DHS’s mission is to lead the unified national effort to secure America by preventing and deterring terrorist attacks and protecting against and responding to threats and hazards to the nation. DHS also is to ensure safe and secure borders, welcome lawful immigrants and visitors, and promote the free flow of commerce. Created in 2003, DHS assumed control of about 209,000 civilian and military positions from 22 agencies and offices specializing in one or more aspects of homeland security. The intent behind the merger creating DHS and expected transformation was to improve coordination, communication, and information sharing among the multiple federal agencies responsible for protecting the homeland. Not since the creation of the Department of Defense in 1947 has the federal government undertaken a transformation of this magnitude. As we reported before the department was created, such a transformation is critically important and poses significant management and leadership challenges. For these reasons, we designated the implementation of the department and its transformation as high-risk in 2003, and we continue to do so today. In this regard, we have stated that failure to effectively address DHS’s management challenges and program risks could have serious consequences for our national security. Among DHS’s transformation challenges, we highlighted the formidable hurdle of managing the acquisition and integration of numerous mission- critical and mission support systems and associated IT infrastructure. For the department to overcome this hurdle, we emphasized the need for DHS to establish an effective IT governance framework, including controls aimed at effectively managing system acquisition and IT-related people, processes and tools. To accomplish its mission, the department is organized into various components, each of which is responsible for specific homeland security missions and for coordinating related efforts with its sibling components, as well as external entities. Figure 1 shows DHS’s organizational structure; table 1 shows DHS’s principal organizations and their missions. Within the Management Directorate is the Office of the Chief Information Officer (CIO). Among other things, this office is to leverage best available technologies and IT management practices, provide shared services, coordinate acquisition strategies, maintain an enterprise architecture that is fully integrated with other management processes, and advocate and enable business transformation. Other DHS entities also are responsible or share responsibility for IT management activities. For example, DHS’s major organizational components (e.g., directorates, offices, and agencies) have their own CIOs and IT organizations. Under this structure, control over the department’s IT management functions is shared by the DHS CIO and the component CIOs. Also within the Management Directorate is the Office of the Chief Procurement Officer (CPO). The CPO is the department’s senior procurement executive who has leadership and authority over DHS acquisition and contracting, including major investments. This office’s responsibilities include issuing policies and implementing instructions, overseeing acquisition and contracting functions, and ensuring that a given acquisition’s contracting strategy and plans align with the intent of the Acquisition Review Board, DHS’s highest investment review board. Similar to the department and component CIOs, DHS relies on a structure of dual accountability and collaboration between the CPO and the heads of DHS components to carry out the acquisition function. To promote coordination across DHS component boundaries, the DHS CIO and CPO have each established management councils. For example, the DHS CIO established the department’s CIO council, which is chaired by the DHS CIO and composed of component-level CIOs. According to its charter, the specific functions of the council include establishing a strategic plan, setting priorities for departmentwide IT, identifying opportunities for sharing resources, coordinating multi-bureau projects and programs, and consolidating activities. To accomplish their respective missions, DHS and its component agencies rely on and invest heavily in IT systems and supporting infrastructure. For example, in fiscal year 2009, DHS IT-related funding totaled about $6.2 billion. Of DHS’s principal component organizations, Customs and Border Protection (CBP) represents the largest IT investor (about $1.7 billion or 28 percent). The next largest single investment in IT transcends DHS organizations and is for DHS-wide IT infrastructure ($1.5 billion), which includes, among other things, development of a replacement for the system used to share homeland security information with its federal, state, and local partners. The U.S. Citizenship and Immigration Services and the National Protection and Programs Directorate are the next largest investors in IT ($561 and $556 million, respectively). See figure 2 for more information on DHS components and their fiscal year 2009 funding. According to DHS, the $6.2 billion in funding supports 279 major IT acquisition programs. Examples of these programs are described below. Automated Commercial Environment (ACE): ACE is a CBP program that was begun in 2001 to modernize trade processing and support border security by, among other things, fully automating commercial import and export data processing and facilitating information sharing among federal agencies with a trade-related mission. ACE capabilities are being delivered in a series of increments, and thus far operational capabilities include screening cargo and conveyances, analyzing data to support targeting of high-risk entities, and processing truck manifests electronically. Future increments are to provide additional screening and combined manifest processing across all types of transportation. Through fiscal year 2009, DHS has been appropriated about $2.7 billion for ACE, and for fiscal year 2010, the department has requested about $268 million. United States Visitor and Immigrant Status Indicator Technology (US-VISIT): This program dates to 2002 and is within the National Protection and Programs Directorate. It is to enhance the security of our citizens and visitors, ensure the integrity of the U.S. immigration system, protect privacy, and facilitate legitimate trade and travel. The program is to achieve these goals by, among other things, (1) collecting, maintaining, and sharing information on certain foreign nationals who enter and exit the United States; (2) identifying foreign nationals who have overstayed or violated the terms of their visit or who can receive, extend, or adjust their immigration status; (3) detecting fraudulent travel documents, verifying visitor identity, and determining visitor admissibility through the use of biometrics (digital fingerprints and a digital photograph); and (4) facilitating information sharing and coordination within the immigration and border management community. DHS has delivered US-VISIT capabilities in a series of increments. As a result, a biometrically enabled entry capability has been operating at about 300 air, sea, and land POEs since December 2006 (115 airports, 14 seaports, and 154 of 170 land ports). Since 2004, DHS has evaluated a number of biometric exit solutions, and several exit pilot evaluations are currently underway. However, an exit capability is not yet operational. Through fiscal year 2009, DHS had been appropriated about $2.5 billion for US-VISIT, and for fiscal year 2010, the department has requested about $356 million. Rescue 21: This is a Coast Guard program to modernize a 30-year-old search and rescue communications system used for missions 20 miles or less from shore, referred to as the National Distress and Response System. Among other things, it is to increase communications coverage area, allow electronic tracking of department vessels and other mobile assets, and enable secure communication with other federal and state entities. As of June 2009, Rescue 21’s initial operating capability has been deployed and accepted at 23 of 42 regions. Additional system capability (e.g., the ability to track vessels) remains to be developed, as does a system to meet the unique needs of the Alaska region. Through fiscal year 2009, DHS has been appropriated about $723 million for Rescue 21, and for fiscal year 2010, the department has requested about $117 million. Secure Flight: This is a Transportation Security Administration (TSA) program to allow the federal government to assume from airlines the responsibility of prescreening passengers for domestic flights by matching of passenger biographic information against watch lists. Among other things, Secure Flight is to prevent people suspected of posing a threat to aviation from boarding commercial aircraft in the United States, protect passengers’ privacy and civil liberties, and reduce the number of people unnecessarily selected for secondary screening. TSA is currently in the process of phasing in its use of Secure Flight for domestic flights. Through fiscal year 2009, DHS has been appropriated about $326 million for Secure Flight, and for fiscal year 2010, the department has requested about $84.4 million. SBInet: SBInet is the technology component of a CBP program known as SBI, which is to help secure the nation’s borders and reduce illegal immigration through physical infrastructure (e.g., fencing), surveillance systems, and command, control, communications, and intelligence technologies. As of 2009, a pilot of SBInet capabilities referred to as Project 28 has been deployed and is currently operating along 28 miles of the southwest border in Tucson, Arizona. Through fiscal year 2009, DHS has been appropriated about $3.6 billion for SBI, and for fiscal year 2010, the department has requested about $779 million. The department has continued to work to establish effective corporate IT and acquisition management controls and capabilities, but progress across these disciplines has been uneven, and more remains to be done. Until DHS fully institutionalizes these controls and capabilities, it will be challenged in its ability to effectively and efficiently acquire large-scale IT systems and thereby leverage technology to support transformation and achieve mission goals and results. Leading organizations recognize the importance of having and using an enterprise architecture (EA)—a corporate blueprint that describes—in useful models, diagrams, tables, and narrative—how a given entity operates today and how it plans to operate in the future, and provides a road map for transitioning from today to tomorrow. Our experience with federal agencies has shown that attempting to acquire systems without an EA often results in investments that are duplicative, not well integrated, unnecessarily costly to maintain, and limited in terms of optimizing mission performance.