In doing so, the FBI recognized the  importance of IT to its organizational transformation efforts, and made it  one of the bureau’s top 10 priorities. Among other things, we said that it will be crucial for the  FBI to manage Sentinel requirements in the context of its architectural  environment and the availability of commercial products, and to  understand the capabilities and dependencies among the commercial  products to minimize incompatibilities. Sentinel Is Implementing Key Commercial Component-Based System Acquisition Methods, but Corporate Guidance Governing These Methods Is Not Fully Defined

In acquiring Sentinel, the FBI is implementing leading practices associated  with effectively acquiring commercial IT solutions. Moreover, this is occurring even though corporate policies and  guidance do not address all of the methods. In implementing them, the  bureau is relying on either its prime contractor’s approaches or Sentinel- specific plans. Among other things, managing system  requirements includes (1) controlling changes to requirements by  establishing a baseline set of requirements and formally reviewing and  approving changes to the baselines in light of expected costs, benefits, and  associated risks; and (2) ensuring that the different levels of requirements  (e.g., high-level operational or user requirements and detailed system and  technical requirements) and their associated design specifications and test  cases are aligned and consistent with one another (bidirectional  traceability). In addition, the second study takes into account the availability  of the products. To the program office’s credit, it has taken steps to employ each of these  practices on Sentinel. Program officials told us that they intend to establish agreements, ranging  from informal agreements to signed memoranda of understanding, with  legacy system owners to ensure that their respective systems are ready in  time for integration with Sentinel. By taking steps to manage the integration of Sentinel with legacy systems,  the program office will be better positioned to ensure that Sentinel is  deployed on time and performs as intended. FBI Policies and Guidance Do Not Address Most Key Acquisition Methods

With the exception of the practices that relate to effective requirements  management, not all of the key practices that were earlier discussed in  association with (1) requirements/commercial product trade-off analysis,  (2) commercial product dependency analysis, (3) commercial product  modification, and (4) legacy system integration management are fully  reflected in any bureauwide policy or guidance. This is especially  important for the Sentinel system, which is to provide long-overdue,  mission-critical intelligence and investigative services across the FBI. To the credit of Sentinel program officials, this void in  corporate policies and guidance is being effectively overcome, as the  program is implementing these key practices either through reliance on its  prime contractor’s approaches or through Sentinel-specific plans. If these  Sentinel practices are successfully incorporated into FBI-wide policies and  guidance, then their chances of being employed on a repeatable basis  across all applicable FBI system investments will be increased. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether the Federal Bureau of  Investigation (FBI) is employing effective methods in acquiring  commercial solutions for Sentinel. We also  reviewed related program documentation to substantiate data provided by  program officials during interviews.
Why GAO Did This Study

The Federal Bureau of Investigation (FBI) is 3 years into its 6-year, $451 million program known as Sentinel, which is to replace its antiquated, paper-based, legacy systems for supporting mission-critical intelligence analysis and investigative case management activities. Because of the importance of Sentinel to the bureau's mission operations, GAO was asked to conduct a series of reviews on the FBI's management of the program. This review focuses on whether the FBI is employing effective methods in acquiring commercial solutions for Sentinel. To do so, GAO researched relevant best practices; reviewed FBI policies and procedures, program plans, and other program documents; and interviewed appropriate program officials.

What GAO Found

The FBI's Sentinel program is implementing five key methods for acquiring commercial information technology solutions. In particular, it is managing Sentinel requirements by making sure that changes to established baselines are justified and approved on the basis of costs, benefits, and risks, and it is ensuring that different levels of requirements and related design specification and test cases are properly aligned with one another. In addition, the bureau is analyzing commercially available product alternatives in relation to requirements, costs, and other factors to ensure that the most cost-effective mix of products is being used to minimize requirement gaps. In doing so, it is taking steps to understand the dependencies among the commercial products, thus ensuring that they can interoperate effectively. Also, the bureau is not modifying the commercial products that it is selecting and using to develop Sentinel, which should allow it to minimize future maintenance costs by taking advantage of future product releases and other vendor product support. Last, it is taking steps to ensure that Sentinel integration with FBI legacy systems will occur when needed, for example, by establishing agreements with legacy system owners. Collectively, implementation of these acquisition methods should increase the chances of cost effectively delivering required Sentinel capabilities on time. However, the implementation of most of these acquisition methods is generally not governed by bureauwide policies and guidance that address all relevant practices. To the credit of program officials, this void in corporate policies and guidance has not affected Sentinel, as they are implementing all of the key practices either through reliance on their prime contractor's approaches or through Sentinel-specific plans. If policies and guidance relative to each of these methods for acquiring commercial component-based systems were incorporated into FBI-wide policies and guidance, the bureau could increase its chances of employing them on a repeatable basis across all applicable system investments.