IT Modernization: Census Bureau Needs Reliable Cost and Schedule Estimates
Fast Facts
While the 2030 Decennial Census is still years away, keeping the Census Bureau's IT systems modernized is critical to its mission.
The Bureau has begun 4 modernization programs for systems that collect, process, and disseminate data, but hasn't fully implemented leading practices for managing requirements, cost, and schedule. Without reliable estimates, the Bureau increases its risk of cost overruns and unmet performance targets.
The Bureau has also begun creating plans to address many of the cybersecurity and privacy challenges it faced during the prior Census but hasn't set timeframes for all of these efforts.
Our recommendations address this.
Highlights
What GAO Found
The Census Bureau fully implemented selected leading practices for risk management, but it did not fully implement selected leading practices for managing requirements, cost, and schedule for the Center for Enterprise Dissemination Services and Consumer Innovation (an enterprise-wide data dissemination modernization program), as shown in the table.
Extent to Which the Census Bureau Implemented Selected Areas for Managing the Center for Enterprise Dissemination Services and Consumer Innovation Program
|
Management area |
Overall assessment |
|---|---|
|
Risk Management |
● Fully implemented |
|
Requirements Management |
◕ Substantially implemented |
|
Cost |
◐ Partially implemented |
|
Schedule |
◔ Minimally implemented |
Source: GAO analysis of Census Bureau data. | GAO-24-105979
The Bureau substantially implemented leading practices for requirements management. However, it did not consistently trace requirements forward and backward from their source to the end product. As a result, the program faces challenges in ensuring it adheres to project requirements. Additionally, the program's cost and schedule estimates were unreliable because the Bureau did not substantially or fully implement leading practices. Specifically:
- Although the program substantially met two of the four characteristics of a high-quality, reliable cost estimate (well documented and accurate), it only partially met the remaining two characteristics (credible and comprehensive).
- The program did not substantially meet any of the four characteristics of a reliable schedule: comprehensive, well constructed, credible, and controlled.
Without reliable cost and schedule estimates, the Bureau increases the risk of cost overruns and unmet performance targets.
GAO's prior work identified several cybersecurity and privacy challenges the Bureau faces implementing its IT modernization programs, including
- addressing cybersecurity workforce challenges,
- improving information security initiatives and programs,
- enhancing its detection and response to cyber incidents, and
- ensuring respondent privacy while maintaining the usability of public Census data.
The Bureau has taken steps to address these challenges but lacks detailed plans and strategies. For example, the Bureau drafted a strategy in 2023 to improve the cybersecurity of software development and operations. However, the strategy has not been finalized and does not include specific information (e.g., time frames) for accomplishing its objectives. In addition, the Bureau was unable to provide detailed information about the steps it plans to take to balance the privacy of respondents to the 2025 American Community Survey against the usability of public data. Until the Bureau develops detailed plans and time frames for these activities, it risks not meeting its objectives of effectively securing and protecting its IT systems and data.
Why GAO Did This Study
The Census Bureau's IT systems are essential to collecting and providing data about the nation's people and economy. During the run up to the 2020 Census, the Bureau faced challenges in modernizing and consolidating its IT systems. For future surveys, including the 2030 Census, the Bureau has embarked on four modernization programs to collect, process, and disseminate data.
GAO was asked to review the Bureau's implementation of key modernization programs. This report (1) examines the extent to which the Bureau is implementing leading practices related to managing risks, requirements, cost, and schedule for a selected enterprise-wide IT program; and (2) describes the key cybersecurity and privacy challenges the Bureau faces in implementing its IT modernization programs and the extent to which the Bureau has plans to address them.
GAO selected the data dissemination program due to the maturity of its cost and schedule documentation. GAO assessed the program's management of risks, requirements, cost, and schedule against leading practices. In addition, GAO reviewed prior GAO reports and Bureau plans related to cybersecurity and privacy challenges, and interviewed Bureau officials.
Recommendations
GAO is making five recommendations to the Department of Commerce related to managing requirements, estimating cost and schedule, and developing plans and time frames on cybersecurity and privacy challenges. Commerce concurred with the recommendations and stated it would take steps to improve in these areas.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Department of Commerce | The Secretary of Commerce should direct the Director of the Census Bureau to ensure that the CEDSCI program consistently documents user stories to ensure bidirectional traceability with requirements. (Recommendation 1) |
In response to our recommendation, in December 2025, the Bureau updated its business process model and requirements management plan to reflect changes it made to simplify its requirements management structure. Specifically, these documents described the program's requirements architecture to ensure traceability of user stories. The documents were also updated to ensure that newly-created requirements are categorized properly as an epic, user story, or non-functional requirement. Further, in August 2026, the Bureau provided evidence to demonstrate that it had implemented its updated requirements management plan for its Center for Enterprise Dissemination Services and Consumer Innovation (CEDSCI) program. For example, the Bureau provided examples of CEDSCI user stories that demonstrated bidirectional traceability with parent and child requirements. By taking these steps, the Census Bureau will help ensure it is effectively managing the CEDSCI program's project requirements.
|
| Department of Commerce | The Secretary of Commerce should direct the Director of the Census Bureau to ensure that the CEDSCI program develops reliable cost estimates using best practices described in GAO's Cost Estimating and Assessment Guide, in particular those practices related to the comprehensive and credible characteristics. (Recommendation 2) |
The Department of Commerce agreed with our recommendation and has taken steps towards implementing it. As of November 2025, the Census Bureau had provided updated cost estimation documentation for the CEDSCI program that demonstrated improvement in its implementation of best practices associated with a reliable cost estimate. Specifically, the Bureau provided a complete technical baseline of CEDSCI's cost estimate and has now substantially met best practices related to a comprehensive estimate. However, as of September 2026, it still only partially met best practices related to the estimate's credibility. The Bureau did not properly document the sensitivity analysis or discuss the implications and realism of the scenarios in that analysis. It also did not demonstrate performance of cross-checks of the estimate's results in accordance with best practices, which would be needed to fully implement this recommendation. Without implementing a cost estimate that reflects the four characteristics of a reliable cost estimate, the Bureau faces increased risks of cost overruns and unmet performance targets for the CEDSCI program.
|
| Department of Commerce | The Secretary of Commerce should direct the Director of the Census Bureau to ensure that the CEDSCI program develops its schedule using the best practices described in GAO's Schedule Assessment Guide. (Recommendation 3) |
In October 2024, the Census Bureau provided an action plan with steps it plans to take to implement this recommendation, including using a checklist to ensure that the schedule complies with all elements of GAO's Schedule Assessment Guide. We will continue to evaluate their progress in implementing this recommendation.
|
| Department of Commerce | The Secretary of Commerce should direct the Director of the Census Bureau to ensure that the OCIO incorporates key elements, such as time frames, into its DevSecOps strategy and finalizes it in a timely manner. (Recommendation 4) |
In response to our recommendation, in July 2026, the Bureau provided an updated DevSecOps implementation strategy, along with an updated timeline for implementation. The implementation strategy included a phased plan with milestones through 2027, assigned owners and contributors, implementation steps, impacts, dependencies, and risks. By taking these steps, the Census Bureau will help ensure that its DevSecOps strategy will be effectively implemented, meets its goals and objectives, and addresses key cybersecurity lessons learned.
|
| Department of Commerce | The Secretary of Commerce should direct the Director of the Census Bureau to ensure that the American Community Survey program develops a plan, including time frames, for the steps they intend to take to determine the most appropriate methods to protect respondent privacy in the publicly available data releases. (Recommendation 5) |
In October 2024, the Census Bureau provided an action plan with steps it plans to take to implement this recommendation, including developing a disclosure risk assessment. We will continue to evaluate their progress in implementing this recommendation.
|