The FBI serves as the primary investigative unit of the Department of Justice. Its mission includes investigating serious federal crimes, protecting the nation from foreign intelligence and terrorist threats, and assisting other law enforcement agencies. Approximately 12,000 special agents and 16,000 analysts and mission support personnel are located in the bureau’s Washington, D.C., headquarters and about 70 offices in the United States and 50 offices in foreign countries. Mission responsibilities at the bureau are divided among a number of major organizational components, including: National Security: integrates investigative and intelligence activities against current and emerging national security threats and provides information and analysis for the national security and law enforcement communities. Criminal Investigations: investigates serious federal crimes and probes federal statutory violations involving exploitation of the Internet and computer systems. Law Enforcement: provides law enforcement information and forensic services to federal, state, local, and international agencies. Administration: manages the bureau’s personnel programs, budgetary and financial services, records, information resources, and information security. Office of the Chief Information Officer: develops and implements the bureau’s IT strategic plan and operating budget, which includes acquiring, operating, and maintaining IT assets. To execute its mission, the FBI relies extensively on the use of IT. In particular, the bureau operates and maintains hundreds of computerized systems, databases, and applications, such as the Combined DNA Index System, which supports forensic examinations; National Crime Information Center and the Integrated Automated Fingerprint Identification System, which help state and local law enforcement agencies identify criminals; Automated Case Management System, which manages information collected on investigative cases; Investigative Data Warehouse, which aggregates data from disparate databases in a standard format to facilitate content management and data mining; and Terrorist Screening Database, which consolidates identification information about known or suspected international and domestic terrorists. Following the terrorist attacks in the United States on September 11, 2001, the FBI shifted its mission focus to detecting and preventing future attacks, which led to the FBI’s commitment to reorganize and transform. According to the bureau, the complexity of this mission shift, along with the changing law enforcement environment, strained its existing IT environment. As a result, the bureau accelerated the IT modernization program that it had begun in September 2000. This program, later named Trilogy, was the FBI’s largest IT initiative to date and consisted of three parts: (1) the Information Presentation Component to upgrade FBI’s computer hardware and system software, (2) the Transportation Network Component to upgrade the agency’s communication network, and (3) the User Application Component to upgrade and consolidate the bureau’s five key investigative software applications. The heart of this last component became the Virtual Case File (VCF) project, which was intended to replace the obsolete Automated Case Support system. While the first two components of Trilogy are currently operating, the third component—VCF—never became operational because it was determined to be an infeasible and cost prohibitive solution. We have previously reported on reasons for VCF’s failure, which included limitations in system requirements, ineffective control over changes to the system, limited oversight of contractors, and lack of continuity in certain management positions and trained staff for key program positions. The Sentinel program began in 2005, and is intended to be both the successor to and an expansion of VCF. As we previously reported, Sentinel is to meet a pressing need for a modern, automated capability for investigative case management and information sharing to help field agents and intelligence analysts perform their jobs more effectively and efficiently. More specifically, it is to (1) provide a single point of entry for all investigative case management and paperless case management and workflow capabilities, (2) facilitate a bureauwide organizational change management program, and (3) provide intuitive interfaces that feature data relevant to individual users. Examples of specific Sentinel capabilities include leads management and evidence management; document and records management; indexed searching and electronic workflow; legacy system and external data source connectivity; training, statistical, and reporting tools; and security management. After conducting a multistep evaluation of the different governmentwide acquisition contracts available to federal agencies, the FBI issued a request for vendor proposals to more than 40 eligible companies under a National Institutes of Health contract in August 2005. In March 2006, the FBI awarded a task order to develop and integrate Sentinel to Lockheed Martin Corporation. The FBI plans to deliver defined Sentinel capabilities in four phases using commercially available software and hardware components. The specific content of each phase is to be proposed by and negotiated with the prime contractor. The general capabilities for each phase are as follows: Phase 1: A Web-based user interface for accessing data from the Automated Case Management System and other legacy systems and a service-oriented architecture to support delivery and sharing of common services across the bureau. Phase 2: An enterprise portal for accessing Sentinel case management capabilities, Web-application reengineering to provide faster response time, electronic authoring and approval of forms, and calendaring. Phase 3: Online searches, integration with FBI scanners, and template management. Phase 4: Enhanced case, evidence and crisis management, full search capability/information profile match, document authoring and workflow capabilities, fully certified FBI records management, and all case and ad hoc view capabilities. Phase 1 capabilities were deployed in June 2007 and are currently operating. Following Phase 1, the FBI, in consultation with its prime contractor, adopted a more incremental design and development approach with more frequent deliveries of capabilities. In general, each phase is to consist of segments, which are to be logically grouped and sequenced bundles of system capabilities that are to be delivered in 3-6 month time frames. Each segment is to be further decomposed into a series of sequenced increments. Figure 1 provides a simplified representation of the relationship and timing of phases, segments, and increments. Sentinel is currently in its second phase, which is to run from October 2007 to July 2009 (22 months) and is to consist of four segments. According to the Sentinel Program Office, Segment 1 was completed in April 2008; Segment 2 began in January 2008 and is largely complete, with deployment scheduled for July 2008. The FBI is currently developing Segment 3, with deployment planned for February 2009. The FBI estimates that the four phases will cost about $451 million through fiscal year 2012. The FBI has budgeted $183 million in funding for Phase 2 (excluding operations and maintenance) and, as of July 2008, had reportedly obligated $135 million. To manage Sentinel, the FBI established a program office within the Office of the Chief Information Officer. The program office is led by a program manager, a deputy program manager for systems development, and a deputy program manager for organizational change management. The FBI’s policies and guidance governing the acquisition of IT programs such as Sentinel are contained in various documents, including its IT life- cycle management directive, which is dated August 2005 and was approved by the Chief Information Officer in January 2006. The directive provides the bureau’s framework for standardized, repeatable, and sustainable management of all of its IT programs and projects. According to the directive, the framework is to be tailored to the needs and priorities associated with each program/project. The framework consists of, among other things, interrelated life-cycle phases, control gates, and reviews. The nine life-cycle phases are concept exploration, requirements development, acquisition planning, source selection, design, development and test, implementation and integration, operations and maintenance, and disposal. The life-cycle phases are associated with one or more control gates and/or program/project reviews. They are also linked to key stakeholder processes, including information security management, and recognized system development and acquisition best practice areas. The framework’s elements are discussed in more detail below and depicted in figure 2. The seven control gates are mechanisms for executive-level control and direction, decision making, coordination, and confirmation of successful performance of activities to date. At these gates, a determination is made regarding the program/project’s readiness to proceed to the next phase. Examples of control gates are system concept review, contract review board, enterprise architecture board, and technical review board. The 14 program/project reviews determine program/project satisfaction of the directive’s requirements, completion of milestones, and system design satisfaction of FBI operational needs. The review results are used to inform control gate determinations and decisions. Examples of reviews are mission needs review, system specification review, preliminary design review, and product test readiness review. The directive has seven key stakeholder processes that are not linked to any particular phase, gate, or review. These processes reflect such management functions as enterprise architecture alignment, investment management, budget execution, acquisition management, and information security management. The directive incorporates basic project management process areas and selected standardization process areas reflected in system development and acquisition best practices published by the Software Engineering Institute. Among the process areas addressed are configuration management, process and product quality assurance, requirements development, and risk management. According to Sentinel officials, they have tailored Version 3.0 of the directive for Sentinel, which is permitted by the guidance. However, a program official told us that a new version of the directive has been drafted. In addition, the FBI’s project manager’s handbook, dated September 2007, provides supporting guidance for implementing the IT life-cycle management directive. The handbook identifies and defines seven primary project management practices for effectively managing IT projects within the context of the management directive. These management practices include managing requirements, performance, and systems engineering, as well as the use of program controls. Acquisition best practices are tried and proven methods that organizations capture in policies and guidance, define, and institutionally implement to minimize program risks and maximize the chances of program success. Using best practices can result in better outcomes—including cost savings, improved service and product quality, and ultimately, a better return on investment.