Within the U.S. Department of Health and Human Services, FDA is responsible for the protection of public health by ensuring the safety, efficacy, and security of human and veterinary drugs, biological products, and medical devices; and ensuring the safety and security of our nation’s food supply, cosmetics, and products that emit radiation. The agency is also responsible for ensuring the proper labeling of foods, drugs, medical devices, tobacco, and cosmetics. Further, its work includes advancing public health by facilitating innovations and promoting public access to science-based information on medicines, devices, and foods. As stated in FDA’s agency-wide strategy for fiscal years 2014 through 2018, FDA Strategic Priorities, four goals support five organizational cross-cutting priorities—regulatory science, globalization, safety and quality, smart regulation, and stewardship. The four supporting goals are to enhance oversight of FDA regulated products, improve and safeguard access to FDA-regulated products to benefit health, promote better informed decisions about the use of FDA-regulated products, and strengthen organizational excellence and accountability. FDA exercises its core functions through four directorates: the Offices of Medical Products and Tobacco; Foods and Veterinary Medicine; Global Regulatory Operations and Policy; and Operations. These offices, along with the Chief Scientist, report to the FDA Commissioner and carry out their missions through seven centers and through FDA’s Office of Regulatory Affairs. Office of Medical Products and Tobacco: Center for Biologics Evaluation and Research. Regulates and evaluates the safety and effectiveness of biological products, such as blood and blood products, vaccines and allergenic products, and cells, tissues, and gene therapy products. Center for Drug Evaluation and Research. Promotes and protects the public health by ensuring that all prescription and over-the-counter drugs are safe, as well as by reviewing and regulating clinical research. Center for Devices and Radiological Health. Promotes and protects the public health by ensuring the safety and effectiveness of medical devices and preventing unnecessary human exposure to radiation from radiation-emitting products. Center for Tobacco Products. Educates the public on the dangers of tobacco use; develops the science needed for tobacco regulation; and develops and enforces regulations on the manufacture, marketing, and distribution of tobacco products. Office of Foods and Veterinary Medicine: Center for Food Safety and Applied Nutrition. In conjunction with FDA’s field staff, promotes and protects the public health, in part by ensuring the safety of the food supply and that food products are properly labeled, and ensuring that cosmetics are safe and properly labeled. Center for Veterinary Medicine. Protects and promotes the health of humans and animals by ensuring the safety and effectiveness of animal drugs, as well as the safety of animal food and devices. Office of the Commissioner: National Center for Toxicological Research. Conducts peer-reviewed scientific research and provides expert technical advice and training to support FDA’s science-based regulatory decisions. Office of Global Regulatory Operations and Policy: Office of Regulatory Affairs. Leads FDA field activities and provides FDA leadership on imports, inspections, and enforcement policy. This office supports the FDA product centers by inspecting regulated products and manufacturers, conducting sample analysis on regulated products, and reviewing imported products offered for entry into the United States. The office also develops FDA-wide policy on compliance and enforcement and executes FDA’s Import Strategy and Food Protection Plans. Office of Operations. Ensures the timely and effective delivery of high quality and cost effective mission support services, including IT support, across the FDA and its centers, and coordinates emergency preparedness and response activities for incidents involving FDA- regulated products across FDA and its stakeholders. FDA relies extensively on the use and outcomes of IT to achieve its strategic priorities, fulfill its mission, and support related administrative needs. Among others, the agency has implemented systems and other technology dedicated to supporting activities, such as: Reviewing and evaluating new product applications, such as for prescription drugs, medical devices, and food additives. These systems are intended to help FDA determine whether a product is safe before it enters the market. One such system—the Document Archiving, Reporting, and Regulatory Tracking System—is intended to manage the drug and therapeutics review process. Monitoring the safety of products on the market by collecting and assessing adverse reactions to FDA-regulated products, such as illnesses due to food or negative reactions to drugs. This activity is supported by systems such as the Vaccine Adverse Event Reporting System, which accepts reports of adverse events that may be associated with U.S.-licensed vaccines from health care providers, manufacturers, and the public. Screening imported food to detect and prevent entry into the United States of adulterated, misbranded, or potentially spoiled food. For example, the Predictive Risk-based Evaluation for Dynamic Import Compliance Targeting is a tool used as part of the system that provides entry reviewers with information to help target high-risk shipments for examination and expedite the clearance of lower-risk cargo. Surveilling and promoting the safety of FDA-regulated products. With the exception of laboratories, systems developed and managed by the Mission Accomplishments and Regulatory Compliance Services (MARCS) investment are used to support all field activities, including domestic and foreign inspections, imports, compliance, and enforcement activities. Conducting post-market safety surveillance for drug and therapeutic biologic products that have been approved by FDA. The FDA Adverse Event Reporting System is used to help identify new safety concerns that might be related to a marketed product, evaluate a manufacturer’s compliance with reporting regulations, and respond to outside requests for information. In addition, FDA relies on various systems that support its administrative processes, such as payroll administration and personnel systems. All of the agency’s systems are supported by an IT infrastructure that includes network components, critical servers, and multiple data centers. FDA’s budget for the development, operations, and maintenance of its IT investments was approximately $419 million for fiscal year 2013 and approximately $566 million for fiscal year 2014. IT spending for fiscal year 2014 was categorized into three portfolios: $287.4 million for IT investments that support mission delivery and $260 million for IT infrastructure, security, office automation, and $18.72 million for investments in enterprise architecture capital planning and chief information officer functions. The agency received about $578 million in IT funding for fiscal year 2015. Within FDA, overall responsibility for managing IT resides in the Office of Information Management and Technology (OIMT), which was established within the Office of Operations as part of an agency-wide reorganization in January 2014. OIMT is headed by the agency’s Chief Operating Officer, and its mission is to ensure the timely and effective delivery of high quality, innovative and cost-effective mission- related information technology support services across the FDA and its centers. The office’s major functions include information security, business and customer assurance, technology, and informatics and technology innovation. The Office of Information Management (OIM) is a component of OIMT and is led by the CIO. OIM’s mission includes, among other things, setting goals for improving customer focus and developing new IT solutions that support changing business needs. Within OIM, and under the direction of the Chief Operating Officer, the CIO is responsible for managing and overseeing the design and development of IT systems to support FDA’s mission, and creating a foundation to enhance the interoperability of the agency’s systems. As such, this official is charged with providing services and support to approximately 20,000 federal personnel and contractors throughout the United States and the international FDA community. In previously reporting on FDA’s IT challenges, we highlighted deficiencies in a number of the agency’s management processes and system modernization efforts. Accordingly, our two reports—issued in June 2009 and March 2012—included a total of nine recommendations aimed at improving key IT areas, such as IT strategic planning, enterprise architecture development, human capital planning, investment management, information sharing, and project management. (We provide a detailed discussion of the agency’s actions to address the recommendations later in this report.) Specifically, in 2009 we reported that FDA did not have a comprehensive IT strategic plan to coordinate and manage the numerous modernization projects that it was pursuing in response to federal law and guidance and the agency’s urgent mission needs. We noted that the agency had developed planning documents that included some, but not all of the elements of a comprehensive plan, and stressed that, lacking such a plan, the agency’s ability to meet its strategic goals was at risk. Thus, we recommended that the Commissioner of FDA require the CIO to set milestones and a completion date for developing a comprehensive IT strategic plan that included results-oriented goals, strategies, milestones, performance measures, and an analysis of interdependencies among projects and activities. We further recommended that the agency use such a plan to guide and coordinate its modernization projects and activities. Our 2009 report also noted that FDA had made mixed progress in establishing important IT management capabilities that are essential for helping to ensure a successful modernization, particularly in the areas of enterprise architecture and related segment development, and in IT human capital planning and management. We recommended additional actions to be taken by the CIO to improve these areas, which we discuss in detail later in this report. The Department of Health and Human Services, in commenting on our 2009 report, agreed with our recommendations and identified actions FDA had initiated or planned to address them. We again reported on the agency’s IT management capabilities in 2012, noting that FDA lacked a comprehensive IT inventory—a tool for managing its investments that identifies and provides key information about the systems it uses and is developing. We also noted that much work remained to be done on the agency’s largest and most costly system modernization effort— the MARCS program—and that FDA’s Center for Food Safety and Applied Nutrition (CFSAN) had not assessed information sharing needs and capabilities.