DHS satisfied or partially satisfied each of the applicable legislative conditions specified in the act. In particular, the plan, including related program documentation and program officials’ statements, satisfied or provided for satisfying all key aspects of (1) compliance with the DHS enterprise architecture; (2) federal acquisition rules, requirements, guidelines, and systems acquisition management practices; and (3) review and approval by DHS and the Office of Management and Budget (OMB). Additionally, the plan, including program documentation and program officials’ statements, satisfied or provided for satisfying many, but not all, key aspects of OMB’s capital planning and investment review requirements. For example, DHS fulfilled the OMB requirement that it justify and describe its acquisition strategy. However, DHS does not have current life cycle costs or a current cost/benefit analysis for US-VISIT. DHS has implemented one, and either partially implemented or has initiated action to implement most of the remaining recommendations contained in our reports on the fiscal year 2002 and fiscal year 2003 expenditure plans. Each recommendation, along with its current status, is summarized below: Develop a system security plan and privacy impact assessment. The department has partially implemented this recommendation. As to the first part of this recommendation, the program office does not have a system security plan for US-VISIT. However, the US-VISIT Chief Information Officer (CIO) accredited Increment 1 based upon security certifications for each of Increment 1’s component systems and a review of each component’s security-related documentation. Second, although the program office has conducted a privacy impact assessment for Increment 1, the assessment does not satisfy all aspects of OMB guidance for conducting an assessment. For example, the assessment does not discuss alternatives to the methods of information collection, and the system documentation does not address privacy issues. Develop and implement a plan for satisfying key acquisition management controls, including acquisition planning, solicitation, requirements management, program management, contract tracking and oversight, evaluation, and transition to support, and implement the controls in accordance with the Software Engineering Institute’s (SEI) guidance. The department plans to implement this recommendation. The US-VISIT program office has assigned responsibility for implementing the recommended controls. However, it has not yet developed explicit plans or time frames for defining and implementing them. Ensure that future expenditure plans are provided to the department’s House and Senate Appropriations Subcommittees in advance of US- VISIT funds being obligated. With respect to the fiscal year 2004 expenditure plan, DHS implemented this recommendation by providing the plan to the Senate and House subcommittees on January 27, 2004. According to the program director, as of February 2004 no funds had been obligated to US-VISIT. Ensure that future expenditure plans fully disclose US-VISIT capabilities, schedule, cost, and benefits. The department has partially implemented this recommendation. Specifically, the plan describes high-level capabilities, high-level schedule estimates, categories of expenditures by increment, and general benefits. However, the plan does not describe planned capabilities by increment and provides only general information on how money will be spent in each increment. Moreover, the plan does not identify all expected benefits in tangible, measurable, and meaningful terms, nor does it associate any benefits with increments. Establish and charter an executive body composed of senior-level representatives from DHS and each US-VISIT stakeholder organization to guide and direct the program. The department has implemented this recommendation by establishing a three-entity governance structure. The entities are (1) the Homeland Security Council, (2) the DHS Investment Review Board, and (3) the US- VISIT Federal Stakeholders Advisory Board. The purpose of the Homeland Security Council is to ensure the coordination of all homeland security- related activities among executive departments and agencies, and the Investment Review Board is expected to monitor US-VISIT’s achievement of cost, schedule, and performance goals. The advisory board is chartered to provide recommendations for overseeing program management and performance activities, including providing advice on the overarching US- VISIT vision; recommending changes to the vision and strategic direction; and providing a communications link for aligning strategic direction, priorities, and resources with stakeholder operations. Ensure that human capital and financial resources are provided to establish a fully functional and effective program office. The department is in the process of implementing this recommendation. DHS has determined that US-VISIT will require 115 government personnel and has filled 41 of these, including 12 key management positions. However, 74 positions have yet to be filled, and all filled positions are staffed by detailees from other organizational units within the department. Clarify the operational context in which US-VISIT is to operate. The department is in the process of implementing this recommendation. DHS released Version 1 of its enterprise architecture in October 2003, and it plans to issue Version 2 in September 2004. Determine whether proposed US-VISIT increments will produce mission value commensurate with cost and risks. The department plans to implement this recommendation. The fiscal year 2004 expenditure plan identifies high-level benefits to be delivered, but the benefits are not associated with specific increments. Additionally, the plan does not identify the total cost of Increment 2. Program officials expected to finalize a cost-benefit analysis this past March and a US-VISIT life cycle cost estimate this past April. Define program office positions, roles, and responsibilities. The department is in the process of implementing this recommendation. Program officials are currently working with the Office of Personnel Management to define program position descriptions, including roles and responsibilities. The program office has partially completed defining the competencies for all 12 key management areas. These competencies are to be used in defining the position descriptions. Develop and implement a human capital strategy for the program office. The department plans to implement this recommendation in conjunction with DHS’s ongoing workforce planning, but stated that they have yet to develop a human capital strategy. According to these officials, DHS’s departmental workforce plan is scheduled for completion during fiscal year 2004. Develop a risk management plan and report all high risks areas and their status to the program’s governing body on a regular basis. The department has partially implemented this recommendation. The program has completed a draft risk management plan, and is currently defining risk management processes. The program is creating a risk management team to operate in lieu of formal processes until these are completed, and also maintains a risk-tracking database that is used to manage risks. Define performance standards for each program increment that are measurable and reflect the limitations imposed by relying on existing systems. The department is in the process of implementing this recommendation. The program office has defined limited performance standards, but not all standards are being defined in a way that reflects the performance limitations of existing systems. Our observations recognize accomplishments to date and address the need for rigorous and disciplined program management practices relating to system testing, independent verification and validation, and system change control. An overview of specific observations follows: Increment 1 commitments were largely met. An initial operating capability for entry (including biographic and biometric data collection) was deployed to 115 air and 14 sea ports of entry on January 5, 2004, with additional capabilities deployed on February 11, 2004. Exit capability (including biometric capture) was deployed to one air and one sea port of entry. Increment 1 testing was not managed effectively and was completed after the system became operational. The Increment 1 system acceptance test plan was developed largely during and after test execution. The department developed multiple plans, and only the final plan, which was done after testing was completed, included all required content, such as tests to be performed and test procedures. None of the test plan versions, including the final version, were concurred with by the system owner or approved by the IT project manager, as required. By not having a complete test plan before testing began, the US-VISIT program office unnecessarily increased the risk that the testing performed would not adequately address Increment 1 requirements and failed to have adequate assurance that the system was being fully tested. Further, by not fully testing Increment 1 before the system became operational, the program office assumed the risk of introducing errors into the deployed system. In fact, post-deployment problems surfaced with the Student and Exchange Visitor Information System (SEVIS) interface as a result of this approach, and manual work-arounds had to be implemented. The independent verification and validation contractor’s roles may be in conflict. The US-VISIT program plans to use its contractor to review some of the processes and products that the contractor may be responsible for defining or executing. Depending on the products and processes in question, this approach potentially impedes the contractor’s independence, and thus its effectiveness. A program-level change control board has not been established. Changes related to Increment 1 were controlled primarily through daily coordination meetings (i.e., oral discussions) among representatives from Increment 1 component systems teams and program officials, and the various boards already in place for the component systems. Without a structured and disciplined approach to change control, program officials do not have adequate assurance that changes made to the component systems for non-US-VISIT purposes do not interfere with US-VISIT functionality. The fiscal year 2004 expenditure plan does not disclose management reserve funding. Program officials, including the program director, stated that reserve funding is embedded within the expenditure plan’s various areas of proposed spending. However, the plan does not specifically disclose these embedded reserve amounts. By not creating, earmarking, and disclosing a specific management reserve fund in the plan, DHS is limiting its flexibility in addressing unexpected problems that could arise in the program’s various areas of proposed spending, and it is limiting the ability of the Congress to exercise effective oversight of this funding. Plans for future US-VISIT increments do not call for additional staff or facilities at land ports of entry. However, these plans are based on various assumptions that potential policy changes could invalidate.