DHS’s mission is to lead the unified national effort to secure America by preventing and deterring terrorist attacks and protecting against and responding to threats and hazards to the nation. The department is also responsible for ensuring that the nation’s borders are safe and secure, welcoming lawful immigrants and visitors, and promoting the free flow of commerce. Created in 2002, DHS assumed control of about 209,000 civilian and military positions from 22 agencies and offices that specialize in one or more aspects of homeland security. The intent behind the merger that created DHS was to improve coordination, communication, and information sharing among these multiple federal agencies. Each of these agencies is responsible for specific homeland security missions and for coordinating related efforts with its sibling components, as well as external entities. Figure 1 shows the department-level organizations which are responsible for or share responsibility for IT acquisition management activities. Within the department’s Management Directorate, headed by the Under Secretary for Management, is the Office of the CIO. The CIO’s responsibilities include setting departmental IT policies, processes, and standards, and ensuring that IT acquisitions comply with DHS IT management processes, technical requirements, and approved enterprise architecture, among other things. Additionally, the CIO chairs DHS’s Chief Information Officer Council, which is responsible for ensuring the development of IT resource management policies, processes, best practices, performance measures, and decision criteria for managing the delivery of IT services and investments, while controlling costs and mitigating risks. Within the Office of the CIO, EBMO has been given primary responsibility for ensuring that the department’s IT investments align with its missions and objectives. EBMO was recently reorganized to include a new Enterprise Portfolio Governance Division dedicated to executing portfolio reviews. This division is to provide support to portfolio stakeholders to administer portfolio activities, such as aligning programs with portfolios, creating baseline portfolios, and establishing portfolio pilot efforts. In October 2011, DHS realigned its acquisition management functions previously performed by divisions within the Office of the Chief Procurement Officer to establish PARM. The office, which reports directly to the Under Secretary for Management, is to ensure the effectiveness of the overall program execution governance process in support of the department’s Investment Review Board (IRB), and has the responsibility for developing and maintaining DHS’s Acquisition Management Directive. PARM is also responsible for providing independent assessments of major investment programs, and monitoring programs between formal reviews to identify any emerging issues that DHS needs to address to keep the programs on track. DHS acquisitions—which are expected to total about $18 billion in fiscal year 2012—support a wide range of missions and investments, including ships and aircraft, border surveillance and screening equipment, nuclear detection equipment, and systems to track the department’s financial and human resources. In support of its diverse missions, DHS plans to spend about $5.6 billion in fiscal year 2012 to deploy and maintain over 360 IT programs to perform both mission-critical and support functions, which frequently must be coordinated among components, as well as among external entities. In 2003, DHS established an investment review process to help reduce risk and increase the chances for successful acquisition outcomes by providing departmental oversight of major investments throughout their life cycle and to help ensure that funds allocated for investments through the budget process are being spent wisely, efficiently, and effectively. In October 2010, DHS updated the acquisition guidance, which outlined the acquisition life cycle phases and called for senior-level approval of each major acquisition program at key decision events during a program’s acquisition life cycle. DHS’s Acquisition Review Board —renamed the IRB in October 2011— was established to review and approve major acquisition programs, at key stages in their life cycles before the acquisition program could move to the next phase. DHS’s guidance establishes four phases that constitute the acquisition life cycle: 1. The need phase—during which a problem is defined and the needed capability is identified. This phase concludes with the IRB granting the acquisition program approval to proceed at Acquisition Decision Event 1. 2. The analyze/select phase—during which it is determined how to provide the needed capability. This phase concludes with the IRB granting the acquisition program approval to proceed at Acquisition Decision Event 2A. 3. The obtain phase—during which the needed capability is obtained. The IRB may review the acquisition program multiple times before granting the acquisition program approval to proceed with particular acquisition activities. Between Acquisition Decision Event 2A and Acquisition Decision Event 2B, the project manager formulates the acquisition into types of acquisition (e.g., capital investment projects, services procurements). The phase concludes with the IRB granting the program approval to proceed at Acquisition Decision Event 3. 4. The produce/deploy/support phase—during which the process to produce, deploy, and support the needed capability takes place. Although the IRB does not have a standard, defined role in this phase, it may conduct additional reviews as necessary. Figure 2 presents the four DHS acquisition phases defined in DHS’s acquisition directive. DHS recently articulated a vision for an Integrated Investment Lifecycle Model as part of a broad effort to improve its overall acquisition management process. The model is intended to help integrate the department’s planning, programming, budgeting, and execution processes with the goal of strengthening strategic decision making by implementing a repeatable process at critical phases throughout the investment life cycle. In June 2012, DHS noted that with the early phases of the model’s development, a key challenge was developing standardized business terms, data elements, and a central portal to collect, store, and report data. DHS also reported that it planned to complete a concept of operations document and an implementation plan for the Integrated Investment Lifecycle Model concept of operations by the second quarter of fiscal year 2013. Over the years, GAO, the department, and DHS’s Office of the Inspector General have reviewed DHS’s overall acquisition process, as well as the processes specifically related to its IT acquisitions, identified weaknesses, and provided recommendations for improvements. For example, in April 2007, we reported that although DHS had established the management structure to effectively manage its IT investments, the department had yet to define most of the policies specifically associated with managing its IT projects as investment portfolios. We also reported that DHS had not fully implemented the key practices needed to actually control investments—either at the project level or at the portfolio level. We recommended that DHS fully define the project-level and portfolio-level policies and procedures defined in GAO’s ITIM frameworkimplement the practices needed to effectively control investments. DHS agreed with our findings and recommendations, and took action to address the majority of them, including augmenting the resources for providing project oversight. In November 2008, we reported that DHS had not provided the oversight needed to identify and address cost, schedule, and performance problems for its major acquisitions. Specifically, we reported that of the 48 major investments reviewed that required milestone or annual reviews, 45 were not reviewed in accordance with the department’s investment review policy, and 18 were not reviewed at all. Four of these investments had transitioned into a late acquisition phase—production and deployment—without any required reviews. We recommended—and DHS concurred—that the department identify and align sufficient management resources to implement oversight reviews in a timely manner throughout the investment life cycle. In 2010, DHS’s Office of the CIO conducted a series of reviews of its major IT programs. According to DHS’s draft Portfolio Governance Concept of Operations, these reviews, plus additional insights from the CIO, highlighted several problems with the existing IT investment management process, including the following: Governance was based on a program-by-program approach that did not reflect the reality that many programs are inter-related in delivering mission outcomes. Programs took too long, were often over cost, and did not meet performance objectives. Decision makers were often far removed from program details; many decisions were reserved for the IRB, which lacks the capacity and time to be familiar with all mission needs and program issues. In addition, the department again held portfolio reviews in 2011 and found that while some progress had been made, many of the aforementioned problems continued. Following the February 2011 update to our high-risk series report on implementing and transforming DHS, in which we reported that while the department had improved its policies and procedures for investment management, more work remained, DHS began providing us with bi- annual updates on its progress in addressing weaknesses, including IT management. Further, we recently reported that the portfolio reviews DHS conducted in 2011 to avoid investing in systems that were duplicative or overlapping, and to identify and leverage investments across the department contributed to the identification and consolidation of duplicative functionality within four investments. further consolidate systems by 2014, which is expected to produce approximately $41 million in cost savings. The portfolio reviews also contributed to the identification of 38 additional systems that are duplicative. GAO, Information Technology: Departments of Defense and Energy Need to Address Potentially Duplicative Investments, GAO-12-241 (Washington, D.C.: Feb. 17, 2012). In December 2010, the Office of Management and Budget (OMB) issued its 25 Point Implementation Plan to Reform Federal Information Technology Management, a document outlining activities spanning 18 months to reform IT management throughout the federal government. A key goal of the plan—referred to as the IT Reform Plan—is to foster more effective management of large-scale IT programs. One way the plan recommends this be done is through streamlining governance and improving accountability. According to the plan, this involves reforming and strengthening IRBs to enable them to more adequately manage agency portfolios, redefining the role of agency CIOs and the federal CIO Council to focus on portfolio management, and rolling out “TechStat” reviews at the agency and bureau levels to focus attention on IT investments, including those that are poorly performing.