The US-VISIT expenditure plan, including related program documentation and program officials’ statements, satisfies or partially satisfies some, but not all, of the legislative conditions. Specifically, the legislative conditions that DHS certify that an independent verification and validation agent is currently under contract for the program and that the DHS Investment Review Board, the Secretary of Homeland Security, and the Office of Management and Budget (OMB) review and approve the plan were satisfied. However, DHS only partially satisfied the legislative conditions that it (1) meet the capital planning and investment control review requirements established by OMB, including OMB Circular A-11, part 7; (2) comply with DHS’ enterprise architecture; and (3) comply with federal acquisition rules, requirements, guidelines, and systems acquisition management practices. In addition, DHS did not satisfy the legislative conditions that the plan include (1) a comprehensive US-VISIT strategic plan and (2) a complete schedule for biometric exit implementation. DHS has partially implemented our recommendations pertaining to US- VISIT that have been open for 4 years. These recommendations, along with their status, are summarized here. Recommendation: Develop and begin implementing a system security plan and perform a privacy impact analysis and use the results of this analysis in near term and subsequent system acquisition decision making. DHS has partially implemented this recommendation. In December 2006, the program office developed a US-VISIT security strategy and has since begun implementing it. However, the scope of this strategy does not extend to all the systems that comprise US-VISIT, such as the Treasury Enforcement Communications System (TECS). We recently testified that TECS has neither the security controls and defensive perimeters in place for preventing an intrusion, nor the capability to detect an intrusion should one occur. Until a more comprehensive security strategy is developed, the systems that comprise US-VISIT could place it at increased risk. Recommendation: Develop and implement a plan for satisfying key acquisition management controls, including acquisition planning, solicitation, requirements management, project management, contract tracking and oversight, evaluation, and transition to support, and implement the controls in accordance with Software Engineering Institute (SEI) guidance. DHS has partially implemented this recommendation. Since 2005, the program office reports progress in implementing 113 practices associated with six SEI key process areas. However, the six areas of focus do not include all of the management controls that our recommendations cover, such as solicitation and transition to support. As long as the program office does not address all of the management controls that we have recommended, it will unnecessarily increase program risks. Recommendation: Ensure that expenditure plans fully disclose what system capabilities and benefits are to be delivered, by when, and at what cost, as well as how the program is being managed. DHS has partially implemented this recommendation. The fiscal year 2007 expenditure plan discloses planned system capabilities, estimated schedules and costs, and expected benefits. However, schedules, costs, and benefits are not always defined in sufficient detail to be measurable and to permit oversight. Finally, the plan does not fully disclose challenges or changes associated with program management. Without such information, the expenditure plan may not provide Congress with enough information to exercise effective oversight and to hold the department accountable. Recommendation: Ensure that the human capital and financial resources provided are sufficient to establish a fully functional and effective program office and associated management capability. DHS has partially implemented this recommendation. At one point in 2006, all of the program office’s 115 government positions were filled. However, 21 positions have since become vacant. Without adequate human capital, particularly in key positions and for extended periods, program risks will increase. Recommendation: Clarify the operational context within which US- VISIT must operate. DHS has partially implemented this recommendation. DHS has yet to define the operational context in which US-VISIT is to operate, such as having a departmentally approved strategic plan or a well-defined department enterprise architecture (EA). While the expenditure plan includes a departmentally approved US-VISIT strategic plan, it does not address key elements of relevant federal strategic planning guidance. Moreover, we recently reported that the version of the department’s EA that DHS has been using for US-VISIT alignment purposes was missing architecture content and was developed with limited stakeholder input. Finally, although program officials have met with related programs to coordinate their respective efforts, specific coordination efforts have not been assigned to any DHS entity. Until a well-defined operational context exists, the department will be challenged in its ability to define and implement US-VISIT and related border security and immigration management programs in a manner that promotes interoperability, minimizes duplication, and optimizes departmental capabilities and performance. Recommendation: Determine whether proposed US-VISIT increments will produce mission value commensurate with costs and risks and disclose to its executive bodies and Congress the results of these business cases and planned actions. DHS has partially implemented this recommendation. We recently reported that, while a business case was prepared for Increment 1B, the analysis performed met only four of the eight criteria in OMB guidance. Since then, the program office has developed business cases for two projects: Unique Identity and U.S. Travel Documents-ePassports (formerly Increment 2A), and we have ongoing work to address, among other things, these business cases. Further, the program office has yet to develop a business case for another project that it plans to begin implementing this year—biometric exit at air ports of entry (POE). Until the program office has reliable business cases for each US-VISIT project in which alternative solutions for meeting mission needs are evaluated on the basis of costs, benefits, and risks, it will not be able to adequately inform its executive bodies and Congress about its plans and will not provide the basis for prudent investment decision making. Recommendation: Develop and implement a human capital strategy that provides for staffing open positions with individuals who have the requisite core competencies (knowledge, skills, and abilities). DHS has partially implemented this recommendation. In February 2006, we reported that the program office issued a human capital plan and had begun implementing it. However, DHS stopped doing so during 2006 pending departmental approval of a DHS-wide human capital initiative and because all program office positions were filled. However, as noted earlier, the program office now reports that it has 21 government positions— including critical leadership positions—that are now vacant. Moreover, it has stated that it developed a new human capital plan but we did not review this plan because it is still undergoing departmental review. Until the department approves the human capital plan and the program office begins to implement it, the program will continue to be at risk. Recommendation: Develop and implement a risk management plan and ensure that all high risks and their status are reported regularly to the appropriate executives. DHS has partially implemented this recommendation. US-VISIT has approved a risk management plan and has begun implementing it. However, the current risk management plan does not address when risks should be elevated beyond the level of the US-VISIT Program Director. According to program officials, elevation of US-VISIT risks is at the discretion of the Program Director, and no risks have been elevated to DHS executives since December 2005. Until the program office ensures that high risks are appropriately elevated, department executives will not have the information they need to make informed investment decisions. Recommendation: Define performance standards for US-VISIT that are measurable and reflect the limitations imposed on US-VISIT capabilities by relying on existing systems. DHS has partially implemented this recommendation. The program office has defined technical performance standards for several increments, but these standards do not contain sufficient information to determine whether they reflect the limitations imposed by relying on existing systems. As a result, the ability of these increments to meet performance requirements remains uncertain and the ability to identify and effectively address performance shortfalls is missing. While available data show that prime contract cost and schedule expectations are being met, aspects of the US-VISIT program continue to lack definition and justification. Each of our observations in this regard are summarized here. Earned value management (EVM) data on ongoing prime contract task orders show that cost and schedule baselines are being met. EVM is a program management tool for measuring progress by comparing the value of work accomplished with the amount of work expected to be accomplished. Data provided by the program office show that the cumulative cost and schedule variances for the overall prime contract and all 12 ongoing task orders are within an acceptable range of performance. DHS continues to propose a heavy investment in program management- related activities without adequate justification or full disclosure. Program management is an important and integral aspect of any system acquisition program and should be justified in relation to the size and significance of the acquisition activities being performed. In 2006, program management costs represented 135 percent of planned development. This means that for every dollar spent on new capabilities, $1.35 was spent on management. The fiscal year 2007 expenditure plan similarly proposed investing $1.25 on management-related activities for every dollar invested in new development. However, the plan does not explain the reasons for the sizable investment in management-related activities or otherwise justify it on the basis of measurable expected value. Without disclosing and justifying its proposed investment and program management-related efforts, it is unclear that such a large amount of funding for these activities represents the best use of resources. Lack of a well-defined and justified exit solution introduces the risk of repeating failed and costly past exit efforts. DHS has issued a high-level schedule for air exit, but information supporting that schedule is not yet available. In addition, there are no other exit program plans available that define what will be done, by what entities, and at what cost in order to define, acquire, deliver, deploy, and operate this capability.