Information Technology: Management Improvements Needed on Immigration and Customs Enforcement's Infrastructure Modernization Program

ICE revised and updated its Atlas cost-benefit analysis and issued it on June 30, 2009. Consistent with our recommendation, the revised analysis identified current mission requirements, such as strengthening the security and protection of U.S. citizens by investigative and intelligence capabilities to prevent terrorism and other illegal activities and how requirements are to be met through the Atlas information technology modernization program. It also provided an analysis of 3 alternative modernization approaches for meeting the requirements, and the associated costs and technical merits of each alternative. In addition, it identified the estimated life-cycle costs, benefits, and return on benefits for each of 9 sub-projects that comprise Atlas. As a result of this analysis, agency executives have established a return on investment benchmark against which to measure whether investments are delivering intended business value.

Consistent with our recommendation, ICE established an Atlas program management office (PMO). In doing so, it also developed a staffing needs assessment, defined roles and responsibilities for the positions identified in the assessment, and has begun implementing key acquisition controls such as risk management. Specifically, in early 2006, ICE stood up the PMO, which is headed by a program manager that reports to ICE's Chief Information Officer, to manage and oversee the program. In addition, in April 2006, ICE developed an Atlas PMO Organizational Assessment that defined the program office's hierarchical structure and functions. As part of the assessment, ICE performed a staffing needs assessment to determine the positions and level of staffing need to adequately manage the program. According to the assessment, the program needed, among other things, a program manager, seven project managers, and a contracting officer's technical representative (COTR). As of early 2007, ICE had hired staff for all of these positions. In the assessment, ICE also defined roles and responsibilities for the positions identified in its staffing assessment as well as for staff associated with each of its seven projects. With respect to key acquisition management controls, ICE has, for example, developed a risk management plan and process, and has begun to implement the risk management plan and process by developing an inventory of risks and hiring a risk management coordinator to maintain and update the risk management plan, facilitate risk assessments, track efforts to reduce risks to acceptable levels, and develop and conduct risk management training.

Consistent with our recommendation, ICE has adopted a management approach that provides for developing security plans for Atlas systems as they are preparing to become operational. For the one Atlas system that has thus far been made operational (called ADEX), ICE developed a security plan (dated February 21, 2007) that is consistent with federal IT security guidance. ICE also took actions consistent with our recommendation to update its privacy impact assessment. Specifically, in conjunction with DHS's Privacy Office, ICE performed a privacy threshold analysis to identify which Atlas projects are to use and store privacy data, thus requiring a privacy impact assessment. The threshold analysis identified that only one Atlas system investment (called ICE Integrated Decision Support) was to use and store privacy data. In July 2009, ICE reported that a privacy impact assessment for this project had been developed and approved by the DHS Privacy Office, and that it was awaiting final review and approval by a couple of other stakeholders including ICE's Office of the Principal Legal Advisor. ICE officials stated that they will continue to monitor the assessment's progress to final approval.

ICE has taken steps to implement performance management practices that are consistent with our recommendation. Specifically, as of April 2007, ICE had developed performance measures for all seven Atlas projects and is using these measures at its quarterly Program Management Reviews to manage and oversee the program. In addition, ICE has developed (and reported in its 2006 and 2007 expenditure plans), benefits and achievements, in measurable terms, for each of the projects. The expenditure plans also describe how the performance measures, benefits, and achievements support and are linked to the program's goals of enhancing productivity, strengthening security of information and data assets, and promoting information sharing and collaboration.

Consistent with our recommendations, ICE's fiscal year 2007 Atlas expenditure plan included a profile for each Atlas project that included a description of the system capabilities, schedule, cost, and benefits to be delivered as well as how they were to be acquired. For example, for system capabilities, the expenditure plan profile provided a summary for each project, of the funding to be provided and the capabilities to be delivered. This summary also included the milestones for when the capabilities were to be provided. In addition, with regard to benefits, the plan profile described the benefits to be realized as a result of each planned system investment. Furthermore, each profile described how each project was to be acquired in accordance with guidance in the acquisition plan developed by the Atlas program. According to ICE officials, including the Atlas Program Manager, they plan to include this information in future expenditure plans.