SBI is a comprehensive, multiyear, multibillion dollar program established in November 2005 by the Secretary of Homeland Security to secure U.S. borders and reduce illegal immigration. SBI’s mission is to promote border security strategies that help protect against and prevent terrorist attacks and other transnational crimes. Elements of SBI will be carried out by several organizations within DHS. One element of SBI is SBInet, the program within CBP that is responsible for developing a comprehensive border protection system. The SBInet program is managed by the SBInet Program Management Office (PMO). The PMO reports to the CBP SBI Program Executive Director. SBInet is a large and complex program that is responsible for leading the effort to ensure that the proper mix of personnel, tactical infrastructure, rapid response capability, and technology is deployed along the border. DHS defines control of the U.S. border as the ability to detect illegal entries into the United States, identify and classify these entries to determine the level of threat involved, efficiently and effectively respond to these entries, and bring events to a satisfactory law enforcement resolution. SBInet’s initial focus will be on the southwest border investments and areas between ports of entry that CBP has designated as having the highest need for enhanced border security due to serious vulnerabilities. In September 2006, CBP awarded an indefinite delivery/indefinite quantity systems integration contract for 3 years, with three additional 1-year options. The minimum dollar amount is $2 million; the maximum is stated as “the full panoply of supplies and services to provide 6,000 miles of secure U.S. border.” According to DHS, the SBInet solution is to include a variety of sensors, communications systems, information technology, tactical infrastructure (roads, barriers, and fencing), and command and control capabilities to enhance situational awareness of the responding officers. The solution is also to include the development of a common operating picture that provides uniform data, through a command center environment, to all DHS agencies and is interoperable with stakeholders external to DHS. See figure 1 for examples of existing technology along the border. Our statement will now focus on what type of information DHS has provided on explicit and measurable commitments relative to schedule and costs. The SBInet expenditure plan included general cost information for proposed activities and some associated milestone information. DHS estimates that the total cost for completing the acquisition phase for the southwest border is $7.6 billion for fiscal years 2007 through 2011. Of this total, approximately $5.1 billion is for the design, development, integration, and deployment of fencing, roads, vehicle barriers, sensors, radar units, and command, control, and communications and other equipment, and $2.5 billion is for integrated logistics and operations support during the acquisition phase for the southwest border. In addition, the SBInet expenditure plan and related documentation discussed generally how approximately $1.5 billion already appropriated will be allocated to SBInet activities (see table 1). For example, about $790 million is allocated for the Tucson Border Patrol sector and $260 million for the Yuma sector in Arizona. Table: 1 SBInet Funding Allocations Fiscal Years, 2005-2007 (dollars in thousands) Yma and Tcson tactical infrastrctre $325,000 $1,187,565 $1,549,365 nds were allocated to SBInet activities. des activities related to test and evalation, deployment and installation, and integrated logistics spport. The expenditure plan also includes certain milestones, such as starting and ending dates, for some but not all activities. For example, consistent with DHS’s task order approach to managing SBInet’s implementation, the task order for Project 28 includes detailed milestones. In other cases, such as the Tucson and Yuma sector activities, milestones and costs are preliminary and highly likely to change because they are still in the planning and requirement setting stage. According to SBInet officials, factors such as technological, environmental, and eminent domain constraints can affect the timetables and costs of these activities. Figure 2 illustrates the extent to which milestones were defined for selected activities. Despite including general cost information for proposed activities and some associated milestone information, the expenditure plan and related documentation did not include sufficient details about what will be done, the milestones involved, the performance capability expected, and the costs for implementing the program. For example, although the plan stated that about $790 million will be spent in the Tucson sector for such elements as fencing, ground sensors, radars, cameras, and fixed and mobile towers, the plan did not specify how the funds will be allocated by element and did not provide specific dates for implementation. According to DHS, each task order will define what will be done, when, the performance capability, and the total cost. The expenditure plan did not include costs incurred to date mainly because SBInet activities are in the early stages of implementation and costs had not yet been captured by DHS’s accounting system (e.g., the SBInet systems integration contract was awarded in September 2006 and the first two task orders were awarded in September and October 2006). Moreover, the expenditure plan did not include a baseline measure of miles under control of the border. While the plan did not discuss progress made to date by the program to obtain control of the border, related program documents, such as the bimonthly SBI reports to Congress, included information on the number of miles under control in the southwest border. Our statement will now focus on DHS’s use of federal acquisition requirements and related program management best practices. As of December 2006, SBInet was using several acquisition best practices. The extent to which these practices were in use varied, and outcomes were dependent on successful implementation. Specifically, SBInet was using several of the best practices or “Guiding Principles” in DHS Management Directive 1400, such as conducting a competition open to all qualified suppliers to award the systems integration contract, and using a performance-based approach where the agency identified the outcome it was seeking to achieve and allowed the competing companies to propose their specific solutions. SBInet plans to use a system for comparing costs incurred with progress achieved known as earned value management (EVM). However, we reported that the SBInet systems integration contract did fully satisfy an acquisition requirement to contain a specific number of units that may be ordered or a maximum dollar value. According to the Federal Acquisition Regulation (FAR), an agency may use an indefinite delivery/indefinite quantity contract, such as that used for SBInet, when it is not possible to determine in advance the precise quantities of goods or services that may be required during performance of the contract. Though these types of contracts are indefinite, they are not open-ended. The FAR requires that indefinite quantity contracts contain a limit on the supplies or services that may be ordered, stated in terms of either units or dollars. This limit serves a variety of purposes, including establishing the maximum financial obligation of the parties. According to DHS, the quantity stated in the contract, “6,000 miles of secure U.S. border,” is measurable and is therefore the most appropriate approach to defining the contract ceiling. We do not agree because the contract maximum used in the SBInet contract, “the full panoply of supplies and services to provide 6,000 miles of secure U.S. border,” does not allow anyone to calculate with certainty what the maximum financial obligation of the parties might turn out to be since the contract does not make clear the total amount of supplies or services that would be required to secure even 1 mile of U.S. border. In order to ensure that the contract is consistent with the FAR requirement, a maximum quantity or dollar value limit needs to be included in the contract. Managing major programs like SBInet also requires applying discipline and rigor when acquiring and accounting for systems and services, such as those requirements and practices embodied in OMB and related guidance. Our work and other best practice research have shown that applying such rigorous management practices improves the likelihood of delivering expected capabilities on time and within budget. In other words, the quality of information technology (IT) systems and services is largely governed by the quality of the management processes involved in acquiring and managing them. Some of these processes and practices are embodied in the Software Engineering Institute’s (SEI) Capability Maturity Models®, which define, among other things, acquisition process management controls that, if implemented effectively, can greatly increase the chances of acquiring systems that provide promised capabilities on time and within budget. Other practices are captured in OMB guidance, which establishes requirements for planning, budgeting, acquisition, and management of federal capital assets. As of December 2006, the SBInet program office had not fully defined and implemented critical acquisition processes, such as project planning, process and product quality assurance, measurement and analysis, and requirements management. To its credit, the program office has developed and begun implementing a draft risk management plan, dated September 29, 2006. The draft plan addresses, among other things, a process for identifying, analyzing, mitigating, tracking, and controlling risks. As part of this process, the program office developed a risk management database that identifies for each risk, among other things, the status, priority, probability of occurrence, the overall impact, consequence, and a mitigation strategy. The program office also established a governance structure, which includes a Risk Review Board (RRB) that is chaired by the SBInet Program Manager. According to the SBInet Risk Manager, a draft RRB charter has been developed. SBInet had not yet implemented other key management practices, such as developing and implementing a system security plan, employing an EVM system to help manage and control program cost and schedule, and following capital planning and investment control review requirements to help ensure that agencies investments achieve a maximum return on investment.