Background According to the President’s budget, the federal government plans to  invest more than $96 billion for IT in fiscal year 2018—the largest amount  ever budgeted. Despite such large IT expenditures, we have previously  reported that investments in federal IT too often result in failed projects  that incur cost overruns and schedule slippages, while contributing little to  the desired mission-related outcomes. For example: The tri-agency National Polar-orbiting Operational Environmental  Satellite System was disbanded in February 2010 by the White  House’s Office of Science and Technology Policy after the program  spent 16 years and almost $5 billion. The Department of Homeland Security’s (DHS) Secure Border  Initiative  Network program was ended in January 2011, after the  department obligated more than $1 billion for the program. The Department of Veterans Affairs’ Financial and Logistics  Integrated Technology Enterprise program was intended to be  delivered by 2014 at a total estimated cost of $609 million, but was  terminated in October 2011. The Department of Defense’s Expeditionary Combat Support System  was canceled in December 2012 after spending more than a billion  dollars and failing to deploy within 5 years of initially obligating  funds. The United States Coast Guard (Coast Guard) decided to terminate  its Integrated Health Information System project in 2015. As reported  by the agency in August 2017, the Coast Guard spent approximately  $60 million over 7 years on this project, which resulted in no  equipment or software that could be used for future efforts. Our past work has found that these and other failed IT projects often  suffered from a lack of disciplined and effective management, such as  project planning, requirements definition, and program oversight and  governance. In many instances, agencies had not consistently applied  best practices that are critical to successfully acquiring IT. Such projects have also failed due to a lack of oversight and governance.  Executive-level governance and oversight across the government has  often been ineffective, specifically from CIOs. For example, we have  reported that some CIOs’ roles were limited because they did not have  the authority to review and approve the entire agency IT portfolio. In addition to failures when acquiring IT, security deficiencies can  threaten systems once they become operational. As we previously  reported, in order to counter security threats, 23 civilian Chief Financial  Officers Act agencies spent a combined total of approximately $4 billion  on IT security-related activities in fiscal year 2016. Even so, our  cybersecurity work at federal agencies continues to highlight information  security deficiencies. The following examples describe the types of risks  we have found at federal agencies. In November 2017, we reported that the Department of Education’s  Office of Federal Student Aid did not consistently analyze privacy  risks for its electronic information systems, and policies and  procedures for protecting information systems were not always up to  date. In August 2017, we reported that, since the 2015 data breaches, the  Office of Personnel Management (OPM) had taken actions to prevent,  mitigate, and respond to data breaches involving sensitive personal  and background investigation information. However, we noted that  the agency had not fully implemented recommendations made to  OPM by DHS’s United States Computer Emergency Readiness Team  to help the agency improve its overall security posture and improve its  ability to protect its systems and information from security breaches. In July 2017, we reported that IT security at the Internal Revenue  Service had weaknesses that limited its effectiveness in protecting the  confidentiality, integrity, and availability  of financial and sensitive  taxpayer data. An underlying reason for these weaknesses was that  the Internal Revenue Service had not effectively implemented  elements of its information security program. In May 2016, we reported that the National Aeronautics and Space  Administration, the Nuclear Regulatory Commission, OPM, and the  Department of Veteran Affairs did not always control access to  selected high-impact systems, patch known software vulnerabilities,  and plan for contingencies. An underlying reason for these  weaknesses was that the agencies had not fully implemented key  elements of their information security programs. In August 2016, we reported that the IT security of the Food and Drug  Administration had significant weaknesses that jeopardized the  confidentiality, integrity, and availability  of its information systems and  industry and public health data. FITARA Increases CIO  Authorities and  Responsibilities Congress and the President have enacted various key pieces of reform  legislation to address IT management issues. These include the federal  IT acquisition reform legislation commonly referred to as the Federal  Information Technology Acquisition Reform Act (FITARA). This  legislation was intended to improve covered agencies’ acquisitions of IT  and enable Congress to monitor agencies’ progress and hold them  accountable for reducing duplication and achieving cost savings. The  law includes specific requirements related to seven areas: Agency CIO authority enhancements. CIOs at covered agencies  have the authority to, among other things, (1) approve the IT budget  requests of their respective agencies and (2) review and approve IT  contracts. Federal data center consolidation initiative (FDCCI). Agencies  covered by FITARA are required, among other things, to provide a  strategy for consolidating and optimizing their data centers and issue  quarterly updates on the progress made. Enhanced transparency and improved risk management. The  Office of Management and Budget (OMB) and covered agencies are  to make detailed information on federal IT investments publicly  available, and agency CIOs are to categorize their investments by  level of risk. Portfolio review. Covered agencies are to annually review IT  investment portfolios in order to, among other things, increase  efficiency and effectiveness and identify potential waste and  duplication. Expansion of training and use of IT acquisition cadres. Covered  agencies are to update their acquisition human capital plans to  support timely and effective IT acquisitions. In doing so, the law calls  for agencies to consider, among other things, establishing IT  acquisition cadres (i.e., multi-functional groups of professionals to  acquire and manage complex programs), or developing agreements  with other agencies that have such cadres. Government-wide software purchasing program. The General  Services Administration is to develop a strategic sourcing initiative to  enhance government-wide acquisition and management of software.  In doing so, the law requires that, to the maximum extent practicable,  the General Services Administration should allow for the purchase of  a software license agreement that is available for use by all executive  branch agencies as a single user. Maximizing the benefit of the Federal Strategic Sourcing  Initiative. Federal agencies are required to compare their  purchases of services and supplies to what is offered under the  Federal Strategic Sourcing Initiative. In June 2015, OMB released guidance describing how agencies are to  implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory establish government-wide IT management controls to meet the law’s  requirements, while providing agencies with flexibility to adapt to  unique agency processes and requirements; strengthen the relationship between agency CIOs and bureau CIOs; strengthen CIO accountability for IT costs, schedules, performance,  and security. The guidance identifies a number of actions that agencies are to take to  establish a basic set of roles and responsibilities (referred to as the  common baseline) for CIOs and other senior agency officials; and thus, to  implement the authorities described in the law. For example, agencies are  to conduct a self-assessment and submit a plan describing the changes  they intend to make to ensure that common baseline responsibilities are  implemented. In addition, in August 2016, OMB released guidance intended to, among  other things, define a framework for achieving the data center  consolidation and optimization requirements of FITARA. The guidance  directs agencies to develop a data center consolidation and optimization  strategic plan that defines the agency’s data center strategy for fiscal  years 2016, 2017, and 2018. This strategy is to include, among other  things, a statement from the agency CIO indicating whether the agency  has complied with all data center reporting requirements in FITARA.  Further, the guidance indicates that OMB is to maintain a public  dashboard to display consolidation-related costs savings and optimization  performance information for the agencies. Congress Has Undertaken  Efforts to Continue  Selected FITARA  Provisions and Modernize  Federal IT Congress has recognized the importance of agencies’ continued  implementation of FITARA provisions, and has taken legislative action to  extend selected provisions beyond their original dates of expiration.  Specifically, Congress and the President enacted laws to:  remove the expiration date for enhanced transparency and improved  risk management provisions, which were set to expire in 2019;  remove the expiration date for portfolio review, which was set to  expire in 2019; and extend the expiration date for FDCCI from 2018 to 2020. In addition, Congress and the President enacted a law to authorize the  availability  of funding mechanisms to help further agencies’ efforts to  modernize IT. The law, known as the Modernizing Government  Technology (MGT) Act, authorizes agencies to establish working capital  funds for use in transitioning from legacy IT systems, as well as for  addressing evolving threats to information security. The law also creates  the Technology Modernization  Fund, within the Department of the  Treasury, from which agencies can “borrow” money to retire and replace  legacy systems, as well as acquire or develop systems. Further, in February 2018, OMB issued guidance for agencies to  implement the MGT Act. The guidance was intended to provide  agencies additional information regarding the Technology Modernization  Fund, and the administration and funding of the related IT working capital  funds. Specifically, the guidance allowed agencies to begin submitting  initial project proposals for modernization on February 27, 2018. In  addition, in accordance with the MGT Act, the guidance provides details  regarding a Technology Modernization Board, which is to consist of (1)  the Federal CIO; (2) a senior official from the General Services  Administration; (3) a member of DHS’s National Protection and Program  Directorate; and (4) four federal employees with technical expertise in IT  development, financial management, cybersecurity and privacy, and  acquisition, appointed by the Director of OMB. FISMA Establishes  Responsibilities for  Agencies to Address  Federal Cybersecurity Congress and the President enacted the Federal Information Security  Modernization Act of 2014 (FISMA) to improve federal cybersecurity  and clarify government-wide responsibilities. The act addresses the  increasing sophistication of cybersecurity attacks, promotes the use of  automated security tools with the ability to continuously monitor and  diagnose the security posture of federal agencies, and provides for  improved oversight of federal agencies’ information security programs. Specifically, the act clarifies and assigns additional responsibilities to  entities such as OMB, DHS, and the federal agencies. Table 1 describes  a selection of OMB, DHS, and agency responsibilities. The Current Administration  Has Undertaken Efforts to  Improve, Modernize, and  Strengthen the Security of  Federal IT Beyond the implementation of FITARA,  FISMA,  and related actions, the  current administration has also initiated other efforts intended to improve  federal IT. Specifically, in March 2017, the administration established the  Office of American Innovation,  which has a mission to, among other  things, make recommendations to the President on policies and plans  aimed at improving federal government operations and services. In doing  so, the office is to consult with both OMB and the Office of Science and  Technology Policy on policies and plans intended to improve government  operations and services, improve the quality of life for Americans, and  spur job creation. In May 2017, the Administration also established the American  Technology Council, which has a goal of helping to transform and  modernize federal agency IT and how the federal government uses and  delivers digital services. The President is the chairman of this council,  and the Federal CIO and the United States Digital Service Administrator  are among the members. In addition, on May 11, 2017, the President signed Executive Order  13800, Strengthening the Cybersecurity of Federal Networks and Critical  Infrastructure. This executive order outlined actions to enhance  cybersecurity across federal agencies and critical infrastructure to  improve the nation’s cyber posture and capabilities against cyber security  threats. Among other things, the order tasked the Director of the  American Technology Council to coordinate a report to the President  from the Secretary of DHS, the Director of OMB, and the Administrator of  the General Services Administration, in consultation with the Secretary of  Commerce, regarding the modernization of federal IT. As a result, the  Report to the President on Federal IT Modernization was issued on  December 13, 2017, and outlined the current and envisioned state of  federal IT. The report focused on modernization efforts to improve the  security posture of federal IT and recognized that agencies have  attempted to modernize systems but have been stymied by a variety of  factors, including resource prioritization, ability to procure services  quickly, and technical issues. The report provided multiple  recommendations intended to address these issues through the  modernization and consolidation of networks and the use of shared  services to enable future network architectures. Further, in March 2018, the Administration issued the President’s  Management Agenda, which lays out a long-term vision for modernizing  the federal government. The agenda identifies three related drivers of  transformation—IT modernization; data, accountability, and transparency;  and the workforce of the future—that are intended to push change across  the federal government. The Administration also established 14 related Cross-Agency Priority  goals, many of which have elements that involve IT. In particular, the  Cross-Agency Priority goal on IT modernization states that modern IT  must function as the backbone of how government serves the public in  the digital age and provides three priorities that are to guide the  Administration’s efforts to modernize federal IT: (1) enhancing mission  effectiveness by improving the quality and efficiency of critical services,  including the increased utilization of cloud-based solutions; (2) reducing  cybersecurity risks to the federal mission by leveraging current  commercial capabilities and implementing cutting edge cybersecurity  capabilities; and (3) building a modern IT workforce by recruiting,  reskilling, and retaining professionals able to help drive modernization  with up-to-date technology. Most recently, on May 15, 2018, the President signed Executive Order  13833, Enhancing the Effectiveness of Agency Chief Information Officers.  Among other things, this executive order is intended to better position  agencies to modernize their IT systems, execute IT programs more  efficiently, and reduce cybersecurity risks. The order pertains to 22 of  the 24 Chief Financial Officer Act agencies: the Department of Defense  and the Nuclear Regulatory Commission are exempt. For the covered agencies, the executive order strengthens the role of  agency CIOs by, among other things, requiring to report directly to their  agency head; to serve as their agency head’s primary IT strategic  advisor; and to have a significant role in all management, governance,  and oversight processes related to IT. In addition, one of the  cybersecurity requirements directs agencies to ensure that the CIO works  closely with an integrated team of senior executives, including those with  expertise in IT, security, and privacy, to implement appropriate risk  management measures. Agencies Have Not  Fully Addressed the  IT Acquisitions and  Operations High-Risk  Area In the February 2017 update to our high-risk series, we reported that   agencies still needed to complete significant work related to the  management of IT acquisitions and operations  We stressed that OMB  and federal agencies should continue to expeditiously implement FITARA  and OMB’s related guidance, which include enhancing CIO authority,  consolidating data centers, and acquiring and managing software  licenses. Our update to this high-risk area also stressed that OMB and agencies  needed to continue to implement our prior recommendations in order to  improve their ability to effectively and efficiently invest in IT. Specifically,  from fiscal years 2010 through 2015, we made 803 recommendations to  OMB and federal agencies to address shortcomings in IT acquisitions and  operations. In addition, in fiscal year 2016, we made 202 new  recommendations, thus, further reinforcing the need for OMB and  agencies to address the shortcomings in IT acquisitions and operations. As stated in the update, OMB and agencies should demonstrate  government-wide progress in the management of IT investments by,  among other things, implementing at least 80 percent of our  recommendations related to managing IT acquisitions and operations  within 4 years. As of May 2018, OMB and agencies had fully implemented  489 (or about 61 percent) of the 803 recommendations. Figure 1  summarizes the progress that OMB and agencies have made in  addressing our recommendations as compared to the 80 percent target. Overall, federal agencies would be better positioned to realize billions in  cost savings and additional management improvements if they address  these recommendations, including those aimed at implementing CIO  responsibilities, review of IT acquisitions; improving data center  consolidation; and managing software licenses. Agencies Need to Address  Shortcomings and  Challenges in  Implementing CIO  Responsibilities In all, the various laws, such as FITARA, and related guidance assign  35 IT management responsibilities to CIOs in six key areas. These areas  are: leadership and accountability, budgeting, information security,  investment management, workforce, and strategic planning. In a draft report on CIO responsibilities that we have provided to the  agencies for comment and plan to issue in June 2018, our preliminary  results suggest that none of the 24 agencies we reviewed had policies  that fully addressed the role of their CIO, as called for by federal laws and  guidance. In this regard, a majority of the agencies fully or substantially  addressed the role of their CIOs for the area of leadership and  accountability. In addition, a majority of the agencies substantially or  partially addressed the role of their CIOs for two areas: information  security and IT budgeting. However, most agencies partially or minimally  addressed the role of their CIOs for two areas: investment management  and strategic planning. These preliminary results are shown in figure 2. Despite these shortfalls, most agency officials stated that their CIOs are  implementing the responsibilities even if the agencies do not have  policies requiring implementation. Nevertheless, the CIOs of the 24 selected agencies acknowledged in  responses to a survey that we administered for our draft report that they  were not always very effective in implementing the six IT management  areas. Specifically, our preliminary results show that at least 10 of the  CIOs indicated that they were less than very effective for each of the six  areas of responsibility. We believe that until agencies fully address the  role of CIOs in their policies, agencies will be limited in addressing  longstanding IT management challenges. Figure 3 depicts that extent to which the CIOs reported their effectiveness  in implementing the six areas of responsibility. Beyond the actions of the agencies, however, our preliminary results  indicate that shortcomings in agencies’ policies also are partially  attributable to two weaknesses in OMB’s FITARA  implementation  guidance. First, the guidance does not comprehensively address all CIO  responsibilities, such as those related to assessing the extent to which  personnel meet IT management knowledge and skill requirements, and  ensuring that personnel are held accountable for complying with the  information security program. Correspondingly, the majority of the  agencies’ policies did not fully address nearly all of the responsibilities  that were not included in OMB’s guidance. Second, OMB’s guidance does not ensure that CIOs have a significant  role in (1) IT planning, programming, and budgeting decisions and (2)  execution decisions and the management, governance, and oversight  processes related to IT, as required by federal law and guidance. In the  absence of comprehensive guidance, CIOs will not be positioned to  effectively acquire, maintain, and secure their IT systems. Based on our preliminary results, 24 agency CIOs also identified a  number of factors that enabled and challenged their ability to effectively  manage IT. As shown in figure 4, five factors were identified by at least  half of the 24 CIOs as major enablers and three factors were identified by  at least half of the CIOs as major challenges. Specifically, most agency  CIOs cited five factors as being enablers to effectively carry out their  responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency  hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition  Officer (CAO), and (5) legal authority. Further, three factors were cited by  CIOs as major factors that have challenged their ability to effectively carry  out responsibilities: (1) processes for hiring, recruiting, and retaining IT  personnel; (2) financial resources; and (3) the availability  of  personnel/staff resources. As our draft report states, although OMB has issued guidance aimed at  addressing the three factors that were identified by at least half of the  CIOs as major challenges, the guidance does not fully address those  challenges. Further, regarding the financial resources challenge, OMB  recently required agencies to provide data on CIO authority over IT  spending; however, its guidance does not provide a complete definition of  the authority. We believe that in the absence of such guidance, agencies  have created varying definitions of CIO authority. Further, until OMB  updates its guidance to include a complete definition of the authority that  CIOs are to have over IT spending, it will be difficult for OMB to identify  any deficiencies in this area and to help agencies make any needed  improvements. In order to address challenges in implementing CIO responsibilities, we  intend to include in our draft report recommendations to OMB and each of  the selected 24 federal agencies to improve the effectiveness of CIOs’  implementation of their responsibilities for each of the six IT management  areas. Agencies Need to Ensure  That IT Acquisitions Are  Reviewed and Approved  by CIOs FITARA includes a provision to enhance covered agency CIOs’ authority  through, among other things, requiring agency heads to ensure that CIOs  review and approve IT contracts. OMB’s FITARA implementation  guidance expanded upon this aspect of the legislation in a number of  ways. Specifically, according to the guidance: CIOs may review and approve IT acquisition strategies and plans,  rather than individual IT contracts; CIOs can designate other agency officials to act as their  representatives, but the CIOs must retain accountability; CAOs are responsible for ensuring that all IT contract actions are  consistent with CIO-approved acquisition strategies and plans; and CAOs are to indicate to the CIOs when planned acquisition strategies  and acquisition plans include IT. In January 2018, we reported that most of the CIOs at 22 selected  agencies  were not adequately involved in reviewing billions of dollars of  IT acquisitions. For instance, most of the 22 agencies did not identify all  of their IT contracts. In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14.7 billion in fiscal year 2016.  However, we identified 31,493 additional contracts with $4.5 billion  obligated, raising the total amount obligated by these agencies to IT  contracts in fiscal year 2016 to at least $19.2 billion. Figure 5 reflects the  obligations that the 22 selected agencies reported to us relative to the  obligations we identified. The percentage of additional IT contract obligations we identified varied  among the selected agencies. For example, the Department of State did  not identify 1 percent of its IT contract obligations. Conversely, 8  agencies did not identify over 40 percent of their IT contract obligations. Many of the selected agencies that did not identify these IT contract  obligations did not follow OMB guidance. Specifically, 14 of the 22  agencies did not involve the acquisition office in their process to identify  IT acquisitions for CIO review, as required by OMB. In addition, 7  agencies did not establish guidance to aid officials in recognizing IT. We  concluded that until these agencies involve the acquisitions office in their  IT acquisition identification processes and establish supporting guidance,  they cannot ensure that they will identify all IT acquisitions. Without  proper identification of IT acquisitions, these agencies and CIOs cannot  effectively provide oversight of these acquisitions. In addition to not identifying all IT contracts, 14 of the 22 selected  agencies did not fully satisfy OMB’s requirement that the CIO review and  approve IT acquisition plans or strategies. Further, only 11 of 96  randomly selected IT contracts at 10 agencies that we evaluated were  CIO-reviewed and approved as required by OMB’s guidance. The 85 IT  contracts not reviewed had a total possible value of approximately $23.8  billion. We believe that until agencies ensure that CIOs are able to review and  approve all IT acquisitions, CIOs will continue to have limited visibility and  input into their agencies’ planned IT expenditures and will not be able to  use the increased authority that FITARA’s contract approval provision is  intended to provide. Further, agencies will likely miss an opportunity to  strengthen CIOs’ authority and the oversight of IT acquisitions. As a  result, agencies may award IT contracts that are duplicative, wasteful, or  poorly conceived. As a result of these findings, we made 39 recommendations in our  January 2018 report. The recommendations included that agencies  ensure that their acquisition offices are involved in identifying IT  acquisitions and issuing related guidance, and that IT acquisitions are  reviewed in accordance with OMB guidance. OMB and the majority of the  agencies generally agreed with or did not comment on the  recommendations. Agencies Have Made  Progress in Consolidating  Data Centers, but Need to  Take Action to Achieve  Planned Cost Savings In our February 2017 high-risk update, we stated that OMB and agencies  needed to demonstrate additional progress on achieving data center  consolidation savings in order to improve the management of IT  acquisitions and operations. Further, data center consolidation efforts are  key to implementing FITARA. Specifically, OMB established the FDCCI in  February 2010 to improve the efficiency, performance, and environmental  footprint of federal data center activities. The enactment of FITARA in  2014 codified and expanded the initiative. In a series of reports that we issued from July 2011 through August 2017,  we noted that, while data center consolidation could potentially save the  federal government billions of dollars, weaknesses existed in several  areas, including agencies’ data center consolidation plans, data center  optimization, and OMB’s tracking and reporting on related cost savings.  In these reports, we made a total of 160 recommendations to OMB and  24 agencies to improve the execution and oversight of the initiative. Most  agencies and OMB agreed with our recommendations or had no  comments. As of May 2018, 80 of these 160 recommendations remained  unimplemented. Further, we recently reported in May 2018 that the 24 agencies  participating in OMB’s Data Center Optimization Initiative  (DCOI) had  communicated mixed progress toward achieving OMB’s goals for closing  data centers by September 2018. Over half of the agencies reported  that they had either already met, or planned to meet, all of their OMB- assigned goals by the deadline. This would result in the closure of 7,221  of the 12,062 centers that agencies reported in August 2017. However, 4  agencies reported that they do not have plans to meet all of their  assigned goals and 2 agencies are working with OMB to establish revised  targets. With regard to agencies’ progress in achieving cost savings, 24  agencies reported $3.9 billion in cost savings through 2018. The 24 agencies also reported limited progress against OMB’s five data  center optimization targets for server utilization and automated  monitoring, energy metering, power usage effectiveness, facility  utilization, and virtualization. As of August 2017, 1 agency reported that it  had met four targets, 1 agency reported that it had met three targets, 6  agencies reported having met either one or two targets, and 14 agencies  reported meeting none of the targets. Further, as of August 2017, most agencies were not planning to meet  OMB’s fiscal year 2018 optimization targets. Specifically, 4 agencies  reported plans to meet all of their applicable targets by the end of fiscal  year 2018; 14 agencies reported plans to meet some of the targets; and 4  reported that they did not plan to meet any targets. Figure 6 summarizes  agency-reported plans to meet or exceed the OMB’s data center  optimization targets, as of August 2017. In 2016 and 2017, we made 81 recommendations to OMB and the 24  DCOI agencies to help improve the reporting of data center-related cost  savings and to achieve optimization targets. As of May 2018, 71 of these  81 recommendations have not been fully addressed. Agencies Need to Better  Manage Software  Licenses to Achieve  Savings In our 2015 high-risk report’s discussion of IT acquisitions and operations,  we identified the management of software licenses as an area of concern,  in part because of the potential for cost savings. Federal agencies  engage in thousands of software licensing agreements annually. The  objective of software license management is to manage, control, and  protect an organization’s software assets. Effective management of these  licenses can help avoid purchasing too many licenses, which can result in  unused software, as well as too few licenses, which can result in  noncompliance with license terms and cause the imposition of additional  fees. As part of its PortfolioStat initiative, OMB has developed policy that  addresses software licenses. This policy requires agencies to conduct an  annual, agency-wide IT portfolio review to, among other things, reduce  commodity IT spending. Such areas of spending could include software  licenses. In May 2014, we reported on federal agencies’ management of software  licenses and determined that better management was needed to achieve  significant savings government-wide. Of the 24 selected agencies we  reviewed, only 2 had comprehensive policies that included the  establishment of clear roles and central oversight authority for managing  enterprise software license agreements, among other things. Of the  remaining 22 agencies, 18 had policies that were not comprehensive, and  4 had not developed any policies. Further, we found that only 2 of the 24 selected agencies had established  comprehensive software license inventories, a leading practice that would  help them to adequately manage their software licenses. The inadequate implementation of this and other leading practices in software license  management was partially due to weaknesses in agencies’ policies. As a  result, we concluded that agencies’ oversight of software license  spending was limited or lacking, thus potentially leading to missed  savings. However, the potential savings could be significant considering  that, in fiscal year 2012, 1 major federal agency reported saving  approximately $181 million by consolidating its enterprise license  agreements, even when its oversight process was ad hoc. Accordingly, we recommended that OMB issue a directive to help guide  agencies in managing software licenses. We also made 135  recommendations to the 24 agencies to improve their policies and  practices for managing licenses. Among other things, we recommended  that the agencies regularly track and maintain a comprehensive inventory  of software licenses and analyze the inventory to identify opportunities to  reduce costs and better inform investment decision making. Most agencies generally agreed with the recommendations or had no  comments. As of May 2018, 78 of the 135 recommendations had not  been implemented. Table 2 reflects the extent to which the 24 agencies  implemented the recommendations in these two areas. Agencies Need to  Address  Shortcomings in  Information Security  Area Since information security was added to the high-risk list in 1997, we  have consistently identified shortcomings in the federal government’s  approach to cybersecurity. We have previously testified that, even  though agencies have acted to improve the protections over federal and  critical infrastructure information and information systems, the federal  government needs to take the following actions to strengthen U.S.  cybersecurity: Effectively implement risk-based entity-wide information security  programs consistently over time. Among other things, agencies  need to (1) implement sustainable processes for securely configuring  operating systems, applications, workstations, servers, and network  devices; (2) patch vulnerable systems and replace unsupported  software; (3) develop comprehensive security test and evaluation  procedures and conduct examinations on a regular and recurring  basis; and (4) strengthen oversight of contractors providing IT  services.  Improve its cyber incident detection, response, and mitigation  capabilities. DHS needs to expand the capabilities and support wider  adoption of its government-wide intrusion detection and prevention  system. In addition, the federal government needs to improve cyber  incident response practices, update guidance on reporting data  breaches, and develop consistent responses to breaches of  personally identifiable information. Expand its cyber workforce planning and training efforts. The  federal government needs to (1) enhance efforts for recruiting and  retaining a qualified cybersecurity workforce and (2) improve  cybersecurity workforce planning activities. Expand efforts to strengthen cybersecurity of the nation’s critical  infrastructures. The federal government needs to develop metrics to  (1) assess the effectiveness of efforts promoting the National Institute  of Standards and Technology’s (NIST) Framework for Improving  Critical Infrastructure Cybersecurity and (2) measure and report on  the effectiveness of cyber risk mitigation activities and the  cybersecurity posture of critical infrastructure sectors. Better oversee protection of personally identifiable information.  The federal government needs to (1) protect the security and privacy  of electronic health information, (2) ensure privacy when face  recognition systems are used, and (3) protect the privacy of users’  data on state-based health insurance marketplaces. As we have previously noted, in order to take the preceding actions and  strengthen the federal government’s cybersecurity posture, agencies  should implement the information security programs required by FISMA.  In this regard, FISMA  provides a framework for ensuring the effectiveness  of information security controls for federal information resources. The law  requires each agency to develop, document, and implement an agency- wide information security program. Such a program includes risk  assessments; the development and implementation of policies and  procedures to cost-effectively reduce risks; plans for providing adequate  information security for networks, facilities, and systems; security  awareness and specialized training; the testing and evaluation of the  effectiveness of controls; the planning, implementation, evaluation, and  documentation of remedial actions to address information security  deficiencies; procedures for detecting, reporting, and responding to  security incidents; and plans and procedures to ensure continuity of  operations. Since 2010, we have made 2,733 recommendations to agencies aimed at  improving the security of federal systems and information. These  recommendations have identified actions for agencies to take to  strengthen technical security controls over their computer networks and  systems. They also have included recommendations for agencies to fully  implement aspects of their information security programs, as mandated  by FISMA.  Nevertheless, many agencies continue to be challenged in  safeguarding their information systems and information, in part because  many of these recommendations have not been implemented. As of May  2018, 793 of information security-related recommendations we have  made have not been implemented. Agencies’ Inspectors  General Are to Identify  Information Security  Program Weaknesses In order to determine the effectiveness of the agencies’ information  security programs and practices, FISMA  requires that federal agencies’  inspectors general conduct annual independent evaluations. The  agencies are to report the results of these evaluations to OMB, and OMB  is to summarize the results in annual reports to Congress. In these evaluations, the inspectors general frame the scope of their  analysis, identify key findings, and detail recommendations to address the  findings. The evaluations also are to capture maturity model ratings for  their respective agencies. Toward this end, in fiscal year 2017, the  inspector general community, in partnership with OMB and DHS, finalized  a 3-year effort to create a maturity model for FISMA  metrics that align to  the five function areas in the NIST Framework for Improving Critical  Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect,  detect, respond, and recover. This alignment is intended to help  promote consistent and comparable metrics and criteria and provides  agencies with a meaningful independent assessment of their information  security programs. This maturity model is designed to summarize the status of agencies’  information security programs on a five-level capability maturity scale.  The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized;  activities are performed in an ad-hoc, reactive manner. Level 2 Defined: Policies, procedures, and strategy are formalized  and documented but not consistently implemented. Level 3 Consistently Implemented: Policies, procedures, and strategy  are consistently implemented, but quantitative and qualitative  effectiveness measures are lacking. Level 4 Managed  and Measurable: Quantitative and qualitative  measures on the effectiveness of policies, procedures, and strategy  are collected across the organizations and used to assess them and  make necessary changes. Level 5 Optimized: Policies, procedures, and strategy are fully  institutionalized, repeatable, self-generating, consistently implemented  and regularly updated based on a changing threat and technology  landscape and business/mission needs. In March 2018, OMB issued its annual FISMA  report to Congress, which  showed the combined results of the inspectors general’s fiscal year 2017  evaluations. Based on data from 76 agency inspector general and  independent auditor assessments, OMB determined that the  government-wide median maturity model ratings across the five NIST  Cybersecurity Framework areas did not exceed a level 3 (consistently  implemented). Table 3 shows the inspectors general’s median ratings for  each of the NIST Cybersecurity Framework areas. OMB Requires Agencies  to Meet Targets for  Cybersecurity Metrics In its efforts toward strengthening the federal government’s cybersecurity,  OMB also requires agencies to submit related cybersecurity metrics as  part of its Cross-Agency Priority goals. In particular, OMB developed the  IT modernization goal so that federal agencies will be able to build and  maintain more modern, secure, and resilient IT. A key part of this goal is  to reduce cybersecurity risks to the federal mission through three  strategies: manage asset security, protect networks and data, and limit  personnel access. The key targets supporting each of these strategies  correspond to areas within the FISMA  metrics. Table 4 outlines the  strategies and their associated targets. In conclusion, FITARA and FISMA  present opportunities for the federal  government to address the high-risk areas on improving the management  of IT acquisitions and operations, and ensuring the security of federal IT,  thereby saving billions of dollars. Most agencies have taken steps to  execute key IT management and cybersecurity initiatives, including  implementing CIO responsibilities, requiring CIO review of IT acquisitions,  realizing data center consolidation cost savings, managing software  assets, and complying with FISMA  requirements. The agencies have also  continued to address the recommendations that we have made over the  past several years. However, further efforts by OMB and federal agencies  to implement our previous recommendations would better position them  to improve the management and security of federal IT. To help ensure  that these efforts succeed, we will continue to monitor agencies’ efforts  toward implementing these recommendations. Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly,  and Members of the Subcommittees, this completes my prepared  statement. I would be pleased to respond to any questions that you may  have at this time. GAO Contacts and  Staff  Acknowledgments If you or your staff have any questions about this testimony, please  contact David A. Powner, Director, Information Technology, at (202) 512- 9286 or pownerd@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement. GAO staff who made key contributions to this testimony  are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler,  Meredith Raymond, and Jessica Waselkow (Analyst in Charge). This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.
The federal government plans to invest almost $96 billion in IT in fiscal year 2018. Historically, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. As a result, GAO added two areas to its high-risk list: IT security in 1997 and the management of IT acquisitions and operations in 2015. This statement summarizes agencies' progress in improving IT management and ensuring the security of federal IT. It is primarily based on GAO's prior reports issued between February 1997 and May 2018 (and an ongoing review) on (1) CIO responsibilities, (2) agency CIOs' involvement in approving IT contracts, (3) data center consolidation efforts, (4) the management of software licenses, and (5) compliance with cybersecurity requirements. The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the security of federal IT through a series of initiatives. As of May 2018, agencies had fully implemented about 61 percent of the approximately 800 IT management-related recommendations that GAO made from fiscal years 2010 through 2015. Likewise, since 2010, agencies had implemented about 66 percent of the approximately 2,700 security-related recommendations as of May 2018. Even with this progress, significant actions remain to be completed. Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. However, in a draft report on CIO responsibilities, GAO's preliminary results suggest that none of the 24 selected agencies have policies that fully address the role of their CIO, as called for by federal laws and guidance. GAO intends to recommend that OMB and each of the selected 24 agencies take actions to improve the effectiveness of CIO's implementation of their responsibilities. IT contract approval . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight over IT acquisitions. Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers, which was codified and expanded in FITARA. According to agencies, data center consolidation and optimization efforts have resulted in approximately $3.9 billion of cost savings through 2018. Even so, additional work remains. GAO has made 160 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets; however, as of May 2018, 80 of the recommendations have not been fully addressed. Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 135 recommendations to improve such management. Four years later, 78 of the recommendations remained open. Improving the security of federal IT systems . While the government has acted to protect federal information systems, agencies need to improve security programs, cyber capabilities, and the protection of personally identifiable information. Over the last several years, GAO has made about 2,700 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. As of May 2018, about 800 of the information security-related recommendations had not been implemented.