FEMA’s mission is to support citizens and first responders to build, sustain, and improve the nation’s capability to prepare for, protect against, respond to, recover from, and mitigate all hazards. It supplies immediate needs, such as ice, water, food, and temporary housing in response to disasters. FEMA also provides financial assistance to individuals who have sustained damage to their personal property, and to state and local governments for damage to public property. To support its mission, FEMA has more than 4,900 full-time employees located at its headquarters in Washington, D.C., its 10 regional offices, two area offices, five recovery offices, and various sites across the country. Additionally, FEMA has more than 3,700 standby disaster assistance employees who are available for disaster deployment and nearly 5,000 reserve employees. The agency also partners with other organizations that are part of the nation’s emergency management system, including 27 federal agencies, state and local emergency management agencies, and the American Red Cross. For fiscal year 2015, FEMA’s budget request was approximately $14.7 billion, representing 24 percent of the DHS budget request of approximately $60.9 billion. The agency is headed by an Administrator and its primary mission areas include Federal Insurance and Mitigation, Mission Support, Protection and National Preparedness, Regional Operations, Response and Recovery, and United States Fire Administration, as depicted in figure 1. Each component has multiple directorates and program offices that carry out disaster response missions and functions, as well as administrative support. Within the Mission Support component, the OCIO is responsible for developing, enhancing and maintaining the IT systems, and increasing efficiencies and cooperation across the entire FEMA organization. OCIO partners with FEMA programs and regional offices to provide for systems development, testing, implementation, and operations and maintenance efforts. For example, the regions have IT employees that report directly to the regional leadership; these staff are to coordinate with the OCIO on IT responsibilities such as managing and supporting IT hardware and software (e.g., needs assessment and hardware issuance, inventory, and decommissioning). According to OCIO officials, in fiscal year 2015, FEMA’s OCIO was made up of nearly 300 federal employees and 228 contractors and had a budget of approximately $122.1 million, which is about one-third of the FEMA IT budget for fiscal year 2015. As shown in figure 1, the office is organized into nine offices and divisions to plan and manage FEMA’s IT environment. IT systems play a critical role in supporting FEMA’s response and recovery efforts. For example: The Disaster Assistance Improvement Program (DAIP) has a major interagency support system that provides disaster survivors an online registration vehicle (including mobile capabilities) to apply for disaster assistance from 17 federal partners, including Individual Assistance from FEMA, and is managed by FEMA’s Office of Response and Recovery. DAIP is currently in the mixed life cycle phase of the systems engineering life cycle; spending on the program was about $13.7 million in fiscal year 2015, of which $12.9 million is from FEMA and the rest is from other federal partners. The Emergency Management Mission Integrated Environment (EMMIE) program has an Internet-based enterprise-wide electronic system for FEMA to manage grants throughout the entire grant life cycle using a standardized web-based interface, and is also managed by FEMA’s Office of Response and Recovery. EMMIE is currently in the operations and maintenance phase of the systems engineering life cycle; the agency spent about $2.7 million on the program in fiscal year 2015. FEMA does not plan to make any enhancements to EMMIE’s functionality because the system is scheduled to be decommissioned once the agency’s Grants Management Modernization system, the enterprise-wide capability for the management of all FEMA disaster and non-disaster grants, is implemented. According to the EMMIE officials, the implementation date is estimated to occur in 2020. The Integrated Public Alert and Warning System (IPAWS) program has a major system that provides a broad range of messaging capabilities through multiple pathways to ensure that the delivery of alerts and warnings reaches more people, and is managed by FEMA’s National Continuity Programs Directorate. IPAWS is currently in the mixed life cycle phase of the systems engineering life cycle; FEMA spent about $10.9 million on the program in fiscal year 2015. In addition, FEMA’s Enterprise Applications Development, Integration, and Sustainment (EADIS) program is intended to develop and integrate new and modernized applications while supporting the sustainment of existing technology, services, and applications. There are almost 80 FEMA systems, including grant tracking, family locator, and assessment reporting, that are supported by EADIS. The current FEMA EADIS contract consists of many individual platform-specific work orders that encompass a spectrum of new and old technologies, architectures, platforms, and tools that include a variety of personal computer-based, client-server, web-based, and service-oriented components. OCIO is also responsible for managing and maintaining the networks, databases, desktops, and telephone systems to support the operations of permanent facilities at FEMA. The CIO is also responsible for providing the IT infrastructure to support hundreds of emergency personnel at temporary disaster field offices and recovery centers, often in remote locations. This involves running cable, establishing networks, supplying wireless connectivity, and installing equipment for information processing and data and voice communications. In addition, a national IT helpdesk is to assist internal users in various ways such as providing and maintaining system accounts, ensuring remote access, troubleshooting systems problems, and making referrals to engineers for systems fixes. Prior GAO and IG assessments have identified concerns with several aspects of FEMA’s IT management. For example: In 2012, we reported that a subsidiary project for FEMA’s DAIP, which included usability enhancements to the agency’s DisasterAssistance.gov website, was delayed. Specifically, technical issues in establishing a testing and development environment that matched the production environment delayed project testing and caused cost and schedule shortfalls. For example, costs for a project under FEMA’s DAIP investment rose approximately 27 percent ($210,000) due, in part, to the delayed deployment of another investment. We recommended that the department define and document corrective actions for these shortfalls. The department agreed with our recommendation and subsequently developed a remediation plan for most of the shortfalls to limit the negative impact. In 2011, we reported that FEMA faced significant management challenges in areas that affect the National Flood Insurance Program, which is to provide direct disaster relief after floods. These challenges included ineffective collaboration among offices within the agency that were responsible for administering the program, including the Mission Support office, which provided mission-critical functions, such as IT, acquisition, and financial management. To address these challenges, we recommended, among other things, that FEMA develop protocols to encourage and monitor collaboration between the office that administers the National Flood Insurance Program and relevant support offices, including those for IT, acquisition management, and financial management. In response, the Mission Support Bureau had an ongoing effort to meet with FEMA program offices to better understand the needs of their customers and encourage collaboration between the Bureau and these offices. In 2015, we identified this program on our high-risk list due to the structural weaknesses on how the program is funded and weaknesses in management and program operations. In response, officials stated that the agency is in the acquisition stage for a new IT system for the entire National Flood Insurance Program. We also reported, in 2009, that FEMA faced coordination issues and technical challenges in developing and implementing the IPAWS program. Specifically, the agency faced challenges related to systems integration and development. Subsequently, we recommended that the Secretary of Homeland Security direct the Administrator of FEMA, as IPAWS is developed and deployed, to establish and implement a plan to verify, among other things, the dependability and effectiveness of systems used to disseminate alerts. DHS agreed with our recommendation and stated that FEMA was developing an IPAWS Strategic Plan and had modified existing plans to address these issues. Similarly, in November 2015, the DHS IG reported that FEMA has taken steps to improve its IT management since the IG’s 2011 audit, but more remained to be done. Specifically, in 2011, the IG had reported that FEMA IT systems did not fully support mission needs, were not integrated, and did not fully provide needed capabilities because, in part, they had been developed, patched, and interconnected in an ad hoc manner. As a result of system limitations, the IG noted that end users were engaged in inefficient, time-consuming business practices, creating their own tools such as spreadsheets and databases. Accordingly, the IG recommended that the CIO implement a plan of action and milestones to address the integration and reporting limitations of existing systems. The IG also recommended that the CIO implement and enforce a standardized, agency-wide process that sufficiently defines and prioritizes the acquisition, development, operation, and maintenance requirements for all systems. In November 2015, the IG reported that this recommendation remained open. FEMA faces a number of challenges in ensuring that its IT systems adequately support the agency’s ability to respond to major disasters. Specifically, the agency has not (1) established a sufficient framework for providing governance and oversight of its IT investments, (2) developed adequate plans for modernizing its IT environment to reduce its reliance on duplicative and outdated systems, and (3) taken sufficient steps to address gaps in its IT workforce. These weaknesses can be attributed, in part, to the agency not viewing these challenges as a management priority. Until it adequately addresses these challenges, FEMA will be hindered in ensuring that its IT systems provide the needed support for its disaster response mission.