This is the accessible text file for GAO report number GAO-06-598T entitled 'Homeland Security: Progress Continues, but Challenges Remain on Department's Management of Information Technology' which was released on March 30, 2006. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. United States Government Accountability Office: GAO: Testimony: Before Congressional Subcommittees: For Release on Delivery: Expected at 3:00 p.m. EST Wednesday, March 29, 2006: Homeland Security: Progress Continues, but Challenges Remain on Department's Management of Information Technology: Statement of Randolph C. Hite, Director: Information Technology Architecture and Systems Issues: GAO-06-598T: GAO Highlights: Highlights of GAO-06-598T, a testimony before congressional subcommittees: Why GAO Did This Study: Information technology (IT) is a critical tool for the Department of Homeland Security (DHS), not only in performing its mission today, but also in transforming how it will do so in the future. In light of the importance of this transformation and the magnitude of the associated challenges, GAO has designated the implementation of the department and its transformation as high risk. GAO has reported that in order to effectively leverage IT as a transformation tool, DHS needs to establish certain institutional management controls and capabilities, such as having an enterprise architecture and making informed portfolio-based decisions across competing IT investments. GAO has also reported that it is critical for the department to implement these controls and associated best practices on its many IT investments. In its past work, GAO has made numerous recommendations on DHS institutional controls and on individual IT investment projects. The testimony is based on GAO’s body of work in these areas, covering the state of DHS IT management both on the institutional level and the individual program level. What GAO Found: DHS continues to work to institutionalize IT management controls and capabilities (disciplines) across the department. Among these are * having and using an enterprise architecture, or corporate blueprint, as an authoritative frame of reference to guide and constrain IT investments; * defining and following a corporate process for informed decision making by senior leadership about competing IT investment options; * applying system and software development and acquisition discipline and rigor when defining, designing, developing, testing, deploying, and maintaining systems; * establishing a comprehensive information security program to protect its information and systems; * having sufficient people with the right knowledge, skills, and abilities to execute each of these areas now and in the future; and * centralizing leadership for extending these disciplines throughout the organization with an empowered Chief Information Officer. Over the last 3 years, the department has made efforts to establish and implement these IT management disciplines, but it has more to do. Despite progress, for instance, in developing its enterprise architecture and its investment management processes, much work remains before these and the other disciplines are fully mature and institutionalized. For example, although the department recently completed a comprehensive inventory of its major information systems—a prerequisite for effective security management—it has not fully implemented a comprehensive information security program, and its other institutional IT disciplines are still evolving. The department also has more to do in deploying and operating IT systems and infrastructure in support of core mission operations, such as border and aviation security. For example, a system to identify and screen visitors entering the country has been deployed and is operating, but a related exit capability largely is not. Also, a government-run system to prescreen domestic airline passengers is not yet in place. Similarly, some infrastructure has been delivered, but goals related to consolidating networks and e-mail systems, for example, remain to be fully accomplished. Similarly, GAO’s review of key nonfinancial systems show that DHS has more to do before the IT disciplines discussed above are consistently employed. For example, these programs have not consistently employed reliable cost estimating practices, effective requirements development and test management, meaningful performance measurement, strategic workforce management, and proactive risk management, among other recognized program management best practices. Until the department fully establishes and consistently implements the full range of IT management disciplines embodied in best practices and federal guidance, it will be challenged in its ability to manage and deliver programs. www.gao.gov/cgi-bin/getrpt?GAO-06-598T. To view the full product, including the scope and methodology, click on the link above. For more information, contact Randolph C. Hite at (202) 512-3439 or email@example.com. [End of section] Mr. Chairmen and Members of the Subcommittees, I appreciate the opportunity to participate in today's joint oversight hearing on Department of Homeland Security (DHS) efforts to effectively manage information technology (IT). As you know, IT is a critical tool in DHS's quest to transform 22 diverse and distinct agencies--some with longstanding management weaknesses--into a single, integrated, high- performing department. In light of the importance of this transformation and the magnitude of the associated challenges, in 2003 we designated the implementation of the department and its transformation as a high-risk undertaking.[Footnote 1] For DHS to effectively leverage IT as a transformation enabler, we reported in 2004 that it needed to put firmly in place certain institutional management controls and capabilities, such as having an enterprise architecture and a process for making informed portfolio- based decisions across competing IT investments.[Footnote 2] These controls and capabilities are interrelated management disciplines that collectively help an organization to deliver IT systems and infrastructure on time and on budget, and to do so in a way that minimizes risk and maximizes value to the organization as a whole. My testimony today addresses the state of DHS IT management on two levels: the institutional level and the individual program level. At the department level, it addresses efforts to establish corporate management controls, such as enterprise architecture, IT investment management, and the empowerment of the Chief Information Officer (CIO) to lead the department's IT activities. At the program level, it addresses the extent to which the institutional management controls are actually being implemented on key nonfinancial systems (such as those related to border and aviation security), pointing out the pitfalls to avoid and best practices to employ in managing these IT investments. In summary, DHS continues to work to institutionalize the range of IT management controls and capabilities that our research and past work have shown are fundamental to any organization's ability to use technology effectively to transform itself and accomplish mission goals.[Footnote 3] Among these IT management controls and capabilities are: * having and using an enterprise architecture, or corporate blueprint, as an authoritative frame of reference to guide and constrain system investments; * defining and following a corporate process for informed decision making by senior leadership about competing IT investment options; * applying system and software development and acquisition discipline and rigor when defining, designing, developing, testing, deploying, and maintaining systems; * establishing a comprehensive, departmentwide information security program to protect information and systems; * having sufficient people with the right knowledge, skills, and abilities to execute each of these areas now and in the future; and: * centralizing leadership for extending these disciplines throughout the organization with an empowered Chief Information Officer. Despite its efforts over the last 3 years, the department has more to do before each of these management controls and capabilities is fully in place and is integral to how each system investment is managed. In this regard, our reviews of key nonfinancial systems show that, for example, DHS IT programs have not consistently employed reliable cost estimating practices, effective requirements development and test management, meaningful performance measurement, strategic workforce management, and proactive management of risks, among other recognized program management best practices. The department also has more to do with respect to deploying and operating the mix of IT systems and infrastructure that are needed to support core mission operations, such as border and aviation security. For example, although a system to identify and screen visitors entering the country has been deployed and is operating, a related exit capability largely is not. Also, a government-run capability to prescreen domestic airline passengers is not yet in place. Similarly, while certain system and infrastructure capabilities have been delivered, goals related to consolidating data centers and networks and employing a common e-mail system, for example, remain to be fully accomplished. To assist the department in addressing its IT needs and management challenges, we have made a series of recommendations for both institutional and program-specific improvements. Spanning these recommendations is one for ensuring that the CIO is sufficiently empowered to extend management discipline and implement common IT solutions across the department. We look forward to working with DHS leadership as it implements these recommendations. In preparing this testimony, we drew extensively from our previous work on DHS's IT management controls and capabilities and their application on key department programs and projects. In addition, we reviewed documentation and interviewed responsible DHS officials, including the CIO. All the work on which this testimony is based was performed in accordance with generally accepted government auditing standards. Background: DHS's mission is to lead the unified national effort to secure America by preventing and deterring terrorist attacks and protecting against and responding to threats and hazards to the nation. DHS also is to ensure safe and secure borders, welcome lawful immigrants and visitors, and promote the free flow of commerce. Created in March 2003, DHS has assumed operational control of about 209,000 civilian and military positions from 22 agencies and offices specializing in one or more aspects of homeland security.[Footnote 4] The intent behind DHS's merger and transformation was to improve coordination, communication, and information sharing among the multiple federal agencies responsible for protecting the homeland. Not since the creation of the Department of Defense in 1947 has the federal government undertaken a transformation of this magnitude. As we reported before the department was created,[Footnote 5] such a transformation is critically important and poses significant management and leadership challenges. For these reasons, we designated the implementation of the department and its transformation as high risk; we also pointed out that failure to effectively address DHS's management challenges and program risks could have serious consequences for our national security. Among DHS's transformation challenges, we highlighted the formidable hurdle of integrating numerous mission-critical and mission support systems and associated IT infrastructure. For the department to overcome this hurdle, we emphasized the need for DHS to establish an effective IT governance framework, including controls aimed at effectively managing IT-related people, processes, and tools. DHS Components and IT Spending: To accomplish its mission, the department is organized into various components, each of which is responsible for specific homeland security missions and for coordinating related efforts with its sibling components, as well as external entities. Table 1 shows DHS's principal organizations and their missions. An organizational structure is shown in figure 1. Table 1: DHS's Principal Organizations and Their Missions: Principal organizations[A]: Citizenship and Immigration Services; Missions: Responsible for the administration of immigration and naturalization adjudication functions and establishing immigration services policies and priorities. Principal organizations[A]: Coast Guard; Missions: Protects the public, the environment, and U.S. economic interests in the nation's ports and waterways, along the coast, on international waters, and in any maritime region as required to support national security. Principal organizations[A]: Customs and Border Protection; Missions: Responsible for protecting the nation's borders in order to prevent terrorists and terrorist weapons from entering the United States, while facilitating the flow of legitimate trade and travel. Principal organizations[A]: Federal Emergency Management Agency; Missions: Prepares the nation for hazards, manages federal response and recovery efforts following any national incident, and administers the National Flood Insurance Program. Principal organizations[A]: Immigration and Customs Enforcement; Missions: The largest investigative arm of the department, responsible for identifying and shutting down vulnerabilities in the nation's border, economic, transportation, and infrastructure security. Principal organizations[A]: Management Directorate; Missions: Responsible for department budgets and appropriations, expenditure of funds, accounting and finance, procurement, human resources, information technology systems, facilities and equipment, and the identification and tracking of performance measurements. This directorate includes the offices of the Chief Financial Officer and the Chief Information Officer. Principal organizations[A]: Preparedness Directorate; Missions: Works with state, local, and private sector partners to identify threats, determine vulnerabilities, and target resources where risk is greatest, thereby safeguarding borders, seaports, bridges and highways, and critical information systems. Principal organizations[A]: Science and Technology Directorate; Missions: Serves as the primary research and development arm of the department, responsible for providing federal, state, and local officials with the technology and capabilities to protect the homeland. Principal organizations[A]: Secret Service; Missions: Protects the President and other high-level officials and investigates counterfeiting and other financial crimes (including financial institution fraud, identity theft, and computer fraud) and computer-based attacks on the nation's financial, banking, and telecommunications infrastructure. Principal organizations[A]: Transportation Security Administration; Missions: Protects the nation's transportation systems to ensure freedom of movement for people and commerce. Principal organizations[A]: US-VISIT; Missions: Responsible for developing and implementing a governmentwide program to record the entry into and exit from the United States of selected individuals, verify their identity, and confirm their compliance with the terms of their admission into and stay in this country. Sources: DHS (data); GAO (analysis). [A] This table does not show the organizations that fall under each of the directorates. This table also does not show all organizations that report directly to the DHS Secretary and Deputy Secretary, such as executive secretary, legislative and intergovernmental affairs, public affairs, chief of staff, inspector general, and general counsel. [End of table] Figure 1: DHS Organizational Structure (Simplified and Partial): [See PDF for image] [End of figure] Within the Management Directorate is the Office of the CIO, which is expected to leverage best available technologies and IT management practices, provide shared services, coordinate acquisition strategies, maintain an enterprise architecture that is fully integrated with other management processes, and advocate and enable business transformation. Other DHS entities also are responsible or share responsibility for critical IT management activities. For example, DHS's major organizational components (e.g., directorates, offices, and agencies) have their own CIOs and IT organizations. Control over the department's IT funding is vested primarily with the components' CIOs, who are accountable to the heads of their respective components.[Footnote 6] To promote IT coordination across DHS component boundaries, the DHS CIO established a CIO Council, chaired by the CIO and composed of component- level CIOs. According to its charter, the specific functions of the council include establishing a strategic plan, setting priorities for departmentwide IT, identifying opportunities for sharing resources, coordinating multibureau projects and programs, and consolidating activities. To accomplish their respective missions, DHS and its component organizations rely extensively on IT. For example, in fiscal year 2006 DHS IT funding totaled about $3.64 billion, and in fiscal year 2007 DHS has requested about $4.16 billion. For fiscal year 2006, DHS reported that this funding supported 279 major IT programs. Table 2 shows the fiscal year 2006 IT funding that was provided to key DHS components. Table 2: IT Funding for Fiscal Year 2006: Dollars in millions: DHS components and investments: Citizenship and Immigration Services; Funding: $388.8. DHS components and investments: Coast Guard; Funding: $201.3. DHS components and investments: Customs and Border Protection; Funding: $$423.7. DHS components and investments: Federal Emergency and Management Agency; Funding: $93.5. DHS components and investments: Immigration and Customs Enforcement; Funding: $166.8. DHS components and investments: Management Directorate: eMerge2[A]; Funding: $17.8. DHS components and investments: Management Directorate: Enterprise Application Delivery[B]; Funding: $20.3. DHS components and investments: Management Directorate: Enterprise Architecture and Investment Management Program[C]; Funding: $34.6. DHS components and investments: Management Directorate: Enterprise- Geospatial System[D]; Funding: $13.1. DHS components and investments: Management Directorate: Homeland Secure Data Network[E]; Funding: $32.7. DHS components and investments: Management Directorate: Human Resources IT[F]; Funding: $20.8. DHS components and investments: Management Directorate: Information Security Program[G]; Funding: $54.1. DHS components and investments: Management Directorate: Integrated Wireless Network[I]; Funding: $261.7. DHS components and investments: Management Directorate: Watch List and Technical Integration[J]; Funding: $9.9. DHS components and investments: Management Directorate: OCIO salaries and expenses; Funding: $15.5. DHS components and investments: Management Directorate: Other IT infrastructure[H]; Funding: $887.2. DHS components and investments: Management Directorate: Other; Funding: $31.6. DHS components and investments: Preparedness Directorate; Funding: $215.4. DHS components and investments: Science and Technology Directorate; Funding: $33.2. DHS components and investments: Secret Service; Funding: $3.8. DHS components and investments: Transportation Security Administration; Funding: $333.2. DHS components and investments: US-VISIT; Funding: $341.0. DHS components and investments: Other DHS components; Funding: $40.2. DHS components and investments: Total; Funding: $3,640.2. Source: GAO analysis of DHS data. [A] eMerge2 is an initiative planned to integrate the business and financial management policies, processes and systems of DHS into a single solution with the goal of meeting the department's financial management, acquisition, and asset management needs. [B] Enterprise Application Delivery is intended to consolidate existing and planned Web pages and platforms of the DHS component organizations. [C] Enterprise Architecture and Investment Management Program is intended to develop the department's enterprise architecture and implement the transition strategy through the department's investment management process. [D] Enterprise-Geospatial System is planned to establish a framework, organizational structure, and requisite resources to enable departmentwide use of geographic information systems. [E] Homeland Secure Data Network is an effort to merge disparate classified networks into a single, integrated network to enable, among other things, the secure sharing of intelligence and other information. [F] HR IT includes the set of DHS enterprisewide systems to support the personnel regulations such as Max.R. [G] Information Security Program is intended to establish information security policies and procedures throughout the department to protect the confidentiality, integrity, and availability of information. [H] Other infrastructure includes initiatives with the goal of creating a single, consolidated, and secure infrastructure to ensure connectivity among the department's 22 component organizations. [I] The Integrated Wireless Network is to deliver the wireless communications services required by agents and officers of DHS, Justice, and Treasury. [J] Watch List and Technical Integration is to increase effective information sharing by consolidating, re-using, and retiring applications that develop multiple terrorist watch lists being used by multiple operating entities within the government. [End of table] GAO Has Reviewed Several of DHS's Mission-Critical IT Programs: In view of the importance of major IT programs to the department's mission, the Congress has taken a close interest in certain mission- critical programs, often directing us to review and evaluate program management, progress, and spending. Among the programs that we have reviewed are the following: * US-VISIT (the United States Visitor and Immigrant Status Indicator Technology) has several major goals: to enhance the security of our citizens and visitors and ensure the integrity of the U.S. immigration system, and at the same time to facilitate legitimate trade and travel and protect privacy. To achieve these goals, US-VISIT is to record the entry into and exit from the United States of selected travelers, verify their identity, and determine their compliance with the terms of their admission and stay. As of October 2005, US-VISIT officials reported that about $1.4 billion had been appropriated for the program. The Automated Commercial Environment (ACE) is a Customs and Border Protection (CBP) program to modernize trade processing systems and support border security. Its goals include enhancing analysis and information sharing with other government agencies; providing an integrated, fully automated information system for commercial import and export data; and reducing costs for the government and the trade community though streamlining. To date, CBP reports that the program has received almost $1.7 billion in funding. The America's Shield Initiative (ASI) program (now cancelled) was to enhance DHS's ability to provide surveillance and protection of the U.S. northern and southern borders through a system of sensors, databases, and cameras. The program was also to address known limitations of the current Integrated Surveillance Intelligence System (ISIS) and to support DHS's antiterrorism mission, including its need to exchange information with state, local, and federal law enforcement organizations. As of September 2005, ASI officials reported that about $340.3 million had been spent on the program. As of December 2005, the program was subsumed within the Secure Border Initiative, the department's broader border and interior enforcement strategy. The Secure Flight program is developing a system to perform passenger prescreening for domestic flights: that is, the matching of passenger information against terrorist watch lists to identify persons who should undergo additional security scrutiny. The goal is to prevent people suspected of posing a threat to aviation from boarding commercial aircraft in the United States, while protecting passengers' privacy and civil liberties. The program also aims to reduce the number of people unnecessarily selected for secondary screening. To date, TSA officials report that about $144 million has been spent on the program. The Atlas program is intended to modernize the IT infrastructure of Immigration and Customs Enforcement (ICE). The goals of the program are to, among other things, improve information sharing, strengthen information security, and improve workforce productivity. ICE estimates the life cycle cost of Atlas to be roughly $1 billion. The Student and Exchange Visitor Information System (SEVIS) is an Internet-based system that is to collect and record information on foreign students, exchange visitors, and their dependents--before they enter the United States, when they enter, and during their stay. Through fiscal year 2006, the department expects to have spent, in total, about $133.5 million on this program. The Rescue 21 program is to replace and modernize the Coast Guard's 30- year-old search and rescue communication system, the National Distress and Response System. The modernization is to, among other things, increase the Coast Guard's communication coverage area in the United States; allow electronic tracking of department vessels and other mobile assets; enable better communication with other federal and state systems; and provide for secure communication of sensitive information. The Coast Guard reports that it plans to spend about $373.1 million on the program by the end of fiscal year 2006. It also estimates program's life cycle cost to be $710 million. IT Management Controls and Capabilities Are Important: Our research on leading private and public sector organizations, as well as our past work at federal departments and agencies, shows that successful organizations embrace the central role of IT as an enabler for enterprisewide transformation.[Footnote 7] These leading organizations develop and implement institutional or agencywide IT management controls and capabilities (people, processes, and tools) that help ensure that the vast potential of technology is applied effectively to achieve desired mission outcomes. Among these IT management controls and capabilities are: * enterprise architecture development and use, * IT investment management, * system development and acquisition process discipline, * information security management, and: * IT human capital management.[Footnote 8] In addition, these organizations establish these controls and capabilities within a governance structure that centralizes leadership in an empowered CIO. These controls and capabilities are interdependent and interrelated IT management disciplines, as shown in figure 2. If effectively established and implemented, they can go a long way in determining how successfully an organization leverages IT to achieve mission goals and outcomes. Figure 2: Interrelated Keys to Successful IT Management: [See PDF for image] Note: Figure shows topics addressed in this testimony; other key IT management areas include IT strategic planning and information management. [End of figure] DHS Is Making Progress but Has Yet to Fully Institutionalize IT Management Controls and Capabilities: Over the last 3 years, our work has shown that the department has continued to work to establish effective corporate governance and associated IT management controls and capabilities, but progress in each of the key areas has been uneven, and more remains to be accomplished. Until it fully institutionalizes effective governance controls and capabilities, it will be challenged in its ability to leverage IT to support transformation and mission results. Enterprise Architecture: Leading organizations recognize the importance of having and using an enterprise architecture, or corporate blueprint, as an authoritative operational and technical frame of reference to guide and constrain IT investments. In brief, an enterprise architecture provides systematic structural descriptions--in useful models, diagrams, tables, and narrative--of how a given entity operates today and how it plans to operate in the future, and it includes a road map for transitioning from today to tomorrow. Our experience with federal agencies has shown that attempting to modernize systems without having an enterprise architecture often results in systems that are duplicative, not well integrated, unnecessarily costly to maintain, and limited in terms of optimizing mission performance.[Footnote 9] To assist agencies in effectively developing, maintaining, and implementing an enterprise architecture, we published a framework for architecture management, grounded in federal guidance and recognized best practices.[Footnote 10] The underpinning of this framework is a five-stage maturity framework outlining steps toward achieving a stable and mature enterprise architecture program. The framework describes 31 practices or conditions, referred to as core elements, that are needed for effective architecture management. We have previously reported on DHS's effort to develop its enterprise architecture from two perspectives. First, in November 2003, we reported on DHS's architecture management program relative to the framework described above.[Footnote 11] At that time, we found that the department had implemented many of the practices described in our framework. For example, the department had, among other things, assigned architecture development, maintenance, program management, and approval responsibilities; created policies governing architecture development and maintenance; and formulated plans to develop architecture products and begun developing them. Second, in August 2004, we reported on DHS's effort to develop enterprise architecture products, relative to well-established, publicly available criteria on the content of enterprise architectures.[Footnote 12] At that time, we concluded that the department's initial enterprise architecture provided a foundation upon which to build, but that it was nevertheless missing important content that limited its utility. Thus, it could not be considered a well-defined architecture. In particular, the content of this initial version was not systematically derived from a DHS or national corporate business strategy; rather, it was more the result of an amalgamation of the existing architectures that several of DHS's predecessor agencies already had, along with their respective portfolios of system investment projects. To its credit, the department recognized the limitations of the initial architecture and has developed a new version. To assist DHS in evolving its architecture, we recommended 41 actions aimed at having DHS add needed architecture content and ensure that architecture development best practices are employed. Since then, DHS reported that it had taken steps in response to our recommendations. For example, the department issued version 2 of its enterprise architecture in October 2004. According to DHS, this version contained additional business/mission, service, and technical descriptions. Also, this version was submitted to a group of CIOs of major corporations and an enterprise architecture consulting firm, both of which found the architecture meritorious. Earlier this month (March 2006), the department issued another new version of its enterprise architecture, which it calls HLS EA 2006. Our analysis of version 2 of the department's architecture indicates that DHS has made progress toward development of its architecture products, particularly descriptions of both the "as-is" and "to-be" environments. Specifically, the scope of the "as-is" and "to-be" environments extends to descriptions of business operations, information and data needs and definitions, application and service delivery vehicles, and technology profiles and standards. With respect to the depth and detail of these descriptions (which are the focus of most of our 41 prior recommendations), the department has reported progress, such as (1) completing its first inventory of information technology systems, a key input to its description of the "as-is" environment; (2) establishing departmentwide technology standards; (3) developing and beginning to implement a plan for introducing a shared services orientation to the architecture, particularly with regard to information services (e.g., network, data center, e-mail, help desk, and video operations); and (4) finalizing content for the portion of its architecture that relates to certain border security functions (e.g., the alien detention and removal process that is a major facet of the department's new Strategic Border Initiative). IT Investment Management: Through IT investment management, organizations define and follow a corporate process to help senior leadership make informed decisions on competing options for investing in IT. Such investments, if managed effectively, can have a dramatic impact on performance and accountability. If mismanaged, they can result in wasteful spending and lost opportunities for improving delivery of services. Based on our research, we have issued an IT investment management framework[Footnote 13] that encompasses the best practices of successful public and private sector organizations, including investment selection and control policies and procedures. Our framework identifies, among other things, effective policies and procedures for developing and using an enterprisewide collection--or portfolio--of investments; using such portfolios enables an organization to determine priorities and make decisions among competing options across investment categories based on analyses of the relative organizational value and risks of all investments.[Footnote 14] A central tenet of the federal approach to IT investment management is the select/control/evaluate model. During the select phase, the organization (1) identifies and analyzes each project's risks and returns before committing significant funds and (2) selects those projects that will best support its mission needs. In the control phase, the organization ensures that the project continues to meet mission needs at the expected levels of cost and risks. If the project is not meeting expectations or if problems have arisen, steps are quickly taken to address the deficiencies. During the evaluate phase, actual versus expected results are compared after a project has been fully implemented. In August 2004, we reported[Footnote 15] that DHS had established an investment management process that included departmental oversight of major IT programs. However, this process was not yet institutionalized: for example, most programs (about 75 percent) had not undergone the departmental oversight process, and resources were limited for completing control reviews in a timely manner. At that time, the CIO and other DHS officials attributed these shortfalls, in part, to the fact that the department's process was maturing and needed to improve. Based on our findings, we made recommendations aimed at strengthening the process. In March 2005,[Footnote 16] we again reported on this investment review process, noting that it incorporated many best practices and provided its senior leaders with the information required to make well-informed investment decisions at key points in the investment life cycle. However, we also concluded that at some key investment decision points, DHS's process did not require senior management attention and oversight. For example, management reviews are not required at key system and subsystem decision points, although such reviews (especially with complex systems that incorporate new technology like US-VISIT) are critical to ensuring that risk is reduced before the organization commits to the next phase of investment. Accordingly, we made further recommendations to improve the process. Further, the CIO recently reported additional steps being taken to strengthen IT investment management. According to the CIO, DHS has: * established an acquisition project performance reporting system, which requires periodic reporting of cost, schedule, and performance measures as well as earned value metrics, as means to monitor and control major acquisitions; * aligned the investment management cycle and associated milestones with the department's annual budget preparation process to allow business cases for major investments to be submitted to department headquarters at the same time as the budget, rather than as a follow- on; * linked investment management systems to standardize and make consistent the financial data used to make investment decisions; * verified alignment of approximately $2 billion worth of investments via the department's portfolio management framework; and: * completed investment oversight reviews (by total dollar value) of over 75 percent of the department's major investments. The department has also developed a standard template for capturing information about a given IT program to be used in determining the investment's alignment with the enterprise architecture. Such alignment is important because it ensures that programs will be defined, designed, and developed in a way that avoids duplication and promotes interoperability and integration. However, the department has yet to document a methodology, with explicit criteria, for making its judgments about the degree of alignment. Instead, it relies on the undocumented and subjective determinations of individuals in its Enterprise Architecture Center of Excellence. Systems Development and Acquisition Management: Managing systems development and acquisition effectively requires applying engineering and acquisition discipline and rigor when defining, designing, developing and acquiring, testing, deploying, and maintaining IT systems and services. Our work and other best practice research have shown that applying such rigorous management practices improves the likelihood of delivering expected capabilities on time and within budget. In other words, the quality of IT systems and services is largely governed by the quality of the management processes involved in developing and acquiring them. Best practices in systems development and acquisition include following a disciplined life cycle management process, in which key activities and phases of the project are conducted in a logical and orderly process and are fully documented. Such a life cycle process begins with initial concept definition and continues through requirements determination to design, development, various phases of testing, implementation, and maintenance. For example, expected system capabilities should be defined in terms of requirements for functionality (what the system is to do), performance (how well the system is to execute functions), data (what data are needed by what functions, when, and in what form), interface (what interactions with related and dependent systems are needed), and security. Further, system requirements should be unambiguous, consistent with one another, linked (that is, traceable from one source level to another),[Footnote 17] verifiable, understood by stakeholders, and fully documented. The steps in the life cycle process each have important purposes, and they have inherent dependencies among themselves. Thus, if earlier steps are omitted or deficient, later steps will be affected, resulting in costly and time-consuming rework. For example, a system can be effectively tested to determine whether it meets requirements only if these requirements have already been completely and correctly defined. Concurrent, incomplete, and omitted activities in life cycle management exacerbate the program risks. Life cycle management weaknesses become even more critical as the program continues, because the size and complexity of the program will likely only increase, and the later problems are found, the harder and more costly they will likely be to fix. These steps, practices, and processes are embedded in an effective systems development life cycle (SDLC) methodology, which sets forth the multistep process of developing information systems from investigation of initial requirements through analysis, design, implementation, maintenance, and disposal. Organizations generally formalize their SDLC in policies, procedures, and guidance. Currently, many of the major DHS components are following the processes established under their predecessor organizations. For example, both the Transportation Security Administration and CBP have their own SDLCs. As part of our reviews of DHS IT management and specific IT programs, we have not raised any issues or identified any shortcomings with these SDLCs. DHS is currently drafting policies and procedures to establish a departmentwide SDLC methodology and thus provide a common management approach to systems development and acquisition. According to DHS, the goals of the SDLC are to help: * align projects to mission and business needs and requirements; * incorporate accepted industry and government standards, best practices, and disciplined engineering methods, including IT maturity model concepts; * ensure that formal reviews and approvals required by the process are consistent with DHS's investment management process; and: * institute disciplined life cycle management practices, including planning and evaluation in each phase of the information system life cycle. The department's SDLC, currently in draft form, is to apply to DHS's IT portfolio as well as other capital asset acquisitions. Under the SDLC, each program will be expected to, among other things, * follow disciplined project planning and management processes balanced by effective management controls; * have a comprehensive project management plan; * base project plans on user requirements that are clearly articulated, testable, and traceable to the work products produced; and: * integrate information security activities throughout the SDLC. Information Security Management: Effective information security management depends on establishing a comprehensive program to protect the information and information systems that support an organization's operations and assets.The overall framework for ensuring the effectiveness of federal information security controls is provided by the Federal Information Security Management Act of 2002.[Footnote 18] In addition, OMB Circular No. A- 130 requires agencies to provide information and systems with protection that is commensurate with the risk and magnitude of the harm that would result from unauthorized access to these assets or their loss, misuse, or modification. Because of continuing evidence indicating significant, pervasive weaknesses in the controls over computerized federal operations, we have designated information security as a governmentwide high-risk issue since 1997.[Footnote 19] Moreover, related risks continue to escalate, in part because the government is increasingly relying on the Internet and on commercially available IT products. Concerns are increasing regarding attacks for the purpose of crime, terrorism, foreign intelligence gathering, and acts of war, as well as by the disgruntled insider, who may not need particular expertise to gain unrestricted access and inflict damage or steal assets. Without an effective security management program, an organization has no assurance that it can withstand these and other threats. Since it was established, both we and the department's inspector general (IG) have reported that although the department continues to improve its IT security, it remains a major management challenge. For example, within its first year the department had appointed a chief information security officer and developed and disseminated information system security policies and procedures, but it had not completed a comprehensive inventory of its major IT systems--a prerequisite for effective security management. In June 2005, we reported that DHS had yet to effectively implement a comprehensive, departmentwide information security program to protect the information and information systems that support its operations and assets.[Footnote 20] In particular, although it had developed and documented departmental policies and procedures that could provide a framework for implementing such a program, certain departmental components had not yet fully implemented key information security practices and controls. Examples of weaknesses in components' implementation included incomplete or missing elements in risk assessments, security plans, and remedial action plans, as well as incomplete, nonexistent, or untested continuity of operations plans. To address these weaknesses, we made recommendations aimed at ensuring that DHS fully implement the key information security practices and controls. More recently, the DHS IG reported that DHS's components have not completely aligned their respective information security programs with DHS's overall policies, procedures, and practices.[Footnote 21] However, the IG also reported progress. According to the IG, DHS completed actions to eliminate two obstacles that had significantly impeded the department in establishing its security program: First, it completed the comprehensive system inventory mentioned earlier, including major applications and general support systems for all DHS components. Second, it implemented a departmentwide tool that incorporates the guidance required to adequately complete security certification and accreditation for all systems. The IG also reported that the CIO had developed a plan to accredit all systems by September 2006. The DHS CIO testified earlier this month (March 2006) on progress in implementing the department's certification and accreditation plan, stating that the department is well on its way to achieving its September 2006 target for full system accreditation.[Footnote 22] The CIO also stated that by the end of February 2006, more than 60 percent of the over 700 systems in its inventory were fully accredited, up from about 26 percent 5 months earlier. IT Human Capital Management: A strategic approach to human capital management includes viewing people as assets whose value to an organization can be enhanced by investing in them,[Footnote 23] and thus increasing both their value and the performance capacity of the organization. Based on our experience with leading organizations, we issued a model[Footnote 24] encompassing strategic human capital management, in which strategic human capital planning was one cornerstone.[Footnote 25] Strategic human capital planning enables organizations to remain aware of and be prepared for current and future needs as an organization, ensuring that they have the knowledge, skills, and abilities needed to pursue their missions. We have also issued a set of key practices for effective strategic human capital planning.[Footnote 26] These practices are generic, applying to any organization or component, such as an agency's IT organization. They include: * involving top management, employees, and other stakeholders in developing, communicating, and implementing a strategic workforce plan; * determining the critical skills and competencies needed to achieve current and future programmatic results; * developing strategies tailored to address gaps between the current workforce and future needs; * building the capability to support workforce strategies; and: * monitoring and evaluating an agency's progress toward its human capital goals and the contribution that human capital results have made to achieving programmatic goals. In June 2004, we reported that DHS had begun strategic planning for IT human capital at the headquarters level, but it had not yet systematically gathered baseline data about its existing workforce. Moreover, the DHS CIO expressed concern over staffing and acknowledged that progress in this area had been slow.[Footnote 27] In our report, we recommended that the department analyze whether it had appropriately allocated and deployed IT staff with the relevant skills to obtain its institutional and program-related goals. In response, DHS stated that on July 30, 2004, the CIO approved funding for an IT human capital Center of Excellence. This center was tasked with delivering plans, processes, and procedures to execute an IT human capital strategy and to conduct an analysis of the skill sets of DHS IT professionals. Since that time, DHS has undertaken a departmentwide human capital initiative, MAXHR, which is to provide greater flexibility and accountability in the way employees are paid, developed, evaluated, afforded due process, and represented by labor organizations. Part of this initiative involves the development of departmentwide workforce competencies. According to the DHS IG, the department intended to implement MAXHR in the summer of 2005, but federal district court decisions have delayed the department's plans. However, the IG stated that the classification, pay, and performance management provisions of the new program are moving forward, with implementation of the new performance management system beginning in October 2005. According to the IG, the new pay system is planned for implementation by January 2007 for some DHS components. CIO Leadership: According to our research on leading private and public sector organizations and experience at federal agencies, leading organizations adopt and use an enterprisewide approach to IT governance under the leadership of a CIO or comparable senior executive, who has responsibility and authority, including budgetary and spending control, for IT across the entity.[Footnote 28] In May 2004, we reported that the DHS CIO did not have authority and control over departmentwide IT spending.[Footnote 29] Control over the department's IT budget was vested primarily with the CIO organizations within each DHS component, and the components' CIO organizations were accountable to the heads of the components. As a result, DHS's CIO did not have authority to manage IT assets across the department. Accordingly, we recommended that the Secretary examine the sufficiency of spending authority vested in the CIO and take appropriate steps to correct any limitations in authority that constrain the CIO's ability to effectively integrate IT investments in support of departmentwide mission goals. Since then, the DHS IG has reported that the DHS CIO is not well positioned to accomplish IT integration objectives.[Footnote 30] According to the IG, despite federal laws and requirements, the CIO is not a member of the senior management team with authority to strategically manage departmentwide technology assets and programs. The IG reported that steps were taken to formalize reporting relationships between the DHS CIO and the CIOs of major component organizations, but that the CIO still does not have sufficient staff resources to assist in carrying out the planning, policy formation, and other IT management activities needed to support departmental units. The IG expressed the view that although the CIO currently participates as an integral member at each level of the investment review process, the department would benefit from following the successful examples of other federal agencies in positioning their CIOs with the authority and influence needed to guide executive decisions on departmentwide IT investments and strategies. In response to the IG's comments, the DHS CIO stated that his office is properly positioned and has the authority it needs to accomplish its mission. According to the CIO, the office is the principal IT authority to the Secretary and Deputy Secretary, and it will continue to hold that leadership role within the department. DHS Is Making Some Progress in Implementing IT Systems and Infrastructure: A gauge of DHS's progress in managing its IT investments is the extent to which it has deployed and is currently operating more modern IT systems and infrastructure. To the department's credit, our reviews have shown progress in these areas, and DHS has reported other progress. However, our reviews have also shown that IT programs have not met stated goals for deployed capabilities, and DHS's own reporting shows that infrastructure goals have yet to be fully met. To expedite the implementation of IT systems, the department has developed and deployed system capabilities incrementally, which we support, as this is a best practice and consistent with our recommendations.[Footnote 31] For example, the department has successfully delivered visitor entry identification and screening capabilities with the first three increments of its US-VISIT program, and it is currently implementing release four of its ACE program. At the same time, however, US-VISIT exit capabilities are not in place, and release four of ACE does not include needed functionality. Further, some IT programs that either were or have been under way for years have not delivered any functionality, such as the canceled ASI program and the Secure Flight program. In addition, the department has recently reported a number of accomplishments relative to IT infrastructure; however, what has been reported also shows that much remains to be accomplished before infrastructure-related efforts produce deployed and operational capabilities. For example, the department reports that it has begun its Infrastructure Transformation Program (ITP), which is its approach to moving to a consolidated, integrated, and services-oriented IT infrastructure. According to the department, the CIO developed and has begun implementing the ITP plan, which is to be centrally managed but executed in a distributed manner, with various DHS components taking the lead for different areas of infrastructure transformation.[Footnote 32] The ITP is to create a highly secure and survivable communications network (OneNet) for Sensitive but Unclassified data across the department, and it is also to establish a common and reliable e-mail system across the department. The department reported that it had deployed the initial core of the DHS OneNet and built the primary Network Operation Center to monitor OneNet performance. Among the other goals of the program are consolidated data centers to reduce costs and provide a highly survivable and reliable computing environment. In this regard, the department reported that it has now established an interim data center. In addition, the department stated that it has extended its classified networking capabilities by fielding 56 Secret sites on the department's Homeland Secure Data Network and by completing the connection of this network to SIPRNet (the Defense Department's Secret Internet Protocol Routed Network). DHS also reported that it has established an Integrated Wireless Program Plan, which provides a program management framework to ensure the on-time cost and schedule performance of wireless programs and projects. Key IT Programs Reflect Mixed Use of Effective IT Management Practices: A key measure of how well an organization is managing IT is the degree to which its IT-dependent programs actually implement corporate management controls and employ associated best practices. In this regard, our reviews of several nonfinancial DHS IT programs provide examples of both strengths and weaknesses in program management. In summary, they show that DHS IT programs are not being managed consistently: some programs are at least partially implementing certain program management best practices, but others are largely disregarding most of the practices. Further, they show that most of the programs are considerably challenged in certain key areas, such as measuring progress and performance against program commitments and establishing human capital capabilities. IT investment alignment with the enterprise architecture. An important element of enterprise architecture management is ensuring that IT investments comply with the architecture. However, in several of the programs that we have reviewed, investments have been approved without documented analysis to support these judgments and to permit the judgments to be independently verified. For example, DHS approved the ACE program's alignment with the department's architecture on the recommendation of its Enterprise Architecture Center of Excellence and Enterprise Architecture Board. However, the Center's evaluators did not provide a documented analysis that would allow independent verification. According to DHS officials, they do not have a documented methodology for evaluating programs' architecture compliance, and instead rely on the professional expertise of Center staff. In contrast, the ASI program provides an example of an instance in which the reviews required to ensure architecture alignment resulted in the discovery of a significant problem: the program had not adequately defined its relationships and dependencies with other department programs.[Footnote 33] As a result, the program was reconsidered and later subsumed within the new Secure Border Initiative, the department's broader strategy for border and interior enforcement. Reliable cost estimates. Reliable cost estimates are prerequisites both for developing an economic justification for a program and for establishing cost baselines against which to measure progress. DHS IT programs that we reviewed have demonstrated mixed results in this regard. For example, the ACE program has made considerable progress in implementing our recommendation to ensure that its development contractor's cost estimates are reconciled with independent cost estimates, and that the derivation of both estimates is consistent with published best practices. However, cost estimating remains a major challenge for other DHS IT programs. For example, Secure Flight did not have cost estimates for either initial or full operating capability, nor did it have a life-cycle cost estimate (estimated costs over the expected life of a program, including direct and indirect costs and costs of operation and maintenance). Also, for the US-VISIT program's analysis of proposed alternatives for monitoring the exit of travelers, cost estimates did not meet key criteria for reliable cost estimating as established in the published best practices mentioned above. For example, they did not include detailed work breakdown structures defining the work to be performed, so that associated costs could be identified and estimated. Such a work breakdown structure provides a reliable basis for ensuring that estimates include all relevant costs. Without reasonable cost estimates, it is not possible to produce an adequate economic justification for choosing among alternatives, and program performance cannot be adequately measured. Earned value management. To help ensure that reliable processes are used to measure progress against cost and schedule commitments, OMB requires agencies to manage and measure major IT projects[Footnote 34] through use of an earned value management (EVM) system that is compliant with specified standards.[Footnote 35] On programs we reviewed, however, the use of EVM was as yet limited. For example, although the ACE program had instituted the use of EVM on recent releases, its use for one release was suspended in June 2005, because staff assigned to the release were unfamiliar with the technique. For another release, EVM was not used because, according to program officials, the release had not established the necessary cost and schedule baseline estimates against which earned value could be measured. ACE officials told us that they plan to establish baselines and use EVM for future work. With regard to the US-VISIT program, although EVM is to be used in managing the prime integration contract, it has not been used in a number of US-VISIT related contracts over the last 3 years. According to DHS, in fiscal year 2005, 30 percent of departmental programs were using EVM. Performance management and accountability. To ensure that programs manage their performance effectively, it is important that they define and measure progress against program commitments and hold themselves accountable for results. These program commitments include expected or estimated (1) capabilities and associated use and quality; (2) benefits and mission value; (3) costs; and (4) milestones and schedules. To be accountable, projects need first to develop and maintain reliable and current expectations and then to define and select metrics to measure progress against these. However, in our reviews of DHS programs (such as those that are required to prepare expenditure plans for Senate and House appropriations subcommittees before obligating funding), we have reported that program performance and accountability has been a challenge. For example, the fiscal year 2004 expenditure plan for the Atlas program did not provide sufficient information on program commitments to allow the Congress to perform effective oversight. On the other hand, although the ACE program office is still not where it needs to be in this regard, it has made progress in this area: it has now prepared an initial version of a program accountability framework that includes measuring progress against costs, milestones and schedules, and risks for select releases. However, ACE benefit commitments are still not well defined, and the performance targets being used were not always realistic. On other programs, such as SEVIS, we found that while some performance aspects of the system were being measured, others were not such as network usage. Disciplined acquisition and development processes. Our reviews of DHS programs have disclosed numerous weaknesses in key process areas related to system acquisition and management, such as requirements development and management, test management, project planning, validation and verification, and contract management oversight. For example, we reported that the Atlas program office, which had been recently established, had not yet implemented any of these key process areas.[Footnote 36] For the ACE program, weaknesses in requirements definition were a major reason for recent problems and delays, including the realization during pilot testing that key functionality had not been defined and built into the latest release. For US-VISIT, test plans were incomplete in that they did not, among other things, adequately demonstrate traceability between test cases and the requirement to be verified by testing. Also, both ASI and Secure Flight were proceeding without complete and up-to-date program management plans, and Secure Flight's requirements were not well developed. In addition, key ASI acquisition controls, such as contract management oversight, were not yet defined. This led to a number of problems in ASI deploying, operating, and maintaining ISIS technology. Further, ACE and US-VISIT projects have not always effectively employed independent verification and validation. Risk management. Effective risk management is vital to the success of any system acquisition. Accordingly, best practices[Footnote 37] advocate establishing management structures and processes to proactively identify facts and circumstances that can increase the probability of an acquisition's failing to meet cost, schedule, and performance commitments and then taking steps to reduce the probability of their occurrence and impact. Our work on the ACE, US-VISIT, and ASI programs, for example, showed that risk management programs were in place, but not all risks were being effectively addressed. In particular, key risks on the ACE program were not being effectively addressed. Specifically, the ACE program schedule had introduced significant concurrency in the development and deployment of releases; as both prior experience on the ACE program and best practices show, such concurrency causes contention for common resources, which in turn produces schedule slips and cost overruns. Also, the ACE program was passing key milestones with known severe system defects--that is, allowing development to proceed to the next stage even though significant problems remained to be solved. This led to a recurring pattern of addressing quality problems with earlier releases by borrowing resources from future releases, which led to schedule delays and cost overruns. Moreover, it led the program to deploy one release prematurely with the intention of gaining user acceptance sooner. However, this premature deployment actually produced a groundswell of user complaints and poor user satisfaction scores with the release. Similar risks were experienced on the Coast Guard's Rescue 21 program. For example, we reported that the Coast Guard's plan to compress and overlap key tests introduced risks, and subsequently the Coast Guard decided to postpone several tests.[Footnote 38] Security. The selection and employment of appropriate security and privacy controls for an information system are important tasks that can have major implications for the operations and assets and for the protection of personal information that is collected and maintained in the system. Security controls are the management, operational, and technical safeguards prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information. Privacy controls limit the collection, use, and disclosure of personal information. For several IT programs, security and privacy has been a challenge. For example, we reported[Footnote 39] in September 2003 and again in May 2004 that the US-VISIT program office had yet to develop a security plan as required by OMB and other federal guidance, although the program later developed a plan that was generally consistent with applicable guidance. However, the program office had not conducted a security risk assessment or included in the plan when such an assessment would be completed. OMB and other federal guidance specifies that security plans should describe the methodology that is used to identify system threats and vulnerabilities and to assess the risks, and include the date the assessment was completed. In addition, we reported that the Atlas program was relying on a bureauwide security plan that did not address Atlas infrastructure requirements. Further, Atlas had yet to develop a privacy impact assessment to determine what effect, if any, the system would have on individual privacy, the privacy consequences of processing certain information, and alternatives considered to collect and handle the information. On TSA's Secure Flight program, although the agency had taken steps to implement security to protect system information and assets, we recently reported that these steps were individually incomplete and collectively fell short of a comprehensive program consistent with federal guidance and associated best practices. More specifically, OMB and other federal guidance and relevant best practices call for agencies to, among other things, (1) conduct a systemwide risk assessment that is based on system threats and vulnerabilities and (2) then develop system security requirements and related policies and procedures that govern the operation and use of the system and address identified risks. Although TSA developed two system security plans--one for the underlying infrastructure (hardware and software) and another for the Secure Flight system application--neither was complete. Specifically, the infrastructure plan only partially defined the requirements to address the risks, and the application plan did not include any requirements addressing risks. Furthermore, we also recently reported[Footnote 40] that TSA did not fully disclose to the public, as required by privacy guidance, its use of personal information during the testing phase of Secure Flight until after many of the tests had been completed. Establishing and maintaining adequate staffing. Implementing the IT management processes that I have been describing requires that programs have the right people--not only people who have the right knowledge, skills, and abilities, but also enough of them to do the job. Generally, all the programs we reviewed were challenged, particularly in their initial stages, to assemble sufficient staff with the right skill mix and to treat workforce (human capital) planning as a management imperative. For example, we reported that both the Atlas and the ASI programs were initiated without being adequately staffed. In addition, in September 2003 we reported that the US-VISIT program office had assessed its staffing needs for acquisition management at 115 government and 117 contractor personnel, but that at the time the program had 10 staff within the program office and another 6 staff working closely with them.[Footnote 41] Since then, US-VISIT has filled 102 of its 115 planned government positions (with plans in place to fill the remaining positions) and all of its planned 117 contractor positions.[Footnote 42] However, to ensure that staffing needs continue to be met, organizations need to manage human capital strategically, which entails identifying the program functions that need to be performed and the associated numbers and skill sets (core competencies) needed to perform them, assessing the on-board workforce relative to these needs, identifying gaps, and developing and implementing strategies (i.e., hiring, retention, training, contracting) for filling these gaps over the long-term. In this regard, the US-VISIT program has made considerable progress. Specifically, we recently reported that it has analyzed the program office's workforce to determine diversity trends, retirement and attrition rates, and mission-critical and leadership competency gaps, and it has updated the program's core competency requirements to ensure alignment between the program's human capital and business needs. In contrast, although the ACE program has taken various informal steps to bolster its workforce (such as providing training), it has been slow to document and implement a human capital strategy that compares competency-based staffing needs to on-board capabilities and includes plans for closing shortfalls. In closing, let me reiterate that we have made a series of recommendations to the department aimed at addressing both the department's institutional IT management challenges and its IT program- specific weaknesses. To the department's credit, it has largely agreed with these recommendations. Although some of these have been implemented, most are still works in process. In my view, these recommendations provide a comprehensive framework for strengthening DHS's management of IT and increasing the chances of delivering promised system capabilities and benefits on time and within budget. We look forward to working constructively with the department in implementing these recommendations and thereby maximizing the role that IT can play in DHS's transformation efforts. Mr. Chairmen, this concludes my statement. I would be happy to answer any questions at this time. Contacts and Acknowledgments: For future information regarding this testimony, please contact Randy Hite, Director, Information Technology Architecture and Systems Issues, at (202) 512-3439, or firstname.lastname@example.org. Other individuals who made key contributions to this testimony were Mathew Bader, Mark Bird, Justin Booth, Barbara Collier, Deborah Davis, Michael Holland, Ash Huda, Gary Mountjoy, and Scott Pettis. FOOTNOTES  GAO, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.: January 2003); High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: January 2005).  GAO, Department of Homeland Security: Formidable Information and Technology Management Challenge Requires Institutional Approach, GAO-04- 702 (Washington, D.C.: Aug. 27, 2004).  GAO, Maximizing the Success of Chief Information Officers: Learning from Leading Organizations, GAO-01-376G (Washington, D.C.: February 2001); Architect of the Capitol: Management and Accountability Framework Needed for Organizational Transformation, GAO-03-231 (Washington, D.C.: Jan. 17, 2003).  Some of those specialties are intelligence analysis, law enforcement, border security, transportation security, biological research, critical infrastructure protection, and disaster recovery.  For example, see GAO, Major Management Challenges and Program Risks: Department of Homeland Security, GAO-03-102 (Washington, D.C.: January 2003) and Homeland Security: Proposal for Cabinet Agency Has Merit, but Implementation Will be Pivotal to Success, GAO-02-886T (Washington, D.C.: June 25, 2002).  GAO, Homeland Security: Information Sharing Responsibilities, Challenges, and Key Management Issues, GAO-03-715T (Washington, D.C.: May 8, 2003).  GAO, Maximizing the Success of Chief Information Officers: Learning from Leading Organizations, GAO-01-376G (Washington, D.C.: February 2001); Architect of the Capitol: Management and Accountability Framework Needed for Organizational Transformation, GAO-03-231 (Washington, D.C.: Jan. 17, 2003).  Other important IT management controls and capabilities are not addressed in this testimony, such as IT strategic planning and information management.  See for example, GAO, DOD Business Systems Modernization: Improvements to Enterprise Architecture Development and Implementation Efforts Needed, GAO-03-458, (Washington, D.C.: Feb. 28, 2003); Information Technology: DLA Should Strengthen Business Systems Modernization Architecture and Investment Activities, GAO-01-631 (Washington, D.C.: June 29, 2001); and Information Technology: INS Needs to Better Manage the Development of Its Enterprise Architecture, AIMD-00-212 (Washington, D.C.: Aug. 1, 2000).  GAO, Information Technology: A Framework for Assessing and Improving Enterprise Architecture Management (Version 1.1), GAO-03-584G (Washington, D.C.: April 2003).  GAO, Information Technology: Leadership Remains Key to Agencies Making Progress on Enterprise Architecture Efforts, GAO-04-40 (Washington, D.C.: Nov. 17, 2003).  GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: Aug. 6, 2004).  GAO, Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, Exposure Draft, GAO/AIMD- 10.1.23 (Washington, D.C.: May 2000); Information Technology Investment Management: A Framework for Assessing and Improving Process Maturity, version 1.1, GAO-04-394G (Washington, D.C.: March 2004).  Our ITIM framework is also consistent with the Clinger-Cohen Act of 1996 (40 U.S.C. §§ 11101-11703), in which Congress enacted provisions requiring federal agencies to focus on results achieved through IT investments and to improve their IT acquisition processes. The act also introduces more rigor and structure into how agencies select and manage IT projects.  GAO, Department of Homeland Security: Formidable Information and Technology Management Challenge Requires Institutional Approach, GAO-04- 702 (Washington, D.C.: Aug. 27, 2004).  GAO, Homeland Security: Successes and Challenges in DHS's Efforts to Create an Effective Acquisition Organization, GAO-05-179 (Washington, D.C.: Mar. 29, 2005).  Examples of higher order sources include legislation, which may dictate certain requirements, and other system documentation, such as the operational concept. When requirements are managed well, traceability can be established from the source requirements to lower level requirements and from the lower level back to their source. Such bidirectional traceability helps determine that all source requirements have been addressed completely and that all lower level requirements can be verified as derived from a valid source.  Pub. L. No. 107-347, tit. III, § 301, 116 Stat. 2946, 2946-55 (Dec. 17, 2002) (codified at 44 U.S.C. §§ 3541-3549).  See GAO, High-Risk Series: Protecting Information Systems Supporting the Federal Government and the Nation's Critical Infrastructures, GAO-03-121 (Washington, D.C.: January 2003).  GAO, Information Security: Department of Homeland Security Needs to Fully Implement Its Security Program, GAO-05-700 (Washington, D.C.: June 17, 2005).  DHS Office of Inspector General, Major Management Challenges Facing the Department of Homeland Security, OIG-06-14 (Washington, D.C.: December 2005).  Statement by Scott Charbo, DHS CIO, before the House Committee on Government Reform (Washington, D.C.: Mar. 16, 2006).  See GAO, Human Capital: Attracting and Retaining a High-Quality Information Technology Workforce, GAO-02-113T (Washington, D.C.: Oct. 4, 2001); A Model of Strategic Human Capital Management, GAO-02-373SP (Washington, D.C.: Mar. 15, 2002); Key Principles for Effective Strategic Workforce Planning, GAO-04-39 (Washington, D.C.: Dec. 11, 2003).  GAO-02-373SP.  The other three are leadership; acquiring, developing, and retaining talent; and results-oriented organizational culture.  GAO-04-39.  GAO, Human Capital: DHS Faces Challenges In Implementing Its New Personnel System, GAO-04-790 (Washington, D.C.: June 18, 2004).  For example, see GAO, Architect of the Capitol: Management and Accountability Framework Needed for Organizational Transformation, GAO- 03-231 (Washington, D.C.: Jan. 17, 2003) and Maximizing the Success of Chief Information Officers: Learning from Leading Organizations, GAO-01- 376G (Washington, D.C.: February 2001).  GAO, Information Technology: Homeland Security Should Better Balance Need for System Integration Strategy with Spending for New and Enhanced Systems, GAO-04-509 (Washington, D.C.: May 21, 2004).  DHS Office of Inspector General, Major Management Challenges Facing the Department of Homeland Security, OIG-06-14 (Washington, D.C.: December 2005).  Clinger-Cohen Act of 1996, Pub. L. 104-106; OMB, Management of Federal Information Resources, Circular A-130 (Nov. 28, 2000).  For instance, CBP is the lead for network services and data centers; the Coast Guard is the lead for e-mail and help desk services; and the Federal Emergency Management Agency is the lead on video operations services.  In February 2006, we reported that the DHS Deputy Secretary had directed that the program be reevaluated within the department's broader border and interior enforcement strategy, now referred to as the Secure Border Initiative. See GAO, Border Security: Key Unresolved Issues Justify Reevaluation of Border Surveillance Technology Program, GAO-06-295 (Washington, D.C.: Feb. 22, 2006).  Specifically, OMB requires agencies to use this method on all new major IT projects, ongoing major IT developmental projects, and high- risk projects.  EVM is a project management tool that integrates the investment scope of work with schedule and cost elements for investment planning and control. This method compares the value of work accomplished during a given period with that of the work expected in the period. Differences in expectations are measured in both cost and schedule variances.  GAO, Information Technology: Management Improvements Needed on Immigration and Customs Enforcement's Infrastructure Modernization Program, GAO-05-805 (Washington, D.C.: Sept. 7, 2005).  Software Engineering Institute, Software Acquisition Capability Maturity Model® version 1.03, CMU/SEI-2002-TR-010 (Pittsburgh, PA: March 2002).  GAO, Coast Guard: New Communication System to Support Search and Rescue Faces Challenges, GAO-03-1111 (Washington, D.C.: Sept. 30, 2003).  Homeland Security: First Phase of Visitor and Immigration Status Program Operating, but Improvements Needed, GAO-04-586 (Washington, D.C.: May 11, 2004); and Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.: Sept. 19, 2003).  GAO, Aviation Security: Transportation Security Administration Did Not Fully Disclose Uses of Personal Information during Secure Flight Program Testing in Initial Privacy Notices, but Has Recently Taken Steps to More Fully Inform the Public, GAO-05-864R (Washington, D.C.: July 22, 2005).  GAO, Homeland Security: Risks Facing Key Border and Transportation Security Program Need to Be Addressed, GAO-03-1083 (Washington, D.C.: Sept. 19, 2003);  GAO, Homeland Security: Recommendations to Improve Management of Key Border Security Program Need to Be Implemented, GAO-06-296 (Washington, D.C.: Feb. 14, 2006).