DHS satisfied or partially satisfied each of the applicable legislative conditions specified in the appropriations act. In particular, the plan, including related program documentation and program officials’ statements, satisfied or provided for satisfying all key aspects of federal acquisition rules, requirements, guidelines, and systems acquisition management practices. Additionally, the plan partially satisfied the conditions that specified (1) compliance with the capital planning and investment review requirements of the Office of Management and Budget (OMB), (2) compliance with DHS’s enterprise architecture, and (3) the plan’s review and approval by DHS’s Investment Review Board, the Secretary of Homeland Security, and OMB. DHS has completely implemented, has partially implemented, is in the process of implementing, or plans to implement all the remaining recommendations contained in our reports on the fiscal years 2002, 2003, and 2004 expenditure plans. Each recommendation, along with its current status, is summarized below: Develop a system security plan and privacy impact assessment. The department has partially implemented this recommendation. First, the US-VISIT program has developed a security plan that provides an overview of system security requirements, describes the controls in place or planned for meeting those requirements, and refers to the applicable documents that prescribe the roles and responsibilities for managing the US-VISIT component systems. However, a security risk assessment of the program has not been completed, and the plan does not include a date for the assessment’s completion. Second, the US-VISIT program has completed a privacy impact assessment for Increment 2. However, the assessment does not satisfy all aspects of OMB guidance for such an assessment, such as fully addressing privacy issues in relevant system documentation. Develop and implement a plan for satisfying key acquisition management controls, including acquisition planning, solicitation, requirements development and management, project management, contract tracking and oversight, evaluation, and transition to support, and implement the controls in accordance with the Software Engineering Institute’s (SEI) guidance. The department is in the process of implementing this recommendation. The US-VISIT Acquisition and Program Management Office has initiated a process improvement program and drafted a process improvement plan. The office has also developed processes or plans, some of which are approved and some of which are in draft, for all except one of SEI’s Software Acquisition Capability Maturity Model (SA-CMM) Level 2 key process areas. Ensure that future expenditure plans are provided to the department’s House and Senate Appropriations Subcommittees in advance of US- VISIT funds being obligated. With respect to the fiscal year 2005 expenditure plan, DHS implemented this recommendation by providing the plan to the Senate and House Subcommittees on October 19, 2004. Ensure that future expenditure plans fully disclose US-VISIT system capabilities, schedule, cost, and benefits to be delivered. The department has partially implemented this recommendation. The expenditure plan identifies high-level capabilities and high-level schedule estimates. It also identifies the amounts budgeted for each increment for fiscal years 2003 through 2005, but it does not associate this funding with specific capabilities and benefits. Further, while the plan identifies several benefits and associates these benefits with increments, it does not include any information on related metrics or on progress against achieving any of the benefits. Ensure that future expenditure plans fully disclose how the US-VISIT acquisition is being managed. The department is in the process of implementing this recommendation. The fiscal year 2005 plan describes some activities being employed to manage the US-VISIT acquisition, such as the governance structure, program office organizational structure, and staffing levels. However, the department does not describe how other important aspects of the program are being managed, such as testing, system capacity, and system configuration. Ensure that human capital and financial resources are provided to establish a fully functional and effective program office. The department has partially implemented this recommendation. As of October 2004, US-VISIT had filled 59 of its 115 government positions, with plans to fill about half the vacant positions once security clearances have been completed. As of November 2004, the program office had filled 88 of a planned 117 contractor positions. The expenditure plan indicates that DHS has budgeted $83 million to maintain the US-VISIT program management structure and baseline operations. Clarify the operational context in which US-VISIT is to operate. The department is in the process of implementing this recommendation. In September 2003, DHS released version 1.0 of its enterprise architecture. We reviewed version 1.0 and found that it is missing, either partially or completely, all the key elements expected in a well-defined architecture, such as descriptions of business processes, information flows among these processes, and security rules associated with these information flows. Since we reviewed version 1.0 of the architecture, DHS has drafted version 2.0. We have not reviewed version 2.0. Determine whether proposed US-VISIT increments will produce mission value commensurate with cost and risks. The department is in the process of implementing this recommendation. US-VISIT developed a cost-benefit analysis for Increment 2B, but it is unclear whether this increment will produce mission value commensurate with cost and risk. For example, the analysis addresses only government costs and does not address potential nongovernmental costs. Further, the analysis identifies three alternatives and identifies the third alternative as the preferred choice. However, US-VISIT is pursuing an alternative more closely aligned with alternative 2, because alternative 3 was considered too ambitious to meet statutorily required time lines. Define US-VISIT program office positions, roles, and responsibilities. The department has partially implemented this recommendation. US- VISIT has developed descriptions for positions within each office, and working with the Office of Personnel Management (OPM), it has drafted a set of core competencies that define the knowledge, skills, abilities, and other competencies needed for successful employee performance. Develop and implement a human capital strategy for the US-VISIT program office that provides for staffing positions with individuals who have the appropriate knowledge, skills, and abilities. The department has partially implemented this recommendation. The US- VISIT program office, in conjunction with OPM, has drafted a Human Capital Plan. The plan includes an action plan that identifies activities, proposed completion dates, and the organization responsible for completing these activities. The program office has completed some of the activities called for in the plan, including the designation of a liaison responsible for ensuring alignment between DHS and US-VISIT human capital policies. Develop a risk management plan and report all high risks and their status to the executive body on a regular basis. The department has partially implemented this recommendation. The US- VISIT program office has developed a risk management plan and process and has established a governance structure involving three primary groups—the Risk Review Board, Risk Review Council, and Risk Management Team. The Risk Review Board represents the highest level of risk management within the program and is composed of senior level staff, such as the program director and functional area directors. However, US- VISIT has not reported high risks beyond this board. Define performance standards for each US-VISIT program increment that are measurable and reflect the limitations imposed by relying on existing systems. The department is in the process of implementing this recommendation. The US-VISIT program office has defined some technical performance measures—such as availability, timeliness, and output quantity—for Increments 1 and 2B, but it has not defined others, such as reliability, resource utilization, and scalability. Additionally, US-VISIT systems documentation does not contain sufficient information to determine the limitations imposed by US-VISIT’s reliance on existing systems that have less demanding performance requirements, such as the 98.0 percent availability of the Treasury Enforcement Communications Systems. Develop and approve test plans before testing begins. These test plans should (1) specify the test environment; (2) describe each test to be performed, including test controls, inputs, and expected outputs; (3) define the test procedures to be followed in conducting the tests; and (4) provide traceability between test cases and the requirements to be verified by the testing. The department is in the process of implementing this recommendation. According to the US-VISIT Systems Assurance Director, the Increment 2B system acceptance test plan was approved on October 15, 2004. However, no documentation was provided that explicitly indicated the approval of the plan. Further, the test plan did not fully address the test environment, include descriptions of tests to be performed, or provide test procedures to be followed in conducting the tests. The plan also did not provide traceability between test cases and the requirements to be verified by the testing. For example, 15 of the 116 requirements did not have test cases, and 2 requirements were labeled “not testable.” Ensure the independence of the Independent Verification and Validation (IV&V) Contractor. The department is in the process of implementing this recommendation. The US-VISIT Information Technology (IT) Management Office is developing high-level requirements for IV&V, including a strategy and statement of work for acquiring an IV&V contractor. Implement effective configuration management practices, including establishing a US-VISIT change control board to manage and oversee system changes. The department plans to implement this recommendation. The US-VISIT program office has not yet developed or implemented US-VISIT-level configuration management practices or a change control board. The office has developed a draft configuration management plan that describes key configuration management activities that are to be defined and implemented, such as defining and identifying processes and products to be controlled and recording and monitoring changes to the controlled items. The draft plan also proposes a governance structure, including change control boards. Identify and disclose management reserve funding embedded in the fiscal year 2004 expenditure plan to the Appropriations Subcommittees. The department has implemented this recommendation.