Recommendation: To help foster strategic decision making and improvements in the acquisition of services, the Under Secretary of Defense for Acquisition, Technology, and Logistics should, as part of its effort to update the January 2016 instruction, reassess the roles, responsibilities, authorities, and organizational placement of key leadership positions, including functional domain experts, senior services managers, and component level leads.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open
Priority recommendation

Comments: DOD concurred with the recommendation. In July 2018, DOD officials told us that they planned to fully implement this recommendation in the revised instruction once it was issued. In January 2020, DOD issued an updated instruction that, among other things, revised elements of the management structure. We plan to begin work later in 2020 that will assess whether the changes reflected in the January 2020 instruction address the issues we identified.

Recommendation: To help foster strategic decision making and improvements in the acquisition of services, the Under Secretary of Defense for Acquisition, Technology, and Logistics should, as part of its effort to update the January 2016 instruction, clarify the purpose and timing of the Services Requirements Review Board process to better align it with DOD's programming and budgeting processes.

Agency: Department of Defense: Office of the Secretary of Defense: Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics
Status: Open
Priority recommendation

Comments: DOD concurred with the recommendation. In July 2018, DOD officials told us that they planned to fully implement this recommendation in the revised instruction once it was issued. In January 2020, DOD issued an updated instruction that, among other things, revised elements of the Services Requirements Review Board process. We plan to begin work later in 2020 that will assess whether the changes reflected in the January 2020 instruction address the issues we identified.

Recommendation: In order to ensure that contracting officers have clear and effective policies as soon as possible, the Secretary of Veterans Affairs should direct the OAL to identify measures to expedite the revision of the Veterans Affairs Acquisition Regulation (VAAR), which has been ongoing for many years, and the issuance of the VA Acquisition Manual.

Agency: Department of Veterans Affairs
Status: Open
Priority recommendation

Comments: VA concurred with this recommendation and has made progress in finalizing the update to its acquisition regulations and manual. In August 2020, VA reported that 31 of the 41 parts in its new acquisition regulations had been issued as draft or final rules. The remainder are at an earlier stage of the rulemaking process. VA also stated that it remains on track to release the final VA Acquisition Regulations in April 2021.

Recommendation: To improve DOD's use of portfolio management for its weapon system investments and ensure that its investment plans are affordable, strategy-driven, balance near- and long-term needs, and leverage efforts across the military services, as well as to provide a solid foundation for future portfolio management efforts at the enterprise-level, the Secretary of Defense should revise DOD Directive 7045.2 on Capability Portfolio Management in accordance with best practices and promote the development of better tools to enable more integrated portfolio reviews and analyses of weapon system investments. Key elements of this recommendation would include (1) designating the Deputy Secretary of Defense or some appropriate delegate responsibility for implementing the policy and overseeing portfolio management in DOD; (2) requiring annual enterprise-level portfolio reviews that incorporate key portfolio review elements, including information from the requirements, acquisition, and budget processes; (3) directing the Joint Staff, AT&L, and CAPE to collaborate on their data needs and develop a formal implementation plan for meeting those needs either by building on the database the Joint Staff is developing for its analysis or investing in new analytical tools; and (4) incorporating lessons learned from military service portfolio reviews and portfolio management activities, such as using multiple risk and funding scenarios to assess needs and re-evaluate priorities.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation. DOD agreed with the need to further develop portfolio management tools, ensure access to authoritative data, and incorporate lessons learned by others performing portfolio management. However, DOD stated that other aspects of our recommendation were redundant to, and would conflict with other processes and activities in place to perform portfolio management. As of January 2020, DOD has taken steps to implement parts of this recommendation. In January 2019, responsibility for DOD Directive 7045.20 was transferred to the Office of the Under Secretary of Defense for Acquisition and Sustainment from the Office of the Under Secretary of Defense for Policy, which sponsored the directive when it was issued. This office began revising DOD Directive 7045.2 in summer 2019, and plans to update the directive by the end of fiscal year 2020. In addition, in October 2016 and September 2017, the Joint Staff informed GAO that they had been updating two of their databases on military capabilities and capability requirements to provide DOD with better analytical tools to support portfolio management. They also reported that they completed a crosscutting study in collaboration with the acquisition community to improve the information sharing and analytical tools for their capability requirements database. In July 2020, the Joint Staff completed an update one of these databases. Joint Staff officials said they anticipated the database update would increase speed and provide a better search engine to help the Joint Staff more effectively conduct portfolio reviews, assess potential redundancy, and collect and analyze the information needed prioritize capabilities across DOD. However, a Joint Staff official stated that it is too soon to tell if the Joint Staff has experienced any improvements with regard to portfolio management as a result of the update. DOD has not taken action on the other aspects of this recommendation.

Recommendation: To improve DOD's use of portfolio management for its weapon system investments and ensure that its investment plans are affordable, strategy-driven, balance near- and long-term needs, and leverage efforts across the military services, and to help ensure the military services' portfolio reviews are conducted regularly and effectively integrate information from the requirements, acquisition, and budget communities, the Secretary of Defense should direct the Secretaries of the Army, Navy, and Air Force to update or develop policies that require them to conduct annual portfolio reviews that incorporate key portfolio review elements, including information from the requirements, acquisition, and budget processes.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation. However, DOD did not indicate that it would take any action to address it. Instead, DOD responded that the services' budget processes and Office of the Secretary of Defense's review of the services' budgets meet the intent of our recommendation. Our report findings showed otherwise. As of July 2020, DOD has not taken any actions to implement this recommendation, but an ongoing update of the department's portfolio management guidance (DOD Directive 7045.20) could lead to further actions on this recommendation.

Recommendation: To improve DOD's ability to collect and maintain reliable data on its acquisitions, the Secretary of Defense should direct the Under Secretary of Defense for Acquisition, Technology, and Logistics, in consultation with DOD components, to establish guidelines on what constitutes a "current" ACAT II or III program for reporting purposes; the types of programs, if any, that do not require ACAT designations; and whether the rules for identifying current MDAPs would be appropriate for ACAT II and III programs.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation and stated that it planned to review existing policy to see if revisions were needed. Since that time, DOD has taken some steps to implement this recommendation, but has not established department-wide guidelines as we recommended. Starting in September 2018, DOD began providing the military departments with a capability to identify ACAT II and III programs using the Defense Acquisition Visibility Environment (DAVE) system. The DAVE system is now considered to be a trusted source for ACAT II and III program data. DOD, in consultation with the military departments, established standard data elements for collection across ACAT II and III programs for inclusion in DAVE, but the military departments determine individually what constitutes a "current" program and the types of programs that do not require ACAT designations. As of August 2019, the Army and Navy have established guidance regarding what constitutes an active ACAT II or III program for reporting purposes. We have requested an update on DOD's recent actions to address this recommendation, but have not received information as of September 2020. We will continue to monitor DOD's progress in implementing this recommendation.

Recommendation: To improve DOD's ability to collect and maintain reliable data on its acquisitions, the Secretary of Defense should direct the Under Secretary of Defense for Acquisition, Technology, and Logistics, in consultation with DOD components, to determine what metrics should be used and what data should be collected on ACAT II and III programs to measure cost and schedule performance; and whether the use of DAMIR and the MDAP selected acquisition report format may be appropriate for collecting data on ACAT II and III programs.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation and stated that it planned to review existing policy to see if revisions were needed. DOD has taken steps to implement this recommendation, but has yet to determine at the department level what metrics should be collected on ACAT II and III cost and schedule performance as we recommended. DOD determined that the use of the Defense Acquisition Visibility Environment (DAVE) system, which is closely related to DAMIR, was appropriate to collect information on ACAT II and III programs and has made that system available to the military departments. Specifically, DOD provided the military departments with the capability to identify ACAT II and III programs in DAVE/DAMIR in September 2018 and made the DAVE/DAMIR Acquisition Program Baseline (APB) workflow tool for cost and schedule data collection available for components' use in April 2019. However, according to officials from the Office of the Under Secretary of Defense for Acquisition and Sustainment, the military departments are responsible for individually determining what cost and schedule metrics to collect and monitor for ACAT II and III programs. According to December 2018 Army guidance, the Army will require all ACAT II and III programs use DOD's APB tool by the end of fiscal year 2019 to capture baseline cost, schedule, and performance parameters for ACAT II and III programs. According to Navy officials, the Navy is developing an APB tool in its for a future update of its acquisition information system that will collect APB cost and schedule information for ACAT II and III programs. We have requested an update on DOD's recent actions to address this recommendation, but have not received information as of September 2020. We will continue to monitor DOD's progress in implementing this recommendation.

Recommendation: To improve DOD's ability to collect and maintain reliable data on its acquisitions, the Secretary of Defense should direct the Secretaries of the Air Force, Army, and Navy and the Commander of SOCOM to assess the reliability of data collected on ACAT II and III programs and work with PEOs to develop a strategy to improve procedures for the entry and maintenance of data.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation and stated that it would direct DOD components to evaluate data on ACAT II and III programs and report back on the reliability of the data and plans to improve it. In September 2015, the Assistant Secretary of Defense directed the military departments and DOD components to assess the reliability of ACAT II and III data, but in July 2018, the Office of the Under Secretary of Defense for Acquisition & Sustainment confirmed that based on the results of the assessments reported by the components, it does not plan to take any additional action to implement this recommendation. Since that time, as of September 2018, DOD began providing standard data elements and definitions of those elements that it collects for ACAT II and III program identification in order to improve the consistency of data. However, officials from the Office of the Under Secretary of Defense for Acquisition and Sustainment stated that it is still up to the military departments to ensure the accuracy of data entered. We have requested an update on DOD's recent actions to address this recommendation, but have not received information as of September 2020. We will continue to monitor DOD's progress in implementing this recommendation.

Recommendation: To improve DOD's ability to collect and maintain reliable data on its acquisitions, the Secretary of Defense should direct the Secretaries of the Air Force, Army, and Navy and the Commander of SOCOM to develop implementation plans to coordinate and execute component initiatives to improve data on ACAT II and III programs.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation and stated that it would direct DOD components to evaluate data on ACAT II and III programs and report back plans to improve it. In September 2015, the Office of the Assistant Secretary of Defense for Acquisition requested that DOD components provide an update on their plans to improve the availability and quality of ACAT II and III data. In July 2018, the Office of the Under Secretary of Defense for Acquisition & Sustainment confirmed that based on an assessment of the information reported by the components, it does not plan to take any additional action to implement this recommendation. Officials from the Office of the Under Secretary of Defense for Acquisition & Sustainment reiterated in August 2019 that while DOD now provides a department-wide system to be used for collecting basic program data for ACAT II and III programs, it remains the responsibility of the military departments to enter complete and accurate data. We have requested an update on DOD's recent actions to address this recommendation, but have not received information as of September 2020. We will continue to monitor DOD's progress in implementing this recommendation.

Recommendation: To help ensure compliance with relevant provisions of DOD acquisition policy with the purpose of improving DOD's ability to provide oversight for ACAT II and III programs, including those programs that may become MDAPs, the Secretary of Defense should direct the Secretary of the Air Force and Commander of SOCOM to establish a mechanism to ensure compliance with APB requirements in DOD policy.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation and stated that the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics would issue guidance to DOD components related to APB requirements for ACAT II and III programs. DOD has taken some steps related to this recommendation. In September 2015, the Office of the Assistant Secretary of Defense for Acquisition requested that DOD components review their mechanisms for establishing and enforcing the APB requirements for all ACAT II and III programs. In July 2018, the Office of the Under Secretary of Defense for Acquisition & Sustainment confirmed that, based on the results of these reviews, it does not plans to take any action to implement this recommendation. However, in 2019, DOD made its DAVE/DAMIR APB workflow tool available for military department use, and the Air Force elected to use the tool to create and track APBs for ACAT II and III programs. We have requested an update on DOD's recent actions to address this recommendation, but have not received information as of September 2020. We will continue to monitor DOD's progress in implementing this recommendation.

Recommendation: To help ensure compliance with relevant provisions of DOD acquisition policy with the purpose of improving DOD's ability to provide oversight for ACAT II and III programs, including those programs that may become MDAPs, the Secretary of Defense should direct the Secretaries of the Air Force, Army, and Navy to improve component procedures for notifying the Defense Acquisition Executive of programs with a cost estimate within 10 percent of ACAT I cost thresholds.

Agency: Department of Defense
Status: Open

Comments: DOD partially concurred with our recommendation and stated that the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics would issue guidance to DOD components related to notification requirements for programs approaching ACAT I cost thresholds. The Army and Navy have reiterated existing guidance and the Air Force is evaluating additional actions it might take to improve its notification procedures. The Office of the Under Secretary of Defense for Acquisition & Sustainment confirmed in July 2018 that it does not plan to take additional actions to implement this recommendation, and as of August 2019, that office has not directed DOD components to improve their processes as we recommended .We have requested an update on DOD's recent actions to address this recommendation, but have not received information as of September 2020. We will continue to monitor DOD's progress in implementing this recommendation.

Recommendation: In order to improve transparency and allow for more informed decision making by congressional leaders and DHS and GSA decision-makers, before requesting additional funding for the DHS headquarters consolidation project, the Secretary of Homeland Security and the Administrator of the General Services Administration should work jointly to conduct the following assessments and use the results to inform updated DHS headquarters consolidation plans: (1) a comprehensive needs assessment and gap analysis of current and needed capabilities that take into consideration changing conditions, and (2) an alternatives analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the project and prioritizes options to account for funding instability.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150) was enacted on April 29, 2016. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS headquarters consolidation efforts not later than 120 days of enactment. As of April 2020, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes a comprehensive assessment of property and facilities utilized by DHS in the National Capital Region, and an analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the consolidation project. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. GAO will review the latest information on DHS headquarters consolidation efforts when it is provided to Congress, and will assess the materials in the context of this recommendation at that time. Continued DHS and GSA attention to following leading capital planning practices is critical given the project's multi-billion dollar cost and impact on future departmental operations.

Recommendation: In order to improve transparency and allow for more informed decision making by congressional leaders and DHS and GSA decision-makers, before requesting additional funding for the DHS headquarters consolidation project, the Secretary of Homeland Security and the Administrator of the General Services Administration should work jointly to conduct the following assessments and use the results to inform updated DHS headquarters consolidation plans: (1) a comprehensive needs assessment and gap analysis of current and needed capabilities that take into consideration changing conditions, and (2) an alternatives analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the project and prioritizes options to account for funding instability.

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150), enacted on April 29, 2016, mirrors GAO recommendations in this area. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS's headquarters consolidation efforts not later than 120 days of enactment. As of April 2020, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes a comprehensive assessment of property and facilities utilized by DHS in the National Capital Region, and an analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the consolidation project. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. We will review the latest information on DHS's headquarters consolidation efforts when it is provided to Congress, and will assess the materials in the context of these recommendations at that time. Continued DHS and GSA attention to following leading practices for capital planning and cost and schedule estimation is critical given the project's multi-billion dollar cost and impact on future departmental operations.

Recommendation: In order to improve transparency and allow for more informed decision making by congressional leaders and DHS and GSA decision-makers, before requesting additional funding for the DHS headquarters consolidation project, after revising the DHS headquarters consolidation plans, the Secretary of Homeland Security and the Administrator of the General Services Administration should work jointly to develop revised cost and schedule estimates for the remaining portions of the consolidation project that conform to GSA guidance and leading practices for cost and schedule estimation, including an independent evaluation of the estimates.

Agency: Department of Homeland Security
Status: Open
Priority recommendation

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150) was enacted on April 29, 2016. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS headquarters consolidation efforts not later than 120 days of enactment. As of April 2020, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes updated cost and schedule estimates for the consolidation project that are consistent with GAO's recommendations in GAO-14-648. Furthermore, the act requires the Comptroller General to evaluate the cost and schedule estimates not later than 90 days after their submittal to Congress. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. GAO will review the latest DHS headquarters consolidation cost and schedule estimates when they are provided to Congress, and will assess the materials in the context of this recommendation at that time. Continued DHS and GSA attention to following leading cost and schedule estimation practices is critical given the project's multi-billion dollar cost and impact on future departmental operations.

Recommendation: In order to improve transparency and allow for more informed decision making by congressional leaders and DHS and GSA decision-makers, before requesting additional funding for the DHS headquarters consolidation project, after revising the DHS headquarters consolidation plans, the Secretary of Homeland Security and the Administrator of the General Services Administration should work jointly to develop revised cost and schedule estimates for the remaining portions of the consolidation project that conform to GSA guidance and leading practices for cost and schedule estimation, including an independent evaluation of the estimates.

Agency: General Services Administration
Status: Open
Priority recommendation

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150) was enacted on April 29, 2016. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS headquarters consolidation efforts not later than 120 days of enactment. As of April 2020, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes updated cost and schedule estimates for the consolidation project that are consistent with GAO's recommendations in GAO-14-648. Furthermore, the act requires the Comptroller General to evaluate the cost and schedule estimates not later than 90 days after their submittal to Congress. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. GAO will review the latest DHS headquarters consolidation cost and schedule estimates when they are provided to Congress, and will assess the materials in the context of this recommendation at that time. Continued DHS and GSA attention to following leading cost and schedule estimation practices is critical given the project's multi-billion dollar cost and impact on future departmental operations.

Recommendation: Congress should consider making future funding for the St. Elizabeths project contingent upon DHS and GSA developing a revised headquarters consolidation plan, for the remainder of the project, that conforms with leading practices and that (1) recognizes changes in workplace standards, (2) identifies which components are to be colocated at St. Elizabeths and in leased and owned space throughout the National Capital Region, and (3) develops and provides reliable cost and schedule estimates.

Agency: Congress
Status: Open

Comments: The Department of Homeland Security Headquarters Consolidation Accountability Act of 2015 (Pub. L. No. 114-150) was enacted on April 29, 2016. Among other things, the act requires DHS, in coordination with GSA, to submit information to Congress about DHS headquarters consolidation efforts not later than 120 days of enactment. As of March 2019, DHS and GSA had not submitted the information to Congress required by Pub. L. No. 114-150. Required information includes: a comprehensive assessment of property and facilities utilized by DHS in the National Capital Region; an analysis that identifies the costs and benefits of leasing and construction alternatives for the remainder of the consolidation project; and updated cost and schedule estimates for the project that are consistent with GAO's recommendations in GAO-14-648. Furthermore, the act requires the Comptroller General to evaluate the cost and schedule estimates not later than 90 days after their submittal to Congress. DHS reported that DHS and GSA prepared a comprehensive response to P.L. No. 114-150, but that the consolidation plan and response needed to be revised based on changing budget circumstances, among other things. In April 2020, DHS estimated that the final consolidation plan will be completed and approved in 2020. A comprehensive report to Congress on DHS headquarters consolidation, along with reliable project cost and schedule estimates, could inform Congress's funding decisions.

Recommendation: To improve the acquisition management of the Plan and the reliability of its cost estimates and schedules, assess the effectiveness of deployed technologies, and better inform CBP's deployment decisions, once data on asset assists are required to be recorded and tracked, the Commissioner of CBP should analyze available data on apprehensions and seizures and technological assists, in combination with other relevant performance metrics or indicators, as appropriate, to determine the contribution of surveillance technologies to CBP's border security efforts.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open
Priority recommendation

Comments: In 2014, CBP expanded its Arizona Border Surveillance Technology Plan to the Southwest Border Technology Plan. In February 2015, the Border Patrol took steps to address this recommendation by developing the Capability Gap Analysis Process (CGAP) with the support of Johns Hopkins University's Applied Physics Lab to examine the effects of technology and other assets. In May 2017, Border Patrol officials demonstrated a new system, intended to allow for more comprehensive analysis of the contributions of surveillance technologies to Border Patrol's mission during the CGAP process. As of March 2019, Border Patrol is now able to generate a performance report, using data collected from multiple systems, on how surveillance technologies have assisted agents during operations, including Border Patrol apprehensions. In February 2020 Border Patrol officials stated the data gathered in the report were reliable. They also provided examples of how they use available performance data to help identify gaps in capabilities and inform future investments in surveillance technologies. Border Patrol officials are also developing a surveillance capability score intended to represent the combined contributions of individual technology assets and agents on patrol to conduct surveillance in a given area. Border Patrol plans to report this score in fiscal year 2021, according to documentation provided by Border Patrol. We view these efforts, as described, as important progress toward fulfilling our recommendation, and will review the planned surveillance capability score once it is implemented to determine whether Border Patrol has fully implemented our recommendation.

Recommendation: In order to improve NMB's planning and make the most effective use of its limited resources, the Chairman of the National Mediation Board should develop and fully implement key components of an information security program in accordance with the Federal Information Security Management Act of 2002.

Agency: National Mediation Board
Status: Open

Comments: In February 2020, we determined that NMB had taken some steps to further implement key information security practices, but had not fully implemented this recommendation. We reported in GAO-20-236 that NMB continued to only partially follow the eight key information security practices in accordance with the Federal Information Security Management Act (FISMA). NMB must take other steps, such as providing risk assessment documentation of its enterprise network for fiscal year 2019. NMB officials stated that the agency plans to address several of these practices by the end of fiscal year 2020. They further noted that they hired a Chief Information Officer and planned to hire additional staff and employ contractors to aid in these efforts.

Recommendation: In order to improve NMB's planning and make the most effective use of its limited resources, the Chairman of the National Mediation Board should establish a privacy program that includes conducting privacy impact assessments and issuing system of record notices for systems that contain personally identifiable information.

Agency: National Mediation Board
Status: Open

Comments: In February 2020, we reported in GAO-20-236 that NMB had taken some steps to implement information privacy practices, such as designating a privacy officer. However, NMB must take additional steps, such as specifying whether a system of records notice would be developed, as required by the Office of Management and Budget.