The FBI serves as the primary investigative unit of the Department of Justice. The FBI’s mission includes investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Approximately 12,000 special agents and 16,000 analysts and mission support personnel are located in the bureau’s Washington, D.C., headquarters and in more than 70 offices in the United States and in more than 50 offices in foreign countries. Mission responsibilities at the bureau are divided among a number of major organizational components, including: Administration: manages the bureau’s personnel programs, budgetary and financial services, records, information resources, and information security. National Security: integrates investigative and intelligence activities against current and emerging national security threats and provides information and analysis for the national security and law enforcement communities. Criminal Investigations: investigates serious federal crimes and probes federal statutory violations involving exploitation of the Internet and computer systems. Law Enforcement: provides law enforcement information and forensic services to federal, state, local, and international agencies. Office of the Chief Information Officer: develops the bureau’s IT strategic plan and operating budget and develops and maintains technology assets. To execute its mission responsibilities, the FBI relies extensively on the use of information systems. In particular, the bureau operates and maintains hundreds of computerized systems, databases, and applications, such as the Combined DNA Index System, which supports forensic examinations; the National Crime Information Center and the Integrated Automated Fingerprint Identification System, which help state and local law enforcement agencies identify criminals; the Automated Case Management System, which manages information collected on investigative cases; the Investigative Data Warehouse, which aggregates data from disparate databases in a standard format to facilitate content management and data mining; and the Terrorist Screening Database, which consolidates identification information about known or suspected international and domestic terrorists. Following the terrorist attacks in the United States on September 11, 2001, the FBI shifted its mission focus to detecting and preventing future attacks and began to reorganize and transform. According to the bureau, the complexity of this mission shift, along with the changing law enforcement environment, strained its existing IT environment. As a result, the bureau accelerated the IT modernization program that it had begun in September 2000. This program, later named Trilogy, was the FBI’s largest IT initiative to date and consisted of three parts: (1) the Information Presentation Component to upgrade FBI’s computer hardware and system software, (2) the Transportation Network Component to upgrade the agency’s communication network, and (3) the User Application Component to upgrade and consolidate the bureau’s five key investigative software applications. The heart of this last component became the Virtual Case File (VCF) project, which was intended to replace the obsolete Automated Case Support system, FBI’s primary case management application. While the first two components of Trilogy experienced cost overruns and schedule delays, in part because of fundamental changes to requirements, both are currently operating. However, we recently reported that certain information security controls over the Trilogy-related network were ineffective in protecting the confidentiality, integrity, and availability of information and information resources. For instance, we found that FBI did not consistently (1) configure network devices and services securely to prevent unauthorized insider access; (2) identify and authenticate users to prevent unauthorized access; (3) enforce the principle of least privilege to ensure that authorized access was necessary and appropriate; (4) apply strong encryption techniques to protect sensitive data on its networks; (5) log, audit, or monitor security-related events; (6) protect the physical security of its network; and (7) patch key servers and workstations in a timely manner. Taken collectively, we concluded that these weaknesses place sensitive information transmitted on the network at increased risk of unauthorized disclosure or modification and could result in a disruption of service. Accordingly, we recommended that the FBI Director take several steps to fully implement key activities of the bureau’s information security program for the network. These activities include updating assessments and plans to reflect the bureau’s current operating environment, providing more comprehensive coverage of system tests, and correcting security weaknesses in a timely manner. In commenting on this report, the FBI’s Chief Information Officer (CIO) concurred with many of our recommendations, but did not believe that the bureau had placed sensitive information at an unacceptable risk for unauthorized disclosure, modification, or insider threat exploitation. The CIO cited significant strides in reducing risk since the Robert Hanssen espionage investigation. In response, we stated that until weaknesses identified in network devices and services, identification and authentication, authorization, cryptography, audit and monitoring, physical security, and patch management are addressed, increased risk to FBI’s critical network remains. Further, until the bureau fully and effectively implements certain information security program activities for the network, security controls will likely remain inadequate or inconsistently applied. The third component of Trilogy—VCF— never became fully operational. In fact, the FBI terminated the project after Trilogy’s overall costs grew from $380 million to $537 million. VCF fell behind schedule and pilot testing showed that completing it was infeasible and cost prohibitive. Among reasons we and others have cited for VCF’s failure were poorly defined system requirements, ineffective requirements change control, limited contractor oversight, and human capital shortfalls because of, for example, no continuity in certain management positions and a lack of trained staff for key program positions. The Sentinel program began in 2005, and is intended to be both the successor to and an expansion of VCF. In brief, Sentinel is to meet FBI’s pressing need for a modern, automated capability for investigative case management and information sharing to help field agents and intelligence analysts perform their jobs more effectively and efficiently. The program’s key objectives are to (1) successfully implement a system that acts as a single point of entry for all investigative case management and that provides paperless case management and workflow capabilities, (2) facilitate a bureau-wide organizational change management program, and (3) provide intuitive interfaces that feature data relevant to individual users. Using commercially available software and hardware components, Sentinel is to provide a range of investigative case management and workflow capabilities, including leads management and evidence management; document and records management, indexed searching, and electronic links to legacy FBI systems and external data sources; training, statistical, and reporting tools; and security management. The FBI chose to use a governmentwide acquisition contract (GWAC) for Sentinel after conducting a multi-step evaluation of the different GWACs available to federal agencies. In August 2005, the FBI issued a request for vendor proposals to more than 40 eligible companies under a National Institutes of Health (NIH) contracting vehicle. According to the CIO, the request was also provided to more than 500 eligible subcontractors. For the next 8 months, FBI’s Sentinel Source Selection Evaluation Team reviewed and evaluated vendors’ responses to the task order request for proposal to determine which proposal represented the best value. The evaluation team recommended—and FBI ultimately chose—Lockheed Martin as the primary Sentinel contractor. In March 2006, the FBI awarded the task order to develop and integrate Sentinel to Lockheed Martin. The FBI has structured the acquisition of Sentinel into four phases; the completion of each is expected to span about 12 to 18 months. According to FBI officials, the FBI is conducting end user training for Phase 1 and expects to roll out the Phase 1 production in June 2007. The specific content of each phase is to be proposed by and negotiated with the prime contractor. The general content of each phase has these and other capabilities include Phase 1: A Web-based portal that will provide a data access tool for the Automated Case Management System and other legacy systems; a service- oriented architecture definition to support delivery and sharing of common services across the bureau. Phase 2: Case document and records management capabilities, document repositories, improved information assurance, application workflow, and improved data labeling to enhance information sharing. Phase 3: Updated and enhanced system storage and search capabilities. Phase 4: Implementing the remaining components of the new case management system to replace ACS. To manage the acquisition and deployment of Sentinel, the FBI established a program management office within the CIO’s office. The program office is led by a program manager and consists of the eight primary FBI units (see fig. 1). Overall, the FBI estimates that the four phases will cost about $425 million through fiscal year 2011. For fiscal year 2005, the FBI reprogrammed $97 million in appropriated funds from various sources to fund Sentinel work. For fiscal years 2006 and 2007, the FBI said it budgeted about $85 million and $138 million respectively, for Sentinel, of which it reports having obligated about $95 million. For fiscal year 2008, the FBI reports that it has budgeted about $50 million for Sentinel. Acquisition best practices are tried and proven methods, processes, techniques, and activities that organizations define and use to minimize program risks and maximize the chances of program success. Using best practices can result in better outcomes—including cost savings, improved service and product quality, and, ultimately, a better return on investment. For example, two software engineering analyses of nearly 200 systems acquisitions projects indicated that teams using systems acquisition best practices produced cost savings of at least 11 percent over similar projects conducted by teams that did not employ the kind of rigor and discipline embedded in these practices. In addition, our research shows that best practices are a significant factor in successful acquisition outcomes, including increasing the likelihood that programs and projects will be executed within cost and schedule estimates. We and others have identified and promoted the use of a number of best practices associated with acquiring IT systems. In 2004, we reported on 18 relevant best practices and grouped them into two categories: (1) ten practices for acquiring any type of business system and (2) eight complementary practices that relate specifically to acquiring commercial component-based business systems.