However, in 2015 we reported that,  among other things, additional work was needed for DHS to continue to  improve its IT management. FITARA includes provisions related to seven areas of management— referred to as FITARA sections. OMB’s FITARA Implementation Guidance

In June 2015, OMB released guidance that describes how agencies are  to implement FITARA. As part of  this process, the CIO is responsible for reviewing, prior to award,  contracts and agreements that have planned values of $2.5 million or  more, among other criteria. DHS Has Taken Steps that Fully Implemented Most, but Not All, of the Selected FITARA Action Plans

Of the 31 selected action plans that we reviewed, 28 of them (about 90  percent) have been fully implemented as of December 2016 (that is, the  evidence provided by DHS fulfilled all aspects of the action plan’s  description), as the department reported. DHS Faces Several Challenges in Implementing FITARA

DHS currently faces a number of important challenges in implementing  several selected FITARA provisions. Moreover, until the department takes actions that fully  address these challenges, the goal of FITARA to elevate the role of the  department CIO may not be fully realized. However, the DHS CIO did not directly review and approve the contracts  for these troubled investments, as required by FITARA for contracts  associated with major investments. Until the governance process is updated in a way  that increases the CIO’s and appropriate delegates’ reviews of contracts  and agreements associated with major and non-major investments, the  DHS CIO will continue to have limited visibility into the department’s  planned IT expenditures. However, as of October 2016, the CIO was no longer directly responsible  for the full evaluations or the associated risk ratings that are publicly  reported on the IT Dashboard for approximately one-third of the  department’s major IT investments. Moreover, DHS’s CIO was previously responsible for evaluating and  reporting the associated risk ratings of the department’s 30 major IT  investments on the Master Acquisition Oversight List against the criteria  that OMB’s 2015 guidance stated CIOs may use to evaluate and report  the risk of their programs. However, as shown in table 4, under the new  process facilitated by the Office of Program Accountability and Risk  Management, the CIO is only responsible for assessing these  investments against one of OMB’s criteria. Specifically,
DHS has not defined its IT acquisition cadre. Specifically, related to the  department’s incomplete implementation of its action plan to use the  updated DHS TechStat process to provide support to failing or troubled  programs, until the CIO finalizes the department’s TechStat policy, DHS  will be limited in its ability to help such programs. Specifically, we are recommending that the Secretary of Homeland  Security direct the Under Secretary for Management to direct the Chief  Information Officer to take the following actions:  finalize the department’s TechStat policy; update the department’s IT Acquisition Review governance process to  increase the number of contracts and agreements (associated with  both major and non-major investments) that are reviewed by the CIO  and appropriate delegates; establish time frames and implement a plan for (1) identifying the  specific staff or positions currently within the department’s IT  acquisition cadre; and (2) assessing whether these staff and positions  address all of the specialized skills and knowledge needed, as  outlined in OMB’s Office of Federal Procurement Policy’s guidance for  developing an IT acquisition cadre; and establish time frames and implement a plan for (1) identifying the  department’s future IT skillset needs as a result of DHS’s new delivery  model, (2) conducting a skills gap analysis, and (3) resolving any skills  gaps identified. Further, we are recommending that the Secretary of Homeland Security  direct the Under Secretary for Management to update the department’s acquisition policies and guidance to be  consistent in identifying that the DHS CIO is to certify investments’  incremental development activities; update DHS headquarters’, Customs and Border Protection’s, and  U.S. Coast Guard’s processes to track, for all contracts and  agreements, the IT investment with which each is associated (as  applicable); and update and implement the process DHS uses for assessing the risks  of major IT investments to ensure that the CIO rating reported to the  Dashboard fully reflects the CIO’s assessment of each major IT  investment. In its comments, the department concurred with  all seven of our recommendations and provided estimated completion  dates for implementing each of them. Appendix I: The Department of Homeland Security’s (DHS) Action Plans to Implement Information Technology Acquisition Reform

The table below lists DHS’s 131 Federal Information Technology  Acquisition Reform Act (FITARA) action plans and the respective Office of  Management and Budget (OMB) common baseline sections with which  they are associated.
Why GAO Did This Study

In 2014, Congress enacted IT reform legislation, referred to as FITARA, which includes provisions related to seven areas of IT acquisition management. In 2015, OMB released FITARA implementation guidance that outlined agency CIO responsibilities and required agencies to develop action plans for implementing the guidance.
This report examines, among other things, the extent to which DHS has implemented selected action plans and the key challenges that DHS has faced in implementing selected FITARA provisions.
To do so, GAO analyzed DHS's efforts to implement a sample of 31 of 109 action plans that DHS had reported as complete and that described later-stage implementation steps. To determine challenges, GAO analyzed and compared DHS documentation, including a random sample of IT-related contracts and agreements, to selected FITARA provisions to identify gaps between what was required by FITARA and what DHS had implemented. These provisions required, among other things, significant coordination between DHS headquarters and five components.

What GAO Found

The Department of Homeland Security (DHS) has fully implemented 28 of the 31 selected Federal Information Technology (IT) Acquisition Reform Act (FITARA) action plans; however, as of December 2016, DHS did not fulfill all aspects of 3 action plans. For example, one action plan is to use an updated process for reviewing troubled programs to provide support to such programs; however, DHS has not finalized its policy for this process. Until DHS ensures that these 3 plans are implemented, it will lack assurance that it is fulfilling FITARA's goals.
DHS faces challenges in implementing certain FITARA provisions:
Chief Information Officer (CIO) approval of contracts and agreements. FITARA requires, among other things, the agency CIO to review and approve IT contracts and agreements associated with major investments (e.g., high cost) prior to award. However, the CIO did not participate in the approval of any of the 48 contracts in GAO's sample associated with major investments. While DHS has made improvements to its review process, until the Office of the CIO determines how to increase its review of contracts and agreements, the CIO will continue to have limited visibility into planned IT expenditures.
CIO evaluation of risk. DHS's Office of the CIO was conducting risk evaluations of major IT investments and updating the ratings on the Office of Management and Budget's (OMB) public website known as the IT Dashboard, as required by FITARA. However, in October 2016, DHS changed its process for evaluating 30 of DHS's 93 major IT investments and, as a result, the CIO is no longer primarily responsible for the evaluations or associated risk ratings that are publicly reported for these investments. Instead, multiple DHS organizations and officials are to evaluate these investments and the CIO's assessment only accounts for about 18 percent of the total score. Further, while under the old process, DHS's CIO was responsible for assessing these 30 investments against criteria that OMB guidance stated CIOs may use, under the new process, the CIO is only to assess these investments against one of OMB's criteria (see table below). This process change challenges the CIO's ability to publicly report risk ratings.
Until DHS addresses these challenges, the goal of FITARA to elevate the role of the department CIO in acquisition management will not be fully realized.

What GAO Recommends

GAO is making 7 recommendations to DHS to ensure that it fully and effectively implements FITARA. Among other things, GAO recommends that DHS fully implement the action plans and address challenges related to CIO contract approval and evaluation of risk. DHS concurred with all 7 recommendations and provided estimated completion dates for implementing each of them.