SBA depends on its IT environment to support the management of its programs. This environment includes 42 mission-critical systems running on legacy mainframes and minicomputers. Ten of these systems support administrative activities; the remaining 32 support loan activities, including loan accounting and collection, loan origination and disbursement, and loan servicing and debt collection. According to SBA’s self-assessment of its IT environment, the legacy systems are not effectively integrated and thus provide limited information sharing. The assessment also showed that SBA cannot depend on the systems to provide consistent information. Because of these problems, it has embarked on an agencywide systems modernization initiative to replace its outmoded legacy systems. Our May report presented the results of our evaluation of SBA’s management of IT in the areas of investment management, architecture, software development and acquisition, information security, and human capital. These five areas encompass major IT functions and are widely recognized as having substantial influence over the effectiveness of operations. Blank Circle indicates that policies and procedures do not exist or are substantially obsolete or incomplete; and practices for planning, monitoring and evaluation are predominantly ad hoc, or not performed. Half Circle indicates that policies and procedures are predominantly current and facilitate key functions; and selected key practices for planning, monitoring, and evaluation have been implemented. Solid Circle indicates that policies and procedures are current and comprehensive for key functions; and practices for planning, monitoring, and evaluation adhere to policies, procedures, and generally accepted standards. Properly implemented, IT investment management is an integrated approach that provides for the life-cycle management of IT projects. This investment process requires three essential phases: selection, control, and evaluation. In the selection phase, the organization determines priorities and makes decisions about which projects will be funded based on their technical soundness, contribution to mission needs, performance improvement priorities, and overall IT funding levels. In the control phase, all projects are consistently controlled and managed. The evaluation phase compares actual performance against estimates to identify and assess areas in which future decision-making can be improved. Our assessments of SBA’s investment management processes disclosed that policies and procedures were substantially incomplete; and practices were predominately ad hoc or not performed for most of the critical activities, as shown in figure 1. SBA had made progress in establishing an investment review board and is beginning to define an investment selection process. However, it had not yet established IT investment management policies and procedures to help identify and select projects that will provide mission-focused benefits and maximum risk-adjusted returns. Likewise, SBA had not yet defined processes for investment control and evaluation to ensure that selected IT projects will be developed on time, within budget, and according to requirements, and that these projects will generate expected benefits. The agency had performed only limited reviews of major IT investments, and these reviews were ad-hoc since little data had been captured for analyzing benefits and returns on investment. Without established policies and defined processes for IT investment, SBA cannot ensure that consistent selection criteria are used to compare costs and benefits across proposals, that projects are monitored and provided with adequate management oversight, or that completed projects are evaluated to determine overall organizational performance improvement. In addition, the agency lacks assurance that the collective results of post- implementation reviews across completed projects will be used to modify and improve investment management based on lessons learned. To address IT investment management weaknesses, SBA planned to develop and implement an investment selection process that includes screening, scoring, and ranking proposals. It also planned to use its target architecture to guide IT investments. In addition, SBA planned to develop and implement an investment control process to oversee and control projects on a quarterly basis. As part of investment control, SBA intended to collect additional data from all investment projects and compare actual data with estimates in order to assess project performance. SBA’s plans indicate a strong commitment to making improvements in this area; however, to establish robust IT investment management processes, additional actions are needed. Accordingly, we recommended that the SBA Administrator direct the chief information officer to establish policies and procedures and define and implement processes to ensure that (1) IT projects are selected that result in mission-focused benefits, maximizing risk-adjusted return-on-investment; (2) projects are controlled to determine if they are being developed on time, within budget, and according to requirements; and (3) projects are evaluated to ascertain whether completed projects are generating expected benefits. An IT architecture is a blueprint—consisting of logical and technical components—to guide the development and evolution of a collection of related systems. At the logical level, the architecture provides a high-level description of an organization’s mission, the business functions being performed and the relationships among the functions, the information needed to perform the functions, and the flow of information among functions. At the technical level, it provides the rules and standards needed to ensure that interrelated systems are built to be interoperable and maintainable. Our assessments of SBA’s information architecture disclosed that SBA had drafted policies and procedures for key activity areas except for change management, and had drafted architecture components except for change management, as reflected in figure 2. SBA had made progress with its target IT architecture by describing its core business processes, analyzing information used in its business processes, describing data maintenance and data usage, identifying standards that support information transfer and processing, and establishing guidelines for migrating current applications to the planned environment. However, procedures did not exist for change management to ensure that new systems installations and software changes would be compatible with other systems and SBA’s planned operating environment. Without established policies and systematic processes for IT architecture activities, SBA cannot ensure that it will develop and maintain an information architecture that will effectively guide efforts to migrate systems and make them interoperable to meet current and future information processing needs. To address IT architecture weaknesses, SBA planned to establish a change management process for architecture maintenance, to ensure that new systems installations and software changes will be compatible with other systems and with SBA’s planned operating environment. In addition, it planned to incorporate in the target architecture specific security standards for hardware, software, and communications. To ensure that these planned improvements are completed and sound practices institutionalized, we recommended that the SBA Administrator direct the chief information officer to establish policies and procedures and define and implement processes to ensure that (1) the architecture is developed using a systematic process so that it meets the agency’s current and future needs and (2) the architecture is maintained so that new systems and software changes are compatible with other systems and SBA’s planned operating environment. To provide the software needed to support mission operations, an organization can develop software using its staff or acquire software products and services through contractors. Key processes for software development include requirements management, project planning, project tracking and oversight, quality assurance, and configuration management. Additional key processes needed for software acquisition include acquisition planning, solicitation, contract tracking and oversight, product evaluation, and transition to support. Our assessment of SBA’s software development and acquisition processes disclosed that SBA had not established policies, its procedures were obsolete, and its practices were predominantly ad hoc for one or more critical activities, as shown in figure 3. SBA lacked policies for software development and acquisition to help produce information systems within the cost, budget, and schedule goals set during the investment management process that at the same time comply with the guidance and standards of its IT architecture. SBA’s IT guidance and procedures were obsolete and thus rarely used for acquisition planning, solicitation, contract tracking and oversight, product evaluation, and transition to support. An existing systems development methodology was being adopted, however, to replace outdated guidelines that lacked key processes for software development. Our review of the selected software projects indicated that SBA’s practices were typically ad hoc for project planning, project tracking and oversight, quality assurance, and configuration management. Without established policies and defined processes for software development and acquisition, practices will likely remain ad hoc and not adhere to generally accepted standards. Key activities—such as requirements management, planning, configuration management, and quality assurance—will be inconsistently performed or not performed at all when project managers are faced with time constraints or limited funding. These weaknesses can delay delivery of software products and services and lead to cost overruns. To address software development and acquisition weaknesses, SBA planned to implement formal practices, such as software requirements management and configuration management, on a project basis before establishing them agencywide. Specifically, SBA had selected the Loan Monitoring System (LMS) project as a starting point for identifying, developing, and implementing a new systems development methodology and associated policies, procedures, and practices. LMS therefore will serve as a model for future systems development projects. While SBA’s plan is a good first step, additional measures need to be taken to ensure agencywide improvements. To establish sound IT software development and acquisition processes, we recommended that the SBA Administrator direct the chief information officer to complete the systems development methodology and develop a plan to institutionalize and enforce its use; and develop a mechanism to enforce the use of newly- established policies in areas including but not limited to requirements management, project planning/tracking/oversight, quality assurance, configuration management, solicitation, contract oversight, and product evaluation. Information security policies address the need to protect an organization’s computer-supported resources and assets. Such protection ensures the integrity, appropriate confidentiality, and availability of an organization’s data and systems. Key information security activities include risk assessment, awareness, controls, evaluation, and central management. Risk assessments consist of identifying threats and vulnerabilities to information assets and operational capabilities, ranking risk exposures, and identifying cost- effective controls. Awareness involves promoting knowledge of security risks and educating users about security policies, procedures, and responsibilities. Evaluation addresses monitoring the effectiveness of controls and awareness activities through periodic evaluations. Central management involves coordinating security activities through a centralized group.