DOD’s organizational structure includes the Office of the Secretary of Defense, the Joint Chiefs of Staff, the military departments, numerous defense agencies and field activities, and various unified combatant commands that contribute to the oversight of DOD’s acquisition programs. Figure 1 provides a simplified depiction of DOD’s organizational structure. The Under Secretary of Defense for AT&L serves as the Defense Acquisition Executive and the Under Secretary has responsibility for oversight of MAIS acquisition programs. AT&L has policy and procedural authority for the defense acquisition system, which establishes the steps that DOD programs generally take as DOD plans, acquires, deploys, operates, and maintains its IT systems (discussed in more detail following this section). Additionally, AT&L is the principal acquisition official of the department and is the acquisition advisor to the Secretary of Defense. AT&L’s authority includes directing the military services and defense agencies on acquisition matters and making milestone decisions for MAIS programs. AT&L can delegate decision authority for MAIS programs to a component head who may further delegate the authority to the component acquisition executive. DOD’s CIO is the Principal Staff Assistant and senior IT advisor to the Secretary of Defense. This role includes overseeing many national security and defense business systems and managing information resources. The CIO coordinates with AT&L to develop and maintain a process for assessing and managing the risks related to the department’s IT acquisitions, including MAIS programs. The Department of Defense Instruction 5000.02 establishes policy for the management of all DOD acquisition programs. In January 2015, DOD updated these guidelines which outline the framework for MAIS programs. This framework consists of six models for acquiring and deploying a program, including two hybrid models that each describe how a program may be structured based on the type of product being acquired (e.g., software-intensive programs and hardware-intensive programs). A generic acquisition model that shows all of the program life-cycle phases and key decision points is shown in figure 2 and described following the figure. Materiel solution analysis: Refine the initial system solution (concept) and create a strategy for acquiring the solution. A decision—referred to as milestone A—is made at the end of this phase to authorize entry into the technology maturation and risk reduction phase. Technology maturation and risk: Determine the preferred technology solution and validate that it is affordable, satisfies program requirements, and has acceptable technical risk. A decision—referred to as milestone B—is made at the end of this phase to authorize entry of the program into the engineering and manufacturing development phase and award development contracts. An acquisition program baseline is first established at the milestone B decision point or at program initiation, whichever occurs later. A program’s first acquisition program baseline contains the original life-cycle cost estimate (which includes acquisition and operations and maintenance costs), the schedule estimate (which consists of major milestones and decision points), and performance parameters that were approved for that program by the milestone decision authority. The first acquisition program baseline is established after the program has refined user requirements and identified the most appropriate technology solution that demonstrates that it can meet users’ needs. Engineering and manufacturing development: Develop a system and demonstrate through testing that the system meets all program requirements. A decision—referred to as milestone C—is made during this phase to authorize entry of the system into the production and deployment phase or into limited deployment in support of operational testing. Production and deployment: Achieve an operational capability that meets program requirements, as verified through independent operational tests and evaluation, and implement the system at all applicable locations. Operations and support: Operationally sustain the system in the most cost-effective manner over its life cycle. MAIS programs enable DOD to organize, plan, direct and monitor important mission operations. As previously mentioned, MAIS programs must comply with certain annual and quarterly reporting requirements identified in statute. Each calendar year, DOD must submit to Congress budget justification documents on each MAIS program, including information on cost, schedule, and performance. Specifically, these programs must report, among other things, on the development and implementation schedules and total acquisition and full life-cycle cost estimates and provide a summary of the key performance parameters for each program. DOD must also provide a summary of any significant changes to information previously provided for each program. Moreover, on a quarterly basis, the program manager for each MAIS program is required to provide the senior DOD official responsible for the program a written report that identifies any variance in the program’s cost, schedule, or performance. Depending on the determination after reviewing the variances identified in the quarterly report, the senior DOD official responsible for the program must notify the congressional defense committees of any programs that have experienced either a significant or critical change. During our review, MAIS programs were required to comply with the following reporting requirements: Significant change. A significant change must be declared if a program experienced a schedule delay of more than 6 months but less than a year; estimated total acquisition or full life-cycle cost for the program has increased by at least 15 percent but less than 25 percent; or there has been a significant adverse change in the expected performance of the system. If such an event occurs, the senior DOD official responsible for the program must notify the congressional defense committees in writing no later than 45 days after receiving the quarterly report from the program manager. Critical change. A critical change must be declared if a program failed to achieve a full deployment decision within 5 years after the milestone A decision or, if there was no milestone A decision, the date when the preferred alternative was selected for the program; experienced a schedule delay of 1 year or more; experienced an estimated total acquisition or full life-cycle cost increase of 25 percent or more over the original estimate; or experienced a change in the expected performance of the system that will undermine the ability of the system to perform as intended. If such an event occurs, the senior DOD official responsible for the program must carry out an evaluation and submit a critical change report to the congressional defense committees no later than 60 days after receiving the quarterly report. Since the December 19, 2014, enactment of the Carl Levin and Howard P. “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015, MAIS programs are now required to declare a significant change— instead of a critical change—if they fail to achieve a full deployment decision within 5 years after the milestone A decision, the date when the preferred alternative was selected for the program (excluding any time during which program activity is delayed as a result of a bid protest). More recently, the National Defense Authorization Act for Fiscal Year 2016 directed the Secretary of Defense to issue guidance for MAIS programs to establish an acquisition baseline within 2 years after program initiation. This statute provides a response to a recommendation we made in our last annual report on MAIS programs. In particular, we found that these programs spent, on average, more than 5 years and $450 million prior to establishing baselines. We noted that programs that have not established baselines were subject to less oversight and could not be measured against cost, schedule, and performance targets. Also, the propensity to carry out MAIS programs for multiple years prior to committing to baselines is inconsistent with incremental and rapid development as called for in federal law and GAO’s IT management best practices. Accordingly, we recommended that these programs be baselined within 2 years; for which DOD partially concurred. We maintained that establishing baselines within 2 years would improve outcomes and increase accountability. DOD’s CIO, along with other agencies, must report on the progress of its IT investments, including MAIS programs, on a public website known as the IT Dashboard. OMB established this website in June 2009 to improve the transparency and oversight of agencies’ investments. The Dashboard visually displays federal agencies’ cost, schedule, and performance data for over 700 major federal investments at 26 federal agencies. It also includes a risk rating that is to be performed by agency CIOs. According to OMB, these data are intended to provide a near-real- time perspective on the performance of these investments. The public display of agency data is intended to allow OMB; other oversight bodies, including Congress; and the general public to hold federal agencies accountable for their progress and results. In August 2011, OMB issued guidance that stated, among other things, that agency CIO’s shall be held accountable for the performance of IT investments. The Dashboard presents performance ratings for individual investments using metrics that OMB has defined—cost, schedule, and CIO evaluation. If OMB or the agency CIO determine the reported data is not timely or reliable, the CIO must notify OMB and establish within 30 days of this determination an improvement program and the progress the agency is making. According to OMB, the addition of CIO names and photos on the website is intended to highlight this accountability and link the Dashboard’s reporting on investment performance. In order to enhance transparency and improve risk management of federal IT acquisitions, Congress codified the Dashboard reporting process through key provisions, known as the Federal Information Technology Acquisition Reform provisions in the Carl Levin and Howard P. “Buck” McKeon National Defense Authorization Act for Fiscal Year 2015. Entities such as the Project Management Institute, the Software Engineering Institute at Carnegie Mellon University, and GAO have developed and identified best practices to help guide organizations to effectively plan and manage their acquisitions of major IT systems, such as MAIS programs. Our prior reviews have shown that properly applying such practices can significantly increase the likelihood of delivering promised system capabilities on time and within budget. These practices include, but are not limited to: Requirements management: Requirements establish what the system is to do, how well it is to do it, and how it is to interact with other systems. Appropriate requirements development involves eliciting and developing customer and stakeholder requirements, and analyzing them to ensure that they will meet users’ needs and expectations.