Recommendation: The Director of BLM should identify the reasons internal control reviews were not completed (e.g., human capital and workforce), develop and implement a plan to address those reasons, and monitor state offices' progress toward completing required reviews. (Recommendation 1)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: In July 2019, BLM's Assistant Secretary for Land and Minerals Management wrote a letter to GAO stating that the bureau agreed that there are additional opportunities to improve the Inspection and Enforcement program's internal control reviews and that policies should be updated and widely circulated. Specifically, BLM wrote that by early August 2020, the bureau will issue updated guidance and procedures for conducting internal control reviews and that this guidance would take the form of a manual, handbook or Instruction Memorandum. BLM also wrote that it is establishing teams to conduct internal control reviews, monitoring the status of any past-due reviews and actively engaging across its multiple state offices to ensure timely resolution. In late August 2020, BLM's Audit Liaison Officer informed GAO that due to competing workload priorities and key management vacancies, BLM now plans to implement this recommendation by the end of June 2021.

Recommendation: The Director of BLM should develop and document procedures for implementing internal control reviews under the July 2012 oversight policy. (Recommendation 2)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: In responding to our report, BLM stated that its July 2012 oversight policy, which expired in September 2013, should not have been allowed to lapse and given the importance of internal control reviews, the bureau will continue to use the July 2012 policy to conduct future reviews. In July 2019, BLM's Assistant Secretary for Land and Minerals Management wrote a letter to GAO stating that the bureau agreed that there are additional opportunities to improve the Inspection and Enforcement program's internal control reviews and that policies should be updated and widely circulated. In addition, BLM wrote that by early August 2020, the bureau will issue updated guidance and procedures for conducting internal control reviews and that this guidance would take the form of a manual, handbook, or Instruction Memorandum. In late August 2020. BLM's Audit Liaison Officer informed GAO that due to competing workload priorities and key management vacancies, BLM now plans to implement this recommendation by the end of June 2021.

Recommendation: The Director of BLM should implement a risk-informed approach to scheduling and conducting internal control reviews that takes into account the risks to BLM's mission, such as those inherent in field offices' workload and workforce. (Recommendation 3)

Agency: Department of the Interior: Bureau of Land Management
Status: Open

Comments: In July 2019, BLM's Assistant Secretary for Land and Minerals Management wrote a letter to GAO stating that the bureau agreed that there are additional opportunities to improve the Inspection and Enforcement program's internal control reviews and that policies should be updated and widely circulated. Specifically, BLM wrote that by early August 2020, the bureau will issue updated guidance and procedures for conducting internal control reviews and that this guidance would take the form of a manual, handbook, or Instruction Memorandum. In addition, BLM noted that the guidance will help ensure that the bureau completes internal control reviews in a timely manner using a consistent risk-based approach. In late August 2020. BLM's Audit Liaison Officer informed GAO that due to competing workload priorities and key management vacancies, BLM now plans to implement this recommendation by the end of June 2021.

Recommendation: The Director of OMB should continue to identify and report to Congress on the status of the top 10 high priority information technology programs and the extent to which USDS is involved in the programs, as was done in June 2015 and June 2016. In doing so, the Director should ensure that these reports are issued quarterly. (Recommendation 1)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: We have been requesting periodic updates from OMB on actions it has taken to address the recommendation. As of April 2020, the agency did not have any updates.

Recommendation: The Director of OMB should ensure that the Federal CIO is directly involved in the oversight of high priority programs. (Recommendation 2)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open
Priority recommendation

Comments: OMB has not taken actions to address this recommendation, stating that the Federal CIO is not typically involved with overseeing individual IT programs. However, we continue to believe it is important for OMB to take this action, as the results of past CIO-led reviews of troubled programs show that CIO oversight can have significant positive results, including producing significant savings. In December 2019, OMB stated that it had no ongoing or planned action to address the recommendation, noting that the recommendation represents a "fundamental disagreement" between OMB and GAO on the role of the Federal CIO in overseeing programs.

Recommendation: The Director of OMB should continue to report on the status of USDS projects. In doing so, the Director should ensure that the reports are issued quarterly. (Recommendation 3)

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: We have been requesting periodic updates from OMB on actions it has taken to address the recommendation. As of April 2020, the agency did not have any updates.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Commissioner of U.S. Customs and Border Protection, with regard to the updated Security Policy and Procedures Handbook, should include data collection and analysis requirements for monitoring the performance of CBP's physical security program.

Agency: Department of Homeland Security: United States Customs and Border Protection
Status: Open

Comments: The U.S. Customs and Border Protection issued an updated Physical Security Policy and Procedures Handbook in January 2020, which includes a series of internal controls and physical security performance measures. We have reviewed the handbook and requested additional information from CBP to determine whether it meets ISC's Risk Management Process for Federal Facilities.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Secretary of Transportation should direct the FAA Administrator to develop a plan that provides sufficient details on the activities needed and time frames within the date when FAA will implement an improved methodology.

Agency: Department of Transportation
Status: Open

Comments: The Federal Aviation Administration (FAA) has developed, initially tested, and deployed a risk assessment methodology that aligns with the Interagency Security Committee Risk Management Process for Federal Facilities. In August and September of 2019, FAA trained some staff on the new methodology, which is being integrated into the facility security reporting system. After resolving any software compatibility issues, completing all necessary testing and training, and issuing the associated security policy, FAA expects to fully implement the methodology by December 31, 2020.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Secretary of Transportation should direct the FAA Administrator to update FAA's policy to require the use of a methodology that fully aligns with the ISC's Risk Management Process for Federal Facilities for assessing all undesirable events, considering all three factors of risk, and documenting all deviations from the standard countermeasures.

Agency: Department of Transportation
Status: Open

Comments: The Federal Aviation Administration (FAA) drafted an updated facility security policy and distributed it for comment in October 2019. It received over 300 comments that are currently being addressed. Once completed, the policy is to incorporate a methodology that fully aligns with the Interagency Security Committee Risk Management Process for Federal Facilities for assessing all undesirable events, considering all three factors of risk, and documenting all deviations from the standard countermeasures. FAA plans to publish the new policy to coincide with the implementation of its risk-assessment methodology by December 31, 2020.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Secretary of Transportation should direct the FAA Administrator to update FAA's policy to include ongoing monitoring of physical security information.

Agency: Department of Transportation
Status: Open

Comments: The Federal Aviation Administration's (FAA) update of its facility security policy and its associated databases should help to improve the monitoring and use of physical security information to better assist with risk assessment decision-making. In February 2020, FAA officials said that its facility security reporting system is to be improved with new metrics and executive level reporting. Such improvements are to result in increased program oversight, risk awareness, and mitigation planning. These improvements are to be completed by December 31, 2020 to coincide with full implementation of the components of the risk management framework, such as the risk assessment methodology, personnel training, and policy publication.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Secretary of Agriculture should include data collection and analysis requirements for monitoring the performance of agencies' physical security programs, in the department's revised physical-security manual.

Agency: Department of Agriculture
Status: Open

Comments: The U.S. Department of Agriculture is drafting a revised physical-security regulation and manual that is to align with risk management processes, including a tracking and monitoring component. It expects to implement a revised process by the end of 2020.

Recommendation: To improve agencies' physical security programs' alignment with the ISC Risk Management Process for Federal Facilities and Standards for Internal Control in the Federal Government for information and monitoring, the Secretary of Agriculture should direct the Administrator of the Agricultural Research Service and the Chief of the Forest Service to implement and monitor a long-term assessment schedule with key milestones to ensure that higher-level facilities are reassessed at least once every 3 years.

Agency: Department of Agriculture
Status: Open

Comments: The U.S. Department of Agriculture (USDA) recognizes the need to develop and implement a database to track and monitor physical security assessment schedules across all of its components. As a result, USDA plans to request funding in the President's Budget for fiscal year 2021 to design and build such a database. If sufficient funding is secured and development efforts go as planned, the agency anticipates having the database operational by the end of 2021.

Recommendation: To help ensure DOD takes a strategic approach for its prototyping and innovation initiatives and overcomes funding and cultural barriers, the Secretary of Defense should direct the Assistant Secretary of Defense for Research and Engineering to develop a high-level DOD-wide strategy, in collaboration with the military services and other appropriate DOD components, to communicate strategic goals and priorities and delineate roles and responsibilities among DOD's prototyping and innovation initiatives.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation, but its progress on addressing it has stalled. In November 2019, DOD's Prototyping Guidebook indicated that the department was developing policy and strategy documents pertaining to prototyping. As part of this effort, the Office of the Undersecretary of Defense for Research and Engineering was drafting a broad DOD Research and Engineering strategy that would include strategies pertaining to prototyping and innovation and address this recommendation. As of August 2020, DOD had not published this strategy.

Recommendation: To make it more likely that HHS will achieve its goals to reduce quality measure misalignment and associated provider burden, the Secretary of HHS should direct CMS and the Office of the National Coordinator for Health Information Technology to prioritize their development of electronic quality measures and associated standardized data elements on the specific quality measures needed for the core measure sets that CMS and private payers have agreed to use.

Agency: Department of Health and Human Services
Status: Open

Comments: In January 2019, HHS told us that CMS completed an analysis to determine which measures-from the core measure sets that CMS and private payers have agreed to use-are feasible to develop as electronic clinical quality measures. Further, in April 2019, CMS officials told us they will consider developing new electronic clinical quality measures where appropriate and feasible to fill future measure needs or gaps identified by the Core Quality Measures Collaborative (CQMC). However, we determined that the actions did not fully address the recommendation because they do not include efforts to work with ONC to prioritize their development of electronic clinical quality measures for the CQMC core measure sets. We will update the status of this recommendation when we receive additional information.

Recommendation: To make it more likely that HHS will achieve its goals to reduce quality measure misalignment and associated provider burden, the Secretary of HHS should direct CMS to comprehensively plan, including setting timelines, for how to target its development of new, more meaningful quality measures on those that will promote greater alignment, especially measures to strengthen the core measure sets that CMS and private payers have agreed to use.

Agency: Department of Health and Human Services
Status: Open

Comments: In April 2019, HHS told us that CMS had conducted an assessment of the impact of selected measures used in its quality programs and has linked key component of that assessment to some meaningful measure areas that CMS has identified as priorities. However, this document did not include elements of a comprehensive plan--such as setting timelines-for how to target its development of new, more meaningful quality measures that will promote greater alignment. We will update the status of this recommendation when we receive additional information.

Recommendation: To strengthen efforts to mitigate earthquake risks to federal buildings, the Secretary of Defense and the Administrator of GSA should (1) Define what constitutes an exceptionally high risk building, identify such buildings, and develop plans to mitigate those risks, including prioritizing associated funding requests as needed; and (2) To the extent practicable, prioritize and implement comprehensive seismic safety measures which could include earthquake drills, seismic safety inspections, and non-structural retrofits to decrease risks and reduce damage in federally-owned and -leased buildings in earthquake hazard areas.

Agency: Department of Defense
Status: Open

Comments: DOD concurred with our recommendation. In June 2019, DOD reported that the U.S. Army Corps of Engineers had developed a sophisticated risk assessment tool which could potentially be used to both define and assess exceptionally high risk buildings in a cost-effective manner. DOD said that it was in the process of determining the suitability of the tool for use by its components, and potentially other federal government partners. According to DOD, further action to address this recommendation will depend on both a favorable determination of the tool's suitability and the availability of funding to conduct assessments and complete the mitigation actions identified by the assessments. We will continue to monitor DOD's efforts to address this recommendation.

Recommendation: To assist CISOs in carrying out their responsibilities, the Director of OMB should issue guidance for agencies' implementation of the FISMA 2014 requirements to ensure that (1) senior agency officials carry out information security responsibilities and (2) agency personnel are held accountable for complying with the agency-wide information security program. This guidance should clarify the role of the agency CISO with respect to these requirements, as well as implementing the other elements of an agency-wide information security program, taking into account the challenges identified in this report.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) partially concurred with this recommendation, but does not intend to directly issue guidance as recommended. As of June 2020, OMB has not provided sufficient evidence that it has implemented this recommendation. We will continue to monitor OMB's implementation of this recommendation.

Recommendation: To ensure that the role of the SISO is defined in department policy in accordance with FISMA 2014, the Secretary of Defense should define the SISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of Defense
Status: Open

Comments: In response to our report, DOD partially concurred with our recommendation; however, DOD subsequently concurred with the recommendation and is taking steps to implement it. The department stated that the issuance of an updated Cyber Incident Handling guidance is on track to be completed and coordinated in the third quarter of fiscal year 2018. As of June 2020, it has not yet provided sufficient evidence that it has implemented the recommendation. When we confirm what actions DOD has taken, we will provide updated information.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of State should define the CISO's role in department policy for ensuring that the department has procedures for incident detection, response, and reporting.

Agency: Department of State
Status: Open

Comments: The Department of State (State) concurred with this recommendation. However, as of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. When we receive additional evidence from State, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that subordinate security plans are documented for the department's information systems.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the CISO is defined in department policy in accordance with FISMA 2014, the Secretary of Transportation should define the CISO's role in department policy for ensuring that security controls are tested periodically.

Agency: Department of Transportation
Status: Open

Comments: The Department of Transportation (DOT) concurred with the recommendation and is currently updating its Cybersecurity Policy. The Department plans to be complete by June 29, 2019. As of June 2020, the department has not yet provided sufficient evidence that it has implemented the recommendation. Upon receiving additional evidence from DOT, we will review it to determine whether the department has addressed the recommendation.

Recommendation: To ensure that the role of the SAISO is defined in agency policy in accordance with FISMA 2014, the Administrator of the National Aeronautics and Space Administration should define the SAISO's role in agency policy for oversight of security for information systems that are operated by contractors on the agency's behalf.

Agency: National Aeronautics and Space Administration
Status: Open

Comments: The National Aeronautics and Space Administration (NASA) concurred with our recommendation. As of June 2020, NASA stated that the agency is working to update the relevant policy to address this recommendation, but the update is taking longer than expected; NASA expects the policy to be updated and the review process to be completed by November 30, 2020. We will examine the evidence when NASA provides it.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prepare a level I quantitative drilldown in accordance with the FIAR Guidance.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it has actions planned, taken, or under way to prepare a quantitative drilldown. In September 2017, Navy provided a listing of certain systems (DCAS, GLs, DDRS-B, and DDRS-AFS) it considered as Level 1 assessable units. However, the listing did not include a drilldown from the financial statement amounts through DDRS-AFS, DDRS-B, and DCAS to the receipt and disbursement source systems. In July 2020, Navy officials stated that Navy is implementing a new system that will enable them to complete a quantitative drill down for its Fund Balance with Treasury (FBWT). The new system is not expected to be fully implemented until March 2021. In the interim, certain FBWT reconciliations are performed at DFAS, that may provide a drilldown capability of FBWT as reported in financial statements to the applicable general ledger amounts.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prioritize audit readiness efforts for the key FBWT systems, prepare an audit strategy that identifies for each system (1) the Navy's plan for assessing the system to gain assurance that the system can be relied on; (2) the assessment types, including prioritizing the assessments based on qualitative and quantitative factors for each system; and (3) planned start and completion dates of these assessments for each system.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it has actions planned, taken, or under way to prioritize audit readiness efforts for key Fund Balance with Treasury (FBWT) systems. In September 2017, Navy provided documentation for three systems, but this documentation did not address corrective actions for ineffective controls and the expected completion dates. Further, during our audit, Navy provided a list of 22 relevant systems. In July 2020, Navy officials stated that they are preparing an audit strategy for each system, and documenting control activities and computer controls for significant systems. We will continue to follow-up on the status of this recommendation.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prepare, in accordance with FIAR Guidance, the documentation of control activities and information technology general computer controls for significant systems; system certifications or accreditations; system, end user, and systems documentation locations; and hardware, software, and interfaces.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it had actions planned, taken, or under way to document control activities, information technology general computer controls for significant systems, systems documentation locations, and hardware, software, and interfaces. In September 2017, Navy provided documentation for 3 systems, but the documentation did not include system certifications or accreditations; system, end user, and systems documentation locations; and hardware, software, and interfaces. Further, during our audit, Navy provided a list of 22 relevant systems. In July 2020, a Navy official told us that they are preparing an audit strategy for each system, and documenting control activities and computer controls for significant systems. We will continue to monitor Navy's progress addressing this recommendation.

Recommendation: To improve the Navy's implementation of the FIAR Guidance for its General Fund FBWT FIP and facilitate efforts to achieve SBR auditability, the Secretary of the Navy should direct the Assistant Secretary of the Navy, Financial Management and Comptroller, to prepare an internal control assessment document for each assessable unit, summarizing control activities that are appropriately designed and in place.

Agency: Department of Defense: Department of the Navy
Status: Open

Comments: The Navy concurred with this recommendation and stated that it had actions planned, taken, or under way to prepare an internal control assessment document. In September 2017, Navy provided support for actions taken to address this recommendation. However, the documentation provided did not summarize controls by assessable unit (DCAS, DDRS-B, or systems). Instead controls were listed by function (Treasury Reporting, Audit Readiness, and Departmental Reporting). In July 2020, a Navy official stated that documentation of overall Fund Balance with Treasury (FBWT) controls is in process and they are finalizing the Risk Control Matrix for FBWT to include controls at DFAS and at Treasury. The Rick Control Matrix is estimated to be completed by the end of August 2020. We will continue to monitor the progress in addressing this recommendation.

Recommendation: In order to better integrate virtual training devices into operational training, the Secretary of Defense should direct the Secretary of the Army to specify in Army guidance for developing virtual training device requirements that training developers consider and document the time available to train with the devices and intended usage rates to achieve training tasks and proficiency goals during operational training.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) concurred with this recommendation. As of December 2019, the Army had taken some steps to improve its guidance, as GAO recommended in August 2016, but did not plan to fully address the recommendation until 2021. Officials stated that the Army established target usage rates for existing virtual training devices and issued guidance and tracking tools for recording device usage. However, the Army had not modified the guidance, cited in GAO's August 2016 report, to require that training developers consider the amount of time available to train with or expected usage rates of new virtual training devices. According to Army officials, they will implement GAO's recommendation in a planned update to guidance on the justification and validation of new virtual training devices scheduled for 2021. By updating this guidance, the Army will have the information it requires to evaluate the amount of virtual training capabilities needed to achieve training tasks and proficiency goals during operational training.

Recommendation: To effectively measure 18F's performance, the Administrator of GSA should direct the Commissioner for the Technology Transformation Service to assess actual results for each performance measure.

Agency: General Services Administration
Status: Open

Comments: The General Services Administration (GSA) agreed with, and has begun to take steps to implement, this recommendation. Specifically, in a March 2020 written response, GSA stated that Technology Transformation Service (TTS) leadership will be briefed on the program's performance measures on a quarterly basis. We are following up with GSA to confirm that its TTS leadership has been briefed on the results on these performance measures. We will continue to evaluate GSA's progress in implementing this recommendation.

Recommendation: To effectively measure performance, prioritize USDS's resources, and ensure that CIOs play an integral role in agency digital service teams, the Director of the Office of Management and Budget should direct the Federal Chief Information Officer to ensure that all goals and associated performance measures are outcome-oriented and that performance measures have targets.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) generally agreed with, and has begun to take steps to implement, this recommendation. Specifically, in its December 2016 report to Congress, OMB developed three goals for U.S. Digital Service (USDS): (1) rethink how the federal government builds and buys digital services; (2) expand the use of common, platforms, services, and tools; and (3) bring top technical talent into public service. In addition, OMB established performance measures with targets for its third goal and for each of the program's major projects. However, OMB has not established performance measures for the first two USDS goals. Further, the program's third goal is not outcome-oriented. In May 2018, an USDS staff member stated that USDS established goals for and measured performance on each of the projects the program supports in its fall 2017 report to Congress. Although measuring performance on projects can provide USDS with valuable information, this effort does not address goals and performance measurement on the overall USDS program. In May 2020, OMB stated that they would provide an update on the agency's efforts to address the recommendation by June 2020. We will continue to evaluate OMB's progress in implementing this recommendation.

Recommendation: To effectively measure performance, prioritize USDS's resources, and ensure that CIOs play an integral role in agency digital service teams, the Director of the Office of Management and Budget should direct the Federal Chief Information Officer to assess actual results for each performance measure.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) generally agreed with, and has begun to take steps to implement, this recommendation. Specifically, in its December 2016 report to Congress, OMB assessed the results of performance measures for one of the U.S. Digital Service (USDS) program's goals--bring top technical talent into public service--and for each of the program's major projects. However, OMB has not established performance measures for the other two USDS goals--rethink how the federal government builds and buys digital services; and expand the use of common, platforms, services, and tools. In May 2018, an USDS staff member stated that USDS established goals for and measured performance on each of the projects the program supports in its fall 2017 report to Congress. As of July 2019, USDS has not publicly released any subsequent reports to Congress or additional information on its goals and performance measures. Although measuring performance on projects can provide USDS with valuable information, this effort does not address performance measurement on the overall USDS program. In May 2020, OMB stated that they would provide an update on the agency's efforts to address the recommendation by June 2020. We will continue to evaluate OMB's progress in implementing this recommendation.

Recommendation: To effectively measure performance, prioritize USDS's resources, and ensure that CIOs play an integral role in agency digital service teams, the Director of the Office of Management and Budget should direct the Federal Chief Information Officer to update USDS policy to clearly define the responsibilities and authorities governing the relationships between CIOs and the digital service teams and require existing agency digital service teams to address this policy. In doing so, the Federal Chief Information Officer should ensure that this policy is aligned with relevant federal law and OMB guidance on CIO responsibilities and authorities.

Agency: Executive Office of the President: Office of Management and Budget
Status: Open

Comments: The Office of Management and Budget (OMB) generally agreed with, and has begun to take steps to implement, this recommendation. In particular, OMB updated its digital service team policy to require that teams appropriately inform their chief information officers (CIO) regarding U.S. Digital Service (USDS) projects. However, the policy does not describe the responsibilities or authorities governing the relationships between CIOs and digital service teams. In May 2018, an USDS staff member stated that the program updated digital service team charters to address the role of agency CIOs. As of May 2020, USDS has yet to provide us with the updated digital service team charters. In May 2020, OMB stated that they would provide an update on the agency's efforts to address the recommendation by June 2020. We will continue to evaluate OMB's progress in implementing this recommendation.

Recommendation: To improve transparency in allocating its limited resources, and to help ensure that its resource allocation decisions are the most effective ones for fulfilling its missions given existing risks, the Commandant of the Coast Guard should document how the risk assessments conducted were used to inform and support its annual asset allocation decisions.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In February 2018, the Coast Guard liaison stated that Coast Guard management made a decision to not to address this recommendation within the annual Strategic Planning Direction (SPD) or Operational Planning Direction (OPD) products as previously planned, but rather within the Standard Operational Planning Process/Global Force Management Process Guide. The liaison further stated that both of these documents are currently under revision and expected to be completed by March 31, 2018. On October 11, 2018, the Coast Guard liaison stated that The Standard Operational Planning Process/Global Force Management Instruction is in routing for edits, comment, and final approval. The new estimated completion date is the 2nd quarter of FY 2019. GAO sent an inquiry to the Coast Guard on April 24, 2019 and is awaiting a reply. On March 30, 2020, the Coast Guard liaison informed GAO that the update to the Standard Operational Planning Process (SOPP)/Global Force Management (GFM) Instruction, which includes the addition and test of Strategic Priorities Planning Guidance and the new Coast Guard Force Allocation Matrix, was further delayed due to recent discussions of changing to a 2-year SOPP planning cycle to align with the Department of Defense Global Force Management process. This change would further require an update of the SOPP/GFM Instruction. The COVID-19 crisis as well as the need to finalize the Strategic Planning Direction by June 2020 are also factors in this delay. New Estimated Completion Date (ECD): June 30, 2021.

Recommendation: To ensure that high priority mission activities are fully supported with the appropriate number of staff possessing the requisite mix of skills and abilities, the Commandant of the Coast Guard should develop a systematic process that prioritizes manpower requirements analyses for units that are the most critical for achieving mission needs.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: On December 14, 2016, the Coast Guard noted that it submitted two FY 2019 Resource Proposals to staff and equip the Manpower Requirements Determination Division to conduct the analysis as described in the recommendation. In April, 2016, the Coast Guard liaison stated that, resources permitting, the Coast Guard is to address the following steps: (1) Validate the "unit-type" list so that it encompasses the vast majority of active duty and civilian billets in a logical framework that can be readily analyzed, review/update the list as changes (e.g., asset mix, organizations) occur. (2) Develop the requirements for the envisioned Manpower Analysis & Simulation Tool (MAST). (3) Prioritize unit list according to strategic alignment and risk assessment (4) Conduct the manpower requirements analyses (MRA) in accordance with established priorities. As of August 2020, the Coast Guard reported it had not implemented the actions. Specifically, the Coast Guard reported that in response to GAO's February 2020 modernization report (GAO-20-223, rec#2), it was developing new guidance for executing the manpower requirement determination process. Officials told us that the new guidance would include a systematic process for prioritizing manpower analysis. In this way, the actions for implementing the GAO-20-223 recommendation may also serve to meet the intent of the recommendation for GAO-16-379. Officials told us the Coast Guard estimated implementing the actions by December 31, 2020.

Recommendation: To improve the strategic allocation of assets, the Commandant of the Coast Guard should incorporate field unit input, such as information on assets' actual performance from Operational Performance Assessment Reports and Planning Assessments, to inform more realistic asset allocation decisions--in addition to asset performance capacities currently used--in the annual Strategic Planning Directions to more effectively communicate strategic intent to field units.

Agency: Department of Homeland Security: United States Coast Guard
Status: Open

Comments: In February 2018, the Coast Guard liaison stated that Coast Guard management made a decision to not to address this recommendation within the annual Strategic Planning Direction (SPD) or Operational Planning Direction (OPD) products as previously planned, but rather within the Standard Operational Planning Process/Global Force Management Process Guide. The liaison further stated these documents are under revision and expected to be completed by March 31, 2018. On October 11, 2018, the Coast Guard liaison stated that The Standard Operational Planning Process/Global Force Management Instruction is in routing for edits, comment, and final approval. The new estimated completion date is the 2nd quarter of FY 2019. GAO sent an inquiry to the Coast Guard on April 24, 2019 asking for an update. On March 30, 2020, the Coast Guard liaison informed GAO that the update to the SOPP/GFM Instruction, which includes the addition and test of Strategic Priorities Planning Guidance and the new Coast Guard Force Allocation Matrix, was further delayed due to recent discussions of changing to a 2-year SOPP planning cycle to align with the Department of Defense Global Force Management process. The liaison stated that the COVID-19 crisis as well as the need to finalize the Strategic Planning Direction by June 2020 are also factors in this delay. The new estimated completion date for this recommendation is June 30, 2021.

Recommendation: To help districts address key challenges in meeting MOE and mitigate unintended consequences that may affect services for students with disabilities, while preserving the safeguard for funding for students with disabilities, Congress should consider options for a more flexible MOE requirement. This could include adopting a less stringent MOE requirement to align with the MOE requirements in other education programs or adding to or modifying exceptions. For example, current exceptions could be changed to allow one-time increases in spending without changing a district's MOE baseline in order to encourage pilot innovations or to allow certain spending decreases (e.g., state caps on teacher benefits), as long as a district can demonstrate the decrease does not negatively affect services.

Agency: Congress
Status: Open

Comments: As of February 2020, Congress has not taken legislative action on this issue.

Recommendation: To improve the public reporting about how agencies are ensuring the quality of performance information used to measure progress towards their priority goals, the Secretaries of Agriculture, Defense, Homeland Security, Interior, and Labor, and the Administrator of NASA should more fully address GPRAMA requirements and OMB guidance by working with OMB to describe on Performance.gov how they are ensuring the quality of performance information used to measure progress towards their APGs.

Agency: Department of Agriculture
Status: Open

Comments: The Department of Agriculture (USDA) has identified five priority goals (APGs) for fiscal years 2020 and 2021. USDA states that action plans and progress updates for these goals are "coming soon". In a November 2018 letter to the Comptroller General, USDA's Inspector General acknowledged that additional efforts are needed to better describe the quality of the data supporting the APGs and said that the Department will increase the amount of information provided in the quarterly APG updates. In April 2020, we followed up and once more requested updated information from USDA officials. As of May 6, 2020, we have not received the requested information. We will continue to monitor USDA's efforts to address our recommendation.

Recommendation: To improve the public reporting about how agencies are ensuring the quality of performance information used to measure progress towards their priority goals, the Secretaries of Agriculture, Defense, Homeland Security, Interior, and Labor, and the Administrator of NASA should more fully address GPRAMA requirements and OMB guidance by working with OMB to describe on Performance.gov how they are ensuring the quality of performance information used to measure progress towards their APGs.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense (DOD) has identified three priority goals (APGs) for fiscal years 2020 and 2021. DOD states action plans and progress updates are "coming soon" for Performance.gov. In March 2020, DOD officials reported that they continue to work to address our recommendation. We will continue to monitor DOD's efforts to address our recommendation.

Recommendation: To improve the public reporting about how agencies are ensuring the quality of performance information used to measure progress towards their priority goals, the Secretaries of Agriculture, Defense, Homeland Security, Interior, and Labor, and the Administrator of NASA should more fully address GPRAMA requirements and OMB guidance by working with OMB to describe on Performance.gov how they are ensuring the quality of performance information used to measure progress towards their APGs.

Agency: Department of the Interior
Status: Open

Comments: The Department of the Interior (Interior) has identified six priority goals (APGs) for fiscal years 2020 and 2021. Interior states on Performance.gov that action plans and progress updates are "coming soon". We will continue to monitor Interior's efforts to address our recommendation.

Recommendation: To improve the public reporting about how agencies are ensuring the quality of performance information used to measure progress towards their priority goals, the Secretaries of Agriculture, Defense, Interior, and Labor, and the Administrator of NASA should more fully address GPRAMA requirements and OMB guidance by describing in their agencies' annual performance plans and reports how they are ensuring the quality of performance information used to measure progress towards their APGs.

Agency: Department of Agriculture
Status: Open

Comments: The Department of Agriculture's (USDA) Fiscal Year 2021 Annual Performance Plan and Fiscal Year 2019 Annual Performance Report provides a general statement on how the agency uses a standardized methodology to measure its performance and that agency officials attest to the quality of the performance information. USDA also identifies its priority goals for fiscal years 2020 and 2021, but specific data quality explanation is not provided for these APGs. In a November 2018 letter to the Comptroller General, USDA's Inspector General stated that the Department agrees with the recommendation and will begin providing data quality explanation for the APGs in its next annual performance plan and report to be published in February 2019, but our review in 2019 found no such explanation. Further, as noted above the most recent plan and report do not provide the required explanation. In April 2020, we once more requested updated information from USDA officials and as of May 6, 2020 have not received the requested information. We will continue to monitor USDA's efforts to address our recommendation.

Recommendation: To improve the public reporting about how agencies are ensuring the quality of performance information used to measure progress towards their priority goals, the Secretaries of Agriculture, Defense, Interior, and Labor, and the Administrator of NASA should more fully address GPRAMA requirements and OMB guidance by describing in their agencies' annual performance plans and reports how they are ensuring the quality of performance information used to measure progress towards their APGs.

Agency: Department of Defense
Status: Open

Comments: The Department of Defense's (DOD) Fiscal Year (FY) 2021 Annual Performance Plan and FY2019 Annual Performance Report states that, "each goal owner has attested the performance results and narrative information included in this report is complete, accurate, and reliable; and that data validation and verification procedures are documented and available upon request," and DOD refers readers to Performance.gov for more information about its priority goals (APGs). However, the GPRA Modernization Act of 2010 requires agencies to publish more specific data quality explanation for each APG in performance plans and reports and on Performance.gov. DOD's performance plan and report does not contain the more specific explanation required. Nor did our review of Performance.gov find the required explanation. In March 2020, DOD officials reported that they continue to work to address our recommendation. We will continue to monitor DOD's efforts to address our recommendation.

Recommendation: To improve the public reporting about how agencies are ensuring the quality of performance information used to measure progress towards their priority goals, the Secretaries of Agriculture, Defense, Interior, and Labor, and the Administrator of NASA should more fully address GPRAMA requirements and OMB guidance by describing in their agencies' annual performance plans and reports how they are ensuring the quality of performance information used to measure progress towards their APGs.

Agency: Department of the Interior
Status: Open

Comments: The Department of the Interior's (Interior) 2021/2020 Annual Performance Plan & 2019 Report (APP&R) includes a section concerning data accuracy and reliability and describes in general terms how Interior ensures the accuracy and reliability of performance information and how it addresses the five data quality requirements in the GPRA Modernization Act of 2010. Interior states in this section that measurement procedures for agency performance goals are described on Performance.gov. As of May 2020, our review found that Interior has not provided specific data quality explanation for its APGs on Performance.gov. We will continue to monitor Interior's efforts to address our recommendation.

Recommendation: To improve the classification system and to strengthen OPM's management and oversight, the Director of OPM, working through the Chief Human Capital Officer Council, and in conjunction with key stakeholders such as the Office of Management and Budget, unions, and others, should use prior studies and lessons learned from demonstration projects and alternative systems to examine ways to make the GS system's design and implementation more consistent with the attributes of a modern, effective classification system. To the extent warranted, develop a legislative proposal for congressional consideration.

Agency: Office of Personnel Management
Status: Open
Priority recommendation

Comments: In January 2020, OPM told us that it continues to concur with GAO's recommendation, however, in order to pursue examining such changes, OPM would need to be appropriately resourced. OPM reported that during 2019, it began studies to identify challenges agencies may experience with implementing OPM-issued classification standards. OPM believe this information, in addition to other prior studies and lessons learned, would help inform the examination going forward at a point in time OPM is resourced to do so. OPM reported it has continued to review and update individual series, despite broader efforts to evaluate the GS system as a whole. To fully implement the recommendation, OPM still needs to work in conjunction with key stakeholders such as OMB and unions; complete its review of studies and lessons learned; and if warranted, develop a legislative proposal to make the GS system's design and implementation more consistent with the attributes of a modern, effective classification system.

Recommendation: To improve the classification system and to strengthen OPM's management and oversight, the Director of OPM should develop cost-effective mechanisms to oversee agency implementation of the classification system as required by law, and develop a strategy that will enable OPM to more effectively and routinely monitor agencies' implementation of classification standards.

Agency: Office of Personnel Management
Status: Open

Comments: In September 2018, OPM reported that it is active in monitoring oversight of classification policy and in issuing classification appeals decisions. However, OPM has experienced staff turnover in the past several months, resulting in the need for key subject matter experts to reconsider the actions proposed in this recommendation. OPM plans to provide GAO with an additional status update at the end of 2018. We will continue to monitor the steps OPM is taking to address this recommendation. GAO reached out to the agency in November 2019 and January 2020 and have yet to receive an update. GAO will continue to monitor the progress.

Recommendation: To improve the resilience of the nation's infrastructure to climate change, the Executive Director of the United States Global Change Research Program or other federal entity designated by the Executive Office of the President should work with relevant agencies to identify for decision makers the "best available" climate-related information for infrastructure planning and update this information over time.

Agency: Executive Office of the President: Office of Science and Technology Policy: U.S. Global Change Research Program
Status: Open

Comments: The Executive Office of the President did not comment on this recommendation. As of January 2020, no federal entity has identified the best available climate-related information for infrastructure planning.

Recommendation: To improve the resilience of the nation's infrastructure to climate change, the Executive Director of the United States Global Change Research Program or other federal entity designated by the Executive Office of the President should work with relevant agencies to clarify sources of local assistance for incorporating climate-related information and analysis into infrastructure planning, and communicate how such assistance will be provided over time.

Agency: Executive Office of the President: Office of Science and Technology Policy: U.S. Global Change Research Program
Status: Open

Comments: The Executive Office of the President did not comment on this recommendation. As of January 2020, no federal entity has comprehensively clarified sources of local assistance for incorporating climate-related information and analysis into infrastructure planning.

Recommendation: To improve the Bureau's use of its master schedule to manage the 2020 decennial census, the Secretary of Commerce should require the Director of the U.S. Census Bureau to include estimates of the resources, such as labor, materials, and overhead costs, in the 2020 integrated schedule for each activity as the schedule is built, and prepare to carry out other steps as necessary to conduct systematic schedule risk analyses on the 2020 schedule.

Agency: Department of Commerce
Status: Open
Priority recommendation

Comments: Commerce neither agreed nor disagreed with this recommendation. Regarding GAO's 2013 assessment of the Bureau's schedule (GAO-14-59), Bureau officials stated that they hoped to begin identifying the resources needed for each activity in their schedules by early 2014. Bureau officials announced they had completed the 2020 Census schedule in July 2016, and have since periodically described their intent to link resources to activities within their schedules. However, as of May 2018, when the Bureau had not taken these steps. Senior Bureau officials stated that it would require additional staffing in order to plan for and implement this recommendation. In July 2018 (GAO-18-589) we reported again on the status of the Bureau's scheduling, stating that when the Bureau has resource loaded its schedule, it will be able to use the schedule more effectively as a management tool. The Bureau took steps toward assigning resources to its master activity schedule for the 2020 Census, but effectively ran out of time to do so. Assigning resources to large complex schedules is easier to do early in schedule development process, as we recommended the Bureau do in 2009 for its 2020 Census schedule. This recommendation will remain open pending the Bureau taking steps in developing its 2030 schedule with appropriate resources linked to it.