Although the federal government has undertaken numerous initiatives to better manage the billions of dollars that federal agencies annually invest in IT, these investments too frequently fail or incur cost overruns and schedule slippages, while contributing little to mission-related outcomes. We have previously reported that the federal government has spent billions of dollars on failed IT investments. These investments often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. As a result of these failures, we added Improving the Management of IT Acquisitions and Operations to our biennial high-risk list in 2015. With its enactment in 2014, FITARA was also intended to improve agencies’ acquisitions of IT and facilitate Congress’ efforts to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. The act included specific provisions related to seven areas, including the five areas selected for our review: CIO authority enhancements—Covered agencies’ CIOs are required to (1) approve the IT budget requests of their respective agencies, (2) certify that agencies’ IT investments are adequately implementing OMB’s incremental development guidance, (3) review and approve contracts for IT, and (4) approve the appointment of other agency employees with the title of CIO (e.g., component agency CIOs). Enhanced transparency and improved risk management in IT investments—OMB and covered agencies are to make detailed information on federal IT investments publicly available, and department-level CIOs are to categorize their major IT investments by risk. Additionally, in the case of major investments rated as high risk for 4 consecutive quarters, the act required that the department- level CIO and the investment’s program manager conduct a review aimed at identifying and addressing the causes of the risk. Portfolio review—OMB and the CIOs of covered agencies are to implement a process to assist agencies in reviewing their portfolios of IT investments. This review process is intended to, among other things, identify or develop opportunities to consolidate the acquisition and management of IT services; identify potential duplication, waste, and cost savings; develop a multi-year strategy to identify and reduce duplication and waste within the agencies’ portfolios, including component agency investments, and to identify projected cost savings resulting from such a strategy. Federal data center consolidation initiative—Agencies are required to provide OMB with a data center inventory, a strategy for consolidating and optimizing the data centers (to include planned cost savings), and quarterly updates on progress made. The act also requires OMB to develop a goal for how much is to be saved through this initiative, and provide annual reports on cost savings achieved. Government-wide software purchasing program—GSA is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law states that, to the maximum extent practicable, GSA should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user. We have issued a number of reports that have identified actions that OMB and federal agencies needed to take to improve their implementation of the FITARA provisions. In reporting on incremental software development in November 2017, we noted that department-level CIOs certified only 62 percent of major IT software development investments as implementing adequate incremental development in fiscal year 2017. Officials from 21 of the 24 agencies in our review reported that challenges had hindered their CIOs’ ability to implement incremental development. These challenges included: (1) inefficient governance processes; (2) procurement delays; and (3) organizational changes associated with transitioning from a traditional software methodology that takes years to deliver a product, to incremental development, which delivers products in shorter time frames. We made recommendations to department-level CIOs to improve reporting accuracy and update or establish certification policies. As of February 2019, agencies had taken steps to address eight of the 19 recommendations. Additionally, our August 2018 report on department-level CIOs noted that none of the 24 agencies had policies that fully addressed the role of their CIOs consistent with federal laws and guidance, including FITARA. In addition, the majority of the agencies had not fully addressed the roles of their CIOs for any of six key areas that we identified. Although officials from most agencies stated that their CIOs were implementing the responsibilities even when not addressed in policy, the 24 CIOs acknowledged in a survey that they were not always very effective in implementing all of their responsibilities. Further, the shortcomings in agencies’ policies were attributable, at least in part, to incomplete guidance from OMB. We noted that, until OMB improved its guidance to clearly address all CIO responsibilities, and agencies fully addressed the role of CIOs in their policies, CIOs would be limited in effectively managing IT and addressing long-standing management challenges. We made 27 recommendations for agencies to improve the effectiveness of CIOs’ implementation of their responsibilities. Most agencies agreed with the recommendations and described actions they planned to take to address them. Enhanced transparency and improved risk management In June 2016, we reported on rating the risk of IT investments and noted that agencies underreported the risk of almost two-thirds of the investments their CIOs reviewed. All 17 selected agencies incorporated at least two of OMB’s factors into their risk rating processes and nine used all of the factors, interpreted differently, less often than on a monthly basis. Our assessments generally showed more risk than the associated CIO ratings. We also issued a series of reports about the IT Dashboard that noted concerns about the accuracy and reliability of the data on the Dashboard. In total, we have made 25 recommendations to OMB and federal agencies to help improve the accuracy and reliability of the information on the Dashboard and to increase its availability. Most agencies agreed with the recommendations or had no comments. As of February 2019, 11 of these recommendations remained open. In April 2015, we reported on actions needed by 26 federal agencies to ensure portfolio savings were realized and tracked. We noted that these agencies had decreased their planned PortfolioStat savings by at least 68 percent from what they reported to us in 2013. Specifically, while the agencies initially had planned to save at least $5.8 billion between fiscal years 2013 and 2015, these estimates were decreased to approximately $2 billion. We made recommendations to OMB and the Department of Defense aimed at improving the reporting of achieved savings, documenting how savings are reinvested, and establishing time frames for PortfolioStat action items. As of February 2019, OMB had addressed one of the five recommendations. Our September 2016 report on application inventories noted that most of the 24 agencies in the review fully met at least three of the four practices we identified to determine if agencies had complete software application inventories. Additionally, six of the agencies relied on their investment management processes and, in some cases, supplemental processes to rationalize their applications to varying degrees. However, five of the six agencies acknowledged that their processes did not always allow for collecting or reviewing the information needed to effectively rationalize all their applications. We made recommendations that 20 agencies improve their inventories and five of the agencies take actions to improve their processes to rationalize their applications more completely. Agencies had addressed four of the 25 recommendations as of February 2019. Federal data center consolidation initiative We have reported annually on agencies’ efforts to meet FITARA requirements related to the federal data center consolidation initiative. For example, in March 2016 we reported that, as of November 2015, the 24 agencies participating in the initiative had identified a total of 10,584 data centers, of which they reported closing 3,125 through fiscal year 2015. In total, 19 of the 24 agencies reported achieving an estimated $2.8 billion in cost savings and avoidances from fiscal years 2011 to 2015. We recommended that 10 agencies take action to address challenges in establishing, and to complete, planned data center cost savings and avoidance targets. We also recommended that 22 agencies take action to improve optimization progress, including addressing any identified challenges. As of February 2019, agencies had addressed 14 of our 32 recommendations. Our May 2018 report on data center consolidation noted mixed progress toward achieving OMB’s goals for closing data centers by September 2018. Over half of the agencies reported that they had either already met, or planned to meet, all of their OMB-assigned goals by the deadline. This was expected to result in the closure of 7,221 of the 12,062 centers that agencies reported in August 2017. However, four agencies reported that they did not have plans to meet all of their assigned goals and two agencies were working with OMB to establish revised targets. No new recommendations were made to agencies in this report because agencies had yet to fully address our previous recommendations. In May 2014, we reported on 24 federal agencies’ management of software licenses and the potential for achieving significant savings government-wide. Specifically, we found that OMB and the vast majority of the 24 agencies reviewed did not have adequate policies for managing software licenses. We also reported that federal agencies were not adequately managing their software licenses because they generally did not follow leading practices in this area. Consequently, we could not accurately describe the most widely used software applications across the government, including the extent to which they were over and under purchased. We recommended that the 24 agencies improve their policies and practices for managing licenses. Most agencies generally agreed with the recommendations or had no comments. We then reported in September 2014 that the 24 agencies had either provided a plan to address most of the recommendations we made to them, partially disagreed with the report’s prior findings, or did not provide information on their efforts to address the recommendations. As of February 2019, the agencies had addressed 109 of the 136 recommendations. The nine selected agencies identified a total of 12 practices that helped them to successfully implement the FITARA provisions considered in our review. Among the practices, a number of the agencies identified four that were overarching—that is, the practices were not unique to a specific provision, but, instead, better positioned agencies to implement the five provisions selected for our review. In addition, agencies identified one practice that helped ensure effective implementation of CIO one practice that helped ensure enhanced transparency and improved one practice that ensured effective portfolio review, four practices that facilitated data center consolidation, and one practice that facilitated software purchasing. Figure 1 identifies the 12 practices that the nine agencies used to effectively implement the selected FITARA provisions. In addition, the narrative following the figure provides details on how these agencies implemented the provisions and realized associated IT management improvements or cost savings. Four of the nine agencies that we reviewed—Commerce, HHS, NASA, and USDA—identified one or more overarching practices that have been vital to their efforts in implementing FITARA: obtain support from senior leadership, treat the implementation of FITARA as a program, establish FITARA performance measures for component agencies, appoint an executive accountable for FITARA implementation in each component agency. As a result of implementing these practices, each of the agencies was better positioned to implement FITARA. Obtain support from senior leadership Three of the agencies—USDA, NASA, and Commerce—emphasized that the support of senior leadership was essential to implementing requirements in FITARA. This support was demonstrated, for example, by senior officials highlighting the act’s importance during key executive-level meetings and in their key memorandums and other communications to the agencies’ workforce. We have previously reported that having senior leadership support is critical to the success of major programs. According to USDA’s Director of FITARA Operations, the agency made a decision to raise the topic of FITARA implementation at each monthly executive leadership meeting that is attended by the Deputy Secretary, Chief Operating Officer, and Assistant Secretary for Administration, in order to keep attention focused on the act’s implementation. In addition, the agency’s October 2016, Concept of Operations for The Oversight, Management, and Operations of FITARA document, which is the primary document used by the agency to assist with the implementation and execution of the act, was signed by the Deputy Secretary, CIO, and Deputy CIO. The officials reported that obtaining support from senior leadership had helped ensure buy-in to changes resulting from implementing provisions of the act. NASA officials also highlighted senior leadership support as being essential to their actions to implement FITARA. For example, the NASA Deputy Administrator and Associate Administrator for Mission Support signed and distributed a memorandum in August 2010 that emphasized the agency’s commitment to the data center consolidation effort. The memorandum stated that Mission Directorate Associate Administrators and Center Directors shall direct their staff to cooperate fully and openly with NASA’s data center consolidation plan. An official in the Office of the CIO stated that the memorandum was evidence of the support the agency had from senior leadership to close data centers. Further, a Commerce official stated that FITARA implementation activities at the agency have had support from agency leadership, including the Deputy Secretary and the CIO. For example, according to the official, the Deputy Secretary provided each of the component agency FITARA sponsors with a signed memorandum asking for assistance from the components. This action resulted in increased cooperation throughout the agency when components were asked to respond to FITARA-related requests for information. Treat implementation of FITARA as a program Commerce and USDA reported that treating FITARA implementation as if it were an IT program was important to implementing the requirements of the act. The two agencies demonstrated this practice by assigning staff to manage implementation of FITARA and regularly discussing implementation of the act at meetings with senior-level officials. According to a Commerce lessons learned document, the agency has managed FITARA like a program by reporting regularly on its implementation status to internal agency stakeholders. In addition, the agency has assigned a program manager to assist with implementation of the act and to track progress on implementing the act’s provisions. As a result, Commerce officials reported that the importance of FITARA has been regularly discussed throughout the agency in bi-weekly meetings within the Office of the Secretary. These meetings led to an increased sense of cooperation between different disciplines (e.g., IT, budget, acquisition, legal, and human resources) and reduced the impression that FITARA was solely focused on the department-level CIO office. Further, USDA created the position of Executive Director for FITARA Operations within the department-level CIO office. This position has responsibility for, among other things, establishing the processes and procedures to bring the agency into compliance with the act and IT management controls that meet the FITARA requirements. The Director stated that treating the implementation of FITARA as if it were an IT program has led the agency to develop key documentation that has assisted in the implementation of the act, including its Concept of Operations for the Oversight, Management, and Operations of FITARA and Data Center Closure Process. Establish FITARA performance measures for component agencies HHS established internal FITARA performance measures for its component agencies that officials believe have led to increased effectiveness in implementing the act. Specifically, the agency undertook an effort to increase its FITARA scorecard grades—called “A by May”— with a goal to attain an ‘A’ on the May 2018 FITARA 6.0 scorecard. As part of this effort, HHS created its own internal scorecard for each of its component agencies that mirrored the agency’s FITARA scorecard. According to an HHS lessons learned document, aligning the FITARA metrics to component agency performance resulted in greater transparency between the department-level CIO and component agency CIOs. The effort to establish internal performance measures received support from senior agency leadership. Specifically, it was endorsed by the Assistant Secretary for Administration and the Principal Deputy for Administration, which agency officials believed was a key factor in the effort’s success. HHS officials also reported that their internal scorecard was helpful because it let component agencies know how well they were doing relative to each other. The officials also believed that establishing FITARA performance measures led to increased cooperation and communication between component agencies and the department-level CIO office. For example, the increased cooperation allowed HHS to more easily collect data required to update the House Committee on Oversight and Government Reform’s FITARA scorecard. At the December 2018 House Committee on Oversight and Government Reform hearing on FITARA, the HHS Acting CIO attributed the agency’s increased scorecard grade—from a ‘D’ on the initial November 2015 scorecard to a ‘B+’ on the December 2018 scorecard—to the “A by May” initiative. According to this official, the measurement of component agencies’ performance had elevated the importance of meeting FITARA objectives and paved the way for agency-wide participation in improvement efforts. Appoint an executive accountable for FITARA implementation in each component agency According to a Commerce memorandum, the Assistant Secretary for Administration asked each component agency to identify a FITARA executive sponsor. The sponsors were assigned responsibility for gathering the necessary information on component agencies’ efforts to implement FITARA and for alerting the agency’s CIO of any issues that needed to be addressed. Once the sponsors were identified, the Commerce Deputy Secretary sent a letter to each sponsor, asking them to help ensure cooperation between their component agencies and the department’s CIO office. A Commerce official reported that having a sponsor in component agencies with responsibility for providing the information needed to report on FITARA results to the department’s CIO office had increased component agencies’ responsiveness to information requests and improved cooperation throughout the agency. Commerce and DHS developed policies to explain how the specific authorities that FITARA provided to the agency CIO are to be carried out. The agencies identified the policies as essential to their ability to implement the CIO authority enhancements provision in FITARA. Commerce officials stated, for example, that their agency established a policy to ensure that the CIO certified major IT investments as adequately implementing incremental development. Specifically, Commerce’s capital planning guidance required component agency CIOs or other accountable officials within the component agencies to certify the adequate implementation of incremental development for these investments. Commerce’s guidance described the role of the CIO in the certification process and how the CIOs’ certification should be documented. The guidance also included definitions of incremental development and time frames for delivering functionality. Officials in Commerce’s Office of the CIO reported that the certification policies assisted them in overseeing the management of IT investments and ensuring the use of incremental development throughout the agency, as called for by FITARA. Also, Commerce changed its personnel policy to require the department- level CIO to approve all senior level IT positions, which addressed the FITARA requirement for the CIO to approve the appointment of other staff with the title of CIO (e.g., component agency CIOs). Specifically, in February 2016, Commerce developed a new human capital policy to give its department-level CIO input into the hiring of all senior level IT positions, including component CIOs. As a result, a Commerce official reported that the policy ensures that the CIOs’ authority has been enhanced to include significant involvement in the hiring of IT leaders throughout the agency. For its part, DHS established a policy to ensure that the department-level CIO certified major IT investments as adequately implementing incremental development. Specifically, DHS’s technical investment review guidance states that the CIO is to conduct a review of each investment using an investment review checklist that includes information provided by project managers as to whether the investments have used incremental development adequately. The CIO is to certify whether the project is implementing incremental delivery at least every 6 months and is to document this certification in the checklist. As a result, officials in DHS’s Office of the CIO said that they can now use information from the incremental certification checklist to improve incremental development processes and to make corrections to projects that were not adequately implementing incremental development. Three agencies—Commerce, DHS, and USDA—identified one practice that was key to their effective implementation of the enhanced transparency and improved risk management provision of FITARA. The practice is to implement a risk rating process for IT investments that incorporates risks (e.g., funding cuts or staffing changes). Commerce’s Office of the CIO implemented a process where this office reviewed at least the top three risks for each investment, verified that these risks were specific to the investment and were appropriately managed and mitigated, and verified that the risk register was updated regularly. In addition, DHS implemented a process that included a review of investment risks, ensured that the risks were current, and that risk mitigation plans were in place. Also, in November 2017, USDA updated its risk rating process to incorporate risks. Specifically, it updated its risk management scoring criteria to include an evaluation of the management and risk exposure scores of risks. The actions that Commerce, DHS, and USDA took to incorporate reviews of risks into their risk rating processes better positioned the agencies to provide more detailed and accurate information on their IT investments to the public. Four of the agencies—GSA, Justice, DHS, and USAID—identified performing application rationalization activities as vital to their effective implementation of the portfolio review provision of FITARA. Application rationalization activities can include establishing a software application inventory, collecting information on each application, or evaluating an agency’s portfolio of IT investments to make decisions on applications (e.g., retire, replace, or eliminate). We have previously reported that the principles of application rationalization are consistent with those used to manage investment portfolios. GSA and Justice performed application rationalization by engaging in efforts to establish complete and regularly updated application inventories. To do so, component agencies specified basic application attributes in their inventories (e.g., application name, description, owner, and function supported), and regularly updated the inventories. As we have previously reported, by having an application inventory that is complete and regularly updated, agencies such as GSA and Justice are better positioned to realize cost savings and efficiencies through activities such as consolidating redundant applications. For its part, DHS utilized application rationalization to identify duplicate investments and consolidate systems. Part of the effort included the regular assessment of programs against criteria such as the program’s cost, schedule, and performance relative to established targets. According to the agency, this resulted in the consolidation of site services, including help desk operations. DHS reported that this consolidation resulted in savings that cumulatively accrued to $202 million by fiscal year 2015. In addition, as an application rationalization activity, USAID reviewed its portfolio of IT investments in order to identify systems to potentially retire or decommission—a requirement of the portfolio review provision of FITARA. Specifically, the agency developed an information system decommissioning plan to retire old systems. The plan described USAID’s three-step approach to decommissioning systems: (1) identifying decommissioning candidates, (2) conducting system reviews and decommissioning decisions and (3) decommissioning planning and execution. As a result of this approach to implementing the portfolio review provision of FITARA, the agency reported in its Information Systems Decommissioning Plan that it has decommissioned 78 old systems and identified additional systems to decommission in future years. Agency officials reported that USAID achieved cost savings of almost $10 million since 2016 as a result of decommissioning systems. GSA, Justice, NASA, USAID, and USDA identified four practices that were essential to their effective implementation of the data center consolidation provision of FITARA and resulted in agencies realizing cost savings or other IT management improvements: conduct site visits to all data centers, transition to a virtual or cloud-based environment, incentivize component agencies to accelerate the pace of data center consolidation, and utilize data centers with excess capacity. Agencies’ actions to implement these practices have led to the retirement of older systems, increased cost savings and future cost avoidance, and a reduction in the number of data centers. In addition, as a result of applying these practices, the agencies were better able to make progress in consolidating and optimizing data centers. Conduct site visits to all data centers USDA and Justice conducted site visits to all of their data centers to more effectively address the data center provision of FITARA. Both agencies stated that the site visits had allowed them to more thoroughly document the inventory of applications and IT hardware in each of the data centers and to validate progress made toward closing data centers. USDA officials stated that conducting site visits to their data centers played a pivotal role in the successful implementation of data center consolidation by providing more direct communication with data center staff to address concerns and issues that staff had about consolidation of the centers. Additionally, agency officials reported that they were able to obtain more detailed information necessary to meet the FITARA requirements for reporting to OMB on USDA’s data center inventory and progress made on data center closures as a result of conducting site visits. Further, Justice officials stated that site visits conducted by staff in the CIO’s office that were responsible for data center consolidation played a key role in the closure of many of the agency’s data centers. Specifically, the officials said that conducting site visits in person showed data center staff that data center consolidation was a priority for the agency. The officials added that the site visits also showed data center staff that they were valued as partners in the consolidation effort. Transition to a virtual or cloud-based environment USDA, GSA, NASA, and USAID have taken actions to transition to a virtual or cloud-based environment as a way to effectively implement the data center consolidation provision of the act. The agencies’ actions consisted of moving data from agency-owned data centers to cloud- based environments, which helped the agencies make progress toward meeting the cost savings and data center optimization requirements of FITARA. USDA officials reported that the agency has been successful in having its components use cloud technology to reduce the number of data centers. For example, the USDA Forest Service developed a migration strategy to move all of the Forest Service production systems and applications from its data centers to USDA’s Enterprise Data Center and Cloud Infrastructure as a Service located at the National Information Technology Center in Kansas City, Missouri. As a result of moving its production systems and applications, the Forest Service increased virtualization, resolved many long-term security vulnerabilities, and reduced the number of duplicative and stand-alone applications by 70 percent. The Forest Service reported that it had identified cost savings of up to $6.1 million annually as a result of these efforts. In addition, GSA developed a data center consolidation strategy which included migrating services from agency-owned data centers to more flexible and optimized cloud computing environments, shared service and co-location centers, and more optimized data centers within their own inventory. For example, the agency migrated numerous systems to provisioned services via cloud computing services. GSA officials reported that their agency has encouraged virtualization and cloud computing as preferred options above new physical implementations. The agency also continues to migrate away from hardware-dependent operating systems and to utilize, build upon, and mature its enterprise service virtualization platform offerings and capabilities. As a result of these actions, the agency has been able to more effectively retire older systems in order to shift them to newer, virtualized technologies. NASA officials stated that their agency is transitioning to a cloud-based environment to close its data centers. For example, NASA moved all of the data from the Earth Observing System to a new commercial cloud- based model that hosts all the data in one location. The Earth Observing System was designed over a decade ago and its data were held at different partner locations based on science discipline (e.g., land, oceans, and atmosphere) and provided data that were used by the public in various capacities. The agency funded data center hardware at each of the locations and transported data between the locations, as necessary, to create integrated data products. According to NASA officials, transitioning to a cloud-based environment has resulted in easier access to NASA data by the public, elimination of recurring capital investments in data center hardware, and improved IT security. USAID reported that it saved money and increased efficiency by consolidating all of its data centers into a single data center in 2012 and then transitioning its single data center to a cloud-based environment. USAID completed the migration of its data center to the cloud in June 2018. According to the agency, moving to the cloud is expected to result in $36 million in future cost avoidance for the agency. Incentivize component agencies to accelerate the pace of data center consolidation Data center consolidation activities can be costly, requiring agencies to use resources to, for example, analyze the need for IT equipment (e.g., servers, processors, networking, and other hardware) and to move such equipment between locations. Our May 2018 report on the results of agencies’ efforts to consolidate data centers noted mixed progress toward achieving OMB’s goals for closing data centers. Justice incentivized a component agency to accelerate its participation in data center consolidation by providing supplemental funding for costs associated with consolidation. For example, the agency’s CIO office provided funding for a component agency to offset the cost to move servers and data center equipment to another location. Justice officials noted that the agency has seen increased cooperation from component agencies as a result of offering supplemental funding to participate in its data center consolidation effort. Utilize data centers with excess capacity A part of GSA’s strategy for consolidating data centers was to move existing data to other government data centers that had the capacity to store its data. To do so, GSA established shared service agreements with the Environmental Protection Agency’s National Computer Center and NASA’s Stennis Space Center data centers. As a result of moving its data to other government data centers with excess capacity, GSA was able to consolidate numerous data centers, resulting in increased efficiency and cost savings. USDA, VA, GSA, NASA, and USAID identified the practice of centralizing the management of software licenses as essential to their effective implementation of the software purchasing provision of FITARA. These five agencies did this by, for example, establishing a software management team, creating contracts with vendors to centrally manage licenses, and establishing governance processes for software license management. USDA employed a centralized software license management approach by establishing a Category Management Team. This team was responsible for the oversight of all software license enterprise agreements, which included collecting, reviewing, consolidating, and reporting on all software procurements. The agency also created Enterprise IT Category Management guidance that supported the central oversight authority for managing enterprise software license agreements. Further, according to USDA officials, management has been supportive in ensuring that all organizations and components join existing enterprise contracts that are already in place. USDA’s actions to centralize the management of its software licenses have led to effective agency-wide decisions regarding software purchases that the agency reported have yielded cost savings. For example, the agency identified instances where multiple software contracts at different price points among component agencies could be consolidated into one contract at the lowest price. This resulted in reducing the cost per license for a software product from $250 to $15.75, saving the agency approximately $85,000 between 2016 and 2017, according to USDA documentation. VA established an Enterprise Software License Management Team to centralize the management of its efforts to purchase software. According to officials in VA’s Office of Information and Technology, this team consisted of knowledgeable staff that had experience with software management and development, and was familiar with software that was deployed across the entire agency. These officials also stated that the Enterprise Software License Management Team conducted weekly meetings with GSA to discuss software licensing and category management to ensure they were aware of other opportunities for cost savings. VA also established an Enterprise Software Asset Management Technical Working Group that was formed to define and document a framework that employed a centralized software license management approach. By centralizing the management of its software licenses, VA has been able to make effective agency-wide decisions regarding the purchase of software products and reported that it has realized cost savings. Specifically, VA provided documentation showing that it had implemented a solution to analyze agency-wide software license data, including usage and costs. The agency identified approximately $65 million in cost savings between 2017 and 2020 due to analyzing one of their software licenses. We previously reported that GSA and USAID had centralized the management of their software licenses. We reported that GSA’s server- based and enterprise-wide licenses were managed centrally, whereas non-enterprise-wide workstation software licenses were generally managed regionally. GSA also issued a policy that established procedures for the management of all software licenses, including analyzing software licenses to identify opportunities for consolidation. Centralizing the management of its purchase of software licenses has led GSA to make effective agency-wide decisions regarding its software licenses and avoid future costs, according to agency documentation. For example, in fiscal year 2015, the agency consolidated licenses for one of its software products, saving the agency over $400,000 and avoiding over $3 million in future costs. For its part, USAID had a contract in place with a vendor for centrally managing licenses for all of its operating units. Further, according to officials within USAID’s Office of the CIO, the agency established a governance process to manage the introduction of new software. As part of this governance process, USAID’s Software and Hardware Approval Request Panel was responsible for reviewing requests to procure new software. USAID’s actions on centralizing the management of its software licenses have led to effective agency-wide decisions regarding software purchases that the agency reported have yielded cost savings. For example, USAID identified opportunities to reduce costs on its software licenses through consolidation or elimination of software. This resulted in the agency reporting a cumulative savings from fiscal year 2016 to fiscal year 2018 of over $2.5 million on software licenses. NASA issued a software license management policy that included the roles and responsibilities for central management of the agency’s software licenses. In addition, in May 2017, NASA’s Administrator issued a memorandum requiring component agencies to use the agency’s Enterprise License Management Team to manage software licenses. By employing a centralized software license management approach, NASA made effective agency-wide decisions on software licenses which the agency reported led to cost avoidance. For example, the agency increased the number of software agreements managed by its enterprise license management team from 24 to 42 in fiscal year 2014, and analyzed its software license data to identify opportunities to reduce costs and make better informed investments moving forward. As a result, NASA reported that it realized cost avoidance of approximately $224 million from fiscal years 2014 through 2018. In summary, as a result of applying the practices identified in this review, the selected agencies were better positioned to implement FITARA provisions and realized IT management improvements and cost savings. We requested comments on a draft of this report from each of the nine agencies included in our review, as well as from OMB. In response, one agency—USAID—provided written comments, which are reprinted in appendix I. Another agency—DHS—provided technical comments, which we incorporated in the report, as appropriate. The other 7 agencies and OMB did not provide comments on the draft report. In its comments, USAID described actions that it had taken to enhance the authority of its CIO. Specifically, the agency stated that it had proposed that the CIO report directly to the Administrator and had notified the congressional committees of jurisdiction about this intended action. Further, USAID stated that, as of April 2019, the Administrator would be expected to approve revisions to internal policy to clarify and strengthen the authority of the CIO in line with FITARA and our report. We are sending copies of this report to the appropriate congressional committees, the heads of the Departments of Agriculture, Commerce, Health and Human Services, Homeland Security, Justice, and Veterans Affairs; the General Services Administration; the National Aeronautics and Space Administration; the U.S. Agency for International Development; the Director of the Office of Management and Budget; and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions on matters discussed in this report, please contact me at (202) 512-4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. Carol C. Harris, (202) 512-4456 or harriscc@gao.gov. In addition to the contact named above, Dave Powner (Director), Mark Bird (Assistant Director), Eric Trout (Analyst-in-Charge), Justin Booth, Chris Businsky, Quintin Dorsey, Rebecca Eyler, Dave Hinchman, Valerie Hopkins, Kaelin Kuhn, Sabine Paul, Monica Perez-Nelson, Meredith Raymond, Bradley Roach, Andrew Stavisky, Niti Tandon, Christy Tyson, Adam Vodraska, Kevin Walsh, Jessica Waselkow, and Eric Winter made key contributions to this report.

Summary: Congress has long recognized that IT has the potential to enable federal agencies to accomplish their missions more quickly, effectively, and economically. However, fully exploiting this potential has presented challenges to covered agencies, and the federal government's management of IT has produced mixed results. As part of its effort to reform the government-wide management of IT, in December 2014 Congress enacted FITARA. The law included specific requirements related to enhancing Chief Information Officers' (CIO) authorities, improving the risk management of IT investments, reviewing agencies' portfolio of IT investments, consolidating federal data centers, and purchasing software licenses. GAO has reported numerous times on agencies' effectiveness in implementing the provisions of the law and highlighted agencies that have had success in implementing selected provisions. In this report, GAO identifies practices that agencies have used to effectively implement FITARA. GAO selected five provisions of FITARA to review: (1) CIO authority enhancements; (2) enhanced transparency and improved risk management; (3) portfolio review; (4) data center consolidation; and (5) software purchasing. GAO then selected nine agencies that had success in implementing at least one of the five provisions. GAO compiled practices where at least one agency was better positioned to implement a provision or realized an IT management improvement or cost savings. Nine selected agencies (the Departments of Agriculture, Commerce, Health and Human Services, Homeland Security, Justice, and Veterans Affairs; the Agency for International Development; the National Aeronautics and Space Administration; and the General Services Administration) identified 12 practices that helped them to effectively implement one or more Federal Information Technology Acquisition Reform Act provisions (commonly referred to as FITARA). The following figure identifies the 12 practices, including the four overarching ones, considered vital to implementing all provisions. By applying the overarching practices, covered agencies were better positioned to implement FITARA. In addition, by implementing the practices relative to the five FITARA provisions GAO selected, covered agencies realized information technology (IT) management improvements, such as decommissioning old systems and cost savings.