Over the years, Congress has enacted various laws in an attempt to improve the government’s management of its IT resources. In doing so, it has provided OMB with broad IT management and oversight responsibilities and given agencies a wide range of IT-related responsibilities. With regard to CIO responsibilities relative to IT management, we have previously identified major areas that are either statutory requirements or are critical to effective IT management.areas include: IT strategic planning: Plans for, among other things, using IT to help agencies improve the productivity, efficiency, and effectiveness of their business processes with the overall goal of achieving and supporting agency missions. Capital planning and investment management: The process of selecting, controlling, and evaluating IT investments to produce business value, reduce investment-related risks, and increase accountability and transparency in the investment decision-making process. IT security: Establishment of a risk-based program that ensures agency-wide compliance with requirements to protect information and systems, including implementing requisite controls that prevent, limit, or detect access to computer networks, systems, or information. Systems acquisitions, development, and integration: Obtain the skilled staff, disciplined processes, and tools necessary to develop and acquire IT system capabilities on time and within budget, including ensuring such capabilities interoperate as intended with existing (legacy) systems. E-government initiatives: A wide range of activities across the federal government involving the use of the Internet and other emerging technologies to improve public access to government information and services. To carry out their responsibilities, OMB (including its Office of E- Government and Information Technology, headed by the Federal CIO) issues directives to the agencies such as circulars, memorandums, and reporting instructions; these directives contain requirements for agency CIOs to, among other things, report on their IT activities. For example, OMB Circular A-11 requires agencies to provide information related to their IT investments, including agency exhibit 53s and capital asset plans and business cases (called exhibit 300s). In addition, in December 2011, OMB issued a memorandum that outlines the Federal Risk and Authorization Management Program guidance for agency adoption and use of cloud services. For each reporting requirement, OMB typically identifies how agencies are to transmit the information. In particular, OMB operates and utilizes the following web-based systems that the agencies are to use to transmit their information: CyberScope: Standardizes manual and automated data inputs for reporting on Federal Information Security Management Actcompliance and agency privacy programs. Integrated Data Collection: Allows reporting of structured information, including agency progress in meeting IT strategic goals, objectives and metrics, as well as cost savings and avoidances resulting from IT management actions. These data include information previously reported by agencies as well as data which agencies shall report on every 3 months. Updates are to be made on the last day of February, May, August, and November of subsequent fiscal years. MAX Portal: Utilized by federal agencies to enter data and upload documentation related to a variety of reporting activities, including data required for the President’s Budget and Mid-Session review, and federal IT investment information. Federal IT Dashboard: Allows federal agencies to upload cost, schedule, and performance data on agency major IT investments. In addition to the reporting system mechanisms listed above, OMB occasionally requires agencies to provide information by e-mail (usually for ad hoc requests) or directs agencies to post information on their websites. For example, with regard to an OMB reporting requirement on open data policies, OMB directs the agencies to post this information on their websites. To help CIOs prioritize their various roles and responsibilities, OMB has directed CIOs to focus their efforts on the following: Governance. CIOs should have responsibility over the entire IT portfolio for the agency, including driving the investment review process for IT investments, working with CFOs and Chief Acquisition Officers to ensure IT portfolio analysis is part of the yearly budget process, and leading TechStat sessions. Commodity IT. CIOs should focus on eliminating duplication in commodity IT services (e.g., data centers, e-mail, and web infrastructure) and rationalize their agency’s IT investments, including using shared services as a provider instead of standing up separate services. Program management. CIOs should improve the overall management of federal IT projects by identifying, recruiting, and hiring top IT program management talent and be accountable for the performance of agency IT program managers. Information security. CIOs should have the authority and primary responsibility for implementing an agency-wide information security program, including having continuous monitoring and standardized risk assessment processes. In addition, OMB has implemented a series of initiatives—commonly referred to by the agency as IT reforms—to, among other things, improve the oversight of underperforming investments, more effectively manage IT, and address duplicative investments. The initiatives include the following: TechStat reviews. In January 2010, the Federal CIO began leading TechStat sessions—face-to-face meetings to terminate or turn around IT investments that are failing or are not producing results. These meetings involve OMB and agency leadership and are intended to increase accountability and transparency and improve performance. Subsequently, OMB empowered agency CIOs to hold their own TechStat sessions within their respective agencies. OMB has reported that these efforts to improve management and oversight of IT investments have resulted in almost $4 billion in savings. Federal Data Center Consolidation Initiative. Concerned about the growing number of federal data centers, the Federal CIO (in February 2010) established the Federal Data Center Consolidation Initiative. The initiative’s four high-level goals were to promote the use of “green IT” by reducing the overall energy and real estate needs of government data centers; reduce the cost of data center hardware, software, and operations; increase the overall IT security posture of the government; and shift IT investments to more efficient computing platforms and technologies. OMB estimates that the initiative has the potential to provide about $3 billion in savings by the end of 2015. PortfolioStat. In order to eliminate duplication, move to shared services, and improve portfolio management processes, OMB (in March 2012) launched its PortfolioStat initiative. It required agencies to conduct annual agency-wide IT portfolio reviews to, among other things, reduce commodity IT spending and demonstrate how IT investments align with agency mission and business functions. PortfolioStat is designed to assist agencies in (1) assessing the current maturity of their IT investment management process, (2) making decisions on eliminating duplicative investments, and (3) moving to shared solutions in order to maximize the return on IT investments across the portfolio. OMB estimates that the PortfolioStat effort has the potential to save $2.5 billion from fiscal year 2013 through fiscal year 2015 by, for example, consolidating duplicative systems. Given the importance of these initiatives, OMB has established reporting requirements to, among other things, track the status of agencies’ implementation of these efforts. In addition, Congress recently incorporated key aspects of a number of these reforms into law. Our extensive experience at federal agencies and in particular, our recent reports on TechStat, data center consolidation, and PortfolioStat, have shown that these reforms and the required information agencies are to report on to OMB as part of these efforts offer important opportunities to improve the efficiency and effectiveness of federal agency programs and operations, including producing financial savings. The reports also included recommendations to OMB to improve agency reporting on key initiatives; the recommendations highlighted the importance of OMB’s reporting requirements and the need for federal agencies to provide current and accurate information about the status of these initiatives. They also highlighted that the requirements are a critical component to ensuring OMB’s effective management and oversight of the initiatives. Together, the responsibilities discussed above require CIOs to be key leaders in managing IT in a coordinated fashion in order to improve the efficiency and effectiveness of programs and operations. Over the last several years, OMB has made changes to CIO reporting requirements to address, among other things, changes in federal IT management. Such changes included modifying how requirements are reported, updating what information is requested as part of existing requirements, and establishing new requirements. For example, in March 2013, OMB issued a memorandum which, among other things, established the Integrated Data Collection, which was a new way for agencies to submit information relating to IT reform initiatives such as PortfolioStat and data center consolidation. OMB, Fiscal Year 2015 Guidance on Exhibits 53 and 300 – Information Technology and E-Government (Washington, D.C.: July 1, 2013). agencies provide information on investments that are to be reduced or eliminated as the result of new investments. Moreover, in May 2014, OMB issued updated instructions for the Integrated Data Collection, aimed at improving the quality of data, which changed the format and information reported for several requirements, as well as adding a new reporting requirement on progress in using standard customer value methodologies to evaluate agencies’ highest impact IT services. During the past several years, we have reported on a variety of issues related to CIOs’ roles and responsibilities and OMB’s management and reporting of information obtained through federal agency reporting requirements. For example, in September 2011, we reported on the roles and responsibilities of agency CIOs. Specifically, we found that although most CIOs are responsible for major areas of IT (e.g., capital planning, IT strategic planning, and e-government initiatives), they are less frequently responsible for other information management areas (e.g., records management and privacy) that, despite being required by law, are considered not critical to effective IT management. We recommended that OMB update its guidance to establish measures of accountability for ensuring that CIOs’ responsibilities are fully implemented and require agencies to establish internal processes for documenting lessons learned. OMB agreed with our recommendations and stated that it had taken actions that it believed addressed the recommendations; we are currently in the process of validating whether these actions fully address our recommendations.