DOD is a massive and complex organization. To illustrate, the department reported that its fiscal year 2006 operations involved approximately $1.4 trillion in assets and $2.0 trillion in liabilities, more than 2.9 million military and civilian personnel, and $581 billion in net cost of operations. Organizationally, the department includes the Office of the Secretary of Defense, the Chairman of the Joint Chiefs of Staff, the military departments, numerous defense agencies and field activities, and various unified combatant commands that are responsible for either specific geographic regions or specific functions. Figure 1 provides a simplified depiction of DOD’s organizational structure. In support of its military operations, DOD performs an assortment of interrelated and interdependent business functions, including logistics management, procurement, health care management, and financial management. As we have previously reported, the systems environment that supports these business functions is overly complex and error prone, and is characterized by (1) little standardization across the department, (2) multiple systems performing the same tasks, (3) the same data stored in multiple systems, and (4) the need for data to be entered manually into multiple systems. Air Force is a major component of DOD. Its mission is to deliver options for the defense of the United States and its global interests in air, space, and cyberspace. Air Force relies extensively on IT to fulfill these competencies effectively and to meet its organizational mission. It has 909 business systems; of these systems, 832 (91 percent) are in operations and maintenance. In fiscal year 2006, Air Force was allocated approximately $651 million for its business systems, of which about $406 million (62 percent) was allocated to systems in operations and maintenance and $245 million (38 percent) was allocated to systems in development and/or modernization. Air Force has created the Office of Warfighting Integration and Chief Information Office to provide the IT and supporting infrastructure to fulfill its mission. Among the goals of this organization are to deliver the ability to direct forces while anticipating situations, capabilities, and limitations; develop adaptive, trained airmen; provide policy, standards, oversight, and training to enable airmen to share and exploit accurate information any place and, anytime; and transform the communications and information career field to lead Air Force in leveraging information for its competitive advantage. The Office of Warfighting Integration and Chief Information Office consists of several organizations, as depicted in figure 2. Successful public and private organizations use a corporate approach to IT investment management. Recognizing this, Congress enacted the Clinger- Cohen Act of 1996, which requires the Office of Management and Budget (OMB) to establish processes to analyze, track, and evaluate the risks and results of major capital investments in IT systems made by executive agencies. In response to the Clinger-Cohen Act and other statutes, OMB has developed policy and issued guidance for the planning, budgeting, acquisition, and management of federal capital assets. We have also issued guidance in this area that defines institutional structures, such as investment review boards; processes for developing information on investments (such as costs and benefits); and practices to inform management decisions (such as whether a given investment is aligned with an enterprise architecture). IT investment management is a process for linking IT investment decisions to an organization’s strategic objectives and business plans. Consistent with this, the federal approach to IT investment management focuses on selecting, controlling, and evaluating investments in a manner that minimize risks while maximizing the return on investment. During the selection phase, the organization (1) identifies and analyzes each project’s risks and returns before committing significant funds to any project and (2) selects those IT projects that will best support its mission needs. During the control phase, the organization ensures that projects, as they develop and investment expenditures continue, meet mission needs at the expected levels of cost and risk. If the project is not meeting expectations or if problems arise, steps are quickly taken to address the deficiencies. During the evaluation phase, expected results are compared with actual results after a project has been fully implemented. This comparison is done to (1) assess the project’s impact on mission performance, (2) identify any changes or modifications to the project that may be needed, and (3) revise the investment management process based on lessons learned. Our ITIM framework consists of five progressive stages of maturity for any given agency relative to selecting, controlling, and evaluating its investment management capabilities. (See fig. 3 for the five ITIM stages of maturity.) This framework is grounded in our research of IT investment management practices of leading private and public sector organizations. The framework can be used to assess the maturity of an agency’s investment management processes and as a tool for organizational improvement. The overriding purpose of the framework is to encourage investment selection and control and to evaluate processes that promote business value and mission performance, reduce risk, and increase accountability and transparency. We have used the framework in several of our evaluations, and a number of agencies have adopted it. ITIM’s five maturity stages represent the steps toward achieving stable and mature processes for managing IT investments. Each stage builds on the lower stages; the successful attainment of each stage leads to improvement in the organization’s ability to manage its investments. With the exception of the first stage, each maturity stage is composed of “critical processes” that must be implemented and institutionalized in order for the organization to achieve that stage. These critical processes are further broken down into key practices that describe the types of activities that an organization should be performing to successfully implement each critical process. It is not unusual for an organization to be performing key practices from more than one maturity stage at the same time. However, our research has shown that agency efforts to improve investment management capabilities should focus on implementing all lower stage practices before addressing the higher stage practices. In the ITIM framework, Stage 2 critical processes lay the foundation for sound IT investment management by helping the agency to attain successful, predictable, and repeatable investment management processes at the project level. Specifically, Stage 2 encompasses building a sound investment management foundation by establishing basic capabilities for selecting new IT projects. This stage also involves developing the capability to control projects so that they finish predictably within established cost and schedule expectations and developing the capability to identify potential exposures to risk and put in place strategies to mitigate that risk. Further, it involves evaluating completed projects to ensure they meet business needs and collecting lessons learned to improve the IT investment management process. The basic management processes established in Stage 2 lay the foundation for more mature management capabilities in Stage 3, which represents a major step forward in maturity, in which the agency moves from project-centric processes to a portfolio approach, evaluating potential investments by how well they support the agency’s missions, strategies, and goals. Stage 3 requires that an organization continually assess both proposed and ongoing projects as parts of a complete investment portfolio—an integrated and competing set of investment options. It focuses on establishing a consistent, well-defined perspective on the IT investment portfolio and maintaining mature, integrated selection (and reselection), control, and post-implementation evaluation processes. This portfolio perspective allows decision makers to consider the interaction among investments and the contributions to organizational mission goals and strategies that could be made by alternative portfolio selections, rather than focusing exclusively on the balance between the costs and benefits of individual investments. Organizations that have implemented Stages 2 and 3 practices have capabilities in place that assist in establishing selection; control; and evaluation structures, policies, procedures, and practices that are required by the investment management provisions of the Clinger- Cohen Act. Stages 4 and 5 require the use of evaluation techniques to continuously improve both the investment portfolio and the investment processes in order to better achieve strategic outcomes. At Stage 4, an organization has the capacity to conduct IT succession activities and, therefore, can plan and implement the deselection of obsolete, high-risk, or low-value IT investments. An organization with Stage 5 maturity conducts proactive monitoring for breakthrough information technologies that will enable it to change and improve its business performance. DOD’s major system investments (i.e., weapons and business systems) are governed by three management systems that focus on defining needs, budgeting for, and acquiring investments to support the mission—the Joint Capabilities Integration and Development System (JCIDS); the Planning, Programming, Budgeting, and Execution (PPBE) system; and the Defense Acquisition System (DAS). In addition, DOD’s business systems are subject to a fourth management system, which, for purposes of this report, we refer to as the Business Investment Management System. For each of these systems, DOD relies on its component agencies to execute the underlying policies and procedures. According to DOD, the four management systems, collectively, are the means by which the department—and its components—selects, controls, and evaluates its business systems investments. JCIDS is a needs-driven, capabilities-based approach to identify mission needs and meet future joint forces challenges. It is intended to identify future capabilities for DOD; address capability gaps and mission needs recognized by the Joint Chiefs of Staff or derived from strategic guidance, such as the National Security Strategy Report or Quadrennial Defense Review; and identify alternative solutions by considering a range of doctrine, organization, training, materiel, leadership and education, personnel, and facilities solutions. According to DOD, the Joint Chiefs of Staff—through the Joint Requirements Oversight Council—has primary responsibility for defining and implementing JCIDS. All JCIDS documents are submitted to the Joint Chiefs of Staff, which determines whether the proposed system has joint implications or is component-unique. If it is designated as joint interest, then the Joint Requirements Oversight Council is responsible for approving and validating the documents. If it is not designated as having joint interests, the sponsoring component is responsible for validation and approval. PPBE is a calendar-driven approach that is composed of four phases that occur over a moving 2-year cycle.