BLM’s mission is to sustain the health, diversity, and productivity of the public lands for the use and enjoyment of present and future generations. It manages approximately 264 million acres of public land in 28 states—about one-eighth of the land in the United States. It also manages the subsurface mineral resources on another 300 million acres of lands administered by other government agencies or owned by private interests. Public resources managed by BLM include rangelands, timber, minerals, watersheds, wildlife habitats, wilderness and recreation areas, and archaeological and historical resources. The bureau has 210 state, district, and resource area offices that manage over 1 billion paper documents, including land surveys and surveyor notes, records of land ownership, mining claims, and oil and gas leases. According to BLM, most of the paper documents are deteriorating and becoming increasingly difficult to read. During the energy boom in the early 1980s, BLM found that it could not handle the case processing workload associated with a peak in the number of applications for oil and gas leases. It recognized that to keep up with increased demand, it needed to automate its manual records and case processing activities. Thus, in the mid-1980s, the bureau began planning to acquire an automated land and mineral case processing system. The scope and functionality of the planned system changed over the years, ranging from a system to automate paper documents and records and case processing activities to a system that would provide improved efficiency for recording, maintaining, and retrieving land description, ownership, and use information and provide geographic information system (GIS)capabilities. In 1993, BLM decided on the scope and functionality of the ALMRS/Modernization. The bureau designated it a critical system for (1) automating land and mineral records and case processing activities and (2) providing information to support land and resource management activities. The ALMRS/Modernization is expected to more efficiently record, maintain, and retrieve land description, ownership, and use information to support BLM, other federal programs, and interested parties. It is to do this by establishing a common information technology platform, integrating multiple databases into a single geographically referenced database, shortening the time to complete case processing activities, and replacing costly manual records with automated ones. The ALMRS/Modernization consists of the ALMRS IOC, geographic coordinate database (GCDB), and modernization of BLM’s computer and telecommunications infrastructure and rehosting of selected management and administrative systems. These components are described more fully below. The ALMRS IOC is the flagship of the ALMRS/Modernization. With new software and upgraded hardware, it is to provide (1) support for case processing activities, including leasing oil and gas reserves, recording valid mining claims, processing mineral patents, and granting rights-of-way for roads and power corridors and (2) information for land and resource management activities, including timber sales and grazing leases. ALMRS IOC is to replace various manual and ad hoc automated BLM systems currently operating on older mainframe computers. GCDB is the database that is to contain geographic coordinates and survey information for land parcels. Other databases, such as those containing land and mineral records, are to be integrated with GCDB. ALMRS IOC will tie BLM’s records and land and mineral resource data to the legal descriptions of specific land parcels. The information technology modernization and rehost component consists of installing computer and telecommunications equipment and office automation applications, and converting selected management and administrative systems to a relational database system to be used throughout BLM. Some elements of the ALMRS/Modernization, such as new computer and telecommunications equipment, e-mail, and office automation, were installed at BLM offices from fiscal years 1994 through 1996. The 12 administrative applications have been rehosted and are operational. According to BLM’s latest estimates, the ALMRS/Modernization is expected to cost about $594 million through fiscal year 2002, about 47 percent more than the $403 million estimate provided to the Office of Management and Budget in 1993. According to the Assistant Director for Information Resources Management (IRM), the increase is largely due to costs that were not included in the original agreement with OMB, including almost $105 million for technology refreshment. Concerned that BLM might deploy the system prematurely, the House and Senate appropriations committees in fiscal year 1996 directed BLM to (1) test, verify, and validate that ALMRS operates as specified and (2) certify to them that it performs accurately and effectively and provides the expected capabilities prior to deployment. BLM retained a contractor to conduct the independent verification and validation testing and an operational assessment, testing, and evaluation and expects to base its certification to the committees on these tests. In our March 1997 report,we stated that BLM would not be ready to deploy ALMRS until it has completed essential management plans, policies, or procedures to help ensure a successful transition and operating environment. As of February 20, 1998, BLM had not fully implemented the recommendations contained in our March 1997 report. BLM’s efforts to develop a security plan and an architecture, transition plans, and operations and maintenance plans were incomplete. BLM had taken substantial action to establish a configuration management program, but it had not yet produced a credible project schedule. These management tools are essential to manage the remainder of the project, help ensure system availability and performance, and avoid security and operational problems. Security focuses on the ability to ensure the confidentiality, integrity, and availability of stored and processed data. Unsecured or poorly secured systems are highly vulnerable to external and internal attacks and unauthorized use. Security planning includes the identification of high-level security requirements, including mission, management, and technical security requirements; functional security requirements that cover users’ security needs; data-sensitivity analysis to identify data requiring special protection; and a security architecture that describes the security controls and relationships among the various system components. The ALMRS/Modernization security plan should define the policies and procedures for operating and maintaining a secure environment. In our March 1997 report, we recommended that before deploying ALMRS IOC, BLM develop a system security architecture and plan, including security policies and procedures; disaster and recovery plans; and security test, evaluation, and certification plans to reduce risks to the availability and integrity of stored and processed data. BLM has not yet developed a security architecture. It has developed a security plan, finalized some policies—such as those governing user access to ALMRS/Modernization components—and has been working to complete contingency plans for the state offices and their subordinate district and area offices. Also, in October 1997, BLM conducted a risk assessment for the planned deployment of ALMRS IOC to the New Mexico State Office. In January 1998, ALMRS IOC was certified for operation in New Mexico by the Department of the Interior’s Information Technology Security Manager. Our review of BLM’s security plan and related documents shows that the plan is not based on a documented risk assessment of ALMRS and does not provide sufficient detail to manage the security of ALMRS and its databases. Because BLM has no documented risk assessment of the ALMRS, it has no basis for asserting that the system is secure or the plan adequately addresses the various vulnerabilities and risks attendant to a nationwide client-server system. Also, the risk assessment performed at the New Mexico State Office focused on policies, procedures, and conditions at that office but did not deal with the security of, or assess the vulnerabilities of and risks to, ALMRS. The process of deploying a major information system that people will use to do their jobs requires careful planning. Many of the 210 BLM offices nationwide that will receive ALMRS/Modernization—designed to automate many manual functions—have little or no experience implementing client-server systems. The transition from automated capabilities provided by a centrally managed mainframe system to a locally managed client-server environment requires changes in organizational roles, responsibilities, and interrelationships among the units and people using the system. A transition plan should address these issues and guide BLM in defining new operational procedures. In our March 1997 report, we recommended that before deploying ALMRS IOC, BLM develop transition plans outlining the changes in organizational roles, responsibilities, and interrelationships among the units and people using the ALMRS/Modernization system to reduce the risk associated with those changes. BLM’s National Information Resources Management Center developed the ALMRS Transition/Deployment Plan, dated September 2, 1997, to be used as a guide for deploying the needed upgrades for the hardware and software and transitioning to the ALMRS/Modernization platform and ALMRS IOC. According to a senior program analyst for the ALMRS project, 4 of the 12 state offices have prepared transition plans for their operations and the offices under their jurisdictions. BLM provided a copy of the 4 state offices’ plans. Our review of the ALMRS Transition/Deployment Plan showed that while the plan generally addresses transition, its primary focus is on deployment activities. BLM notes that subsequent versions of the plan will provide more transition information to help each state office make use of ALMRS in the most effective and efficient way. The Assistant Director for IRM told us that the ALMRS Transition/Deployment Plan will be updated to incorporate the recent work of user advisory teams and lessons from final ALMRS testing. Our review of the 4 state offices’ plans showed that only 1 of them identified and addressed transition issues, such as how the state and subordinate offices will deal with oil and gas, mining, and solid mineral business process changes resulting from the implementation of ALMRS. Unless BLM ensures that the revised plans adequately address transition issues, BLM faces increased risks of disruptions to its work processes and impairments to its ability to (1) conduct its land and mineral management business and (2) use ALMRS most effectively.