Advances in the use of IT and the Internet are continuing to change the way that federal agencies communicate, use, and disseminate information; deliver services; and conduct business. For example, electronic government (e-government) has the potential to help build better relationships between government and the public by facilitating timely and efficient interaction with citizens. To help the agencies more effectively manage IT, the Congress has established a statutory framework of requirements and roles and responsibilities relating to information and technology management. Nevertheless, the agencies face significant challenges in effectively planning for and managing their IT. Such challenges can be overcome through the use of a systematic and robust management approach that addresses critical elements, such as IT strategic planning and investment management. The Congress established a statutory framework to help address the information and technology management challenges that agencies face. Under this framework, agencies are accountable for effectively and efficiently developing, acquiring, and using IT in their organizations. In particular, the Paperwork Reduction Act of 1995 and the Clinger-Cohen Act of 1996 require agency heads, acting through agency CIOs, to, among other things, better link their IT planning and investment decisions to program develop and maintain a strategic IRM plan that describes how IRM activities help accomplish agency missions; develop and maintain an ongoing process to establish goals for improving IRM’s contribution to program productivity, efficiency, and effectiveness; methods for measuring progress toward these goals; and clear roles and responsibilities for achieving these goals; develop and implement a sound IT architecture; implement and enforce IT management policies, procedures, standards, establish policies and procedures for ensuring that IT systems provide reliable, consistent, and timely financial or program performance data; and implement and enforce applicable policies, procedures, standards, and guidelines on privacy, security, disclosure, and information sharing. Moreover, under the government’s current legislative framework, OMB has important responsibilities for providing direction on governmentwide information and technology management and overseeing agency activities in these areas. Among OMB’s responsibilities are ensuring agency integration of IRM plans, program plans, and budgets for the acquisition and use of IT and the efficiency and effectiveness of interagency IT initiatives; developing and maintaining a governmentwide strategic IRM plan; developing, as part of the budget process, a mechanism for analyzing, tracking, and evaluating the risks and results of all major capital investments made by an executive agency for information systems; directing and overseeing the implementation of policy, principles, standards, and guidelines for the dissemination of and access to public information; encouraging agency heads to develop and use best practices in IT developing and overseeing the implementation of privacy and security policies, principles, standards, and guidelines. Further, in 2002, the Congress passed, and the President signed, legislation intended to improve the collection, use, and dissemination of government information and to strengthen information security. Specifically, Public Law 107-347, the E-Government Act of 2002, which was enacted in December 2002, includes provisions to promote the use of the Internet and other information technologies to provide government services electronically. The E-Government Act also contains the Federal Information Security Management Act (FISMA) of 2002, which replaced and strengthened the Government Information Security Reform legislative provisions (commonly referred to as “GISRA”). Among other provisions, FISMA requires each agency, including national security agencies, to (1) establish an agencywide risk-based information security program to be overseen by the agency CIO and ensure that information security is practiced throughout the life cycle of each agency system; and (2) develop, maintain, and annually update an inventory of major information systems (including major national security systems) operated by the agency or under its control. Even with the framework laid out by the Congress, the federal government faces enduring IT challenges. Specifically, in January 2003, we reported on a variety of challenges facing federal agencies in continuing to take advantage of the opportunities presented by IT. Unless and until the challenges outlined below are overcome, federal agencies are unlikely to optimize their use of IT, which can affect an organization’s ability to effectively and efficiently implement its programs and missions. Pursuing opportunities for e-government. E-government offers many opportunities to better serve the public, make government more efficient and effective, and reduce costs. Federal agencies have implemented a wide array of e-government applications, including using the Internet to collect and disseminate information and forms; buy and pay for goods and services; submit bids and proposals; and apply for licenses, grants, and benefits. Although substantial progress has been made, the government has not yet fully reached its potential in this area. Recognizing this, a key element of the President’s Management Agenda is the expansion of e-government to enhance access to information and services, particularly through the Internet. In response, OMB established a task force that selected a strategic set of initiatives to lead this expansion. Our review of the initial planning projects associated with these initiatives found that important aspects—such as collaboration and customer focus—had not been thought out for all of the projects and that major uncertainties in funding and milestones were not uncommon. Accordingly, we recommended that OMB take steps as overseer of the e-government initiatives to reduce the risk that the projects would not meet their objectives. Improving the collection, use, and dissemination of government information. The rapid evolution of IT is creating challenges in managing and preserving electronic records. Complex electronic records are increasingly being created in a decentralized environment and in volumes that make it difficult to organize them and make them accessible. Further, storage media themselves are affected by the dual problems of obsolescence and deterioration. These problems are compounded as computer hardware and application software become obsolete, since they may leave behind electronic records that can no longer be read. Overall responsibility for the government’s electronic records lies with the National Archives and Records Administration (NARA). Our past work has shown that while NARA has taken some action to respond to the challenges associated with managing and preserving electronic records, most electronic records remain unscheduled; that is, their value had not been assessed and their disposition had not been determined. In addition, records of historical value were not being identified and provided to NARA; as a result, they were at risk of being lost. We recommended that NARA develop strategies for raising agency management’s awareness of the importance of records management and for performing systematic inspections. In July 2003 we testified that although NARA has made progress in addressing these issues, more work remains to be done. The growth of electronic information—as well as the security threats facing our nation—are also highlighting privacy issues. For example, online privacy has emerged as one of the key—and most contentious— issues surrounding the continued evolution of the Internet. In addition, our survey of 25 departments and agencies about their implementation of the Privacy Act—which regulates how federal agencies may use the personal information that individuals supply when obtaining government services or fulfilling obligations—found that a key characteristic of the agencies’ 2,400 systems of records is that an estimated 70 percent contained electronic records. Our survey also found that although compliance with Privacy Act provisions and related OMB guidance was generally high in many areas, according to agency reports, it was uneven across the federal government. To improve agency compliance and address issues reported by the agencies, we made recommendations to OMB, such as to direct agencies to correct compliance deficiencies, to monitor agency compliance, and to reassess its guidance. Strengthening information security. Since September 1996, we have reported that poor information security is a high-risk area across the federal government with potentially devastating consequences. Although agencies have taken steps to redesign and strengthen their information system security programs, our analyses of information security at major federal agencies have shown that federal systems were not being adequately protected from computer-based threats. Our latest analyses of audit reports published from October 2001 through October 2002 continue to show significant weaknesses in federal computer systems that put critical operations and assets at risk. In addition, in June 2003 we testified that agencies’ fiscal year 2002 reports and evaluations required by GISRA found that many agencies have not implemented security requirements for most of their systems, such as performing risk assessments and testing controls. In addition, the usefulness of agency corrective action plans may be limited when they do not identify all weaknesses or contain realistic completion dates. One of the most serious problems currently facing the government is cyber critical infrastructure protection, which is protecting the information systems that support the nation’s critical infrastructures, such as national defense and power distribution. Since the September 11 attacks, warnings of the potential for terrorist cyber attacks against our critical infrastructures have increased. In addition, as greater amounts of money are transferred through computer systems, as more sensitive economic and commercial information is exchanged electronically, and as the nation’s defense and intelligence communities increasingly rely on commercially available information technology, the likelihood increases that information attacks will threaten vital national interests. Among the critical infrastructure protection challenges the government faces are (1) developing a national critical infrastructure protection strategy, (2) improving analysis and warning capabilities, and (3) improving information sharing on threats and vulnerabilities. For each of the challenges, improvements have been made and continuing efforts are in progress, but much more is needed to address them. In particular, we have identified and made numerous recommendations over the last several years concerning critical infrastructure challenges that still need to be addressed. As a result of our concerns in this area, we have expanded our information security high-risk area to include cyber critical infrastructure protection. Constructing and enforcing sound enterprise architectures. Our experience with federal agencies has shown that attempts to modernize IT environments without blueprints—models simplifying the complexities of how agencies operate today, how they want to operate in the future, and how they will get there—often result in unconstrained investment and systems that are duplicative and ineffective. Enterprise architectures offer such blueprints. Our reports on the federal government’s use of enterprise architectures in both February 2002 and November 2003 found that agencies’ use of enterprise architectures was a work in progress, with much to be accomplished.