient context for the mission need and border security. CBP officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. CUSTOMS AND BORDER PROTECTION (CBP) The NII Systems Program supports CBP’s interdiction of weapons of mass destruction, contraband such as narcotics, and illegal aliens being smuggled into the United States, while facilitating the flow of legitimate commerce. CBP officers use large- and small-scale NII systems at air, sea, and land ports of entry; border checkpoints; and international mail facilities to examine the contents of containers, railcars, vehicles, baggage, and mail. CBP initiated efforts for future NII requirements and procurements. 66 percent staffing gap contributed to delays in NII deployments. GAO last reported on this program in April 2017 (GAO-17-346SP). The NII Systems Program is on track to meet its approved schedule and cost goals. The estimates in the program’s annual life-cycle cost estimate (LCCE) update continued to decrease overall compared to its approved acquisition program baseline (APB) cost thresholds. Specifically, compared to the prior year’s estimate, the program’s acquisition costs decreased by $96 million and operations and maintenance (O&M) costs increased by $22 million. However, the LCCE update only estimated costs through fiscal year 2026—9 years short of the program’s final year. The LCCE primarily decreased because of a reduction of 1,977 planned additional and replacement NII systems. CBP officials said fewer large- and small-scale systems are needed because some systems have longer estimated lives than expected, and systems procured have better capability. CBP officials do not anticipate that the reduction in quantities will have an adverse effect on operations because they stated that the new systems can provide dual purpose capabilities (i.e., one system can replace multiple separate systems). The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs. CBP officials anticipate receiving approximately $605 million of O&M funding over this 5-year period to cover about $626 million in estimated O&M costs, which includes $100 million to operate and maintain radiation detection equipment acquired by the Domestic Nuclear Detection Office. These officials also identified $37 million in carryover funding to cover the remaining $21 million of O&M estimated costs. However, the program is projected to have a $266 million acquisition funding gap from fiscal years 2018 to 2022.The program has a plan to address funding shortfalls but, according to CBP officials, it has not yet needed to implement the strategies in this plan because of several factors, including cost reductions achieved through combined life-cycle contracts and lower-than-expected actual technology costs in fiscal year 2016. Customs and Border Protection (CBP) trucks as they are driven through the inspection portals—low dose X-ray to inspect the truck cab and high dose X-ray to inspect the cargo trailer. In March 2017, the Joint Requirements Council validated a capability analysis report that assessed current capability gaps in NII operations to assist with identifying potential upgrades to existing systems and developing requirements for future systems. According to program officials, CBP plans to review and update, as necessary, the mission need statement in fiscal year 2018. Additionally, program officials are preparing a consolidated acquisition plan for future procurements. These officials said CBP has not yet determined whether future procurements would be included into the current NII Systems Program of record or constitute a new acquisition program. CBP’s ability to successfully execute the existing NII Systems Program and plan for future efforts may be at risk because of understaffing. As of January 2018, the NII Systems Program continued to face a staffing gap of approximately 66 percent, including critical vacancies such as the acquisition program manager and a logistics program manager. Officials also noted that a lack of adequate personnel to procure, test, and deploy NII systems forces the program to prioritize its acquisitions, which can result in delays of NII deployments and testing efforts. For example, one manufacturer increased its output rate of NII systems, but the program did not have the staff to accept the systems at the increased rate. Officials anticipate the program may remain understaffed until CBP completes a reorganization that started more than a year ago, in which acquisition programs are realigned from a mission-support office to their operational entity. CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. REMOTE VIDEO SURVEILLANCE SYSTEM (RVSS) CUSTOMS AND BORDER PROTECTION (CBP) The RVSS program helps the Border Patrol detect, track, identify and classify illegal entries across U.S borders. RVSS consists of daylight and infrared video cameras mounted on fixed towers and buildings with communications systems that link to command and control centers. From 1995 to 2005, CBP deployed approximately 310 RVSS towers along the U.S. northern and southern borders, and initiated efforts to upgrade legacy RVSS towers in Arizona in 2011. Program does not plan to conduct additional operational testing on future deployments. Once funded, program plans to award a new contract for deployments in sectors along the southwest border. GAO last reported on this program in November 2017 (GAO-18-119). In April 2016, Department of Homeland Security (DHS) leadership elevated RVSS from a level 3 program—which focused on upgrading legacy RVSS in Arizona—to a level 1 program after approving CBP’s plan to expand deployments to the Rio Grande Valley (RGV) sector and adding an additional 6 sectors along the southwest border. At this time, DHS leadership approved the program to move forward with deployments to two RGV stations, which can be completed as options under the program’s existing contract. However, the program was required to re-baseline to account for its expanded scope and conduct an acquisition decision event (ADE) to obtain approval for additional deployments. As of January 2018, the program had not yet conducted its ADE or obtained DHS approval for an acquisition program baseline (APB) that established cost, schedule, and performance goals for the expanded program. In September 2017, CBP officials told us that they had drafted the APB and other required documentation, such as a life-cycle cost estimate (LCCE), but were unsure when the ADE would occur because the program had not received funding for the additional deployments. In addition, the ADE may have been delayed because DHS leadership directed CBP to develop a comprehensive border plan in October 2016 that includes RVSS capabilities. In September 2017, DHS leadership approved the RVSS’s revised LCCE which totaled nearly $4 billion for all program costs from fiscal years 2011 through 2042, including expansion along the southwest border and new initiatives such as a pilot for relocatable RVSS towers. DHS conducted an independent cost estimate for the program, which DHS cost estimating officials stated was within 2 percent of the program’s LCCE. RVSS was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because it had not yet been elevated to a level 1 program at the time the plan was developed. CBP officials stated that the program has received acquisition funding to cover the approved RGV deployments. However, CBP officials told GAO that the program may also assume responsibility for maintaining all legacy RVSS, but has not received adequate operations and maintenance funding to do so. Customs and Border Protection (CBP) REMOTE VIDEO SURVEILLANCE SYSTEM (RVSS) In July 2013, CBP awarded a firm fixed-price contract for a commercially available, non-developmental system. This contract covered the program’s initial scope to deploy upgraded RVSS in Arizona and two stations within the RGV sector, which can be completed as options. According to CBP officials, the program will need to award a new contract to cover expansion to the remaining six sectors along the southwest border. In September 2017, CBP officials said that the request for proposals for the new contract had been drafted but it cannot be released until the program receives funding. CBP officials told GAO that RVSS is coordinating with CBP’s Border Wall System Program on some planned deployments within the RGV sector. For example, CBP is considering moving 2 of the planned RVSS towers to be co-located with the planned barrier, which officials stated may provide better surveillance. If the Border Wall System Program does not receive funding, CBP officials said the towers will be placed in the originally planned locations. CBP officials stated that the RVSS program requires additional staff for contracting activities, maintenance activities for legacy RVSS, and for relocatable tower pilot deployments. To mitigate the staffing gap, CBP officials said they prioritize responsibilities of current personnel to meet program execution needs. CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. CUSTOMS AND BORDER PROTECTION (CBP) The TACCOM program is intended to upgrade land mobile radio infrastructure and equipment to support approximately 95,000 users at CBP and other federal agencies. It is replacing obsolete radio systems with modern digital systems across various sectors located in 19 different service areas, linking these service areas to one another through a nationwide network, and building new communications towers to expand coverage in 5 of the 19 service areas. Issues related to security requirements have delayed full operational capability by more than a year. Program is being re-organized under Border Patrol, but still faces staffing challenges. GAO last reported on this program in April 2017 (GAO-17-346SP). In November 2017, Department of Homeland Security (DHS) leadership re-baselined the TACCOM program, removing it from breach status after the program experienced a schedule slip and cost growth. In July 2017, CBP officials notified DHS leadership that the program would not achieve full operational capability (FOC) as planned due to issues related to federal information security requirements. The program now plans to achieve FOC by March 2019—more than a year later than its initial acquisition program baseline (APB) deadline. According to CBP officials, FOC will include planned upgrades to the San Diego system, which requires transitioning management of the legacy system from the Department of Justice to DHS. In August 2017, CBP officials stated that both agencies were reviewing an agreement with plans to complete the transition in fiscal year 2018. CBP officials stated that the program realized it would exceed its initial APB cost thresholds as it was developing its annual life-cycle cost estimate (LCCE) update and subsequently submitted a revised LCCE for DHS leadership approval. The program’s costs primarily grew because of increases in costs for contractor labor and support for facilities and infrastructure. CBP officials said the program’s initial estimates were immature; however, DHS leadership approved the initial LCCE in December 2015—4 years after the program began sustaining capabilities. DHS’s Chief Financial Officer (CFO) approved the program’s revised LCCE in November 2017, but noted that the program’s estimate exceeded its available funding and requested that the program address the affordability gap before it was re-baselined. CBP officials said that they are conducting an affordability analysis, which they anticipate will be completed by March 2018. Nevertheless, DHS leadership approved the program’s re-baseline in November 2017. CBP officials subsequently identified errors in the approved APB cost threshold tables and provided revised amounts, which are presented here. The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs. CBP officials anticipate receiving approximately $120 million in O&M funding over this 5-year period. Customs and Border Protection (CBP) CBP officials told GAO that in January 2018, the program will move from a mission support office to a joint program office under Border Patrol as a part of CBP’s reorganization that started more than a year ago. The goal of this move is to make CBP land mobile radio capabilities seamless by combining the mission critical voice functions of Air and Marine Operations, the Border Patrol, and the Office of Field Operations—the TACCOM program’s primary customers—under one organizational leader, the Border Patrol Chief. CBP officials anticipate that the current TACCOM program structure will remain in place after this move with the exception of the program’s engineers, which will move to CBP’s Office of Information and Technology but be assigned to support TACCOM full time. In August 2017, CBP officials told GAO they were in the process of hiring staff to fill the program’s vacant positions. They added that the fiscal year 2019 budget contains plans for additional infrastructure enhancements, which will require technical staff to assist in the planning and execution of these efforts and may put additional strain on the program’s limited government technical staff. They noted that the hiring and retention of qualified land mobile radio engineers and information technology technical staff is a challenge because of competition with the private sector, among other factors. In addition to maintenance of the CBP Land Mobile Radio System that provides critical communication needs for CBP agents and officers protecting U.S. borders, CBP officials stated the TACCOM program is providing infrastructure, such as building an engineering lab to facilitate design, development, test, and evaluation activities, to support improvements in CBP’s current and future Land Mobile Radio Systems. CBP officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. CUSTOMS AND BORDER PROTECTION (CBP) TECS (not an acronym) is a law-enforcement information system that has been in place since the 1980s and helps CBP officials determine the admissibility of persons entering the United States at border crossings, ports of entry, and prescreening sites located abroad. CBP initiated efforts to modernize TECS to provide users with enhanced capabilities for accessing and managing data. Immigration and Customs Enforcement has a separate TECS Modernization program. System operationally effective and suitable, but cybersecurity testing needed. CBP working to address and prevent major system outages. GAO last reported on this program in April 2017 (GAO-17-346SP). In July 2017, Department of Homeland Security (DHS) leadership granted the program acquisition decision event (ADE) 3 approval, but required CBP to conduct follow-on operational test and evaluation (OT&E) before declaring full operational capability (FOC). This is more than a 2-year delay from CBP’s initial FOC date and a 9-month delay from its most recent revised FOC date. DHS approved the fourth version of the program’s acquisition program baseline (APB) in July 2016. In this APB, CBP split FOC into two separate operational capability milestones at its data centers to better reflect the program’s activities. CBP delivered operational capability at the primary data center in Decemberas scheduled—which provides redundant TECS access to minimize downtime during system maintenance or unscheduled outages. However, not all test results were available in time for the program’s ADE 3 decision, which contributed to DHS leadership’s decision to delay declaring FOC. 2016, which included transitioning all TECS users to the modernized system. CBP delivered operational capability at the secondary data center in June 2017—The program updated its life-cycle cost estimate (LCCE) for ADE 3, which is within its current APB cost thresholds. However, the LCCE only included costs through fiscal year 2021—7 years short of DHS’s guidance that states program cost estimates should cover at least 10 years from the FOC date. Nevertheless, DHS granted the program ADE 3 approval without an understanding of the program’s full life-cycle costs, as required by its acquisition policy. CBP officials plan to update the LCCE by the end of calendar year 2018 to include costs for future years and other items, such as costs associated with follow-on OT&E and moving the data centers to a cloud environment—a CBP-wide initiative. The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs. CBP officials anticipate receiving approximately $205 million in O&M funding over the next 4 years and have identified carryover for each year. However, CBP officials said there may be a small funding gap starting in fiscal year 2020, but they expect to achieve savings by migrating the data centers to a cloud environment. Customs and Border Protection (CBP) Since the program has completed development, CBP is focused on ensuring that the modernized TECS system works as intended by addressing operational issues as they are identified. For example, on January 2, 2017, a primary TECS Modernization application experienced a major outage that resulted in long airport delays. In August 2017, CBP officials said they continually monitor system health through a 24/7 operations center and have established a group dedicated to addressing the issues related to the January 2, 2017, outage. In September 2017, DHS’s Office of Inspector General (OIG) found that nearly 100 outages, periods of latency, or degraded service were reported for three TECS Modernization applications between June 2016 and March 2017. The OIG also found that CBP’s monthly reports on TECS system availability did not include periods of slowness or service interruptions that were caused by external factors. For example, the January 2, 2017, incident was identified in CBP outage reports, but was not captured in the monthly report because it was caused by a change to an external feed to the TECS system. CBP officials clarified that the monthly reports only account for interruptions that result in a full loss of operations for all TECS system users. The OIG recommended that CBP develop a plan to address factors that contributed to challenges regarding availability of primary traveler screening applications, among other things. CBP concurred with the recommendations. On January 1, 2018, the TECS system experienced another major outage that caused long airport delays; CBP officials said this incident is under review. CBP officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. LOGISTICS SUPPLY CHAIN MANAGEMENT SYSTEM (LSCMS) FEDERAL EMERGENCY MANAGEMENT AGENCY (FEMA) LSCMS is a computer-based tracking system that FEMA officials use to track shipments during disaster-response efforts. It is largely based on commercial-off-the- shelf software. FEMA initially deployed LSCMS in 2005, and initiated efforts to enhance the system in 2009. According to FEMA officials, LSCMS can identify when a shipment leaves a warehouse and the location of a shipment after it reaches a FEMA staging area near a disaster location. FEMA now anticipates reaching full operational capability by June 2019, up to 6 months late. Recent testing shows progress, but additional operational testing delayed to May 2018. GAO last reported on this program in April 2017 (GAO-17-346SP). In November 2017, Department of Homeland Security (DHS) leadership approved a revised acquisition program baseline (APB) after the LSCMS program experienced a schedule breach. In September 2017, FEMA officials notified DHS leadership that it would not complete all required activities—including follow-on operational test and evaluation (OT&E)—to achieve acquisition decision event (ADE) 3 and full operational capability (FOC) by its initial APB dates of September 2018 and December 2018, respectively. According to FEMA officials, the delay was primarily caused by the need to deploy LSCMS program personnel in support of response and recovery efforts during the 2017 hurricane season. The program now plans to achieve FOC by June 2019—up to 6 months later than initially planned. DHS leadership authorized LSCMS to resume all development and acquisition efforts in March 2016 after a nearly 2-year program pause following program management issues. In October 2017, FEMA officials told GAO that they had completed several development efforts—such as integration with DHS’s asset management system—and were in the process of adding Electronic Data Interchange (EDI) to allow LSCMS to interface with its partners’ information systems. The program’s annual life-cycle cost estimate (LCCE) update continued to be within its APB cost thresholds. However, the program’s APB thresholds are not adjusted to account for risk, which increases the chance that the program could experience a cost breach. As of November 2017, FEMA officials did not anticipate that its schedule delays would lead to a cost breach. Federal Emergency Management Agency (FEMA) LOGISTICS SUPPLY CHAIN MANAGEMENT SYSTEM (LSCMS) The LSCMS program previously experienced significant execution challenges because of poor governance. FEMA initially deployed the enhanced LSCMS in 2013 without DHS leadership approval, a DOT&E letter of assessment, or a DHS-approved APB documenting the program’s costs, schedule, and performance parameters, as required by DHS’s acquisition policy. DHS’s Office of Inspector General also found that neither DHS nor FEMA leadership ensured the program office identified all mission needs before selecting a solution. In response, DHS leadership paused all LSCMS development efforts in April 2014 until the program addressed these issues, among others. FEMA subsequently completed an analysis of alternatives and developed an APB based on this assessment. DHS leadership approved the APB in December 2015 and authorized FEMA to resume all LSCMS development and acquisition efforts in March 2016. In October 2017, FEMA officials told GAO that the LSCMS program had minimal staffing shortages and was working to recruit additional staff. Officials previously attributed the program’s governance and testing challenges, in part, to staffing shortages and we previously found that it only had 7 of the 22.5 full time equivalents it needed in fiscal year 2014. Although the program has obtained more staff since then, FEMA officials noted in October 2017 that during disasters—such as 2017 hurricanes Harvey, Irma, and Maria—LSCMS program personnel are deployed to support response and recovery efforts, which leave program positions vacant for the duration of the deployment. FEMA officials stated that during the response to hurricanes Harvey, Irma and Maria in 2017, LSCMS processed supply chain transactions that exceeded the total number of transactions from the preceding 12 years—which includes the response to Hurricane Katrina. They added that the program provided support for nearly 130 million meals in 2017 compared to a total of approximately 84 million from the 12 previous years. FEMA officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. IMMIGRATION AND CUSTOMS ENFORCEMENT (ICE) Since the 1980s, TECS (not an acronym) has provided case management, intelligence reporting, and information sharing capabilities to support ICE’s mission to investigate and enforce border control, customs, and immigration laws. ICE initiated efforts to modernize TECS in 2009 to replace aging functionality and provide end users with additional functionality to meet mission needs. Customs and Border Protection (CBP) executes a separate TECS Modernization program. Conducted additional testing of a revised key performance parameter and cybersecurity. Program has improved integration with external systems. GAO last reported on this program in April 2017 (GAO-17-346SP). In November 2017, Department of Homeland Security (DHS) leadership approved a revised life-cycle cost estimate (LCCE) and acquisition program baseline (APB) in preparation for the program’s acquisition decision event (ADE) 3 following deployment of final functionality. According to ICE officials, the program completed deployment of full operational capability (FOC) functionality in August 2017—4 months earlier than initially planned. FOC functionality included enhancements to case management capabilities, such as improved system search capabilities. The functionality was deployed in conjunction with enhancements and fixes for initial operational capability (IOC) functionality. The program achieved IOC in June 2016, which entailed delivering 80 percent of the modernized TECS functionality and successfully transitioning ICE off the legacy system. The overall cost thresholds in the current APB increased compared to the program’s prior APB from July 2016. Specifically, the acquisition cost threshold decreased by $14 million and the operations and maintenance (O&M) cost threshold increased by $147 million. These costs changed for various reasons, such as the following: The acquisition cost threshold decreased when ICE included actual costs through fiscal year 2016 and accounted for funding shortfalls. ICE officials told GAO that the program experienced a funding shortfall in fiscal year 2017 that led it to adjust spending under multiple contracts and shift some costs to fiscal year 2018. The O&M cost threshold increased when ICE extended the estimate from fiscal years 2024 to 2028 and continued contractor and systems engineering support for an additional 11 years. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs. ICE officials anticipate receiving approximately $94 million in O&M funding to cover an estimated $105 million in O&M costs over this 5-year period. ICE officials said that they are pursuing strategies to reduce future O&M costs, such as awarding a competitive contract in March 2018 for O&M activities and any future enhancements. ICE officials continue to work closely with CBP to provide users access to various systems through the modernized TECS system. The program previously worked to resolve technical problems with CBP support services that emerged during final integration testing of the ICE and CBP modernized TECS systems, which contributed to a 3-month delay in achieving IOC. Users reported during initial OT&E that the modernized ICE TECS system was an improvement over the legacy system but they requested better integration with external systems, such as CBP’s Seized Assets and Case Tracking System (SEACATS), which they use to determine the disposition of seized assets for case management and reporting purposes. According to ICE officials, CBP subsequently decided to modernize SEACATS. ICE officials stated that they have coordinated closely with CBP to integrate the two modernized systems and ensure un-interrupted access to SEACATS for TECS users. For example, ICE developed a workaround so that TECS users maintain access to the latest seizure data available from the modernized SEACATS. ICE officials added that they continue to make improvements in interfaces with other external systems as prioritized by end users. In July 2017, ICE reported that the program was fully staffed. ICE officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. CONTINUOUS DIAGNOSTICS AND MITIGATION (CDM) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) The CDM program aims to strengthen the cybersecurity of the federal government’s networks at more than 65 participating civilian agencies by providing tools and dashboards that continually monitor and report on network vulnerabilities. Tools are delivered in four phases: phase 1 and 2 tools report vulnerabilities in hardware and software, and user access controls, respectively; phase 3 tools will report on efforts to prevent attacks; and phase 4 tools will provide encryption to protect network data. Program revised its key performance parameters and test and evaluation master plan as a part of its rebaseline. Program plans to change its acquisition strategy and continues to face workforce challenges. GAO last reported on this program in April 2017 (GAO-17-346SP). In June 2017, Department of Homeland Security (DHS) leadership re-baselined the CDM program for the third time to approve initiating development of phase 3 and to address challenges encountered during phase 1. Specifically, contractors previously found large gaps—ranging from 19 to 384 percent—in the actual number of devices needing phase 1 tools than what was originally reported by 12 agencies. The operations and maintenance (O&M) cost thresholds increased by $631 million when the program shifted some potential acquisition costs to beThe program’s new acquisition program baseline (APB) modified the program’s cost, schedule, and performance parameters. For example: consistent with DHS’s new appropriation structure, among other things. The O&M cost thresholds previously decreased by $1.2 billion, in part, because DHS leadership determined the program would only fund CDM tools for the first 2 years after deployment. The acquisition costs did not increase despite phase 1 challenges, in part, because coverage for the U.S. Postal Service— The program’s full operational capability (FOC) date slipped almost 4 years after which had the largest gap in estimated devices—will no longer be funded by the CDM program. it was redefined from deployment of phase 1-3 tools at 5 agencies to the availability of these tools to all participating agencies. However, the program’s costs will increase and its FOC date may slip further once the program establishes goals for phase 4. NPPD officials said they were unable to complete planning efforts for phase 4 in time to incorporate it into the most recent APB revision and, therefore, plan to re-baseline the CDM program again in 2018. The CDM program identified a potential acquisition affordability gap in fiscal year 2018 based on its revised life-cycle cost estimate, which it addressed by adjusting the phase 3 schedule to shift some acquisition costs out to fiscal year 2020. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs. However, the program anticipates receiving approximately $281 million in O&M funding over the 5-year period. 12/16 Phase 1 initial operational capability (IOC) National Protection and Programs Directorate (NPPD) CONTINUOUS DIAGNOSTICS AND MITIGATION (CDM) The CDM program updated its acquisition plan as a part of its re-baselining efforts, which reflects a change in strategy for procuring CDM tools and integration services for participating agencies through the General Services Administration (GSA). Previously, the CDM program issued task orders for these tools and services through blanket purchase agreements established under vendors’ GSA Federal Supply Schedule contracts. These agreements are set to expire in August 2018. Going forward, the program plans to use an existing GSA government-wide acquisition contract—known as Alliant—to obtain CDM tools and services. According to NPPD officials, the new acquisition strategy is intended to provide greater flexibility in contracting for current capabilities and to support future capabilities. It will also allow participating agencies to order additional CDM-approved products or services from GSA’s schedule for information technology equipment, software, and services; however, as of September 2017, NPPD officials stated they were in the process of determining how this process will work. NPPD officials said that the program continues to face workforce challenges related to managing the program’s change in contracts and planning for phase 4. In February 2018, NPPD officials stated that they had on-boarded 5 staff to help address the program’s reported fiscal year 2017 gap of 16 full time equivalents. They noted that another 5 candidates were in the hiring process and that NPPD continues to work with officials from DHS’s Office of the Chief Security Officer to reduce continued challenges in onboarding new staff due to the lengthy security clearance process. In addition to activities outlined in this assessment, NPPD officials stated that the CDM program continues to manage its budget to ensure program costs match available funding, and is leveraging the collective buying power of federal agencies and strategic sourcing to achieve government cost savings on CDM products. NPPD officials also stated that, as of December 2017, CDM has deployed agency dashboards to 23 agencies and was conducting and testing information exchanges of data between agency dashboards and the federal dashboard. HOMELAND ADVANCED RECOGNITION TECHNOLOGY (HART) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) HART will replace and modernize the Department of Homeland Security’s (DHS) legacy biometric identification system—known as IDENT—which shares information on foreign nationals with U.S. government and foreign partners to facilitate legitimate travel, trade, and immigration. NPPD plans to develop HART in four increments: increments 1 and 2 will replace and enhance IDENT functionality; increments 3 and 4 will provide additional biometric services, as well as a web portal and new tools for analysis and reporting. Key performance parameters will be demonstrated as capability is developed. Program has developed mitigation plans to address workforce risks. GAO last reported on this program in April 2017 (GAO-17-346SP). In June 2017, NPPD declared a schedule breach when it determined the HART program would not be able to meet its initial acquisition program baseline (APB) milestones. DHS leadership approved the program’s APB in April 2016 and authorized the program to initiate development efforts for increments 1 and 2 in October 2016. NPPD officials attribute the schedule slip to multiple delays in awarding the contract for increments 1 and 2 as a result of issues with the request for proposals (RFP). The program released the RFP in February 2017 and awarded the contract in September 2017—approximately 9 months later than NPPD officials had planned. However, the program experienced additional delays after a bid protest to the contract award was filed with GAO in October 2017. GAO subsequently denied the protest and NPPD officials said the program plans to initiate work with the contractor in March 2018. HART initially planned to achieve initial operational capability (IOC) with the deployment of increment 1 in December 2018, at which point program officials anticipated beginning to transition users from IDENT to HART. However, it is unclear when this will now occur, which is a significant challenge because IDENT is at risk of failure and may be unable to fully support requirements related to new programs— such as Customs and Border Protection’s Biometric Entry-Exit. As a result, delays in HART could contribute to delays in other DHS acquisition programs. The program updated its life-cycle cost estimate (LCCE) in June 2017 to inform the budget process. This LCCE is within its current APB cost thresholds, but does not account for the contractor’s solution. The program plans to update its LCCE and other acquisition documentation, such as its APB, after initiating work with the contractor. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs. However, the program anticipates receiving approximately $1.3 billion in O&M funding to cover $1.5 billion in O&M costs. NPPD officials explained that the current O&M cost estimate includes costs for maintaining IDENT. Future LCCE updates will reflect delivery of services through HART, which NPPD officials anticipate will be more cost effective. National Protection and Programs Directorate (NPPD) HOMELAND ADVANCED RECOGNITION TECHNOLOGY (HART) NPPD officials told GAO they are currently planning for increments 3 and 4 and plan to refine the cost, schedule, and performance goals for these increments in its next APB. NPPD plans to pursue a separate contract for the development and delivery of increments 3 and 4. However, the program will require DHS leadership approval prior to initiating these development efforts. In September 2017, NPPD officials told GAO they had hired two staff and planned to hire additional staff to address the program’s staffing gap of 5.5 full time equivalents. In response to DHS leadership’s direction, the program coordinated with DHS’s Chief Technology Officer to assess the skills and functions of staff necessary to execute the program and to develop the HART staffing plan. In its June 2017 staffing plan, the program identified workforce risks, including the potential for experiencing insufficient technical skillsets and inadequate resources to simultaneously execute development of HART and operate IDENT. To mitigate these risks, the program plans to develop a training plan to address the gap in skills, leverage support within the program by cross- training staff, and issue contracts for additional support as needed, among other things. However, if the program does not have adequate staff to complete these efforts, it may experience further schedule delays. NPPD officials stated that the program’s schedule delays pose a challenge because IDENT remains at risk of failure despite incremental improvements to extend its service life and may be unable to fully support new customer requirements or requirements related to new programs. They added that the program has a risk management process, which it is using to manage a variety of identified risks—including several related to workforce. They noted that these risks have not yet materialized. NPPD officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. NATIONAL CYBERSECURITY PROTECTION SYSTEM (NCPS) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) NCPS is intended to defend the federal civilian government from cyber threats. NCPS develops and delivers capabilities through a series of “blocks.” Blocks 1.0, 2.0, and 2.1 are fully deployed and provide intrusion-detection and analytic capabilities across the government. The NCPS program is currently deploying EINSTEIN 3 Accelerated (EA) to provide intrusion-prevention capabilities and plans to deliver block 2.2 to improve information sharing across agencies. A at 95 percent of agencies and departments. GAO last reported on this program in April 2017 (GAO-17-346SP). NPPD officials said the program is on track to meet the schedule and cost goals in its current acquisition program baseline (APB), which reflected changes resulting from the adoption of some of the Department of Homeland Security’s (DHS) Homeland Security Information Network (HSIN) capabilities for block 2.2 rather than developing custom solutions. However, challenges in completing test plans delayed testing: Initial operational test and evaluation (OT&E) for EA transition to sustainment— slipped from September 2016 to May 2017. The initial test event for block 2.2—intended to inform the ADE 2C for deploying additional block 2.2 capabilities—slipped from March 2017 to September 2017. As of August 2017, NPPD officials said NCPS had adopted all planned HSIN capabilities but one because of security concerns, which HSIN is addressing by piloting a new tool. The program updated its life-cycle cost estimate (LCCE) in June 2017 to inform the budget process, which is within its current APB cost thresholds. However, the program plans to update the LCCE again to support the EA, and costs through fiscal year 2022. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan no longer contained O&M funding for individual programs. NPPD officials anticipate receiving $1.8 billion in O&M funding over this 5-year period. The program is also projected to have an $83 million surplus in acquisition funding over this 5-year period, which NPPD officials anticipate will be less once the LCCE revision is complete. National Protection and Programs Directorate (NPPD) NATIONAL CYBERSECURITY PROTECTION SYSTEM (NCPS) A intrusion-prevention capabilities have been primarily provided through sole source contracts with internet service providers (ISP) and a contract to provide basic intrusion-prevention services. In December 2015, Congress required DHS to make available for use by federal agencies, certain capabilities, such as those provided by NCPS’s EA at approximately 93 percent of civilian federal agencies and departments and, in January 2018, NPPD officials said NCPS was up to 95 percent. According to NPPD officials, the program first focused on integrating EA for individual agencies and departments, but stated that they continue to work with all agencies and departments to provide EA services and approximately 95 percent of the federal civilian .gov user population is protected by at least one EA and an OA of NCPS block 2.2 information sharing capabilities in 2017. NPPD officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. NEXT GENERATION NETWORKS PRIORITY SERVICES (NGN-PS) NATIONAL PROTECTION AND PROGRAMS DIRECTORATE (NPPD) NGN-PS is intended to address an emerging capability gap in the government’s emergency telecommunications service, which prioritizes select officials’ phone calls when networks are overwhelmed. NPPD executes NGN-PS through commercial telecommunications service providers, which addresses the government’s requirements as they modernize their own networks. NPPD is executing NGN-PS in two phases—(1) voice and (2) data and video. Initial operational capability for voice phase wireless capabilities achieved in August 2017. Acquisition of data and video phase capabilities to begin in September 2021. GAO last reported on this program in April 2017 (GAO-17-346SP). In November 2017, the Department of Homeland Security’s (DHS) Chief Financial Officer approved a revised life-cycle cost estimate (LCCE) for NGN-PS, which includes costs for the entire program’s voice phase and eliminates operations and maintenance (O&M) costs. The program removed O&M costs because capabilities acquired through NGN-PS are transferred to and funded through NPPD’s Priority Telecommunications Service (PTS) once they become operational. NGN-PS is currently focused on delivering its voice phase, which is divided into three increments: Increment 1 maintains current priority service on long distance calls as commercial service providers update their networks; Increment 2 delivers wireless capabilities; and Increment 3 is intended to address landline capabilities. The program’s previous LCCE and current acquisition program baseline (APB) only include costs associated with increments 1 and 2. NPPD officials told GAO they plan to update the program’s APB in January 2018 to include costs, schedule, and performance goals for increment 3 and expect to receive DHS leadership approval to initiate development by August 2018. NGN-PS remains on track to meet its cost and schedule goals for the first two increments of the voice phase. The program’s full operational capability (FOC) for increment 1 previously slipped from June 2017 to March 2019, which NPPD officials attributed to funding shortfalls. NGN-PS achieved initial operational capability (IOC) for increment 2 wireless capabilities in August 2017 when priority service via cellular towers was demonstrated by the program’s largest service provider. The program projects an acquisition affordability gap of $92 million from fiscal years 2018 to 2022. However, DHS’s current funding plan does not include funding for increment 3, which accounts for the funding shortfall in fiscal years 2021 and 2022. NPPD officials said they anticipate receiving an additional $79 million in acquisition funding over this 2-year period, but will continue to prioritize capabilities if additional funding is not provided. These officials also said the program has achieved cost savings on increments 1 and 2 that will mitigate some of the projected shortfall in fiscal years 2018 and 2019. National Protection and Programs Directorate (NPPD) NEXT GENERATION NETWORKS PRIORITY SERVICES (NGN-PS) NGN-PS was established in response to an Executive Order requiring the federal government to have the ability to communicate at all times during all circumstances to ensure national security and manage emergencies. A Presidential Policy Directive issued in July 2016 superseded previous directives requiring continuous communication services for select government officials. According to NPPD officials, the new directive validates the program’s requirements for the voice phase and was used to develop requirements for the video and data phase. The program expects to begin the acquisition of the phase 2 for video and data in September 2021. In July 2017, NPPD reported that the program needed a systems engineer and was mitigating the vacancy with contracted support staff. The program also identified a need for an additional systems engineer and program support staff starting in fiscal year 2019 to support the start of increment 3. In August 2017, NPPD officials told GAO they continue to face challenges hiring and retaining engineers with adequate experience because of competition with the private sector. The program has historically mitigated staffing gaps by leveraging support from contracted and PTS program staff, as needed. In addition to activities identified in this assessment, NPPD officials stated that the program has received Joint Requirements Council validation of the phase 2 concept of operations and DHS leadership approval of the phase 2 operational requirements document. As of January 2018, the updated APB was in the approval process. NPPD officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. NATIONAL BIO AND AGRO-DEFENSE FACILITY (NBAF) SCIENCE AND TECHNOLOGY DIRECTORATE (S&T) The NBAF program is constructing a state-of-the-art laboratory in Manhattan, Kansas to replace the Plum Island Animal Disease Center. The facility will enable the Department of Homeland Security (DHS) and the Department of Agriculture (USDA) to conduct research, develop vaccines, and provide enhanced diagnostic capabilities to protect against foreign animal, emerging, and zoonotic diseases that threaten the nation’s food supply, agricultural economy, and public health. Commissioning process underway, but performance will not be demonstrated until construction is complete. NBAF adequately staffed, but staffing needs will change as operational stand-up activities begin. GAO last reported on this program in April 2017 (GAO-17-346SP). The program’s annual life-cycle cost estimate (LCCE) update is within its current acquisition program baseline (APB) cost thresholds and, according to NBAF officials, the program remains on track to meet its schedule goals. In August 2017, NBAF officials said that construction activities thus far—such as pouring concrete for the main laboratory and steel framing—have proceeded as anticipated and will continue through December 2020. NBAF officials told GAO the program has already received full acquisition funding for facility construction efforts through federal appropriations and gift funds from the state of Kansas. As construction continues, the program plans to begin operational stand-up activities for the facility. However, a potential affordability gap may delay the program’s ability to complete these stand-up activities, which are needed to begin conducting laboratory operations. The program was not included in DHS’s funding plan to Congress for fiscal years 2018 to 2022 because DHS did not report operations and maintenance (O&M) funding for individual programs. However, NBAF officials anticipate receiving only $149 million in O&M funding to cover an estimated $239 million in O&M costs over the next 5 years, resulting in a projected shortfall of approximately $90 million. NBAF officials stated the O&M funding gap could delay a number of operational stand-up activities, including plans to award a management operations and research support contract in October 2018, the purchase of laboratory and information technology equipment, and hiring of operations management staff. According to NBAF officials, if operational stand-up activities are delayed, there is a risk the facility will not be fully operational by December 2022, as is currently planned. This may delay the transition from the Plum Island Animal Disease Center, which is nearing the end of its useful life. NBAF officials reported that S&T plans to communicate the program’s future funding needs to DHS leadership through the annual budget process. If the program does not receive the funding it requests, these officials stated that S&T will prioritize the operational stand-up activities that best reduce the risk of schedule delays. Science and Technology Directorate (S&T) NATIONAL BIO AND AGRO-DEFENSE FACILITY (NBAF) NBAF officials reported that they coordinate regularly with key stakeholders. For example, they hold regular coordination meetings with USDA officials to discuss NBAF operations, including operational stand-up activities and future procurement. The NBAF program office has also begun outreach to the federal regulators responsible for awarding the registrations needed for NBAF to conduct laboratory operations to begin planning for this authorization process. The NBAF program office is currently fully staffed. However, NBAF officials reported the program’s staffing needs will change in the coming years, as the program progresses through construction and begins operational stand-up of the facility. For example, over the next 5 years, the program will need to hire an operations director, bio-risk manager, chief information officer, and facility manager, among others, for NBAF operations management. However, the projected O&M funding shortfall during this same period could affect the program’s ability to hire new staff when needed and complete operational stand-up activities on time. NBAF officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. ELECTRONIC BAGGAGE SCREENING PROGRAM (EBSP) TRANSPORTATION SECURITY ADMINISTRATION (TSA) Established in response to the terrorist attacks of September 11, 2001, EBSP tests, procures, and deploys transportation security equipment, such as explosives trace detectors and explosives detection systems, across approximately 440 U.S. airports to ensure 100 percent of checked baggage is screened for explosives. EBSP is primarily focused on delivering new systems with enhanced screening capabilities and developing software upgrades for existing systems. Program is incorporating requirements to address cybersecurity risk for existing systems. EBSP plans to pursue a new procurement approach in 2018, and staffing challenges exist. GAO last reported on this program in April 2017 (GAO-17-346SP). In the program’s annual life-cycle cost estimate update, its operations and maintenance (O&M) costs exceeded the acquisition program baseline (APB) cost threshold, which constitutes a breach under the Department of Homeland Security’s (DHS) acquisition policy. The O&M costs increased when TSA accounted for updated maintenance costs and quantities, and shifted salaries from acquisition to O&M to align with DHS’s new appropriation structure. TSA officials said they did not submit a breach notification because they considered the movement of salaries to be an administrative change. The program plans to update its APB in calendar year 2018 to reflect a new plan for procuring equipment under its current acquisition strategy. TSA officials said this APB will also reflect the cost changes. In May 2016, DHS leadership approved a revised APB for EBSP, which reflects its current acquisition strategy to competitively procure systems on an ongoing basis using qualified product lists. The program’s revised APB cost thresholds decreased compared to its initial APB, which TSA officials attributed to various reasons, including shortening the program’s end date by 3 years and lower than anticipated actual costs, among other things. TSA officials told GAO that one of their primary challenges is funding, and the program is projected to face a $72 million acquisition funding shortfall in fiscal year 2018. TSA identified $70 million in carryover funding to address this gap. To mitigate anticipated funding gaps in future years, TSA officials said they may shift projects from one fiscal year to another or cancel them altogether, which may result in the delay or elimination of screening capabilities. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs. TSA anticipates receiving $980 million in O&M funding over this 5-year period to cover $1 billion in O&M costs. TSA officials anticipate achieving the program’s final APB milestone—initial operational capability (IOC) for systems that detect additional materials and provide an advanced threat detection algorithm—by its revised threshold date. Previously, EBSP planned to award contracts for these systems in September 2015 and September 2018, respectively. Transportation Security Administration (TSA) ELECTRONIC BAGGAGE SCREENING PROGRAM (EBSP) As of December 2017, EBSP had deployed 1,664 explosives detection systems and 2,638 explosives trace detectors nationwide. In 2018, EBSP plans to pursue a new competitive procurement approach to replace and update existing systems that will include: New contract vehicles to better align EBSP procurement activities with the program’s strategic roadmap. Updates to EBSP’s vendor qualification process to allow for vendor collaboration before testing. Transitioning from procuring systems with different sizes and speeds to two types: (1) inline systems that integrate with a baggage handling system and are linked through a network and (2) standalone systems that may be integrated with a baggage handling system, but not linked to a network. The program is in the process of updating its acquisition documentation to reflect this new procurement approach and TSA officials anticipate opening a qualified products list for new systems starting in June 2018. TSA officials said that staffing remains a challenge for the program because of cuts in government and contracted mission support staff and critical vacancies, including a division director. In September 2017, TSA reported that existing personnel across the program have assumed responsibilities of these positions, but workloads are unsustainable at current staffing levels. TSA officials stated that EBSP continues to procure, test, and deploy equipment and capabilities to recapitalize older equipment, improve security screening capability at airports, and enhance the detection capabilities of the fleet. They added that TSA employs extensive testing to verify the suitability and effectiveness of equipment to meet requirements. Moving forward, EBSP intends to establish IOC milestones for new technologies and capabilities, while allowing TSA the flexibility to make risk-based decisions. TSA officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. PASSENGER SCREENING PROGRAM (PSP) TRANSPORTATION SECURITY ADMINISTRATION (TSA) The Department of Homeland Security (DHS) established PSP in response to the terrorist attacks of September 11, 2001. PSP identifies, tests, procures, deploys, and sustains transportation security equipment across approximately 440 U.S. airports to help TSA officers identify threats concealed on people and in their carryon items. The program aims to increase threat detection capabilities, improve the efficiency of passenger screening, and balance passenger privacy and security. Started testing on the Credential Authentication Technology in TSA Precheck lanes during 2017. Critical staffing vacancies persist and may delay followon acquisition planning efforts. GAO last reported on this program in April 2017 (GAO-17-346SP). In May 2017, the DHS Under Secretary for Management (USM) approved the sixth version of the PSP acquisition program baseline (APB) and subsequently removed the program from breach status. In January 2016, TSA declared a schedule breach of a key milestone—acquisition decision event (ADE) 3—for the Credential Authentication Technology (CAT) because of delays in incorporating new cybersecurity requirements. Consistent with previous versions of the program’s APB, the new baseline modified the program’s cost, schedule, and performance parameters. For example, the program established the following: Separate CAT milestone dates for TSA Precheck and standard lanes. TSA officials stated there is no capability difference between screening lanes, but an initial focus on TSA Precheck lanes will assist with demonstrating CAT requirements and resolving past testing issues that contributed to an initial 4-year delay to CAT’s full operational capability (FOC) date. PSP now plans to reach FOC for CAT more than 5 years later than its revised target of June 2018 and more than 9 years later than initially planned. New FOC dates for other technologies, which TSA officials said are expected to be more realistic about delivery dates and account for changes in some FOC quantities. For example, TSA requested and received approval in September 2017 to increase FOC quantities for second generation Advanced Technology (AT-2) TierI systems to meet increasing passenger volume and expected airport growth. In May 2017, the USM also directed the program to revise its life-cycle cost estimate (LCCE) in response to less-than-expected funding levels. The new LCCE also shifted some acquisition costs to operations and maintenance (O&M) to be consistent with DHS’s new appropriation structure. TSA officials believe the new funding profile will be sufficient to sustain legacy PSP equipment, but will significantly limit the program’s ability to enhance existing equipment capabilities and support operational needs. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained O&M funding for individual programs. TSA anticipates receiving $906 million in O&M funding over this 5-year period to cover $923 million in O&M costs. 05/17 APB version 6.0 approved 03/20 CAT ADE 3 (precheck lanes) 09/21 CAT ADE 3 (standard lanes) 12/21 CAT FOC (precheck lanes) 12/23 CAT FOC (standard lanes) Transportation Security Administration (TSA) PASSENGER SCREENING PROGRAM (PSP) Automated screening lanes operational utility assessment AT-2 tier II follow-on operational test & evaluation (OT&E) TSA employs two acquisition strategies to acquire PSP systems: Qualified Product List (QPL) approach—used for proven technologies when capability requirements are rigid and contractors’ systems are mature. Any contractors’ systems that demonstrate they meet the capability requirements are added to the QPL. TSA has used this approach to acquire the second generation AT-2 systems, Bottled Liquid Scanners, and Explosive Trace Detectors. Low Rate Initial Production (LRIP) approach—used when capability requirements are flexible and contractors’ systems are evolving. Under this approach, PSP uses a series of development contracts to enhance systems’ capabilities over time. PSP is currently using this approach to acquire CAT. TSA planned to initiate new acquisition programs starting in fiscal year 2018 that will replace PSP, but this effort may be at risk because of understaffing. In August 2017, TSA reported that its checkpoint screening division—whose staff is concurrently responsible for PSP and its follow-on programs—continued to have staffing vacancies, including project managers, analysts, and a deputy program manager. TSA is mitigating these gaps with existing staff and, according to TSA officials, the staffing challenges may decrease because the new programs may be delayed in response to funding cuts. TSA officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. TECHNOLOGY INFRASTRUCTURE MODERNIZATION (TIM) TRANSPORTATION SECURITY ADMINISTRATION (TSA) The TIM program was initiated to address shortfalls in TSA’s threat assessment screening and vetting functions by providing a modern and centralized end-to-end credentialing system. The TIM system will manage credential applications and the review process for millions of transportation workers and travelers across three segment populations: maritime, surface, and aviation. It will support large programs, such as TSA Precheck and the Transportation Worker Identification Credential. Operational testing identified limitations with the system; cybersecurity has not been assessed. Staffing gaps in key areas, such as systems engineering and testing, are a significant program risk. GAO last reported on this program in October and April 2017 (GAO-18-46, GAO-17- 346SP). The TIM program is on track to meet the cost and schedule goals in its current acquisition program baseline (APB). In September 2016, the Department of Homeland Security’s (DHS) Under Secretary for Management approved the TIM program’s revised APB—which reflected a new technical approach to deploy capabilities using an agile development methodology—and subsequently removed the program from breach status, authorizing TSA to resume new development after a nearly 22-month pause. DHS leadership paused new development in January 2015 after the program breached its initial APB goals for various reasons, including technical challenges, insufficient contractor performance, and the addition of new requirements after DHS leadership had approved the program’s initial acquisition strategy. The program now plans to achieve full operational capability (FOC) in March 2022 and its life-cycle cost estimate (LCCE) increased to account for this 6-year schedule slip and integration with the Transportation Vetting System, among other things. Since the program’s re-baseline, it has been developing and deploying capabilities in 2-month incremental agile releases, such as functionality to transition TSA Precheck program to the TIM system. The program updated its LCCE in November 2017 to inform a program review with DHS leadership, which is within its current APB cost thresholds. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance (O&M) funding for individual programs. TSA officials anticipate receiving approximately $318 million in O&M funding over this 5-year period, which includes nearly $118 million in fees from vetting programs. TSA officials plan to realign $57 million to cover the projected acquisition shortfall, and said any additional surplus funding available in fiscal year 2022 would be used to implement new system requirements identified by the program’s customers. In November 2017, TSA officials identified several program and technical risks that could affect the program’s cost, schedule, and performance. These risks include an increase in new requirements and increased risk of system vulnerabilities and cyberattacks if the program does not identify a provider to perform software updates on open source code. TSA officials are working to mitigate these risks. Transportation Security Administration (TSA) TECHNOLOGY INFRASTRUCTURE MODERNIZATION (TIM) Under the program’s new technical approach, TSA plans to replace the TIM system’s existing commercial-off-the-shelf applications with open source applications—software that can be accessed, used, modified, and shared by anyone—and move to a new virtual environment. The program’s new agile development methodology develops, tests, and deploys capabilities using an iterative, rather than a sequential approach. Consistent with this strategy, TSA awarded task orders in 2016 and 2017 totaling $34.5 million to the program’s existing contractor for agile design and development services, and plans to competitively award a new contract by May 2018. In October 2017, GAO found that TSA had not fully implemented several leading practices to ensure successful agile adoption. GAO also found that TSA and DHS needed to conduct more effective oversight of the TIM program to reduce the risk of repeating past mistakes. DHS concurred with all 14 recommendations made by GAO to improve program execution and oversight, and identified actions DHS and TSA can take to address them. TSA reported that staffing challenges are a significant risk to the program’s success and identified gaps in key areas—such as systems engineering, testing, and agile development. Program officials told GAO these positions cannot be filled because of a hiring freeze within TSA, which the component has imposed to assess their current workforce and restructure, if necessary. Program officials told GAO they requested waivers from the hiring freeze and, as of January 2018, they had received approval to hire 4 additional staff. TSA officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. FAST RESPONSE CUTTER (FRC) UNITED STATES COAST GUARD (USCG) The USCG uses the FRC to conduct search and rescue, migrant and drug interdiction, and other law enforcement missions. The FRC carries one cutter boat on board and is able to conduct operations in moderate sea conditions. The FRC replaces the USCG’s Island Class patrol boat and provides improved fuel capacity, surveillance, and communications interoperability with other Department of Homeland Security (DHS) and Department of Defense assets. FRC found operationally effective and suitable, and all key performance parameters validated. Main diesel engine issues persist, which may require further retrofits. GAO last reported on this program in March and April 2017 (GAO-17-218, GAO-17- 346SP). According to USCG officials, the FRC program is on track to meet its current cost and schedule goals. The USCG plans to acquire 58 FRCs and, as of September 2017, 25 had been delivered and 19 were on contract. To inform the budget process, the program updated its life-cycle cost estimate in June 2017, which is within its current acquisition program baseline (APB) cost thresholds. Previously, the program’s initial operational capability (IOC) date slipped after a bid protest related to the program’s initial contract award—now known as phase 1—and the need for structural modifications. USCG officials attributed the 5-year slip in the program’s full operational capability (FOC) date to a decrease in annual procurement quantities under the phase 1 contract. Specifically, in fiscal years 2010 and 2011, the quantities decreased from 6 FRCs per year to 4. In May 2014, the USCG determined that it would procure only 32 of the 58 FRCs through this contract and initiated efforts to conduct a full and open competition for the remaining 26 vessels—known as phase 2. In May 2016, the USCG awarded the phase 2 contract for the remaining 26 FRCs, which has a potential value of $1.42 billion. Under the phase 2 contract, the USCG can procure 4 to 6 FRCs per option period. The USCG ordered 6 FRCs at the time of the phase 2 award and, in June 2017, exercised an option for an additional 6 FRCs. The USCG has established that the annual procurement quantity will be dictated by funding levels, and funding shortfalls could cause further schedule delays. The affordability gap from fiscal years 2018 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not contain operations and maintenance (O&M) funding for USCG programs. USCG officials anticipate receiving $1.6 billion in O&M funding over this 5-year period. USCG officials stated that they expect to exercise an option for 4 FRCs in fiscal year 2018 and that the USCG plans to prioritize acquisition funding in fiscal years 2019 and 2020 to procure the final 10 hulls and complete procurement of all 58 FRCs. United States Coast Guard (USCG) FAST RESPONSE CUTTER (FRC) The USCG continues to work with the contractor—Bollinger Shipyards, LLC—to address issues covered by the warranty and acceptance clauses for each ship. For example, 18 engines—9 operational engines and 9 spare engines—have been replaced under the program’s warranty. According to USCG documentation, 65 percent of the current issues with the engines have been resolved through retrofits; however, additional problems with the engines have been identified since our April 2017 review. For example, issues with water pump shafts are currently being examined through a root cause analysis and will be redesigned and are scheduled to undergo retrofits starting in December 2018. We previously found that the FRC’s warranty resulted in improved cost and quality by requiring the shipbuilder to pay for the repair of defects. As of September 2017, USCG officials said the replacements and retrofits completed under the program’s warranty allowed the USCG to avoid an estimated $104 million in potential unplanned costs—of which $63 million is related to the engines. The FRC program does not have any critical staffing vacancies, but the USCG identified insufficient staffing for shore-side support groups as a potential risk that could affect the asset’s operations. These groups provide maintenance to the FRCs while they are in port. In order to mitigate this staffing issue, the USCG is using commercial contracts for maintenance to supplement the capacity of the USCG’s maintenance staff. USCG officials stated that the FRC program is fully funded, executable, and on track to reach FOC by March of 2027. They added that FRCs were recently delivered to locations in Mississippi, Alaska, and Hawaii. USCG officials stated that FRCs are integral to USCG operations, such as providing critical support during the recent hurricane season, and that the program office continues to work with the contractor and stakeholders to quickly and properly address issues with FRCs as they are identified. USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. H-65 CONVERSION/SUSTAINMENT PROGRAM (H-65) UNITED STATES COAST GUARD (USCG) The H-65 aircraft is a short-range helicopter that the USCG uses to fulfill its missions, including search and rescue, ports and waterways security, marine safety, and defense readiness. The H-65 acquisition program increased the fleet’s size by 7 aircraft, added armament capabilities, upgraded navigation systems, and replaced each of the helicopters’ engines. The program is currently focused on upgrades to radar sensors, the automatic flight control system (AFCS), and avionics. Operational assessment of avionics upgrade planned to start in February 2018. Program fully staffed, but schedule slips raise risks with future staffing requirements. GAO last reported on this program in April 2017 (GAO-17-346SP). As of November 2017, the program remains in breach of its current acquisition program baseline (APB). In November 2016, the USCG notified Department of Homeland Security (DHS) leadership that it would not complete all activities required—including developmental testing and an operational assessment—to achieve acquisition decision event (ADE) 2C for low-rate initial production of the avionics and AFCS upgrades by its current APB threshold date of March 2017. USCG officials primarily attributed these delays to an underestimation of the technical effort necessary to meet the requirements and have subsequently worked with the contractor to continue development of avionic upgrades. In January 2017, DHS leadership directed the program to update its APB, life-cycle cost estimate (LCCE) and test and evaluation master plan by May 2017. However, the USCG did not meet this deadline, in part, because it decided to add a service life extension program (SLEP) to the H-65 program. The SLEP is expected to extend the current 20,000 flight hour service life of each aircraft by another 10,000 flight hours by replacing obsolete aircraft components. USCG officials stated that this will allow the USCG to delay purchasing new aircraft to prioritize funding for the Offshore Patrol Cutter. USCG officials plan to obtain approval for the SLEP when the program submits its revised APB for DHS approval, which is expected by March 2018. The program is revising its LCCE, but provided an update in June 2017 to inform the budget process. This update exceeds its current APB thresholds because it includes an initial estimate for the SLEP. The USCG estimates that the SLEP will cost $54 million for the entire fleet. USCG officials attributed the increase in operations and maintenance (O&M) costs to the additional extension of the aircraft’s operational life. The program’s O&M costs previously increased due to the USCG’s decision to extend the aircraft’s operational life from 2030 to 2039. The affordability gap from fiscal years 2018 to 2022 may be overstated because— as we found in April 2015—DHS’s funding plan to Congress does not contain O&M funding for USCG programs. USCG officials anticipate receiving $1.6 billion in O&M funding over this 5-year period. United States Coast Guard (USCG) H-65 CONVERSION/SUSTAINMENT PROGRAM (H-65) The USCG awarded new contracts to Rockwell Collins—the original equipment manufacturer of the legacy AFCS and avionics—to address the challenges encountered with development of the new upgrades. Specifically, the program awarded new contracts to support continued development of the AFCS and avionics upgrades in July 2016 and March 2017, respectively. As of September 2017, the combined value of both contracts totaled more than $15 million. The USCG cancelled development of a dedicated surface search radar capability for the H-65 in 2014, but USCG officials said a commercial off-the-shelf weather radar with surface search capability will be installed as part of the avionics upgrade. USCG officials said there is some risk involved with extending the aircrafts’ service life beyond 20,000 flight hours since it has never been done by other agencies that operate the H-65. However, USCG officials stated that the aircraft manufacturer, Airbus, assisted the USCG’s chief aeronautical engineer in identifying specific parts needing replacement and is providing support. In July 2017, the USCG reported that the program was fully staffed, but that the schedule slips have introduced potential risks with future staffing requirements. The program is mitigating these risks by extending some military personnel and ensuring rotating personnel are replaced by new staff with the expertise needed to complete the program’s planned activities, such as testing. USCG officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. UNITED STATES COAST GUARD (USCG) The program is intended to assist the USCG in maintaining the capability to access the Arctic and Antarctic polar regions. The USCG requires its icebreaking fleet to conduct multiple missions, including defense readiness; marine environmental protection; ports, waterway, and coastal security; and search and rescue. The USCG plans to acquire three heavy icebreakers to recapitalize the only existing operational heavy icebreaker, which is nearing the end of its service life. Program initiated model testing of hull and propulsion systems, which will inform design decisions. Program office integrates USCG and Navy personnel, but funding responsibilities may cause challenges. GAO last reported on this program in September 2017 (GAO-17-698R). In June 2014, Department of Homeland Security (DHS) leadership granted the program acquisition decision event (ADE) 1 approval. The Acting Under Secretary for Management also acknowledged the USCG’s need to accelerate the acquisition process to mitigate gaps in the heavy icebreaking capability because the service life of the USCG’s only heavy polar icebreaker, which had already been extended, could end as early as 2020. In January 2018, DHS leadership approved the program’s initial acquisition program baseline (APB) establishing cost, schedule, and performance goals. The USCG planned to achieve a combined ADE 2A and 2B by December 2017, which would authorize the initiation of development efforts. According to DHS officials, this milestone was delayed to February 2018 to allow for the completion of required acquisition documents to inform the decision, such as the program’s life-cycle cost estimate and APB. The USCG is partnering with the Navy to leverage shipbuilding expertise and engaging early with potential shipbuilders through industry studies to mitigate some risks associated with the program’s accelerated acquisition schedule. However, GAO previously found that the program faces challenges in implementing the accelerated schedule. For example, the first icebreaker—which is preliminarily estimated to cost about $750 million to design and construct—would need to be fully funded in fiscal year 2019 at the same time the USCG is expecting to prioritize funding for the Offshore Patrol Cutter. In fiscal year 2017, the Consolidated Appropriations Act or associated explanatory materials, reflected funding for the program, including $150 million for advance procurement of heavy polar icebreakers and $25 million to the USCG for programmatic costs, respectively. USCG officials stated that the Navy funding could cover most of the design costs but would not cover long lead items or construction costs for any of the ships. They further stated that uncertainties with the amount and source of future appropriations have made planning the icebreaker acquisition challenging. United States Coast Guard (USCG) DHS leadership approved four key performance parameters (KPP) related to the ship’s ability to independently break through ice, the ship’s operating duration, and communications. In May 2017, the USCG began model testing of potential hull designs and propulsion configurations. USCG officials explained that the hulls of icebreakers are unique from other ships because they must balance a hull design optimized for icebreaking, which are generally broad and blunt, against a hull design optimized for seakeeping, which are generally narrow and streamlined. USCG officials noted that the power demands and propulsion system for the ship are dependent on the hull design. USCG officials stated that maneuverability was identified as a challenge during model testing and explained that azimuthing propulsors—propellers that sit below the ship and can rotate 360 degrees—offered better maneuverability than traditional propulsion systems. USCG officials said these propulsors are widely used on commercial ships, but may need modification to meet the USCG’s requirements. USCG officials anticipate results from the model testing to be completed by March 2018 and plan to use these results to inform the final specifications for the ships. The USCG established an integrated heavy polar icebreaker program office with the Navy and in 2017, DHS, the USCG, and Navy entered into several agreements that outline oversight roles, among other things. For example, these agreements state that the program will follow DHS acquisition policies with DHS leadership serving as the acquisition decision authority for program milestones. However, the Navy will review and approve acquisition documents before the program seeks DHS approval. These agreements also state that the program’s contracting actions could be funded by either USCG or Navy appropriations, and the source of the appropriations will award the contract. The program plans to competitively award a contract, which would include options for the detail design and construction for all three ships to a single shipbuilder by June 2019. Program officials stated they plan to award the contract under full and open competition to obtain competitive prices and include the construction of the three ships as options to accommodate the program’s funding uncertainties. In February 2017, the USCG awarded contracts to five shipbuilders—valued at approximately $4 million each—for design studies which will inform program decisions. Program officials stated that under these design studies contracts, the shipbuilders developed several potential ship designs and preliminary costs, with a focus on alternative propulsion options and hull designs. In August 2017, USCG officials told GAO that the program’s staffing gap was not negatively impacting program efforts. USCG officials stated that the program office had completed requirements for ADE 2A and 2B, and is on track to release the request for proposals for the detail design and construction contract by March 2018. These officials added that, during 2017, the program office refined the program’s requirements, completed ice and open water model testing, and partnered with five industry teams to evaluate multiple design solutions. USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. LONG RANGE SURVEILLANCE AIRCRAFT (HC-130H/J) UNITED STATES COAST GUARD (USCG) The USCG uses HC-130H and HC-130J aircraft to conduct search and rescue missions, transport cargo and personnel, support law enforcement, and execute other operations. Both aircraft are quad-engine propeller-driven platforms. The HC-130J is a modernized version of the HC-130H, which has advanced engines, propellers, and equipment that provide enhanced speed, altitude, range, and surveillance capabilities. Performance testing of new mission system processor complete. Transfer of HC-130H aircraft to other agencies ongoing. GAO last reported on this program in April 2017 (GAO-17-346SP). During 2017, the USCG continued a nearly 3-year effort to re-baseline the program— which includes revisions to the program’s life-cycle cost estimate (LCCE) and acquisition program baseline (APB)—to account for significant changes. Specifically, the USCG decided to pursue an all HC-130J fleet and, in fiscal year 2014, Congress directed the transfer of 7 HC-130H aircraft to the U.S. Air Force. The USCG was in the process of upgrading these aircraft, but cancelled further HC-130H upgrades. In September 2017, Department of Homeland Security (DHS) leadership directed the USCG to submit the revised APB by January 2018. According to USCG officials, the re-baseline has been delayed, in part, because Congress also directed the USCG to conduct a multi-phased analysis of its mission needs. In November 2016, the USCG submitted the results of its analysis for fixed- wing aircraft, which confirmed the planned total quantity of 22 HC-130J aircraft and an annual flight-hour goal of 800 hours per aircraft. USCG officials said the results of the analysis will be reflected in the program’s revised LCCE and subsequent APB, but noted that challenges with the vendor hired to complete the LCCE revision have also contributed to delays. The program submitted cost information in June 2017 to inform the budget process, but it reflected no updates from the program’s November 2011 LCCE. USCG officials previously attributed the acquisition cost growth and schedule slip from the program’s initial APB to the increase in HC-130J quantities from 6 to 22. However, when the revised LCCE is complete, estimated costs may decrease since the HC-130J aircraft are less expensive to maintain. As of December 2017, USCG officials stated they had received 11 HC-130J aircraft and had awarded contracts for 3 more—some of which were not requested. USCG officials previously stated that the program needs to acquire 1-2 HC-130J aircraft per year to meet its full operational capability (FOC) date. However, it is unclear how the USCG will meet its FOC date because it only requested funding for 1 aircraft over the next 5 years. The affordability gap from fiscal years 2018 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not contain operations and maintenance (O&M) funding for USCG programs. USCG officials anticipate receiving approximately $1.4 billion in O&M funding over this 5- year period. United States Coast Guard (USCG) LONG RANGE SURVEILLANCE AIRCRAFT (HC-130H/J) In December 2013, Congress directed the transfer of 7 HC-130H aircraft to the U.S. Air Force for modifications—which consists of upgrades and installing a fire retardant delivery system—and subsequent transfer to the U.S. Forest Service. This direction factored into the USCG’s decision to pursue an all HC-130J fleet. As of December 2017, the Forest Service had not yet received any modified aircraft primarily because of issues with contractors. According to USCG officials, the original contract the Air Force awarded to install the fire retardant delivery system in May 2016 was terminated 7 months later due to an unqualified vendor and a new contract has not yet been awarded. In the meantime, the Forest Service is using 2 of the 7 HC-130Hs. USCG officials said these aircraft are not modified, but outfitted with a less effective firefighting device. As of November 2017, the USCG plans to operate 14 of its HC-130H aircraft until the end of their service lives or until they can be replaced with new HC-130J aircraft. However, as previously discussed, the USCG has not requested funding for the additional HC-130J aircraft to support this plan. In October 2017, USCG officials reported that they were in the process of hiring staff to address the program’s staffing gap. USCG officials provided technical comments on a draft of this assessment, which GAO incorporated, as appropriate. MEDIUM RANGE SURVEILLANCE AIRCRAFT (HC-144A/ C-27J) UNITED STATES COAST GUARD (USCG) The USCG uses HC-144A and C-27J aircraft to conduct all types of missions, including search and rescue and disaster response. All 32 aircraft—18 HC-144A aircraft and 14 C-27J aircraft—are twin-engine propeller driven platforms. The interior of both aircraft are able to be re-configured to accommodate cargo, personnel or medical transports. Developmental testing of new mission system processor is ongoing. Program continues to face challenges related to purchasing spare parts and accessing technical data. GAO last reported on this program in April 2017 and March 2015 (GAO-17-346SP, GAO-15-325). USCG officials said the program is on track to meet the cost and schedule goals in its current acquisition program baseline (APB), which Department of Homeland Security (DHS) leadership approved in August 2016 to reflect the restructuring of the HC-144A acquisition program. The USCG initially planned to procure a total of 36 HC-144A aircraft, but reduced that number to the 18 it had already procured after Congress directed the transfer of 14 C-27J aircraft from the U.S. Air Force to the USCG in fiscal year 2014. The program’s APB divides the program into two phases: phase 1 includes acceptance of the 18 HC-144A aircraft and upgrades to the aircraft’s mission and flight management systems, and phase 2 includes acceptance of and modifications to the C-27J aircraft to meet the USCG’s mission needs. In October 2017, USCG officials told GAO that the program had initiated phase 1 efforts to upgrade the first HC-144A aircraft. The USCG plans to complete upgrades on all HC-144As by the end of fiscal year 2021. For phase 2, the USCG has accepted all 14 C-27Js from the U.S. Air Force and plans to complete the modification of all C-27Js by March 2025 to achieve full operational capability (FOC). To inform the budget process, the program updated its life-cycle cost estimate (LCCE) in June 2017, which is within its current APB cost thresholds. This estimate includes C-27J modification costs, such as installation of a new sensor package and new mission system processor. The program’s LCCE for the 36 HC-144A aircraft previously increased to $28.7 billion in 2012 when the USCG accounted for 5 years of additional costs, among other things. The current LCCE represents a considerable decrease, but also reflects a reduction in the number of aircraft and planned flight hours. The affordability gap from fiscal years 2018 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not contain operations and maintenance (O&M) funding for USCG programs. USCG officials anticipate receiving nearly $1.7 billion in total funding over this 5-year period to cover nearly $1.8 billion in total costs. United States Coast Guard (USCG) MEDIUM RANGE SURVEILLANCE AIRCRAFT (HC-144A/C-27J) The USCG still faces challenges in transitioning the C-27J into the USCG fleet. In March 2015, GAO found that the successful and cost-effective fielding of the C-27J aircraft is contingent on the USCG’s ability to address risk areas including, purchasing spare parts and accessing technical data, among other issues. According to USCG officials, the program continues to face challenges purchasing spare parts and accessing technical data. The program is reliant on the aircraft original equipment manufacturer for about 35 percent of spare C-27J parts. For other parts, USCG officials said that the USCG continues to look for ways to provide the same or similar parts for the aircraft at a faster rate and the USCG plans to award contracts to two additional manufacturers in calendar year 2018. USCG officials stated that retrieving technical data for the C-27J aircraft remains a challenge, but the USCG is working with the Department of Defense to obtain rights to data currently owned by the original equipment manufacturer. Once the USCG receives appropriate rights to C-27J technical data, the USCG officials said they can begin modification of the aircraft. The USCG also plans to purchase the same surface search radar used on the HC-144A or the HC-130J for the C-27J, which will give the USCG some commonality in maintenance, logistics, and training for this aspect of the aircraft. In October 2017, USCG officials told GAO that the program’s staffing is adequate and the gap has not negatively affected the program. USCG officials stated that the program remains on track to meet the cost, schedule, and performance goals outlined in its current APB and that they monitor APB key parameters in accordance with DHS guidance. These officials added that market research continues to increase supply chain sources and to identify products for new mission systems. USCG officials also provided technical comments, which GAO incorporated as appropriate. NATIONAL SECURITY CUTTER (NSC) UNITED STATES COAST GUARD (USCG) The USCG uses the NSC to conduct search and rescue, migrant and drug interdiction, environmental protection, and other missions. The NSC replaces and provides improved capabilities over the USCG’s High Endurance Cutters. The NSC carries helicopters and cutter boats, provides an extended on-scene presence at forward deployed locations, and operates worldwide. Follow-on operational testing began in October 2017, but cybersecurity testing delayed. The USCG is conducting a study to determine root cause of propulsion system issues. GAO last reported on this program in March and April 2017 (GAO-17-218, GAO-17- 346SP). In November 2017, Department of Homeland Security (DHS) leadership approved a revised acquisition program baseline (APB), which accounted for the addition of a ninth NSC to the program of record. The USCG originally planned to acquire only eight NSCs; however, in the Consolidated Appropriations Act of 2016, Congress directed that not less than $640 million be immediately available and allotted to contract for the production of a ninth NSC. In December 2016, the USCG awarded a contract to produce the ninth NSC and, as of November 2017, six NSCs had been delivered and three were under construction. The USCG anticipates delivery of the ninth NSC in September 2020, which coincides with the program’s prior APB threshold date for full operational capability (FOC). However, the revised APB extends this date by 1 year to account for any risks in delivering the additional ship. The program’s FOC date previously slipped 4 years, which USCG officials attributed to funding shortfalls, among other things. The ninth NSC contributed to a $453 million and $123 million increase in the program’s APB cost thresholds for acquisition and operations and maintenance (O&M), respectively. However, the program’s revised life-cycle cost estimate (LCCE) is still lower than its initial estimate for eight ships, which USCG officials attribute to more accurate estimates. The revised LCCE also included costs for several design changes the USCG has had to implement on equipment with known issues. As of September 2017, 12 equipment systems required design changes, which totaled an estimated cost of over $260 million. This work includes structural enhancement work on the first two NSCs and the replacement of the gantry crane, which aids in the deployment of cutter boats. The affordability gap from fiscal years 2018 to 2022 may be overstated because— as we found in April 2015—DHS’s funding plan to Congress does not contain O&M funding for USCG programs. USCG officials anticipate receiving approximately $2.1 billion in O&M funding over this 5-year period to cover the NSC’s estimated $1.8 billion in O&M costs, but stated it will refine its annual budget request based on the program’s needs each year. The USCG also identified carryover funding to cover the projected acquisition funding shortfall in fiscal year 2018. United States Coast Guard (USCG) NATIONAL SECURITY CUTTER (NSC) The NSC program does not have any critical staffing vacancies. However, in July 2017, the program reported that the greatest staffing challenge is a potential extension to the program’s end date if the USCG acquires more than 9 NSCs. If this occurs, the program office must reassess future staffing requirements to ensure adequate program oversight continues until the last NSC completes post-delivery activities. In addition, the USCG has made changes to its staffing model for operating the NSCs. The USCG initially planned to implement a crew rotational concept in which crews would rotate while NSCs were underway to achieve a goal of 230 days away from the cutter’s homeport. In February 2018, USCG officials told GAO they abandoned the crew rotational concept because the concept did not provide the USCG with the expected return on investment. Instead, USCG officials said a new plan has been implemented that does not rotate crew and is anticipated to increase the days away from home port from the current capability of 185 days to 200 days. USCG officials stated that NSCs had a record year of narcotics seizures in 2017. In addition to the test activities identified in this assessment, USCG officials stated that the first follow-on OT&E event was completed in December 2017 and the first cybersecurity test event is scheduled for February 2018. They also noted that the shipbuilder continues to show improving cost performance and is completing construction within budget. USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. OFFSHORE PATROL CUTTER (OPC) UNITED STATES COAST GUARD (USCG) The USCG plans to use the OPC to conduct patrols for homeland security, law enforcement, and search and rescue operations. The OPC is being designed for long-distance transit, extended on-scene presence, and operations with deployable aircraft and small boats. It is intended to replace the USCG’s aging Medium Endurance Cutters (MEC) and bridge the operational capabilities provided by the Fast Response Cutters and National Security Cutters (NSC). Program plans to refine the ship’s design, as needed, based on early operational assessment results. Program’s acquisition strategy incorporated some best practices. GAO last reported on this program in April and June 2017 (GAO-17-346SP, GAO-17-654T). According to USCG officials, the OPC program is on track to meet its cost and schedule goals. In September 2014, Department of Homeland Security (DHS) leadership approved the program’s current acquisition program baseline (APB), which accounts for schedule slips resulting from delays in awarding the program’s initial contracts and a subsequent bid protest. The USCG expects to start construction of the first OPC in fiscal year 2019 and procure a total of 25 ships. The USCG plans to initially fund one OPC per year and eventually two OPCs per year until all 25 OPCs are delivered. USCG officials have stated that additional OPC delays will decrease the USCG’s operational capacity because the MECs will likely require increased downtime for maintenance and other issues, reducing their availability. In January 2016, DHS leadership directed the USCG to revise the OPC life-cycle cost estimate (LCCE) and submit it for approval within 6 months of awarding the detailed design and construction contract for the ships—which the USCG subsequently awarded in September 2016. In June 2017, the program submitted an updated LCCE to inform the budget process that—while not approved by DHS leadership—accounts for the contract award and the program’s schedule slips. As of December 2017, the program’s revised LCCE still had not been approved. It is unclear whether it will address other issues, such as an increase in the estimated weight of each ship. The OPC’s initial LCCE was based in large part on the estimated weight of each ship. However, in November 2017, USCG officials said the ship is expected to weigh up to 35 percent more than originally estimated. Nevertheless, USCG officials expect to procure all 25 OPCs for the program’s APB objective cost of $10.5 billion because the contractor identified cost efficiencies to compensate for the increased weight. GAO previously raised questions about the OPC’s affordability and its effect on other USCG acquisition programs, such as the Heavy Polar Icebreaker. Specifically, GAO noted that the OPC procurement will consume about two-thirds of the USCG’s planned acquisition budget between fiscal years 2018 and 2032 based on recent funding history. The program’s affordability gap from fiscal years 2020 to 2022 may be overstated because—as we found in April 2015—DHS’s funding plan to Congress does not report operations and maintenance (O&M) funding for USCG programs. USCG officials anticipate receiving $103 million in O&M funding over this 5-year period. United States Coast Guard (USCG) OFFSHORE PATROL CUTTER (OPC) The USCG is in the process of completing the design of the OPC before starting construction, which is in-line with GAO shipbuilding best practices. In addition, USCG officials stated that the program is using state-of-the-market technology that has been proven on other ships as opposed to state-of-the-art technology, which lowers the risk of the program. The USCG used a two-phased down-select strategy to select a contractor to deliver the OPC. For phase 1, the USCG conducted a full and open competition and selected three contractors to perform preliminary design work. For phase 2, the USCG selected one of the phase 1 contractors—Eastern Shipbuilding—to develop a detailed design of the OPC and construct no more than the first 11 ships. The contract—worth approximately $110 million—includes separate options for each ship. The options for ships 10 and 11 were unpriced and included in the solicitation as an incentive to convert the contract type from fixed price incentive to firm fixed price. These options will be included in a repricing proposal submitted by the contractor for ships 6-9 after delivery of the first ship. USCG officials have stated the USCG will decide whether to exercise the option for ships 10 and 11 based on the contractor’s re-pricing proposal for ships 6-9. The USCG plans to re-compete the contract for the remaining 14-16 ships. The OPC program continued to increase its required staffing level and the USCG reported that adjustments to staffing will continue as the program matures. The program faces shortages including engineers, a logistics manager, and a technical director, but USCG officials said they are hiring staff to address these gaps. USCG officials stated that the OPC program is fully funded, executable, and on track to award construction for the first OPC in September 2018. These officials said design efforts are on track and the contractor is meeting the milestones to deliver the first OPC in 2021. USCG officials noted that they are continuing to increase staff at the contractor’s facility to prepare for the start of construction for the first OPC. USCG officials also provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. UNITED STATES CITIZENSHIP AND IMMIGRATION SERVICES (USCIS) The Transformation program was established in 2006 to transition USCIS from a fragmented, paper-based filing environment to a consolidated, paperless environment for processing immigration and citizenship applications. The program developed a new system architecture and delivers capability through releases that correspond to new product lines within four lines of business: Citizenship, Immigrant, Non-Immigrant, and Humanitarian. Revision of key performance parameters and test and evaluation master plan in progress. Program is reorganizing to leverage expertise within USCIS and revise its approach. GAO last reported on this program in April 2017 and July 2016 (GAO-17-346SP, GAO-16- 467). The program remains in breach of its current acquisition program baseline (APB). In September 2016, the Transformation program experienced a schedule breach when it failed to complete deployment of all the product lines associated with the Citizenship line of business. The deployment was delayed because of challenges processing new product lines on the new system architecture and other technical issues with the case management system. Prior to the breach, the program deployed six product lines, which supported approximately 24 percent of the total workload processed by USCIS in fiscal year 2016. Department of Homeland Security (DHS) leadership previously re- baselined the program in April 2015 after USCIS determined that it could not use any of the architecture delivered under its initial strategy, despite having invested more than $475 million in its development. In December 2016, DHS leadership directed USCIS to stop planning and development for new product lines, develop a breach remediation plan, and update its acquisition documentation. In February 2017, DHS leadership approved the program’s remediation plan and the program has since made progress in implementing this plan. However, DHS leadership elected to continue with the program’s pause in new development following program reviews in March 2017, July 2017, and October 2017. USCIS officials said they are revising the program’s acquisition documents—including its APB and life-cycle cost estimate (LCCE)—and plan to re-baseline by March 2018. The program updated the total costs in its LCCE to inform the budget process, but these costs do not reflect the program’s re-baselining plans. As a result, the status of the program against its cost and schedule goals is unclear. However, the program is more than 3 years past its original full operational capability (FOC) date. The affordability gap from fiscal years 2018 to 2022 may be overstated because DHS’s funding plan to Congress no longer contained operations and maintenance funding for individual programs. USCIS uses revenue from premium processing fees to fund the Transformation program and routinely collects more fees than the program’s estimated costs. USCIS officials told GAO that the program office underwent a reorganization in January 2017 to help address the program’s recent challenges. This effort included dismantling the program office and repositioning Transformation under the USCIS Office of Information Technology so the program could leverage expertise in areas such as engineering within USCIS. USCIS officials reported that the program no longer plans to deliver capability by product lines because this strategy focused too narrowly on the automation of forms associated with the lines of business. Going forward, USCIS officials said the program plans to develop capabilities that will address broader objectives, such as reducing the time it takes to process applications and decisions. The program previously made significant changes after it experienced a 5-month delay with its first release, which was deployed in May 2012. DHS attributed this delay to weak contractor performance and pursuing an unnecessarily complex system, among other things. To address these issues, the Office of Management and Budget, DHS, and USCIS determined the program should implement a new acquisition strategy, which allowed for an agile software development methodology and increased competition for development work. This strategy was reflected in the program’s April 2015 re-baseline. USCIS officials told GAO that they plan to address the Transformation program’s staffing gap now that the reorganization is complete. USCIS officials provided technical comments on a draft of this assessment, which GAO incorporated as appropriate. To help determine the extent to which the Department of Homeland Security (DHS) has taken actions to enhance its policies and processes to better reflect key portfolio management practices, we assessed the department’s requirements, acquisition management, and resource allocation policies using key practices we established in September 2012. These key practices are based on our past work, in which we examined the practices that private sector entities use to achieve a balanced mix of new projects and found that successful commercial companies use a disciplined and integrated approach to prioritize needs and allocate resources. As a result, these organizations can avoid pursuing more projects than their resources can support and better optimize the return on their investments. This approach, known as portfolio management, requires companies to view each of their investments as contributing to a collective whole, rather than as independent and unrelated. The objectives of this audit were designed to provide congressional committees insight into the Department of Homeland Security’s (DHS) major acquisition programs. We assessed the extent to which (1) DHS’s major acquisition programs are on track to meet their schedule and cost goals and (2) DHS has taken actions to enhance its policies and processes to better reflect key portfolio management practices. To answer these questions, we reviewed 28 of DHS’s 79 major acquisition programs. We reviewed all 16 of DHS’s Level 1 acquisition programs— those with life-cycle cost estimates (LCCE) of $1 billion or more—that had at least one project, increment, or segment in the Obtain phase—the stage in the acquisition life cycle when programs develop, test, and evaluate systems—at the initiation of our audit. Additionally, we reviewed 12 other major acquisition programs—including 8 Level 1 programs that either had not yet entered or were beyond the Obtain phase, and 4 Level 2 programs that have LCCEs between $300 million and less than $1 billion—that we identified were at risk of not meeting their cost estimates, schedules, or capability requirements based on our past work and discussions with DHS officials. Specifically, we met with representatives from DHS’s Office of Program Accountability and Risk Management (PARM)—DHS’s main body for acquisition oversight—as a part of our scoping effort to determine which programs (if any) were facing difficulties in meeting their cost estimates, schedules, or capability requirements. The 28 selected programs were sponsored by eight different components, and they are identified in table 7, along with our rationale for selecting them. To determine the extent to which DHS’s major acquisition programs are on track to meet their schedule and cost goals, we collected key acquisition documentation for each of the 28 programs, such as all LCCEs and acquisition program baselines (APB) approved at the department level since DHS’s current acquisition management policy went into effect in November 2008. DHS policy establishes that all major acquisition programs should have a department-approved APB, which establishes a program’s critical cost, schedule, and performance parameters, before they initiate efforts to obtain new capabilities. Twenty four of the 28 programs had one or more department-approved LCCEs and APBs between November 2008 and December 31, 2017. We used these APBs to establish the initial and current cost and schedule goals for the programs. We then developed a data collection instrument to help validate the information from the APBs and collect similar information from programs without department-approved APBs. Specifically, for each program, we pre-populated a data collection instrument to the extent possible with the schedule and cost information we had collected from the APBs and our 2017 assessment (if applicable) to identify schedule and cost goal changes, if any, since (a) the program’s initial baseline was approved and (b) January 2017—the data cut-off date of the report we issued in April 2017. We shared our data collection instruments with officials from the program offices to confirm or correct our initial analysis and to collect additional information to enhance the timeliness and comprehensiveness of our data sets. We then met with program officials to identify causes and effects associated with any identified schedule and cost goal changes. Subsequently, we drafted preliminary assessments for each of the 28 programs, shared them with program and component officials, and gave these officials an opportunity to submit comments to help us correct any inaccuracies, which we accounted for as appropriate (such as when new information was available). Additionally, in July 2017, we collected copies of the detailed data on affordability that programs submitted to inform the fiscal year 2019 resource allocation process. We also collected copies of any annual LCCE updates programs submitted in fiscal year 2017. For each of the 24 programs with a department-approved APB, we compared (a) the most recent cost data we collected (i.e., a department-approved LCCE, the detailed LCCE information submitted during the resource allocation process, a fiscal year 2017 annual LCCE update, or an update provided by the program office) to (b) DHS’s funding plan presented in the Future Years Homeland Security Program (FYHSP) report to Congress for fiscal years 2018–2022, which presents 5-year funding plans for DHS’s major acquisition programs, to assess the extent to which a program was projected to have an acquisition funding gap in fiscal year 2018. Through this process, we determined that our data elements were sufficiently reliable for the purpose of this engagement. The FYHSP reports information by the department’s new common appropriation structure, which created standard appropriation fund types including (1) procurement, construction, and improvements and (2) operations and support. We refer to these types of funding as (1) acquisition and (2) operations and maintenance throughout this report. which are listed in appendix II—and identified any significant shortfalls. Specifically, we assessed the joint requirements directives and instruction manual; DHS’s Acquisition Management Directive 102-01, Acquisition Management Instruction 102-01-001, and other related guidance; and DHS’s resource allocation directive, instruction, and handbook. First, we assessed each group of policies against the key practices using the following ratings: Met—the documents fully reflected the key practice. Partially met—the documents reflected some, but not all parts of the key practice. Not met—the documents did not reflect the key practice. We shared our preliminary analysis for each group of policies with the DHS officials responsible for implementing them—specifically, the Joint Requirements Council (JRC), PARM, and the Office of Program Analysis and Evaluation (PA&E)—to discuss our findings, identify relevant sections of the documents we had not yet accounted for, and solicit their thoughts on those key practices that were not reflected in the policies. Second, we used the scores for each group of policies to develop a department-wide rating for each key practice. When applicable, we weighted the department-wide rating based on the intent of the key practice. For example, the department-wide rating for the key practice related to resource allocation across the portfolio was based more heavily on the rating for the resource allocation policies, rather than the ratings for the requirements or acquisition management policies. Third, we rolled-up the ratings for all the key practices in a particular area—as identified in appendix II—to establish a department-wide overall rating for each key practice area. We concluded that a key practice area was met if all ratings for the individual key practices in that area were met; partially met if the ratings for the individual key practices in that area were all partially met or a mix of met and not met; or not met if the ratings for the individual key practices in that area were all not met. In addition, we reviewed documentation that resulted from DHS’s requirements, acquisition management, and resource allocation processes since January 2016 to get a sense of how the department has implemented its current policies. For example, we reviewed JRC- validated requirements documents; acquisition decision memorandums; Acquisition Program Health Assessment reports; and documentation related to the development of DHS’s fiscal year 2018 budget request and the fiscal year 2018–2022 FYHSP report, including resource allocation guidance, presentations to DHS leadership, and preliminary decisions. We also interviewed officials from the JRC, PARM, PA&E, and the Deputy’s Management Action Group to identify any current and planned initiatives to improve management of the department’s portfolio of major acquisition programs. We then compared our assessment of DHS’s current policies, practices, and planned initiatives to our previous findings and the Standards for Internal Control in the Federal Government. We conducted this performance audit from March 2017 through May 2018 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact listed above, Rick Cederholm (Assistant Director), Aryn Ehlow (Analyst-in-Charge), Pete Anderson, Lorraine Ettaro, Helena Johnson, TyAnn Lee, Alexis Olson, Sylvia Schatz, Roxanna Sun, and Lindsay Taylor made key contributions to this report. Other contributors included Mathew Bader, Carissa Bryant, Andrew Burton, Erin Butkowski, Lisa Canini, Jenny Chow, John Crawford, Lindsey Cross, Laurier R. Fish, Betsy Gregory-Hosler, Claire Li, Sarah Martin, Marycella Mierez, Erin O’Brien, Katherine Pfeiffer, John Rastler, Ashley Rawson, Andrew Redd, Jill Schofield, Charlie Shivers III, and Jeanne Sung. DHS Program Costs: Reporting Program-Level Operations and Support Costs to Congress Would Improve Oversight. GAO-18-344. Washington, D.C.: April 25, 2018. Homeland Security Acquisitions: Identifying All Non-Major Acquisitions Would Advance Ongoing Efforts to Improve Management. GAO-17-396. Washington, D.C.: April 13, 2017. Homeland Security Acquisitions: Earlier Requirements Definition and Clear Documentation of Key Decisions Could Facilitate Ongoing Progress. GAO-17-346SP. Washington, D.C.: April 6, 2017. Coast Guard Cutters: Depot Maintenance Is Affecting Operational Availability and Cost Estimates Should Reflect Actual Expenditures. GAO-17-218. Washington, D.C.: March 2, 2017. Homeland Security Acquisitions: Joint Requirements Council’s Initial Approach Is Generally Sound and It Is Developing a Process to Inform Investment Priorities. GAO-17-171. Washington, D.C.: October 24, 2016. Homeland Security Acquisitions: DHS Has Strengthened Management, but Execution and Affordability Concerns Endure. GAO-16-338SP. Washington, D.C.: March 31, 2016. National Security Cutter: Enhanced Oversight Needed to Ensure Problems Discovered during Testing and Operations Are Addressed. GAO-16-148. Washington, D.C.: January 12, 2016. TSA Acquisitions: Further Actions Needed to Improve Efficiency of Screening Technology Test and Evaluation. GAO-16-117. Washington, D.C.: December 17, 2015. Homeland Security Acquisitions: Major Program Assessments Reveal Actions Needed to Improve Accountability. GAO-15-171SP. Washington, D.C.: April 22, 2015. Coast Guard Aircraft: Transfer of Fixed-Wing C-27J Aircraft Is Complex and Further Fleet Purchases Should Coincide with Study Results. GAO-15-325. Washington, D.C.: March 26, 2015. Homeland Security Acquisitions: DHS Should Better Define Oversight Roles and Improve Program Reporting to Congress. GAO-15-292. Washington, D.C.: March 12, 2015. Coast Guard Acquisitions: Better Information on Performance and Funding Needed to Address Shortfalls. GAO-14-450. Washington, D.C.: June 5, 2014. Homeland Security Acquisitions: DHS Could Better Manage Its Portfolio to Address Funding Gaps and Improve Communications with Congress. GAO-14-332. Washington, D.C.: April 17, 2014. Homeland Security: DHS Requires More Disciplined Investment Management to Help Meet Mission Needs. GAO-12-833. Washington, D.C.: September 18, 2012. Department of Homeland Security: Assessments of Selected Complex Acquisitions. GAO-10-588SP. Washington, D.C.: June 30, 2010. Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight. GAO-09-29. Washington, D.C.: November 18, 2008.

Summary: Each year, the DHS invests billions of dollars in a diverse portfolio of major acquisition programs to help execute its many critical missions. DHS's acquisition activities are on GAO's High Risk List, in part, because of management and funding issues. The Explanatory Statement accompanying the DHS Appropriations Act, 2015 included a provision for GAO to review DHS's major acquisitions. This report, GAO's fourth annual review, assesses the extent to which: (1) DHS's major acquisition programs are on track to meet their schedule and cost goals, and (2) DHS has taken actions to enhance its policies and processes to better reflect key practices for effectively managing a portfolio of investments. GAO reviewed 28 acquisition programs, including DHS's largest programs that were in the process of obtaining new capabilities as of April 2017, and programs GAO or DHS identified as at risk of poor outcomes. GAO assessed cost and schedule progress against baselines, assessed DHS's policies and processes against GAO's key portfolio management practices, and met with relevant DHS officials. During 2017, 10 of the Department of Homeland Security (DHS) programs GAO assessed that had approved schedule and cost goals were on track to meet those goals. GAO reviewed 28 programs in total, 4 of which were new programs that GAO did not assess because they did not establish cost and schedule goals before the end of calendar year 2017 as planned. The table shows the status of the 24 programs GAO assessed. Reasons for schedule delays or cost increases included technical challenges, changes in requirements, and external factors. Recent enhancements to DHS's acquisition management, resource allocation, and requirements policies largely reflect key portfolio management practices (see table). However, DHS is in the early stages of implementing these policies. GAO identified two areas where DHS could strengthen its portfolio management policies and implementation efforts: DHS's policies do not reflect the key practice to reassess a program that breaches—or exceeds—its cost, schedule, or performance goals in the context of the portfolio to ensure it is still relevant or affordable. Acquisition management officials said that, in practice, they do so based on a certification of funds memorandum—a tool GAO has found to be effective for DHS leadership to assess program affordability—submitted by the component when one of its programs re-baselines in response to a breach. Documenting this practice in policy would help ensure DHS makes strategic investment decisions within its limited budget. DHS is not leveraging information gathered from reviews once programs complete implementation to manage its portfolio of active acquisition programs. DHS's acquisition policy requires programs to conduct post-implementation reviews after initial capabilities are deployed, which is in line with GAO's key practices. Acquisition management officials said they do not consider the results of these reviews in managing DHS's portfolio because the reviews are typically conducted after oversight for a program shifts to the components. Leveraging these results across DHS could enable DHS to address potential issues that may contribute to poor outcomes, such as schedule slips and cost growth, for other programs in its acquisition portfolio. GAO recommends DHS update its acquisition policy to require certification of fund memorandums when programs re-baseline as a result of a breach and assess programs' post-implementation reviews to improve performance across the acquisition portfolio. DHS concurred with GAO's recommendations.