Information Technology: Implementation of GAO Recommendations Would Strengthen Federal Agencies' Acquisitions, Operations, and Cybersecurity Efforts

The federal government plans to spend over $90 billion in fiscal year 2019 on IT. Even so, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. To focus attention on these concerns, GAO's high-risk list includes both the management of IT acquisitions and operations and cybersecurity.

This statement summarizes federal agencies' progress in improving the management and ensuring the security of federal IT. It is primarily based on GAO's reports issued between July 2011 and April 2019 on (1) CIO responsibilities, (2) CIO IT acquisition review requirements, (3) data center consolidation efforts, (4) the management of software licenses, and (5) cybersecurity.

The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure federal cybersecurity through a series of initiatives. As of June 2019, federal agencies had fully implemented 60 percent of the 1,277 IT management-related recommendations that GAO has made to them since fiscal year 2010. Likewise, agencies had implemented 78 percent of the 3,058 security-related recommendations that GAO has made since 2010. Even with this progress, significant actions remain to be completed.

Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. In August 2018, GAO reported that none of the 24 selected agencies had established policies that fully addressed the role of their CIO, as called for by laws and guidance. GAO recommended that OMB and each of the 24 agencies take actions to improve the effectiveness of CIOs' implementation of their responsibilities. As of June 2019, none of the 27 recommendations had been implemented.

CIO IT acquisition review . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 covered agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight for these acquisitions. As of June 2019, 23 of the recommendations had not been implemented.

Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers. According to 24 agencies, data center consolidation and optimization efforts had resulted in approximately $4.7 billion in cost savings through August 2018. Even so, additional work remains. GAO has made 196 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets. As of June 2019, 79 of the recommendations had not been implemented.

Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 136 recommendations to improve such management. As of June 2019, 27 of the recommendations had not been implemented.

Ensuring the nation's cybersecurity . While the government has acted to protect federal information systems, GAO has consistently identified shortcomings in the federal government's approach to cybersecurity. The 3,058 recommendations that GAO made to agencies since 2010 have been aimed at addressing cybersecurity challenges. These recommendations have identified actions for agencies to take to fully implement aspects of their information security programs and strengthen technical security controls over their computer networks and systems. As of June 2019, 674 of the recommendations had not been implemented.

Since fiscal year 2010, GAO has made about 1,300 recommendations to OMB and agencies to address shortcomings in IT acquisitions and operations, as well as approximately 3,000 recommendations to agencies to improve the security of federal systems. These recommendations addressed, among other things, implementation of CIO responsibilities, oversight of the data center consolidation initiative, management of software license efforts, and the efficacy of security programs and technical controls. Implementation of these recommendations is essential to strengthening federal agencies' acquisitions, operations, and cybersecurity efforts.

I am pleased to be here today to provide an update on federal agencies’  efforts to address our high-risk areas on improving the management of  information technology (IT) acquisitions and operations, as well as  ensuring the cybersecurity of the nation. The federal government has  spent billions of dollars on failed and poorly performing IT investments,  which often suffered from ineffective management. Consequently, we  added improving the management of IT acquisitions and operations to our  high-risk areas for the federal government in February 2015. In March  2019, we reported that, while progress had been made in addressing the  high-risk area of IT acquisitions and operations, significant work remained  to be completed.

With regard to cybersecurity, the increasingly sophisticated threats and  frequent cyber incidents underscore the continuing and urgent need for  effective information security. We first identified federal information  security as a government-wide high-risk area in 1997. Subsequently, in  2003, we expanded this area to include computerized systems  supporting the nation’s critical infrastructure, and, in 2015, we further  expanded this area to include protecting the privacy of personally  identifiable information. In 2018, we updated this high-risk area to reflect  the lack of a comprehensive cybersecurity strategy for the federal  government.

My statement today provides an update on agencies’ progress in  improving the management of IT acquisitions and operations and the  security of federal IT. The statement is based on our prior reports issued  between July 2011 and April 2019 that discuss federal agencies’ (1)  implementation of Chief Information Officer (CIO) responsibilities, (2)  fulfillment of CIO IT acquisition review requirements, (3) data center  consolidation efforts, (4) management of software licenses, and (5)  cybersecurity. More detailed information on our objectives, scope, and  methodology for that work is included in each of the reports that are cited  throughout this statement.

We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

The federal government plans to invest over $90 billion in IT in fiscal year  2019. Nevertheless, we have previously reported that investments in  federal IT too often resulted in failed projects that incurred cost overruns  and schedule slippages, while contributing little to the desired mission- related outcomes. For example:

The tri-agency National Polar-orbiting Operational Environmental  Satellite System was disbanded in February 2010 at the direction of the  White House’s Office of Science and Technology Policy after the  program spent 16 years and almost $5 billion.

The Department of Homeland Security’s (DHS) Secure Border Initiative  Network program was ended in January 2011, after the department  obligated more than $1 billion for the program.

The Department of Veterans Affairs’ Financial and Logistics Integrated  Technology Enterprise program was intended to be delivered by 2014 at  a total estimated cost of $609 million, but was terminated in October  2011.

The Department of Defense’s Expeditionary Combat Support System  was canceled in December 2012 after spending more than a billion  dollars and failing to deploy within 5 years of initially obligating funds.

The United States Coast Guard (Coast Guard) decided to terminate its  Integrated Health Information System project in 2015. As reported by the  agency in August 2017, the Coast Guard spent approximately $60 million  over 7 years on this project, which resulted in no equipment or software  that could be used for future efforts.

Our past work has found that these and other failed IT projects often  suffered from a lack of disciplined and effective management, such as  project planning, requirements definition, and program oversight and  governance. In many instances, agencies had not consistently applied  best practices that are critical to successfully acquiring IT.

Federal IT projects have also failed due to a lack of oversight and  governance. Executive-level governance and oversight across the  government has often been ineffective, specifically from CIOs. For  example, we have reported that some CIOs’ roles were limited because  they did not have the authority to review and approve the entire agency IT  portfolio.

In addition to failures when acquiring IT, our cybersecurity work at federal  agencies continues to highlight information security deficiencies. The  following examples describe the types of risks we have found at federal  agencies.

In September 2018, we reported that the Department of Education’s  Office of Federal Student Aid exercised minimal oversight of lenders’  protection of student data and lacked assurance that appropriate risk- based safeguards were being effectively implemented, tested, and  monitored.

In August 2017, we issued a report stating that, since the 2015 data  breaches, the Office of Personnel Management (OPM) had taken actions  to prevent, mitigate, and respond to data breaches involving sensitive  personal and background investigation information. However, we noted  that the agency had not fully implemented recommendations made to  OPM by DHS’s United States Computer Emergency Readiness Team to  help the agency improve its overall security posture and improve its  ability to protect its systems and information from security breaches.

We reported in July 2017 that information security at the Internal  Revenue Service had weaknesses that limited its effectiveness in  protecting the confidentiality, integrity, and availability of financial and  sensitive taxpayer data. An underlying reason for these weaknesses was  that the Internal Revenue Service had not effectively implemented  elements of its information security program.

In May 2016, we found that the National Aeronautics and Space  Administration, the Nuclear Regulatory Commission, OPM, and the  Department of Veteran Affairs did not always control access to selected  high-impact systems, patch known software vulnerabilities, or plan for  contingencies. An underlying reason for these weaknesses was that the  agencies had not fully implemented key elements of their information  security programs.

We reported in August 2016 that the information security of the Food and  Drug Administration had significant weaknesses that jeopardized the  confidentiality, integrity, and availability of its information systems and  industry and public health data.

FITARA Increases CIO Authorities and Responsibilities for Managing IT

Congress and the President have enacted various key pieces of reform  legislation to address IT management issues. These include the federal  IT acquisition reform legislation commonly referred to as the Federal  Information Technology Acquisition Reform Act (FITARA). This  legislation was intended to improve covered agencies’ acquisitions of IT  and enable Congress to monitor agencies’ progress and hold them  accountable for reducing duplication and achieving cost savings. The  law includes specific requirements related to seven areas:

Agency CIO authority enhancements. CIOs at covered agencies have  the authority to, among other things, (1) approve the IT budget requests  of their respective agencies and (2) review and approve IT contracts.

Federal data center consolidation initiative (FDCCI). Agencies  covered by FITARA are required, among other things, to provide a  strategy for consolidating and optimizing their data centers and issue  quarterly updates on the progress made.

Enhanced transparency and improved risk management. The Office  of Management and Budget (OMB) and covered agencies are to make  detailed information on federal IT investments publicly available, and  agency CIOs are to categorize their investments by level of risk.

Portfolio review. Covered agencies are to annually review IT investment  portfolios in order to, among other things, increase efficiency and  effectiveness and identify potential waste and duplication.

Expansion of training and use of IT acquisition cadres. Covered  agencies are to update their acquisition human capital plans to support  timely and effective IT acquisitions. In doing so, the law calls for agencies  to consider, among other things, establishing IT acquisition cadres (i.e.,  multi-functional groups of professionals to acquire and manage complex  programs), or developing agreements with other agencies that have such  cadres.

Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software. In  doing so, the law requires that, to the maximum extent practicable, the  General Services Administration should allow for the purchase of a  software license agreement that is available for use by all executive  branch agencies as a single user.

Maximizing the benefit of the Federal Strategic Sourcing Initiative.

Federal agencies are required to compare their purchases of services  and supplies to what is offered under the Federal Strategic Sourcing  Initiative.

In June 2015, OMB released guidance describing how agencies are to  implement FITARA. This guidance was intended to, among other things: assist agencies in aligning their IT resources with statutory requirements; establish government-wide IT management controls to meet the law’s  requirements, while providing agencies with flexibility to adapt to unique  agency processes and requirements;  strengthen the relationship between agency CIOs and bureau CIOs; and  strengthen CIO accountability for IT costs, schedules, performance, and  security.

The guidance identifies a number of actions that agencies are to take to  establish a basic set of roles and responsibilities (referred to as the  common baseline) for CIOs and other senior agency officials and, thus, to  implement the authorities described in the law. For example, agencies are  to conduct a self-assessment and submit a plan describing the changes  they intend to make to ensure that common baseline responsibilities are  implemented.

In addition, in August 2016, OMB released guidance intended, among  other things, to define a framework for achieving the data center  consolidation and optimization requirements of FITARA. The guidance  directed agencies to develop a data center consolidation and optimization  strategic plan that defined the agency’s data center strategy for fiscal  years 2016, 2017, and 2018. This strategy was to include, among other  things, a statement from the agency CIO indicating whether the agency  had complied with all data center reporting requirements in FITARA.  Further, the guidance states that OMB is to maintain a public dashboard  to display consolidation-related costs savings and optimization  performance information for the agencies.

Congress Has Undertaken Efforts to Continue Selected FITARA Provisions and Modernize Federal IT

Congress has recognized the importance of agencies’ continued  implementation of FITARA provisions, and has taken legislative action to  extend selected provisions beyond their original dates of expiration.  Specifically, Congress and the President enacted laws to:  remove the expiration dates for the enhanced transparency and improved  risk management provisions, which were set to expire in 2019;  remove the expiration date for portfolio review, which was set to expire in  2019; and extend the expiration date for FDCCI from 2018 to 2020.

In addition, Congress and the President enacted a law to authorize the  availability of funding mechanisms to help further agencies’ efforts to  modernize IT. The law, known as the Modernizing Government  Technology (MGT) Act, authorizes agencies to establish working capital  funds for use in transitioning away from legacy IT systems, as well as for  addressing evolving threats to information security. The law also creates  the Technology Modernization Fund within the Department of the  Treasury, from which agencies can “borrow” money to retire and replace  legacy systems, as well as to acquire or develop systems.

Further, in February 2018, OMB issued guidance for agencies on  implementing the MGT Act. The guidance was intended to provide agencies additional information regarding the Technology Modernization  Fund, as well as the administration and funding of the related IT working  capital funds. Specifically, the guidance encouraged agencies to begin  submitting initial project proposals for modernization on February 27,  2018. In addition, in accordance with the MGT Act, the guidance provided  details regarding a Technology Modernization Board, which is to consist  of (1) the Federal CIO; (2) a senior IT official from the General Services  Administration; (3) a member of DHS’s National Protection and Program  Directorate; and (4) four federal employees with technical expertise in IT  development, financial management, cybersecurity and privacy, and  acquisition that were appointed by the Director of OMB.

FISMA Establishes Responsibilities for Agencies to Address Federal Cybersecurity

Congress and the President enacted the Federal Information Security  Modernization Act of 2014 (FISMA) to improve federal cybersecurity and  clarify government-wide responsibilities. The act addresses the  increasing sophistication of cybersecurity attacks, promotes the use of  automated security tools with the ability to continuously monitor and  diagnose the security posture of federal agencies, and provides for  improved oversight of federal agencies’ information security programs. To  this end, the act clarifies and assigns specific responsibilities to entities  such as OMB, DHS, and the federal agencies. Table 1 describes a  selection of the OMB, DHS, and agency responsibilities.

The Administration Has Undertaken Efforts to Improve and Modernize Federal IT and Strengthen Cybersecurity

Beyond the implementation of FITARA, FISMA, and related actions, the  administration has also initiated other efforts intended to improve federal  IT and the nation’s cybersecurity. Specifically, in March 2017, the  administration established the Office of American Innovation, which has a  mission to, among other things, make recommendations to the President  on policies and plans aimed at improving federal government operations  and services. In doing so, the office is to consult with both OMB and the  Office of Science and Technology Policy on policies and plans intended  to improve government operations and services, improve the quality of life  for Americans, and spur job creation.

In May 2017, the Administration also established the American  Technology Council, which has a goal of helping to transform and  modernize federal agency IT and how the federal government uses and  delivers digital services. The President is the chairman of this council,  and the Federal CIO and the United States Digital Service Administrator  are among the members.

In addition, in May 2017, the President signed Executive Order 13800,  Strengthening the Cybersecurity of Federal Networks and Critical  Infrastructure. This executive order outlined actions to enhance  cybersecurity across federal agencies and critical infrastructure to  improve the nation’s cyber posture and capabilities against cybersecurity  threats. Among other things, the order tasked the Director of the  American Technology Council to coordinate a report to the President  from the Secretary of DHS, the Director of OMB, and the Administrator of  the General Services Administration, in consultation with the Secretary of  Commerce, regarding the modernization of federal IT.

In response, the Report to the President on Federal IT Modernization was  issued in December 2017 and outlined the current and envisioned state of  federal IT. The report focused on modernization efforts to improve the  security posture of federal IT. Further, it recognized that agencies have  attempted to modernize systems but have been stymied by a variety of  factors, including resource prioritization, ability to procure services  quickly, and technical issues. The report provided multiple  recommendations intended to address these issues through the  modernization and consolidation of networks and the use of shared  services to enable future network architectures.

Further, in March 2018, the Administration issued the President’s  Management Agenda, which laid out a long-term vision for modernizing  the federal government. The agenda identified three related drivers of  transformation—IT modernization; data, accountability, and transparency;  and the workforce of the future—that are intended to push change across  the federal government.

The Administration also established 14 related Cross-Agency Priority  goals, many of which have elements that involve IT. In particular, the  Cross-Agency Priority goal on IT modernization stated that modern IT  must function as the backbone of how government serves the public in  the digital age. This goal established three priorities that are to guide the  Administration’s efforts to modernize federal IT: (1) enhancing mission  effectiveness by improving the quality and efficiency of critical services,  including the increased utilization of cloud-based solutions; (2) reducing  cybersecurity risks to the federal mission by leveraging current  commercial capabilities and implementing cutting edge cybersecurity  capabilities; and (3) building a modern IT workforce by recruiting,  reskilling, and retaining professionals able to help drive modernization  with up-to-date technology.

On May 15, 2018, the President signed Executive Order 13833:  Enhancing the Effectiveness of Agency Chief Information Officers. Among  other things, this executive order was intended to better position agencies  to modernize their IT systems, execute IT programs more efficiently, and  reduce cybersecurity risks. The order pertains to 22 of the 24 Chief  Financial Officers (CFO) Act agencies; the Department of Defense and  the Nuclear Regulatory Commission are exempt.

For the covered agencies, the executive order strengthened the role of  agency CIOs by, among other things, requiring them to report directly to  their agency head; serve as their agency head’s primary IT strategic  advisor; and have a significant role in all management, governance, and  oversight processes related to IT. In addition, one of the cybersecurity  requirements directed agencies to ensure that the CIO works closely with  an integrated team of senior executives, including those with expertise in  IT, security, and privacy, to implement appropriate risk management  measures.

Agencies Have Not Fully Addressed the IT Acquisitions and Operations High-Risk Area

In the March 2019 update to our high-risk series, we reported that  agencies still needed to complete significant work related to the  management of IT acquisitions and operations. As government-wide  spending on IT increases every year, the need for appropriate  stewardship of that investment increases as well. However, we stated that  OMB and federal agencies have not made significant progress since  2017 in taking the steps needed to improve how these financial resources  are budgeted and realized. To address this issue, we highlighted the  need for OMB and federal agencies to further implement the  requirements of federal IT acquisition reforms, including the enhancement  of CIO authority.

Our update to the IT acquisitions and operations high-risk area also  stressed that OMB and agencies needed to continue to implement our  prior recommendations in order to improve their ability to effectively and  efficiently invest in IT. Specifically, since fiscal year 2010, we have made  1,278 recommendations to address shortcomings in IT acquisitions and  operations.

As stated in our 2019 high-risk update, OMB and agencies should  demonstrate government-wide progress by, among other things,  implementing at least 80 percent of our recommendations related to  managing IT acquisitions and operations. As of June 2019, OMB and  agencies had fully implemented 768 (or 60 percent) of their 1,277  recommendations. Figure 1 summarizes the progress that OMB and  agencies have made in addressing our recommendations compared to  the 80 percent target.

Overall, federal agencies would be better positioned to realize billions in  cost savings and additional management improvements if they address  these recommendations, including those aimed at implementing CIO  responsibilities, reviewing IT acquisitions; improving data center  consolidation; and managing software licenses.

Agencies Need to Address Shortcomings and Challenges in Implementing CIO Responsibilities

In all, various laws, such as FITARA and related guidance, assign 35 IT  management responsibilities to CIOs in six key areas. These areas are:  leadership and accountability, budgeting, information security, investment  management, workforce, and strategic planning.

In August 2018, we reported that none of the 24 agencies we reviewed  had policies that fully addressed the role of their CIO, as called for by  federal laws and guidance. In this regard, a majority of the agencies had  fully or substantially addressed the role of their CIOs for the area of  leadership and accountability. In addition, a majority of the agencies had  substantially or partially addressed the role of their CIOs for two areas:  information security and IT budgeting.

However, most agencies had partially or minimally addressed the role of  their CIOs for two areas: investment management and strategic planning.  Further, the majority of the agencies minimally addressed or did not  address the role of their CIOs for the remaining area: IT workforce. Figure  2 depicts the extent to which the 24 agencies addressed the role of their  CIOs for the six areas.

Notwithstanding the shortfalls in agencies’ policies addressing the roles of  their CIOs, most agency officials stated that their CIOs are implementing  the responsibilities even if the agencies do not have policies requiring  implementation.

Nevertheless, in their responses to our survey, the CIOs of the 24  selected agencies acknowledged that they were not always very effective  in implementing the six IT management areas. Specifically, at least ten of  the CIOs indicated that they were less than very effective for each of the  six areas of responsibility. We believe that until agencies fully address the  role of CIOs in their policies, agencies will be limited in addressing  longstanding IT management challenges.

Figure 3 depicts the extent to which the CIOs reported their effectiveness  in implementing the six areas of responsibility.

Beyond the actions of the agencies, however, shortcomings in agencies’  policies were also partially attributable to two weaknesses in OMB’s  guidance. First, the guidance did not comprehensively address all CIO  responsibilities, such as those related to assessing the extent to which  personnel meet IT management knowledge and skill requirements and  ensuring that personnel are held accountable for complying with the  information security program. Correspondingly, the majority of the  agencies’ policies did not fully address nearly all of the responsibilities  that were not included in OMB’s guidance.

Second, OMB’s guidance did not ensure that CIOs had a significant role  in (1) IT planning, programming, and budgeting decisions; and (2)  execution decisions and the management, governance, and oversight  processes related to IT, as required by federal law and guidance. In the  absence of comprehensive guidance, CIOs would not be positioned to  effectively acquire, maintain, and secure their IT systems.

In response to the survey conducted for our August 2018 report, the 24  agency CIOs also identified a number of factors that enabled and  challenged their ability to effectively manage IT. Specifically, most agency  CIOs cited five factors as being enablers to effectively carry out their  responsibilities: (1) NIST guidance, (2) the CIO’s position within the  agency hierarchy, (3) OMB guidance, (4) coordination with the Chief  Acquisition Officer (CAO), and (5) legal authority. Further, three factors  were cited by CIOs as major factors that have challenged their ability to  effectively carry out responsibilities: (1) processes for hiring, recruiting,  and retaining IT personnel; (2) financial resources; and (3) the availability  of personnel/staff resources.

As shown in figure 4, the five enabling factors were identified by at least  half of the 24 CIOs and the three factors cited as major challenges were  identified by at least half of the CIOs.

Although OMB issued guidance aimed at addressing the three factors  identified by a majority of the CIOs as major challenges, the guidance did  not fully do so. Further, regarding the financial resources challenge, OMB  recently required agencies to provide data on CIO authority over IT  spending; however, its guidance did not provide a complete definition of  that authority. In the absence of such guidance, agencies created varying  definitions of CIO authority. Until OMB updates its guidance to include a  complete definition of the authority that CIOs are to have over IT  spending, it will be difficult for OMB to identify any deficiencies in this area  and to help agencies make any needed improvements.

In order to address challenges in implementing CIO responsibilities, we  made three recommendations to OMB and one recommendation to each  of the selected 24 federal agencies for each of the six IT management  areas. Most agencies agreed with or had no comments on the  recommendations. However, as of June 2019, none of the 27  recommendations had been implemented. We will continue to monitor the  implementation of these recommendations.

Agencies Need to Ensure that IT Acquisitions Are Reviewed and Approved by CIOs

FITARA includes a provision to enhance covered agency CIOs’ authority  through, among other things, requiring agency heads to ensure that CIOs  review and approve IT contracts. OMB’s FITARA implementation  guidance expanded upon this aspect of the legislation in a number of  ways. Specifically, according to the guidance:

CIOs may review and approve IT acquisition strategies and plans, rather  than individual IT contracts;

CIOs can designate other agency officials to act as their representatives,  but the CIOs must retain accountability;

CAOs are responsible for ensuring that all IT contract actions are  consistent with CIO-approved acquisition strategies and plans; and

CAOs are to indicate to the CIOs when planned acquisition strategies  and acquisition plans include IT.

In January 2018, we reported that most of the CIOs at 22 selected  agencies were not adequately involved in reviewing billions of dollars of  IT acquisitions. For instance, most of the 22 agencies did not identify all  of their IT contracts. In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14.7 billion in fiscal year 2016.  However, we identified 31,493 additional IT contracts with combined  obligations totaling $4.5 billion, raising the total amount obligated to IT  contracts by these agencies in fiscal year 2016 to at least $19.2 billion.

Figure 5 reflects the obligations that the 22 selected agencies reported to  us relative to the obligations we identified.

The percentage of additional IT contract obligations we identified varied  among the selected agencies. For example, the Department of State did  not identify 1 percent of its IT contract obligations. Conversely, eight  agencies did not identify over 40 percent of their IT contract obligations.

Many of the selected agencies that did not identify these IT contract  obligations also did not follow OMB guidance. Specifically, 14 of the 22  agencies did not involve the acquisition office in their process to identify  IT acquisitions for CIO review, as required by OMB. In addition, seven  agencies did not establish guidance to aid officials in recognizing IT. We  concluded that, until these agencies involve the acquisitions office in their  IT acquisition identification processes and establish supporting guidance,  they cannot ensure that they will identify all such acquisitions. Without  proper identification of IT acquisitions, these agencies and their CIOs  cannot effectively provide oversight of these acquisitions.

In addition to not identifying all IT contracts, 14 of the 22 selected  agencies did not fully satisfy OMB’s requirement that the CIO review and  approve IT acquisition plans or strategies. Further, only 11 of 96 randomly  selected IT contracts at 10 of the 22 agencies were CIO-reviewed and  approved as required by OMB’s guidance. The 85 contracts that were not  reviewed had a total possible value of approximately $23.8 billion.

Until agencies ensure that CIOs are able to review and approve all IT  acquisitions, CIOs will continue to have limited visibility and input into  their agencies’ planned IT expenditures and will not be able to effectively  use the increased authority that FITARA’s contract approval provision is  intended to provide. Further, agencies will likely miss an opportunity to  strengthen their CIOs’ authority and the oversight of acquisitions. As a  result, agencies may award IT contracts that are duplicative, wasteful, or  poorly conceived.

As a result of these findings, we made 39 recommendations in our  January 2018 report. Among these, we recommended that agencies  ensure that their acquisition offices are involved in identifying IT  acquisitions and issuing related guidance and that IT acquisitions are  reviewed in accordance with OMB guidance. OMB and the majority of the  agencies generally agreed with or did not comment on the  recommendations. As of June 2019, 23 of the 39 of the recommendations  had not been implemented.

Agencies Have Made Significant Progress in Consolidating Data Centers, but Need to Take Action to Achieve Planned Cost Savings

Data center consolidation efforts are key to implementing FITARA.  Specifically, OMB established the FDCCI in February 2010 to improve the  efficiency, performance, and environmental footprint of federal data  center activities. The enactment of FITARA in 2014 codified and  expanded the initiative.

In addition, in August 2016, OMB issued a memorandum which  established the Data Center Optimization Initiative (DCOI) and included  guidance on how to implement the data center consolidation and  optimization provisions of FITARA. Among other things, the guidance  required agencies to consolidate inefficient infrastructure, optimize  existing facilities, improve their security posture, and achieve cost  savings.

According to the 24 agencies covered by the initiative, data center  consolidation and optimization efforts had resulted in approximately $4.7  billion in cost savings through August 2018. Even so, additional work  remains to fully carry out the initiative. Specifically, in a series of reports  that we issued from July 2011 through April 2019, we noted that, while  data center consolidation could potentially save the federal government  billions of dollars, weaknesses existed in several areas, including  agencies’ data center consolidation plans, data center optimization, and  OMB’s tracking and reporting on related cost savings.

In April 2019, we reported that agencies continued to report mixed  progress toward achieving OMB’s goals for closing data centers and  realizing the associated savings by September 2018. Specifically, as of  August 2018, over half of the agencies reported that they had met, or  planned to meet, all of their OMB-assigned closure goals for tiered data  centers by the deadline. Six agencies reported that they did not plan to  meet their goals for tiered data centers. In addition, as of August 2018, 11  agencies reported that they had already met the goal for closing 60  percent of their non-tiered centers, three agencies reported that they  planned to meet the goal by the end of fiscal year 2018, and nine  agencies reported that they did not plan to meet the goal by the end of  fiscal year 2018.

In all, the 24 agencies reported a total of 6,250 data center closures as of  August 2018, which represented about half of the total reported number  of federal data centers. In addition, the agencies reported 1,009 planned  closures by the end of fiscal year 2018, with an additional 191 closures  planned through fiscal year 2023, for a total of 1,200 further closures.

Further, in August 2018, 22 agencies reported that they had achieved  $1.94 billion in cost savings for fiscal years 2016 through 2018, while two  agencies reported that they had not achieved any savings. In addition to  that amount, 21 agencies identified an additional $0.42 billion in planned  savings through fiscal year 2018—for a total of $2.36 billion in planned  cost savings from fiscal years 2016 through 2018. Nevertheless, this total  is about $0.37 billion less than OMB’s goal of $2.7 billion for overall DCOI  savings.

From July 2011 through April 2019, we made a total of 196  recommendations to OMB and 24 agencies to improve the execution and  oversight of the initiative. Most agencies and OMB agreed with our  recommendations or had no comments. As of June 2019, 79 of these 196  recommendations had not been implemented.

Agencies Need to Better Manage Software Licenses to Achieve Savings

In our 2015 high-risk report’s discussion of IT acquisitions and operations,  we identified the management of software licenses as a focus area, in  part because of the potential for cost savings. Federal agencies engage  in thousands of software licensing agreements annually. The objective of  software license management is to manage, control, and protect an  organization’s software assets. Effective management of these licenses  can help avoid purchasing too many licenses, which can result in unused  software, as well as too few licenses, which can result in noncompliance  with license terms and cause the imposition of additional fees.

As part of its PortfolioStat initiative, OMB has developed a policy that  addresses software licenses. This policy requires agencies to conduct an  annual, agency-wide IT portfolio review to, among other things, reduce  commodity IT spending. Such areas of spending could include software  licenses.

In May 2014, we reported on federal agencies’ management of software  licenses and determined that better management was needed to achieve  significant savings government-wide. Of the 24 selected agencies we  reviewed, only two had comprehensive policies that included the  establishment of clear roles and central oversight authority for managing  enterprise software license agreements, among other things. Of the  remaining 22 agencies, 18 had policies that were not comprehensive, and  four had not developed any policies.

Further, we found that only two of the 24 selected agencies had  established comprehensive software license inventories, a leading  practice that would help them to adequately manage their software  licenses. The inadequate implementation of this and other leading  practices in software license management was partially due to  weaknesses in agencies’ policies. As a result, we concluded that  agencies’ oversight of software license spending was limited or lacking,  thus, potentially leading to missed savings. However, the potential  savings could be significant considering that, in fiscal year 2012, one  major federal agency reported saving approximately $181 million by  consolidating its enterprise license agreements, even when its oversight  process was ad hoc.

Accordingly, we recommended that OMB issue a directive to help guide  agencies in managing software licenses. We also made 135  recommendations to the 24 agencies to improve their policies and  practices for managing licenses. Among other things, we recommended  that the agencies (1) regularly track and maintain a comprehensive  inventory of software licenses and (2) analyze the inventory to identify  opportunities to reduce costs and better inform investment decision  making.

Most agencies generally agreed with the recommendations or had no  comments. As of June 2019, 27 of the 135 recommendations had not  been implemented. Table 2 reflects the extent to which the 24 agencies  implemented the recommendations in these two areas.

Agencies Need to Address Shortcomings in Cybersecurity Area

We have consistently identified shortcomings in the federal government’s  approach to cybersecurity. In particular, in a September 2018 report, we  identified four major cybersecurity challenges: (1) establishing a  comprehensive cybersecurity strategy and performing effective oversight,  (2) securing federal systems and information, (3) protecting cyber critical  infrastructure, and (4) protecting privacy and sensitive data.

To address these challenges, we identified 10 critical actions that the  federal government and other entities need to take. For example, in order  to address the challenge of securing federal systems and information, we  identified three actions that the agencies should take: (1) improve  implementation of government-wide cybersecurity initiatives, (2) address  weaknesses in federal information security programs, and (3) enhance  the federal response to cyber incidents. Figure 6 depicts the 10 critical  actions to address the four major cybersecurity challenges.

As we have previously noted, in order to strengthen the federal  government’s cybersecurity posture, agencies should fully implement the  information security programs required by FISMA. In this regard, FISMA  provides a framework for ensuring the effectiveness of information  security controls for federal information resources. The law requires each  agency to develop, document, and implement an agency-wide information  security program. Such a program should include risk assessments; the  development and implementation of policies and procedures to cost- effectively reduce risks; plans for providing adequate information security  for networks, facilities, and systems; security awareness and specialized  training; the testing and evaluation of the effectiveness of controls; the  planning, implementation, evaluation, and documentation of remedial  actions to address information security deficiencies; procedures for  detecting, reporting, and responding to security incidents; and plans and  procedures to ensure continuity of operations.

Since fiscal year 2010, we have made 3,058 recommendations to  agencies aimed at addressing the four cybersecurity challenges. These  recommendations have identified actions for agencies to take to  strengthen technical security controls over their computer networks and  systems. They also have included recommendations for agencies to fully  implement aspects of their information security programs, as mandated  by FISMA. Nevertheless, many agencies continue to be challenged in  safeguarding their information systems and information, in part, because  many of these recommendations have not been implemented. Of the  3,058 recommendations made since 2010, 2,384 (or 78 percent) had  been implemented as of June 2019, leaving 674 recommendations (or 22  percent) unimplemented.

Agencies’ Inspectors General Are to Identify Information Security Program Weaknesses

In order to determine the effectiveness of the agencies’ information  security programs and practices, FISMA requires federal agencies’  inspectors general to conduct annual independent evaluations. The  agencies are to report the results of these evaluations to OMB, and OMB  is to summarize the results in annual reports to Congress.

In these evaluations, the inspectors general are to frame the scope of  their analyses, identify key findings, and detail recommendations to  address the findings. The evaluations also are to capture maturity model  ratings for their respective agencies. Toward this end, in fiscal year 2017,  the inspector general community, in partnership with OMB and DHS,  finalized a 3-year effort to create a maturity model for FISMA metrics. The  maturity model aligns with the five function areas in the NIST Framework  for Improving Critical Infrastructure Cybersecurity (Cybersecurity  Framework): identify, protect, detect, respond, and recover. This  alignment is intended to help promote consistent and comparable metrics  and criteria and provide agencies with a meaningful independent  assessment of their information security programs.

The maturity model is designed to summarize the status of agencies’  information security programs on a five-level capability maturity scale.  The five maturity levels are defined as follows:

Level 1 (Ad hoc): Policies, procedures, and strategy are not formalized;  activities are performed in an ad-hoc, reactive manner.

Level 2 (Defined): Policies, procedures, and strategy are formalized and  documented but not consistently implemented.

Level 3 (Consistently Implemented): Policies, procedures, and strategy  are consistently implemented, but quantitative and qualitative  effectiveness measures are lacking.

Level 4 (Managed and Measurable): Quantitative and qualitative  measures on the effectiveness of policies, procedures, and strategy are  collected across the organizations and used to assess them and make  necessary changes.

Level 5 (Optimized): Policies, procedures, and strategy are fully  institutionalized, repeatable, self-generating, consistently implemented  and regularly updated based on a changing threat and technology  landscape and business/mission needs.

According to this maturity model, Level 4 (managed and measurable)  represents an effective level of security. Therefore, if an inspector  general rates an agency’s information security program at Level 4 or  Level 5, then that agency is considered to have an effective information  security program.

For fiscal year 2017, the inspectors general for six of the 23 civilian CFO  Act agencies reported that their agencies had an effective agency-wide  information security program. Specifically, for the five function areas in  the NIST Cybersecurity Framework, most inspectors general reported  that their agencies were at Level 3 (consistently implemented) for the  identify, protect, and recover functions, and at Level 2 (defined) for the  detect and respond functions. Table 3 shows the individual maturity  ratings for each covered agency.

OMB Requires Agencies to Meet Targets for Cybersecurity Metrics

In its efforts toward strengthening the federal government’s cybersecurity,  OMB also requires agencies to submit related cybersecurity metrics as  part of its Cross-Agency Priority goals. In particular, OMB developed the  IT modernization goal so that federal agencies will be able to build and  maintain more modern, secure, and resilient IT. A key part of this goal is  to reduce cybersecurity risks to the federal mission through three  strategies: manage asset security, protect networks and data, and limit  personnel access. The key targets supporting each of these strategies  correspond to areas within the FISMA metrics. Table 4 outlines the  strategies, their associated targets, and the 23 civilian CFO Act agencies’  progress in meeting those targets, as of June 2018.

In conclusion, by addressing the high-risk areas on improving the  management of IT acquisitions and operations and ensuring the  cybersecurity of the nation, the government has the opportunity to both  save billions of dollars and advance the efficiency and effectiveness of  government services. Most agencies have taken steps to execute key IT  management and cybersecurity initiatives, including implementing CIO  responsibilities, requiring CIO reviews of IT acquisitions, realizing data  center consolidation cost savings, managing software assets, and  complying with FISMA requirements. The agencies have also continued  to address the recommendations that we have made over the past  several years. Nevertheless, further efforts by OMB and federal agencies  to implement our previous recommendations would better position them  to improve the management and security of federal IT. To help ensure  that these efforts succeed, we will continue to monitor agencies’ efforts  toward implementing the recommendations.

Chairman Connolly, Ranking Member Meadows, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions that you may have at this time.

If you or your staff have any questions about this testimony, please  contact Carol C. Harris, Director of Information Technology Acquisition  Management Issues, at (202) 512-4456 or harriscc@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. GAO staff who made key  contributions to this testimony are Kevin Walsh (Assistant Director),  Meredith Raymond (Analyst-in-Charge), Chris Businsky, and Rebecca  Eyler.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

The federal government has spent billions on information technology projects that have failed or performed poorly. Some agencies have had massive cybersecurity failures. These IT efforts often suffered from ineffective management.

We testified about 2 issues on our High Risk List: management of IT acquisitions and operations, and cybersecurity.

60% of our 1,277 recommendations on IT acquisitions and operations

78% of our 3,058 recommendations on cybersecurity

Much remains to be done. For example, most agencies have not, as required, assigned key IT responsibilities to the chief information officer.