For  the department to overcome this hurdle, we emphasized the need for DHS  to establish an effective IT governance framework, including controls  aimed at effectively managing system acquisition and IT-related people,  processes and tools. Examples of these programs are described below. However, an exit capability is not yet operational. As of  June 2009, Rescue 21’s initial operating capability has been deployed and  accepted at 23 of 42 regions. As of 2009, a pilot of SBInet capabilities referred to as  Project 28 has been deployed and is currently operating along 28 miles of  the southwest border in Tucson, Arizona. DHS Has Made Uneven Progress in Establishing Institutional Management Controls and Capabilities for Large-Scale IT Acquisitions

The department has continued to work to establish effective corporate IT  and acquisition management controls and capabilities, but progress across  these disciplines has been uneven, and more remains to be done. Until  DHS fully institutionalizes these controls and capabilities, it will be  challenged in its ability to effectively and efficiently acquire large-scale IT  systems and thereby leverage technology to support transformation and  achieve mission goals and results. Since 2003, DHS has issued annual updates to its EA that have improved  on prior versions by adding previously missing content. Based on our research, we issued an IT investment  management framework that encompasses, among other things, best  practices of successful public and private sector organizations relative to  selecting and controlling individual investments as well as portfolios  (segments) of investments. System Life Cycle Management Process Guidance Issued, But Improvements Still Needed

Managing IT projects and programs throughout their life cycles requires  applying engineering discipline and rigor when defining, designing,  developing, integrating, testing, deploying, and maintaining IT systems and  services. Our evaluations and research show that applying such rigorous  management practices improves the likelihood of delivering expected  capabilities on time and within budget. More  specifically, we reported that DHS  lacked an overall direction for acquisition workforce planning, and  notwithstanding some recent actions, had not fully involved key  stakeholders, such as the CHCO and component procurement and  program offices, both of which have been shown to increase the likelihood  of success for workforce planning;   excluded some acquisition-related career fields from its definition of  acquisition workforce, thus limiting the scope of its planning efforts, and  while it intended to expand its definition, it had yet to identify which  positions should be included; lacked sufficient data to fully assess its acquisition workforce needs,  including the gaps in the number of employees needed or the skills of  these employees; and lacked sufficient insight into the number of contractors supporting its  acquisition function or the types of tasks that contractors were  performing. For  example it has not established implementation milestones, assigned  stakeholder responsibilities and accountability, or begun to track,  document, and report on human capital risks. Large-Scale IT Investments Exposed to Risk Because Key Acquisition and IT Management Controls Have Not Always Been Effectively Implemented

The success of a major IT program can be judged by the extent to which it  delivers promised system capabilities and mission benefits on time and  within schedule. CBP has largely agreed with our recommendations, and  continues to work to implement many of them. To the department’s  credit, it has addressed many of the recommendations that we have made  for addressing these weaknesses, and as a result the program is better  positioned today for success than it has been in the past. Since 2005, we have reported on a number of  acquisition and investment management weaknesses, such as  requirements, testing, cost and schedule estimation, and security  management, and made recommendations to address them. We made a series of recommendations to address these weaknesses,  including assessing SBInet development, testing, and deployment risks and  disclosing them to DHS leadership and the Congress, and defining and  implementing relevant system deployment, requirements management,  and testing weaknesses guidance. In closing, the department has made progress in establishing key  institutional acquisition and IT investment management-related controls  and implementing them on large-scale programs, including its recent  efforts to increase corporate oversight of major investments and its recent  deployment and operation of Secure Flight. However, considerable work  remains to be accomplished before the department can be considered a  mature IT system acquirer and investor. For example, the department has  yet to address longstanding challenges in, among other things, sufficiently  defining its enterprise architecture and strategically managing its  acquisition and IT workforce. Unless this changes, ongoing  and future DHS major acquisitions will likely fall short in delivering  promised capabilities and benefits on time and on budget.
Why GAO Did This Study

The Department of Homeland Security (DHS) invested more than $6 billion in 2009 on large-scale, information technology (IT) systems to help it achieve mission outcomes and transform departmentwide operations. For DHS to effectively leverage these systems as mission enablers and transformation tools, it needs to employ a number of institutional acquisition and IT management controls and capabilities, such as using an operational and technological blueprint to guide and constrain system investments (enterprise architecture) and following institutional policies, practices, and structures for acquiring and investing in these systems. Other institutional controls and capabilities include employing rigorous and disciplined system life cycle management processes and having capable acquisition and IT management workforces. As GAO has reported, it is critical for the department to implement these controls and capabilities on each of its system acquisition programs. GAO has issued a series of reports on DHS institutional controls for acquiring and managing IT systems, and its implementation of these controls on large-scale systems. GAO was asked to testify on how far the department has come on both of these fronts, including its implementation of GAO's recommendations. To do this, GAO drew from its issued reports on institutional IT controls and IT systems, as well as our recurring work to follow up on the status of our open recommendations.

What GAO Found

Since its inception, DHS has made uneven progress in its efforts to institutionalize a framework of interrelated management controls and capabilities associated with effectively and efficiently acquiring large-scale IT systems. To its credit, it has continued to issue annual updates to its enterprise architecture that have added previously missing scope and depth, and further improvements are planned to incorporate the level of content, referred to as segment architectures, needed to effectively introduce new systems and modify existing ones. Also, it has redefined its acquisition and investment management policies, practices, and structures, including establishing a system life cycle management methodology, and it has increased its acquisition workforce. Nevertheless, challenges remain relative to, for example, implementing the department's plan for strengthening its IT human capital, and fully defining key system investment and acquisition management policies and procedures. Moreover, the extent to which DHS has actually implemented these investment and acquisition management policies and practices on major programs has been at best inconsistent, and in many cases, quite limited. For example, recent reviews by GAO show that major acquisition programs have not been subjected to executive level acquisition and investment management reviews at key milestones and have not, among other things, employed reliable cost and schedule estimating practices, effective requirements development and test management practices, meaningful performance measurement, strategic workforce management, proactive identification and mitigation of program risks, and effective contract tracking and oversight, among other things. Because of these weaknesses, major IT programs aimed at delivering important mission capabilities have not lived up to expectations. For example, full deployment of the Rescue 21 "search and rescue" system had to be extended from 2006 to 2017; development and deployment of an "exit" capability under the US-VISIT program has yet to occur; and the timing and scope of an SBInet "virtual border fence" initial operating capability has been delayed and reduced from the entire southwest border to 28 miles of the border. To assist the department in addressing its institutional and system-specific challenges, GAO has made a range of recommendations. While DHS and its components have acted on many of these recommendations, and as a result have arguably made progress and improved the prospects for success on ongoing and future programs, more needs to be done by DHS's new leadership team before the department can ensure that all system acquisitions are managed with the rigor and discipline needed to consistently deliver promised capabilities and benefits on time and on budget.