To reap the full benefits of new technologies, federal agencies must have effective information management leaders who can transform IT dollars into prudent investments that achieve cost savings, increase productivity, and improve the timeliness and quality of service delivery. This was widely recognized by the Congress in the 1990s as it worked in conjunction with the administration to craft several key information management reform laws, notably the Federal Acquisition Streamlining Act of 1994, the revision of the Paperwork Reduction Act (PRA) in 1995, and the Clinger- Cohen Act of 1996. Other than the Computer Security Act of 1987, these were the first major information management reforms instituted in the federal government since 1980. The Clinger-Cohen Act, for example, required major departments and agencies to appoint CIOs and implement IT management reforms largely grounded in successful commercial IT management practices.In particular, the act established CIO positions that report directly to the agency heads and have IM as a primary function. As noted below, the CIOs are responsible for a wide range of strategic and tactical information management activities outlined in the Clinger-Cohen Act, such as developing architectures, managing and measuring the performance of IT investment portfolios, and assisting in work process improvements. This mirrors the evolution of the CIO position in industry where it has largely moved from solely a technical support focus to a much more executive and strategic level position. Work with the agency head and senior program managers to implement effective information management to achieve the agency’s strategic goals. Assist the agency head in establishing a sound investment process to select, control, and evaluate IT spending for costs, risks and benefits. Promote improvements to the work processes used by the agency to carry out its programs. Increase the value of the agency’s information resources by implementing an integrated agencywide technology architecture. Strengthen the agency’s knowledge, skills, and capabilities to manage information resources effectively. Effective selection and positioning of CIOs can make a real difference in building the institutional capacity and structure needed to implement the management practices embodied in Clinger-Cohen and PRA.But the position is both relatively new and evolving in the federal government, and agency leaders face many challenges from the growing expectations for dramatic improvements in implementing improved IT management practices and demonstrating cost-effective results. Just finding an effective CIO can be a difficult task, since the individual must combine a number of strengths, including leadership ability, technical skills, an understanding of business operations, and good communications and negotiation skills. Also, the individual selected must match the specific needs of the agency, which must be determined by the agency head based on the agency’s mission and strategic plan. The CIO must recognize the need to work as a partner with other business or program executives and to build credibility in order to be accepted as a full participant in the development of new organizational systems and processes and to achieve successful outcomes with IT investments. Even with the right person in place, the agency head must make a commitment to the success of the CIO by assuring that adequate resources are available and a constructive management framework is in place for implementing agencywide IT initiatives. The resolution of problems founded in unsound investment control processes, poor project management, and weak software development and acquisition capabilities requires executive commitment and active support. CIOs’ progress in working with agency executives to meet these challenges has been mixed. On the positive side, responding to the Year 2000 (Y2K) date conversion challenge helped most agency leaders recognize the importance of consistent and persistent top management attention to information management and technology issues.Progress has been made in strengthening IT management capabilities in order to rectify past failures with costly modernization efforts, e.g., by developing IT architectures, strengthening cost-estimating processes, and improving software acquisition capabilities.In addition, in responding to Y2K, many agencies developed inventories of their information systems, linked those systems to agency core business processes, and jettisoned systems of marginal value.Moreover, more agencies have established much-needed IT policies in areas such as system configuration management, risk management, and software testing. According to officials at the Office of Management and Budget (OMB), the Y2K problem also gave agency CIOs a “crash course” in how to accomplish projects. Many CIOs were relatively new in their positions and expediting Y2K efforts required many of them to quickly gain an understanding of their agency’s systems, work extensively with agency program managers and chief financial officers (CFOs), and become familiar with budgeting and financial management practices. The Federal CIO Council has also facilitated positive developments.For example, the Council has been working actively with the Office of Personnel Management to develop special pay rates for hard-to-hire IT professionals. It has facilitated the development of a web-based information consolidation tool, which provides a standard IT budget reporting format and should assist agencies in linking their internal planning, budgeting, and management of IT resources. The Council also assisted administration officials in tracking the progress of Presidential Decision Directive 63, which tasked federal agencies with developing critical infrastructure protection plans, identification and evaluation of information security standards, and best practices and efforts to build communication links with the private sector. Further, in addressing the Y2K challenge, the Council participated in governmentwide efforts to develop best practices for Y2K conversion and to address important issues such as acquisition and Y2K product standards, data exchange issues, telecommunications, buildings, biomedical and laboratory equipment, and international issues. Still, agencies face incredible challenges in effectively managing their IT investments and in assuring that these investments make the maximum contribution to mission performance that is possible. Some of our recent reviews have found that fundamental IT investment processes are incomplete and not working consistently to help achieve better project outcomes. For example, IT portfolio selection, control, and evaluation processes and performance metrics have not been developed to gauge the progress of investments or their contribution to program outcomes. Acquisitions may be executed faster, but in many cases the link to program performance is lost so the real value of the investment cannot be determined. In short, more clarity could be given to how IT investments are being or will be used to improve performance or help achieve specific agency goals and ensuring that better data exists to guide informed decisions. Other common problem areas include inadequate progress in designing and implementing IT architectures before proceeding with massive modernization efforts and immature software development, cost estimation, and acquisition practices.These are areas where the agency heads were assigned specific responsibility in the PRA and in the Clinger- Cohen Act, and for which CIOs were appointed to help rectify poor agency track records. Information security is another widespread and growing problem confronting federal CIOs. A rash of break-ins at federal websites and disruptions caused by the Melissa computer virus and other malicious viruses sent via the Internet recently highlighted this concern. However, our reviews show that this problem runs much deeper. In particular, our October 1999 analysis of our own and inspector general audits found that 22 of the largest federal agencies were not adequately protecting critical federal operations and assets from computer-based attacks.Among other things, we found that agencies are lacking the strong, centralized leadership needed to protect critical information and assets as well as sound security planning, effective control mechanisms, and speedy response to security breakdowns.These weaknesses pose enormous risks to our computer systems and, more important to the critical operations and infrastructure they support, such as telecommunications; power distribution, national defense, and law enforcement; government services; and emergency services. In the case of computer security, too, the responsibility has been given to the agency heads by the PRA and Clinger-Cohen Act with CIOs to provide support. Clearly, more remains to be done to realize the full potential of CIOs as information management leaders, to build CIO organizations that have the credibility needed to be successful; to define the measures necessary to gauge this success and demonstrate results, and to put in place the structure for organizing information management to meet pressing business needs. The CIO executive guide that we are releasing today is designed to help resolve these challenges. Through our research and interviews with CIOs and other executives in case study organizations, we have developed a framework of critical success factors and leading principles. Federal agencies can turn to this guide for pragmatic assistance in leveraging the CIO position. Mr. Chairman, our research has demonstrated that CIOs of leading organizations use a consistent set of IM principles to execute their responsibilities successfully. These principles, listed below, span a broad range of management imperatives, from executive leadership and change management through organizational design and workforce development. Some principles need to be addressed by top executives across the organization, rather than by the CIO. For example, along with other top executives, the chief executive officer (CEO) must recognize the role of IM in creating value to the business before appointing a CIO. In addition, the CEO must also undertake responsibility for defining and instituting the CIO position. The other principles are squarely within the domain of the CIO. For example, the CIO must take full responsibility for ensuring the credibility of the IM organization. While other leaders can contribute to this principle, the CIO must be seen as the leader of the unit and must consistently raise the visibility and demonstrate the value of the IM organization across the enterprise. Overall, the principles are strikingly simple and strongly supported by a wide range of other CIO-based research. Nevertheless, consistent attention and commitment often remains elusive and pinpoints the notable difference between leading organizations and others. Six Principles of CIO Management Recognize the role of IM in creating value Measure success and demonstrate results Organize IM to meet business needs Develop IM human capital Position the CIO for success Ensure the credibility of the IM organization Let me also underscore, Mr. Chairman, that the principles are most effective when implemented together in a mutually reinforcing manner. As ad hoc efforts, each principle addresses a single aspect that while necessary, is not sufficient for success by itself.