Advances in the use of information technology and the Internet are transforming the way federal agencies communicate, use information, deliver services, and conduct business. To increase the ability of citizens to interact with the federal government electronically, in 1998 the Congress enacted GPEA. GPEA makes OMB responsible for ensuring that federal agencies meet the act’s October 21, 2003, implementation deadline. In May 2000, OMB issued GPEA implementation guidance, which lays out a process and principles for agencies to employ in evaluating the use and acceptance of electronic documents and signatures. The guidance calls for agencies to examine business processes that might be revamped to employ electronic documents, forms, or transactions; identify customer needs and demands; consider the costs, benefits, and risks associated with making the transition to electronic environments; and develop plans and strategies for recordkeeping and security. In September 2000, we concluded that OMB’s GPEA guidance—as well as the guidance and supplementary efforts being undertaken by Treasury, the National Archives and Records Administration, the Departments of Justice and Commerce and others— provided a useful foundation of information to assist agencies with GPEA implementation and the transition to electronic government (e- government). Our report also laid out information technology management challenges that are fundamental to the success of GPEA. OMB’s May guidance also required each agency, by October 2000, to develop and submit a GPEA implementation plan and schedule. According to this guidance, these plans were to prioritize implementation of systems and system modules based on achievability and net benefit. Further, agencies were required to coordinate their GPEA plans and schedules with their strategic information technology (IT) planning activities and report progress annually. In July 2000 OMB issued supplemental guidance that provided a structured, standardized format for agency reporting of GPEA implementation plans. Unlike the May 2000 guidance, which discussed a wide range of activities needed for an agency to comply with GPEA, this new guidance focused on specific kinds of data that OMB was expecting agencies to submit in the October 2000 plans. The new guidance specified that the plans be divided into four parts: First, agencies were to provide a cover letter describing their overall strategy and actions to comply with the act. This letter is the part of the plan that provides an agencywide perspective on GPEA compliance efforts. Second, agencies were required to provide data in tabular form regarding information-collection activities approved by OMB under the Paperwork Reduction Act (PRA), which mandates that OMB review how agencies collect and use information. The data tables were to include a column showing when an electronic option would be completed (if one was being planned) and whether electronic signatures were to be used. Third, agencies were requested to provide an additional table showing interagency reporting, information-dissemination activities, and other agency-identified transactions. According to OMB’s guidance, “interagency reporting” encompasses ongoing, periodic reports, such as personnel and payroll reports, which are exchanged among agencies. “Information-dissemination activities” refers to information products intended for the general public, such as the periodic release of labor statistics. Like the PRA-based inventory, this list was to include a column showing when an electronic option would be completed, if planned, and whether electronic signatures were to be used. Lastly, supplemental information was also to be provided about any of the previously listed transactions that the agency had determined to pose a “high risk,” such as those involving particularly sensitive information or very large numbers of respondents. This section of the plan was to include a description of the transactions, their sensitivity, and additional risk management measures that would be taken. Let me now turn to the three agency plans you asked us to review. According to Treasury’s plan, the department’s GPEA-related activities are a critical component of the overall departmental effort to fundamentally redefine the way it performs its critical missions. According to the plan, a key element of that effort was the development of an e-government strategic plan—just published this month—which Treasury is using as a framework for selecting and implementing electronic initiatives. In addition to its internal initiatives, Treasury’s plan notes that the department has been involved in governmentwide actions to advance electronic government and comply with GPEA. A key example is Pay.gov, an Internet portal developed by its Financial Management Service. According to the plan, the services of Pay.gov can help agencies meet GPEA requirements to accept forms electronically by 2003 by offering a package of electronic financial services to assist agencies, such as enabling end-users to submit agency forms and authorize payments, presenting agency bills to end-users, and establishing the identity of end- users and reporting information about transactions back to the agencies. Once fully operational, this service could help agencies throughout the federal government to more easily reach the goals of GPEA. According to the department’s deputy chief information officer (CIO), the progress of major GPEA-related initiatives at Treasury is being monitored through monthly CIO meetings with representatives from each of the department’s various bureaus and by using an investment management tool. The Deputy CIO added that compliance with GPEA is also included in the criteria that Treasury uses in its investment review process for evaluating newly proposed information technology projects. Treasury used its database of information collections identified under PRA as a starting point for preparing the required data tables for its GPEA implementation plan. PRA information collections include such things as requests for forms and publications, tax-related forms, and business- production reports. To refine the list, the department’s CIO organization convened a group comprising representatives from Treasury’s IT policy and strategy group, CIO development team, bureau representatives, and policy office representatives. The group reviewed the PRA collections and added a records management initiative that had not been part of the original database. Treasury’s plan provides the kind of information stipulated in OMB’s July 2000 guidance. Altogether, Treasury identified 336 PRA information- collection processes that are subject to GPEA. According to the plan, 23 of these are scheduled for conversion to an electronic option in 2001, 36 are scheduled for 2002, and 84 are scheduled for 2003. Of the remaining initiatives, 80 were reported to already be converted, two are scheduled for conversion in 2004, and 111 were not assigned a completion date for conversion. In all but one case where the conversion date was beyond October 2003 or not assigned, Treasury included explanations, as required by OMB’s guidance. Further, Treasury identified 105 initiatives offering an electronic option for interagency reporting, information-dissemination activities, and other transactions, and four transactions identified as high risk. For those initiatives included in Treasury’s plan that did not specify completion dates, the department plans to include that information when it becomes available, according to the deputy CIO. The plan also is expected to be updated as the bureaus and department offices make progress toward completing its initiatives. According to its October 2000 plan, EPA is currently undertaking three major activities in an effort to provide e-government services and comply with GPEA. The first initiative is to establish a new rule that would permit electronic reporting and recordkeeping and establish the requirements necessary to ensure that electronic documents are valid and authentic. EPA has drafted the proposed new rule, and it is currently being reviewed by administration officials. Agency officials expect it to be approved this year, with a final rule to be published in 2002. The second major initiative is the development of a computer network facility known as the Central Data Exchange. This new facility is to be the central point of entry for all electronic reporting, and is expected to provide security, authentication, error detection, and distribution capabilities. EPA expects the facility to be fully operational by the fall of 2002. The third major initiative is to improve EPA’s information security. We have previously reported on significant weaknesses in EPA’s information security program. The October 2000 plan states that the agency has made significant progress in improving its cyber defenses by implementing security confidentiality protocols and procedures. Further, agency officials state that they are actively exploring the use of electronic signatures and public key infrastructure (PKI) technology to ensure the security, confidentiality, and non-repudiation of sensitive data collections. EPA used an iterative process to develop its October 2000 plan. Starting with its internal PRA database as a baseline, Office of Environmental Information personnel created a template of information collections that was sent to each program office for validation and for completion of additional GPEA-related data. The agency’s final plan contains a detailed inventory of its PRA information collections. An EPA official said that this inventory and its related attachments include all of the information regarding plans for electronic interagency reporting, information dissemination activities, and high-risk transactions, as required by OMB. EPA identified 279 data-collection activities applicable to GPEA. Through iterative reviews, it determined that 108 of these were not candidates for electronic reporting for reasons such as that they involved interaction with only a few members of the public or because filling out a paper form was deemed to not be a significant burden. According to the agency’s plan, of the 171 data collections that were considered suitable for electronic reporting, 21 have already been converted, 3 are scheduled for 2001, 13 are scheduled for 2002, and 96 are scheduled for 2003. The remaining 38 data collections that will not be ready for electronic reporting by the GPEA deadline all involve the reporting of confidential business information. The electronic transmission of this type of data poses additional risks that EPA does not plan to have fully addressed by October 2003. Agency officials state that they are in the process of assessing these data collections to determine how to collect these data centrally and in a secure form. By 2003 they expect that they will be testing methods of secure transmission but do not expect them to be operational until after the GPEA deadline.