The FBI’s mission responsibilities include investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Approximately 12,000 special agents and 16,000 analysts and mission support personnel are located in the bureau’s Washington, D.C., headquarters and in more than 450 offices in the United States and 45 offices in foreign countries. Mission responsibilities at the bureau are divided among the following five major organizational components. ● Administration: manages the bureau’s personnel programs, budgetary and financial services, records, information resources, and information security. ● Counterterrorism and Counterintelligence: identifies, assesses, investigates, and responds to national security threats. ● Criminal Investigations: investigates serious federal crimes and probes federal statutory violations involving exploitation of the Internet and computer systems. ● Intelligence: collects, analyzes, and disseminates information on evolving threats to the United States. ● Law Enforcement Services: provides law enforcement information and forensic services to federal, state, local, and international agencies. The components are further organized into subcomponents, such as divisions, offices, and other groups (hereafter referred to as “divisions”). Table 1 lists the components and briefly describes their respective divisions. To execute its mission responsibilities, the FBI relies extensively on IT, and this reliance is expected to grow. For example, the bureau operates and maintains hundreds of computerized systems, networks, databases, and applications, such as ● the Combined DNA Index System, to support forensic ● the National Crime Information Center and the Integrated Automated Fingerprint Identification System, to help state and local law enforcement agencies identify criminals; ● the Automated Case Management System, to manage information collected on investigative cases; ● the Investigative Data Warehouse, to aggregate data in a standard format from disparate databases to facilitate content management and data mining; and ● the Terrorist Screening Database, to consolidate identification information about known or suspected international and domestic terrorists. According to the FBI, it also has almost 500 systems, applications, databases, and networks that are in operation, undergoing enhancement, or being developed or acquired. In particular, it has identified 18 new or enhancement projects that support its intelligence, investigative, and analyst activities. Included in these 18 is its Sentinel program, the FBI’s effort to deliver—using commercially available software and hardware components—a modern automated capability for investigative case management and information sharing, with the goal of helping field agents and analysts to perform their jobs more effectively and efficiently. As we have previously reported, these ongoing and planned IT programs and projects are part of the FBI’s systems modernization program. This program is based both on the bureau’s long-standing recognition of its antiquated, nonintegrated systems environment and its awareness of the importance of modern, integrated IT systems to its transformation efforts in the wake of the September 11 attacks. Currently, the FBI reports that it will spend approximately $484 million on modernization projects in fiscal year 2005 out of a total IT budget of $1.07 billion. Technology can be a valuable tool in helping organizations transform and better achieve mission goals and objectives. Our research on leading private and public sector organizations, as well as our past work at federal departments and agencies, shows that successful organizations embrace the central role of IT as an enabler for enterprisewide transformation. These leading organizations develop and implement institutional or agencywide system modernization management controls to ensure that the vast potential of technology is effectively applied to achieving mission outcomes. Among these management controls are ● assigning IT responsibility and providing commensurate authority centrally with the agency’s CIO, ● using a well-defined enterprise architecture as a systems modernization blueprint, ● following a portfolio-based approach to selecting among competing IT programs and projects and controlling investment in each during their life cycles, ● adhering to a structured and disciplined system development and acquisition life cycle management methodology, and ● employing sufficient and qualified IT human capital. We have observed that without these types of controls and capabilities, organizations increase the risk that system modernization projects will (1) experience cost, schedule, and performance shortfalls and (2) lead to systems that are redundant and overlap. They also risk not achieving their aim of increased interoperability and effective information sharing. All told, this means that technology will not effectively and efficiently support agency mission performance and help realize strategic mission outcomes and goals. The FBI Director has recognized the importance of IT to transformation, and accordingly made it one of the bureau’s top 10 priorities. Consistent with this, the FBI’s strategic plan contains explicit IT-related strategic goals, objectives, and initiatives (near- term and long-term) to support the collection, analysis, processing, and dissemination of information. However, as we have previously reported, the bureau’s long- standing approach to managing IT has not always been fully consistent with leading practices. The effects of this approach can be seen in, for example, the cost and schedule shortfalls experienced on a key infrastructure and applications modernization program, Trilogy, and particularly on one of its projects (the Virtual Case File), which was recently terminated by the bureau. Reviews of this project identified management weaknesses as the cause for its cost, schedule, and performance shortfalls. Among these weaknesses were lack of integration planning, inadequately defined requirements, project management deficiencies, and frequent turnover of key personnel. In place of the Virtual Case File project, the FBI launched its Sentinel program in early 2005 to develop what the bureau describes as its next-generation electronic information management system. According to the FBI, the system is planned to consolidate and replace its existing case management capabilities with an integrated, paperless file management and workflow system. The FBI is making progress in establishing institutional IT modernization management capabilities. It has centralized IT responsibility and authority under the CIO, and it is establishing and beginning to implement management capabilities in the areas of enterprise architecture, IT investment management, systems development and acquisition, and IT human capital. Before it can effectively leverage technology to transform itself, the FBI will have to build on these capabilities and effectively implement them on its system investments. Our research on leading private and public sector organizations, as well as our past work at federal departments and agencies, shows that successful organizations adopt a corporate, or agencywide, approach to managing IT under the leadership and control of a senior executive—commonly called a chief information officer— who operates as a full partner with the organizational leadership team in charting the strategic direction and making informed IT investment decisions. The Clinger-Cohen Act also mandates that major federal departments and agencies establish the position of CIO. As the focal point for IT management within an agency, the CIO is positioned to oversee the establishment and implementation of agencywide capabilities in IT management. In the FBI, responsibility for managing IT was historically decentralized and diffused. For example, we testified in March 2004 that the FBI had not provided its CIO with bureauwide IT management authority and responsibility, vesting these instead in the bureau’s divisions. This is part of the reason that the FBI’s IT environment at the time consisted of nonintegrated applications residing on different servers, each of which had its own unique databases, unable to share information with other applications or with other government agencies. To address this, we discussed with the Director in 2003 the importance of centralizing IT management responsibility and authority under the CIO, and we subsequently recommended that the CIO be provided with the responsibility and authority for managing IT bureauwide, including budget management control and oversight of IT programs and initiatives. The FBI has since taken steps to strengthen the scope and influence of the CIO Office. In particular, the CIO was assigned agencywide responsibility, authority, and control over IT resources, including responsibility for preparing the bureau’s IT strategic plan and operating budget; operating and maintaining existing systems and networks; developing and deploying new systems; defining and implementing IT management policies, procedures, and processes; and developing and maintaining the bureau’s enterprise architecture. To fulfill these responsibilities, the CIO’s office has begun the process of developing and implementing a corporatewide approach to managing IT. For example, the FBI reorganized the CIO Office, establishing four offices to carry out key institutional management functions, and issued an IT strategic plan in September 2004 that outlined ongoing and planned efforts to strengthen policies and procedures by standardizing them across the bureau and incorporating best practices. Among other things, this plan provided for building capabilities in a number of key IT management areas, including the following four areas: enterprise architecture, IT investment management, systems development and acquisition, and IT human capital. As our research and evaluations have shown, it is risky to attempt to modernize an IT environment without using an architecture, or blueprint, to guide and constrain the definition, design, and development of IT programs and projects. An enterprise architecture provides systematic structural descriptions—in useful models, diagrams, tables, and narrative—of how a given entity operates today and how it plans to operate in the future, and it includes a road map for transitioning from today to tomorrow. Our experience with federal agencies has shown that attempting to modernize systems without having an enterprise architecture often results in systems that are duplicative, not well integrated, unnecessarily costly to maintain, and limited in terms of optimizing mission performance. To assist agencies in effectively developing, maintaining, and implementing an enterprise architecture, we published a framework for architecture management, grounded in federal guidance and recognized best practices. In 2002 and again in 2003, we reported that the FBI did not have either an architecture to guide and constrain its IT investments or the means in place to develop and implement one. We further reported that the development of an architecture was not being given the priority that it deserved. Accordingly, we recommended that the Director make it an institutional priority, and provided a series of recommendations for building an architecture management foundation, developing and completing the architecture, and using it to inform IT investment decision making.