U.S. Attorneys prosecute criminal cases brought forward by the federal government, prosecute and defend civil cases in which the United States is a party, and collect debts owed to the federal government that are administratively uncollectible. EOUSA was established in 1953 as a component of the Department of Justice to, among other things, provide general executive assistance and administrative and operational support to the 93 USAOs located throughout the 50 states, the District of Columbia, Guam, the Marianas Islands, Puerto Rico, and the U. S. Virgin Islands and to coordinate with other Department of Justice organizational units and other federal agencies on behalf of the U.S. Attorneys. One of EOUSA’s key responsibilities is managing the USAOs’ IT resources, including preparing their annual IT budget submissions and supporting their acquisition and maintenance of IT assets. IT plays an important role in helping the USAOs meet their mission objectives and, according to EOUSA planning documents, the USAOs’ reliance on IT is to increase in response to expected growth in the number and complexity of their cases. Currently, EOUSA manages an IT environment consisting of central and distributed computing and communication resources in Washington, D.C., and 93 USAOs, respectively. Connectivity among these offices, Justice headquarters, and Justice’s Data Center in Rockville, MD, is through a virtual private network (VPN) connection on the Justice Consolidated Network (JCN), with such security safeguards as firewalls between USAO local area networks and JCN. The VPN/firewall combination, which provides the foundation for secure communications between EOUSA and the sites mentioned above, is currently being replaced. Figure 1 generally depicts EOUSA’s network topology. The USAOs’ support is also provided by such application systems as the Legal Information Office Network System, which is a case management system that compiles, maintains, and tracks information about defendants, crimes, criminal charges, court events, and witnesses, and the Victim Notification System, which notifies crime victims of the status of their cases and assists with checking compliance with regulations and policies concerning victim notification. Recognizing the importance of IT to achieving the USAOs’ mission, EOUSA appointed a Chief Information Officer (CIO) in May 2001 and assigned the CIO accountability and responsibility for managing central and distributed IT resources and services, including managing the IT budget for the office and all of the USAOs; developing and acquiring new systems, including case management systems, and providing support for existing systems; managing network, telephone, and video communications; and securing IT assets (data, applications, and supporting networks). In fiscal year 2003, EOUSA reports that it plans to spend approximately $125 million on about 20 initiatives. Roughly $110 million of this amount is to be spent on IT infrastructure and office automation projects (e.g., telecommunications programs). The remainder is to be spent on acquiring mission support systems (e.g., Enterprise Case Management System (ECMS), Victim Notification System) and maintaining existing ones. Figure 2 shows the breakdown of estimated expenditures for fiscal year 2003. Research into the IT management practices that are employed by leading public- and private-sector organizations has identified key institutional IT management disciplines that are interrelated and critical to ensuring, among other things, the integrity, security, and efficiency of IT systems. These disciplines are also addressed in legislation and federal guidance. 1. enterprise architecture management, which involves defining, maintaining, and implementing an institutional blueprint that defines both the business and the supporting technology of the organization’s current and target operating environments and a roadmap to achieve the target environment; 2. IT investment management, which involves selecting, controlling, and evaluating a portfolio of investments within the context of an enterprise architecture; 3. IT security management, which involves protecting the integrity, confidentiality, and availability of an organization’s IT assets (e.g., data, application systems, and networks) and reducing the risks of tampering, unauthorized intrusions and disclosures, and disruption of operations. 4. system acquisition management, which involves managing selected investments (system projects) in a manner that increases the probability of promised system capabilities being delivered on time and within budget. As we have previously reported, to successfully institutionalize these disciplines, organizations should develop integrated plans to guide their efforts that (1) specify measurable goals, objectives, and milestones; (2) specify needed resources; and (3) assign clear responsibility and accountability for accomplishing well-defined tasks. In addition, these plans should be approved by senior management. In implementing these plans, it is important that organizations allocate adequate resources and measure and report progress against planned commitments and that appropriate corrective actions be taken to address deviations. EOUSA has defined and implemented each of the four IT management disciplines mentioned above to some degree. However, none has been institutionalized, meaning that they are not fully defined in accordance with best practices and what has been defined has not been fully implemented. While these disciplines have been given attention since the recent appointment of the CIO, they have not been treated as priorities, in that action plans needed for successful institutionalization have not been developed or resourced. As a result, EOUSA is currently limited in its ability to meet Justice’s strategic goal of improving its IT systems, and the USAOs will be challenged in their ability to effectively and efficiently meet their mission goals and priorities. An enterprise architecture (EA) is an investment blueprint that defines, both in logical terms (including business functions and applications, work locations, information needs and users, and the interrelationships among these variables) and in technical terms (including hardware, software, data communications, and security) how an organization operates today (“as is”), how it intends to operate tomorrow (“to be”), and a roadmap for transitioning from today to tomorrow. The development, maintenance, and implementation of architectures are recognized hallmarks of successful public and private organizations. According to a guide published by the federal CIO Council,effective architecture management consists of a number of core elements. In February 2002, we published version 1.0 of our EA management maturity framework, which arranges the core elements of the CIO Council’s guide into five hierarchical stages. The framework provides an explicit benchmark for gauging the effectiveness of architecture management and provides a roadmap for making improvements. Table 1 summarizes the framework’s five stages of maturity. EOUSA has satisfied many of the framework’s core elements. Specifically, it has satisfied about 80 percent of the elements associated with building the EA management foundation—stage 2 of our EA management maturity framework—and half of the 12 core elements associated with higher maturity stages. At stage 2, it has established a chief architect and has selected a framework (the Federal Enterprise Architecture Framework) and, according to officials, selected a tool (the Enterprise Architecture Management System) to serve as a repository for its EA artifacts. At the higher stages of our framework, the CIO, for example, approved a version of an EA in May 2002 that describes the “as is” and “to be” environments for its core business functions. However, the office has yet to satisfy several of the core elements that are critical to effective EA management. For example, a committee or group representing the enterprise has not yet been established to guide and oversee the development of future versions of the architecture. Instead, the current version of its architecture has been primarily guided and directed by the CIO’s office. Until a committee or group representing the enterprise is established, there is increased risk that the architecture will not represent a corporate decision-making tool and will not be viewed and endorsed officewide as such a tool. Another example is the absence of a written or approved policy for maintaining the EA. Without a documented, approved policy for EA maintenance that, for example, assigns responsibility and accountability for configuration management and version control, EOUSA risks allowing its architecture to become outdated and irrelevant, thus limiting its effectiveness in selecting and guiding IT investments. EOUSA does not have a written plan of action for strengthening EA management and evolving the current version of its EA, because, according to the CIO, developing such a plan is not a priority. Table 2 shows EOUSA’s performance in addressing the core elements of our maturity framework. Effective IT investment management provides for evaluating each proposed and ongoing investment, based on EA alignment and measurable risks and returns and for selecting and controlling these investments as a portfolio of competing investment options. We have developed a framework that defines and measures an organization’s maturity in IT investment management (ITIM) and provides a basis for improving investment management. This framework, which is based on the IT investment management practices of leading private- and public-sector organizations, is structured to permit progression through five maturity stages (shown in table 3). Each maturity stage consists of critical processes and key practices that should be implemented for an organization to become more effective in managing its IT investments. According to the framework, the first key step toward an effective investment management process is to build the investment foundation. An organization with this foundation (stage 2 maturity) has attained repeatable, successful investment control processes and basic selection processes at the project level. Successful management at this level allows an organization to measure the progress of existing IT projects and to identify variances in cost, schedule, and performance expectations by following established, disciplined processes. The organization should also be able to take corrective action, if appropriate, and should possess basic capabilities for selecting new project proposals. To accomplish this level of basic control, an organization should establish an investment board, identify the business needs and opportunities to be addressed by each project, and use this knowledge in the selection of new proposals. The office has satisfied two of the critical processes for stage 2, but it has not satisfied the other three. Specifically, it has established an investment governing board, known as the Investment Review Board (IRB) and developed a guide to direct its operations. It is also defining project needs in alignment with the agency’s mission goals.