Recommendation: The NASA Administrator should take steps to fulfill the requirement that contracting officers ensure that subcontracting reports are submitted by contractors in a timely manner. For example, the agency could require contracting officers to verify that prior reports were submitted when reviewing current submissions. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NASA Administrator should take steps to ensure contracting officers compare subcontracting goals in contractor report submissions to goals in the approved subcontracting plan and address any discrepancies. (Recommendation 8)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's Chief Information Officer updates the telecommunications inventory to include all telecommunications assets and services in use at the agency, and updates NASA's process for ongoing maintenance of the inventory to include the complete inventory. (Recommendation 21)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. We will continue to follow-up on the agency's efforts to address it.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's Chief Information Officer completes efforts to identify the agency's future telecommunications needs using a complete inventory of existing telecommunications services. (Recommendation 22)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. We will continue to follow-up on the agency's efforts to address it.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's Chief Information Officer identifies telecommunications transition roles and responsibilities related to (1) managing human capital during the planning and execution phases of the transition and (2) providing legal expertise during the execution phase of the transition. (Recommendation 23)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. We will continue to follow-up on the agency's efforts to address it.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's Chief Information Officer conducts an analysis to support the anticipated cost savings identified as part of the agency's justification for its resource requests related to hardware and software upgrades for the telecommunications transition, and justifies its resource requests for transition program management staff; conducts an analysis to identify staff resources needed for the entire transition effort; and analyzes training needs for staff assisting with the transition. (Recommendation 24)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. We will continue to follow-up on the agency's efforts to address it.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's Chief Information Officer takes into account the agency's mission critical systems and contingency plans in NASA's telecommunications transition time line. (Recommendation 25)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. We will continue to follow-up on the agency's efforts to address it.

Recommendation: The Administrator of NASA should assess the feasibility of receiving and reviewing concerns of sex discrimination—including sexual harassment—and communicating to individuals on agency-funded grants the option to notify the agency of these concerns, outside of the Title IX complaint process. (Recommendation 9)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with the recommendation. According to the agency's February 2020 formal comment letter, NASA plans to assess the feasibility of receiving and reviewing concerns of sex discrimination and harassment and communicating to individuals on agency-funded grants the option to notify the agency of these concerns. In conducting the feasibility assessment, NASA will benchmark with agencies that currently have the capability to receive and review concerns of sex discrimination, including sexual harassment. NASA will also examine internal resources to ensure successful implementation. NASA estimates completion by September 20, 2020.

Recommendation: The Administrator of NASA should establish goals and an overall plan to assess all of the agency's sexual harassment prevention efforts for their university grantees, including methods to regularly monitor and evaluate its sexual harassment prevention policies and communication mechanisms (e.g. Title IX or sex discrimination websites). (Recommendation 14)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with the recommendation. According to the agency's February 2020 formal comment letter, NASA accepts its responsibility to establish policies and communication mechanisms to help university grantees to prevent sexual harassment, and the agency is committed to ongoing monitoring and evaluation of these efforts. At the same time, NASA judges that the most effective way to discharge these responsibilities is to adopt the approach now being developed by the National Science and Technology Council. NASA will establish goals, plans, and methods pursuant to this recommendation by adopting the policies and approaches developed through the interagency process. The estimated completion is to be determined based on timelines and milestones established by the Office of Science and Technology Policy's Safe and Inclusive Research Environments Subcommittee Subcommittee.

Recommendation: The Administrator of the National Aeronautics and Space Administration should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 8)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In comments on our report, the National Aeronautics and Space Administration (NASA) agreed with our recommendation and described actions that the agency planned to take to address the recommendation. NASA stated that it expected to complete these actions by March 31, 2020. Once we have obtained and assessed evidence of the agency's actions taken, we will update the status of this recommendation.

Recommendation: The Administrator of the National Aeronautics and Space Administration should establish a time frame to develop an inventory of electronic information systems used to store agency records that includes all of the required elements. (Recommendation 17)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration concurred with this recommendation. As of June 2020, we had not received information pertaining to planned actions for this recommendation. Once the agency states that it has taken action, we plan to verify whether implementation has occurred.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Advanced Exploration Systems division to define and determine a schedule for synchronization reviews, including the role of the proposed Lunar Exploration Control Board, to help ensure that requirements between mission and program levels are reconciled. (Recommendation 1)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that the Advanced Exploration Systems division will review program life-cycle review plans to ensure enterprise and program requirements are reconciled across the mission. NASA is in the process of determining the organizational structure of the Human Exploration and Operations Mission Directorate. Following this completion, NASA officials stated that the appropriate control board and division structures for review and program direction will become active.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Gateway program to conduct a joint cost and schedule confidence level at the program level for the Artemis III mission. (Recommendation 2)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated it would conduct a joint cost and schedule confidence level analysis or equivalent. The Gateway program is planning to conduct a series of project- and program-level reviews and assessments aligned with key decision point reviews. This includes conducting a joint cost and schedule confidence level analysis or equivalent of the Gateway initial configuration to support a program key decision point planned for fall 2021. NASA has not yet taken action on this recommendation.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Gateway program to update its overall schedule for 2024 to add a KDP II to occur before system integration. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation, but has not yet taken action on it. NASA stated that it would provide a schedule for future reviews, including whether there will be a Key Decision Point (KDP) II, at the KDP-I review currently scheduled for fall 2021.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations creates a life-cycle cost estimate for the Artemis III mission. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with the recommendation and stated that the agency will provide a preliminary cost estimate for the Artemis III mission by the end of 2020. Further, NASA stated that it will provide an updated cost estimate for the Artemis III mission after it establishes cost and schedule commitments for some of the projects that compose the lunar mission, currently planned for the Spring of 2021. To fully implement this recommendation, NASA will need to provide a cost estimate.

Recommendation: The NASA Administrator should ensure that the NASA Associate Administrator for Human Exploration and Operations directs the Advanced Exploration Systems division to commit to a completion date and finalize a cohesive document outlining the rationale for selecting its current lunar architecture and lunar programs. (Recommendation 5)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that it is developing a document that will summarize the trades and architectural studies, but the document is not yet complete.

Recommendation: The NASA Administrator should ensure that the Office of the Chief Engineer determines under what conditions it is appropriate to complete an analysis of alternatives, particularly when there are multiple pathways—including architectures or programs—that NASA could pursue in the future, and document the justification for not completing an analysis. (Recommendation 6)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation, but has not yet taken any action on it. NASA stated that it will provide additional clarifying guidance for conducting analyses of alternatives for new programs in the next update to NASA Procedural Requirements 7120.5E, "NASA Space Flight Program and Project Management Requirements." NASA plans to complete the update of the procedural requirement in September 2021.

Recommendation: The Administrator of the National Aeronautics and Space Administration (NASA) should update the agency's policies to require (1) an organization-wide risk assessment and (2) the use of risk assessments to inform POA&M prioritization. (Recommendation 46)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. As of January 2020, the agency stated that it is working to address gaps in its cybersecurity policy. Once NASA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: The Administrator of NASA should establish a process for conducting an organization-wide cybersecurity risk assessment. (Recommendation 47)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA concurred with this recommendation. As of January 2020, NASA stated that the agency is in the process of documenting its process for conducting an organization-wide cybersecurity risk assessment. NASA's planned completion date for this effort is September 30, 2020. Once NASA has provided evidence of these actions, we plan to verify whether implementation has occurred.

Recommendation: We recommend the NASA Administrator ensure that the NASA Associate Administrator for Human Exploration and Operations direct the SLS program to calculate its development cost growth using a baseline that is appropriately adjusted for scope and costs NASA has determined are not associated with the first flight, and determine if the development cost growth has increased by 30 percent or more. (Recommendation 1)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with this recommendation. As of February 2020, NASA stated that it is conducting a rebaseline of the cost and schedule commitments for the SLS program and will document final decisions in an Agency Baseline Commitment decision memorandum. NASA officials anticipate they will complete this effort in Spring 2020. To fully implement this recommendation, NASA will need to measure cost growth using a baseline that reflects the scope of work currently planned for the first mission.

Recommendation: We recommend the NASA Administrator ensure that the NASA Associate Administrator for Human Exploration and Operations direct the Orion program to update its cost estimate to reflect its committed EM-2 baseline date of April 2023. (Recommendation 2)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA partially agreed with this recommendation, stating that providing the estimate to the forecasted launch date rather than to the committed baseline date of April 2023 is the most appropriate approach. In November 2019, program officials told us that they will consider this recommendation as part of updating the joint confidence level analysis for the program's Key Decision Point D review. This review occurs before the program enters the system assembly, integration and test, and launch phase, and is not scheduled to occur until December 2020. To fully implement this recommendation, NASA needs to provide an updated cost estimate through April 2023.

Recommendation: We recommend the NASA Administrator ensure that the NASA Associate Administrator for Human Exploration and Operations direct the EGS program to demonstrate design maturity by completing 3D product modeling of the basic and functional design of the second Mobile Launcher prior to construction start. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with this recommendation and stated that the acquisition strategy for the second mobile launcher requires the use of 3D product modeling and that it will be the source for all engineering activities including integrated design reviews to demonstrate design maturity. It is too soon to assess the design maturity prior to construction start and we will provide updated information on actions NASA has taken at that time.

Recommendation: We recommend the NASA Administrator ensure that the NASA Associate Administrator for Human Exploration and Operations direct the SLS and Orion programs to reevaluate their strategies for incentivizing contractors and determine whether they could more effectively incentivize contractors to achieve the outcomes intended as part of ongoing and planned contract negotiations. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA agreed with the intent of this recommendation and stated that the SLS and Orion program offices reevaluate their strategies for incentivizing contract performance as part of normal contracting activities including contract restructures, contract baseline adjustments, and new contract actions. The Orion program has awarded a long term contract for production of the Orion spacecraft that incorporates new strategies intended to reduce contract costs. The SLS program is in the process of negotiating long term production contracts for required hardware.

Recommendation: The Administrator of the National Aeronautics and Space Administration should take action to meet the data center optimization metric targets established under DCOI by OMB. (Recommendation 28)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In comments on our report, the National Aeronautics and Space Administration (NASA) agreed with our recommendation and began taking action to implement it. After the Office of Management and Budget (OMB) released the updated Data Center Optimization Initiative policy in June 2019, the agency established new data center optimization targets. The agency subsequently reported meeting its targets for the virtualization, advanced energy metering, and server utilization metrics. However, given the short time to evaluate implementation efforts between when OMB released the updated policy in June 2019 and the end of fiscal year 2019, we will continue to monitor NASA's efforts to implement this recommendation through fiscal year 2020.

Recommendation: The Administrator of NASA should develop documented procedures for identifying and addressing alleged violations of its scientific integrity policy. (Recommendation 10)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA officials stated that the agency is undergoing additional internal and external reviews-with NASA officials working through the National Science and Technology Council's Joint Committee on Research Environments, which supports scientific security, rigor, and integrity-and that completion of the implementation of the recommendation is due October 31, 2020.

Recommendation: To complete the appropriate assignment of codes to their positions performing IT, cybersecurity, or cyber-related functions, in accordance with the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, the Administrator of the National Aeronautics and Space Administration should complete the identification and coding of vacant positions at NASA performing IT, cybersecurity, or cyber-related functions. (Recommendation 23)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration did not concur with the recommendation. As of January 2020, it had not yet provided sufficient evidence that it had implemented the recommendation. We will continue to monitor the situation.

Recommendation: To complete the appropriate assignment of codes to their positions performing IT, cybersecurity, or cyber-related functions, in accordance with the requirements of the Federal Cybersecurity Workforce Assessment Act of 2015, the Administrator of the National Aeronautics and Space Administration should take steps to review the assignment of the "000" code to any positions at NASA in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. (Recommendation 24)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation and stated that it would complete a review of the assignment of the "000" code to its positions in the 2210 IT management occupational series, assign the appropriate NICE framework work role codes, and assess the accuracy of position descriptions. In March 2020, NASA indicated that it expected to implement the recommendation by September 30, 2020. To fully implement this recommendation, NASA will need to provide evidence that it has assigned appropriate NICE framework work role codes to its positions in the 2210 IT management occupational series and assessed the accuracy of position descriptions.

Recommendation: The Administrator of the National Aeronautics and Space Administration should ensure that the agency's IT management policies address the role of the CIO for key responsibilities in the six areas we identified. (Recommendation 21)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with our recommendation and stated that the agency was updating its policies to address the responsibilities identified in the report. When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The NASA Associate Administrator for Human Exploration and Operations should direct the Commercial Crew Program to include the results of its schedule risk analysis in its mandatory quarterly reports to Congress. (Recommendation 1)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA did not concur with our recommendation that the Commercial Crew Program should include the results of its schedule analysis in its quarterly reports to Congress. In July 2019, NASA reaffirmed that it will be working to ensure that the contractors' schedules and the program's internal assessments sync up as the program gets closer to launch, which is the process it used in March 2019 leading up to SpaceX's uncrewed test flight. GAO continues to believe that the recommendation is valid because the program's schedule risk analysis would provide Congress with valuable insight into potential delays, which are likely.

Recommendation: The NASA Administrator should develop and maintain a contingency plan for ensuring a presence on the ISS until a Commercial Crew Program contractor is certified. (Recommendation 2)

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with this recommendation. NASA stated that it is in discussions with Russia to obtain additional seats on its Soyuz spacecraft for NASA crew as a contingency plan. NASA is also providing Extra-Vehicular Activity and robotics training for a subset of cosmonauts to support U.S. Operating Segment operations, and looking at a possible extension of the duration of the Space X Demonstration 2 crewed test flight. In November 2019, NASA reported that it completed its actions for this recommendation. However, while NASA is working on potential solutions, there is no contingency plan in place. To fully implement this recommendation, NASA needs to provide documentation of its contingency plan.

Recommendation: The NASA Administrator should direct the Chief of Safety and Mission Assurance, the NASA Associate Administrator for Human Exploration and Operations, the Commercial Crew Program Manager, and the Commercial Crew Program Contracting Officer to collectively determine and document before the agency certification review how the agency will determine its risk tolerance level with respect to loss of crew. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA partially concurred with our recommendation, stating it documented the agency's risk tolerance level with respect to loss of crew for the program in its May 2011 safety memo. NASA stated that ultimately the Commercial Crew Program is accountable for ensuring that the contractors' systems meet the loss of crew value of 1 in 270. In July 2019, the Commercial Crew Program noted that it will continue to determine its risk tolerance with respect to loss of crew and formally document its decisions at program management meetings. We continue to believe that, before agency certification, the key parties must collectively determine how the agency will determine its risk tolerance with response to loss of crew, as the risk tolerance for the loss of crew requirement depends on which entity is presenting the results of its analysis. We believe this approach will reduce confusion and increase transparency. In late September 2020, GAO received additional information from NASA on actions taken to implement this recommendation. We are currently assessing this information.

Recommendation: After completing the agency certification review, NASA's Chief Engineer and Chief of Safety and Mission Assurance, with support from the NASA Associate Administrator for Human Exploration and Operations and the Commercial Crew Program Manager, should document lessons learned related to loss of crew as a safety threshold for future crewed spaceflight missions, given the complexity of the metric. (Recommendation 4)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with our recommendation to document lessons learned related to the loss of crew requirement. In June 2020, NASA told us that they expect to take action to close this recommendation by the end of May 2021.

Recommendation: The Administrator of NASA should provide agency records of final opinions online. (Recommendation 14)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In August 2018, NASA agreed to provide agency records of final opinions online. NASA noted that final opinions will be provided online as they are issued and released for public posting. To date, the Department has not posted any final opinions.

Recommendation: The Administrator of the National Aeronautics and Space Administration should evaluate the level of preparedness for cybersecurity personnel not currently holding certifications to take certification exams and report this information to Congress. (Recommendation 16)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: National Aeronautics and Space Administration (NASA) did not concur with our recommendation and has not yet provided evidence that it has implemented the recommendation as of August 2020. We will continue to monitor the situation.

Recommendation: The Administrator should direct the Chief Information Officer to address, in conjunction with the Chief Human Capital Officer, gaps in IT workforce planning by fully implementing the eight key IT workforce planning activities noted in this report. (Recommendation 3)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA did not concur with this recommendation. As of October 2019, the agency reported that the Office of the Chief Information Officer was beginning its involvement with the agency's Mission Support Architecture Program which aims at re-aligning mission support functions from a decentralized model to an enterprise model. The office's participation in the re-alignment effort has an estimated completion date in fiscal year 2023.

Recommendation: The Administrator should direct the Chief Information Officer to address weaknesses in oversight practices and ensure routine oversight of all investments by taking action to document criteria for escalating investments among governance boards and establish procedures for tracking corrective actions for underperforming investments. (Recommendation 6)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. In July 2018, NASA reported that the agency intended to address this recommendation by documenting its approach for governing IT investments. In February 2020, NASA reported that the agency remained committed to taking action to address this recommendation and reported that the Office of the Chief Information Officer had established a process to govern IT investment funds and had planned additional modifications for that framework. The agency now expects to complete actions to address this recommendation by November 2020.

Recommendation: The Administrator should ensure that the Chief Information Officer fully defines policies and procedures for developing the portfolio criteria, creating the portfolio, and evaluating the portfolio. (Recommendation 7)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. In July 2018, NASA reported that it had begun updating policies and procedures for developing the portfolio criteria. In April 2019, NASA provided copies of its updated guidance. Among other things, the guidance described criteria for the portfolio and defined policies and procedures for creating the portfolio. As of April 2020, the agency had not yet provided evidence that it had developed policies and procedures for evaluating the portfolio. We plan to continue following up on the status of efforts to address this recommendation.

Recommendation: The Administrator should direct the Chief Information Officer to establish an agency-wide approach to managing cybersecurity risk that includes a cybersecurity strategy that, among other things, makes explicit the agency's risk tolerance, accepted risk assessment methodologies, a process for consistently evaluating risk across the organization, response strategies and approaches for monitoring risk over time, and priorities for risk management investments. (Recommendation 8)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. In July 2018, NASA reported that it had hired a Chief Cybersecurity Risk Officer in April 2018 and that it had also approved a charter for an agency-wide Cybersecurity Integration Team. As of September 2020, NASA reported that it intends to deliver a cybersecurity risk management strategy that addresses the elements outlined in this recommendation by 2021.

Recommendation: The Administrator should direct the Chief Information Officer to establish an agency-wide approach to managing cybersecurity risk that includes policies and procedures with well-defined roles and responsibilities that are integrated and reflect NASA's current security practices and operating environment. (Recommendation 10)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: NASA concurred with this recommendation. As of September 2020, NASA reported that the Chief Information Officer had initiated a review of the agency's cyber policy management framework and that any related updates were expected to be completed by 2021.

Recommendation: The Administrator of NASA should ensure that IT acquisition plans or strategies are reviewed and approved according to OMB's guidance. (Recommendation 32)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The agency concurred with the recommendation, and in September 2017, NASA's CIO delegated the review and approval authority of IT acquisitions to the Center CIOs. We have requested evidence of CIO-approved IT acquisitions. We will continue to monitor the implementation of this recommendation.

Recommendation: The Administrator of the National Aeronautics and Space Administration (NASA) should ensure that the CIO of NASA establishes an agency-wide policy and process for the CIO's certification of major IT investments' adequate use of incremental development, in accordance with OMB's guidance on the implementation of FITARA, and confirm that it includes: a description of the CIO's role in the certification process; a description of how CIO certification will be documented; and a definition of incremental development and time frames for delivering functionality, consistent with OMB guidance. (Recommendation 13)

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation and reported that the agency was in the process of addressing it. Specifically, NASA officials reported in June 2020 that its guidance is currently being updated to include the information noted in our recommendation and will be finalized by September 2020. We will continue to monitor NASA's progress on these efforts.

Recommendation: To ensure that the role of the SAISO is defined in agency policy in accordance with FISMA 2014, the Administrator of the National Aeronautics and Space Administration should define the SAISO's role in agency policy for oversight of security for information systems that are operated by contractors on the agency's behalf.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation. As of June 2020, NASA stated that the agency is working to update the relevant policy to address this recommendation, but the update is taking longer than expected; NASA expects the policy to be updated and the review process to be completed by November 30, 2020. We will examine the evidence when NASA provides it.

Recommendation: To provide the Congress and NASA a reliable estimate of program cost and schedule that are useful to support management and stakeholder decisions, the NASA Administrator should direct the Orion program to perform an updated JCL analysis including updating cost and schedule estimates in adherence with cost and schedule estimating best practices.

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA partially agreed with this recommendation, stating that the agency reviewed, in detail, the Orion integrated cost/schedule and risk analysis methodology and determined the rigor to be a sufficient basis for the agency commitments. In November 2019, Orion program officials told us that in response to a recent policy change, the program office will update its joint confidence level analysis when the program has its Key Decision Point D review. This review occurs before the program enters the system assembly integration and test, and launch phase and is not scheduled to occur until December 2020. To fully implement this recommendation, NASA will need to provide evidence that it updated its joint confidence level analysis when the Orion program holds its Key Decision Point D review.

Recommendation: To help the agency effectively manage spending on mobile devices and services, the Administrator of the National Aeronautics and Space Administration should ensure a complete inventory of mobile devices and associated services is established.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: As of January 2020, the National Aeronautics and Space Administration (NASA) had not implemented the recommendation. We reported in May 2015, that NASA had an inventory of mobile devices and associated service information which included most, but not all, of the devices used by the agency. In November 2019, NASA's Office of the Chief Information Officer (OCIO) stated that the agency was in the process of enrolling devices in a new mobile device management tool, and that when the approximately 15 percent of devices that are not currently on NASA's new End-User Services Technology contract are brought on the contract, NASA will have a monthly deliverable depicting the services of all mobile devices. We will continue to monitor NASA's implementation of this recommendation.

Recommendation: To help the agency effectively manage spending on mobile devices and services, the Administrator of the National Aeronautics and Space Administration should ensure a reliable inventory of mobile service contracts is developed and maintained.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: As of January 2020, the National Aeronautics and Space Administration (NASA) had not demonstrated that it has implemented the recommendation. NASA's Office of the Chief Information Officer (OCIO) stated that NASA had established, on September 1, 2019, the NASA End-User Services and Technology contract to procure mobile services, but as of November 2019, had not yet included 15 percent of its devices on the new contract. We will continue to monitor NASA's efforts to develop and maintain a mobile services contract inventory as described in our report.

Recommendation: To help the agency effectively manage spending on mobile devices and services, the Administrator of the National Aeronautics and Space Administration should ensure procedures to monitor and control spending are established agency-wide. Specifically, ensure that (1) procedures include assessing devices for zero, under, and over usage; (2) personnel with authority and responsibility for performing the procedures are identified; and (3) the specific steps to be taken to perform the process are documented.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: As of January 2020, the National Aeronautics and Space Administration (NASA) had not demonstrated that it had implemented the recommendation. In November 2019, NASA's Office of the Chief Information Officer (OCIO) stated that as part of enterprise mobility service contract deliverables, NASA requires monthly reports to monitor and optimize usage (zero, under, and over). NASA's OCIO also stated that the agency established role-based privileges to monitor and report on this activity agency-wide. However, the agency has not demonstrated that it has established procedures to assess device usage in accordance with our recommendation. We will continue to monitor NASA's implementation of the recommendation.

Recommendation: To provide the Congress with the necessary insight into program planning and affordability, and to decrease the risk of cost and schedule overruns, NASA's Administrator should direct the Human Exploration and Operations Mission Directorate to take the following action: To allow for a continued assessment of progress and affordability, NASA should structure each future increment of SLS capability with a total cost exceeding the $250 million threshold for designation as a major project as a separate development effort within the SLS program. In doing so, NASA should require each increment to complete both the technical and programmatic reviews required of other major development projects, per the agency's acquisition and system engineering policies.

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with this recommendation. In January 2020, NASA stated that it planned to establish an agency baseline commitment for capability upgrades (e.g., Block 1B upgrades, such as Mobile Launcher-2 and Exploration Upper Stage) above the $250 million threshold. A joint confidence level analysis will be performed at key decision points and will include the cost and schedule range estimates for each of these upgrades. To fully implement this recommendation, however, NASA needs to provide evidence that each capability upgrade is designated a major project and is required to complete the technical and programmatic reviews required of other major development projects.

Recommendation: To provide the Congress with the necessary insight into program planning and affordability, and to decrease the risk of cost and schedule overruns, NASA's Administrator should direct the Human Exploration and Operations Mission Directorate to take the following action: Provide decision makers with an informed basis for making investment decisions regarding the SLS program, NASA should identify a range of possible missions for each future SLS variant that includes cost and schedule estimates and plans for how those possible missions would fit within NASA's funding profile.

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA agreed with this recommendation. In January 2020, NASA stated that new leadership at the Human Exploration and Operations Mission Directorate is conducting an internal independent assessment to assess the current schedule and technical approach for achieving a lunar landing by 2024, including the utilization of SLS for Artemis missions. With the insights gained from this assessment, NASA will move forward with planning and executing these missions through the annual budgeting process. To fully address this recommendation, NASA will need to identify cost and schedule estimates for possible SLS missions beyond its first exploration mission, now known as Artemis I, and how its planned missions would fit within NASA's funding profile.

Recommendation: To provide the Congress with the necessary insight into program affordability, ensure its ability to effectively monitor total program costs and execution, and to facilitate investment decisions, the NASA's Administrator should direct the Human Exploration and Operations Mission Directorate to establish a separate cost and schedule baseline for work required to support the SLS Block I Exploration Mission-2 (EM-2) and report this information to the Congress through NASA's annual budget submission. If NASA decides to fly the SLS Block I beyond EM-2, establish separate life cycle cost and schedule baseline estimates for those efforts, to include funding for operations and sustainment, and report this information annually to Congress via the agency's budget submission.

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA partially agreed with this recommendation, stating that it defined and documented life-cycle costs for SLS to a first demonstrated capability, consistent with cost estimating best practices and NASA project and program management policy and that it would report costs associated with the second exploration mission via its annual budget submission. In January 2020, NASA stated that it is evaluating changes to NASA Procedural Requirements 7120.5E, "NASA Space Flight Program and Project Management Requirements," to better enable the necessary insight into program affordability and efficient monitoring of total program costs and execution for multi-year, multi-cadence type programs. Further, NASA stated that it is investigating plans to redefine performance expectations for multi-decade programs' formal commitments while maintaining visibility to the entire plan. To address this recommendation, NASA needs to establish separate cost and schedule baselines for work required to support SLS for EM-2, which is now known as Artemis II.

Recommendation: To provide the Congress with the necessary insight into program affordability, ensure its ability to effectively monitor total program costs and execution, and to facilitate investment decisions, because NASA intends to use the increased capabilities of the SLS, Orion, and Ground Systems Development and Operations efforts well into the future and has chosen to estimate costs associated with achieving the capabilities, the NASA's Administrator should direct the Human Exploration and Operations Mission Directorate to establish separate cost and schedule baselines for each additional capability that encompass all life cycle costs, to include operations and sustainment. When NASA cannot fully specify costs due to lack of well-defined missions or flight manifests, forecast a cost estimate range -- including life cycle costs -- having minimum and maximum boundaries. These baselines or ranges should be reported to Congress annually via the agency's budget submission.

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA partially agreed with this recommendation, stating that it had established separate programs for SLS, Orion, and the ground systems and adopted a block upgrade approach for SLS. In January 2020, NASA stated that it plans to establish an agency baseline commitment for capability upgrades (e.g., Block 1B upgrades, such as Mobile Launcher-2 and Exploration Upper Stage) above the $250 million threshold. A joint confidence level analysis will be performed at key decision points and will include the cost and schedule range estimates for each of these upgrades. To address this recommendation, NASA needs to provide evidence that it established separate cost and schedule baselines for each additional SLS, Orion, and Ground Systems Development and Operations capability blocks that encompass all life-cycle costs, including operations and sustainment.

Recommendation: To improve the agency's implementation of PortfolioStat, the Administrator of the National Aeronautics and Space Administration should direct the CIO to reflect 100 percent of information technology investments in the agency's enterprise architecture.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: In February 2018, NASA reported that it was making revisions to its enterprise architecture policy that would assist with ensuring that 100 percent of the agency's information technology investments are in the enterprise architecture. In July and December 2018, the agency provided updates on its efforts along with supporting documentation, though not enough to fully address the recommendation. In July 2019, the agency stated it also had efforts underway to centralize IT governance under the Chief Information Officer and this would contribute to reflect all investments in the enterprise architecture. The agency stated it would continue to update us on the status of its efforts to address the recommendation.

Recommendation: To improve NASA management and oversight of its spaceflight projects, and to improve the reliability of project EVM data, the NASA Administrator should direct the appropriate offices to modify the NASA Procedural Requirements (NPR) 7120.5 to require projects to implement a formal surveillance program that: (1) Ensures anomalies in contractor-delivered and in-house monthly earned value management reports are identified and explained, and report periodically to the center and mission directorate's leadership on relevant trends in the number of unexplained anomalies. (2) Ensures consistent use of work breakdown structures (WBS) for both the EVM report and the schedule. (3) Ensures that lower level EVM data reconcile to project level EVM data using the same WBS structure. (4) Improves underlying schedules so that they are properly sequenced using predecessor and successor dependencies and are free of constraints to the extent practicable so that the EVM baseline is reliable.

Agency: National Aeronautics and Space Administration
Status: Open
Priority recommendation

Comments: NASA partially agreed with this recommendation, stating that the reliability and utility of the EVM data needed to be improved but that it did not plan to implement a formal surveillance plan due to resource constraints. Since initially commenting on the report, however, in December 2018, NASA included an initiative in its Corrective Action Plan-a plan put in place in response to recent programmatic performance and NASA's designation on GAO's High-Risk List-to enhance EVM implementation. In June 2019, NASA issued EVM guidance that covered several items, including enhancing in-house and contracted earned value management surveillance and requiring EVM reporting at Baseline Performance Review. NASA officials reported that its near-term plans are well-defined to address the reliability of project EVM data, but they have expressed concerns about funding challenges and cultural resistance. To fully implement this recommendation, NASA will need to take action and provide documentary support for several of its identified planned next steps to enhance EVM surveillance. Without implementing proper surveillance, NASA may be utilizing unreliable EVM data in its analyses to inform its cost and schedule decision making.

Recommendation: To enhance federal agencies' ability to realize enterprise architecture benefits, the Secretaries of the Departments of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Homeland Security, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, and Small Business Administration; the Commissioners of the Nuclear Regulatory Commission and Social Security Administration; and the Directors of the National Science Foundation and the Office of Personnel Management should fully establish an approach for measuring enterprise architecture outcomes, including a documented method (i.e., steps to be followed) and metrics that are measurable, meaningful, repeatable, consistent, actionable, and aligned with the agency's enterprise architecture's strategic goals and intended purpose.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) has not yet implemented this recommendation. In July 2019, NASA's Associate Chief Information Officer for Enterprise Service and Integration said the agency was in the process of developing an enterprise architecture policy directive and procedural requirements. He anticipated that they would be completed in October 2020.

Recommendation: To enhance federal agencies' ability to realize enterprise architecture benefits, the Secretaries of the Departments of Agriculture, the Air Force, the Army, Commerce, Defense, Education, Energy, Homeland Security, the Interior, Labor, the Navy, State, Transportation, the Treasury, and Veterans Affairs; the Attorney General; the Administrators of the Environmental Protection Agency, General Services Administration, National Aeronautics and Space Administration, and Small Business Administration; the Commissioners of the Nuclear Regulatory Commission and Social Security Administration; and the Directors of the National Science Foundation and the Office of Personnel Management should periodically measure and report enterprise architecture outcomes and benefits to top agency officials (i.e., executives with authority to commit resources or make changes to the program) and to OMB.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) has not implemented this recommendation. In July 2019, NASA's Associate Chief Information Officer for Enterprise Service and Integration said the agency was in the process of developing an enterprise architecture policy directive and procedural requirements. He anticipated that they would be completed in October 2020.