Under the  plan, the ISE would consist of five “communities of interest”—homeland  security, law enforcement, foreign affairs, defense, and intelligence. Program Manager and Agencies Have Advanced Key Information Sharing Activities but Have Not Yet Developed a Comprehensive Road Map to Effectively Implement the ISE

Since we issued our 2008 report, the Program Manager and agencies  have established a discrete set of goals and undertaken activities to guide  development and implementation of the ISE, but these actions do not fully  address our recommendations or provide the comprehensive road map  that we called for in our report. For example, the Program Manager and  agencies have not yet fully defined what the ISE is expected to achieve  and contain, identified the incremental costs necessary to implement the  ISE, or fully developed procedures to show what work remains and  related milestones to provide accountability for results. The administration  has taken steps to strengthen the ISE governance structure to help guide  the development and implementation of the ISE, but it is too early to  gauge the structure’s effectiveness. Consistent with the Intelligence Reform Act, the ISE is  intended to provide the means for sharing terrorism information across  the five communities in a manner that, among other things, builds upon  existing systems and leverages ongoing efforts. To date, the ISE has  primarily focused on the homeland security and law enforcement  communities and related sharing between the federal government and  state and local partners, in part to align with information sharing priorities. However, it does not describe business  activities and information flows for the remaining 21 current business  processes, such as the business process that supports responding to a  terrorism-related threat. However,  the Office of the Program Manager’s approach to managing ISE  architecture-related activities does not fully satisfy the core elements  described in our EAMMF for establishing institutional commitment and  creating the EA management foundation. In addition, officials from the key ISE  implementing agencies indicated that the lack of detailed and  implementable ISE guidance was one limiting factor in developing agency  information sharing segment architectures. The Program Manager added that  this approach is based on (1) OMB decisions to establish a standardized  EA framework that departments and agencies that own their respective  information systems and architectures could use to develop, modify, and  integrate those systems into the ISE; (2) the Office of the Program  Manager’s interpretation of the Intelligence Reform Act; and (3) the Office  of the Program Manager’s understanding that a full EA must be  organization based and tied to budget authority. Conclusions

The ISE is to fulfill a critical purpose in a time when acts of terrorism on  U.S. soil have recently been attempted or planned. Establishing an improved EA management foundation, including well- defined EA guidance for the ISE, would better position the government to  realize significant benefits, such as better planning for implementation,  improved decision making, and ultimately more effective sharing of critical  terrorism-related information among all ISE agencies. To support future progress in developing and implementing the ISE, we  recommend that after the end state is defined, the Program Manager  in consultation with the ISA IPC and key ISE agencies, determine to  what extent relevant agency initiatives across all five communities  could be better leveraged by the ISE so that their benefits can be  realized governmentwide and  in coordination with the ISA IPC and OMB, task the key ISE agencies  to define, to the extent possible, the incremental costs needed to help  ensure successful implementation of the ISE and prioritize  investments. To better define ISE EA guidance and effectively manage EA activities to  support ISE implementation efforts, we recommend that the Program  Manager, in consultation with the ISA IPC and key ISE agencies,  establish an ISE EA program management plan that (1) reflects ISE EA  program work activities, events, and time frames for improving ISE EA  management practices and addressing missing architecture content and  (2) defines accountability mechanisms to help ensure that this program  management plan is implemented. To determine the extent to which the Program Manager and stakeholder  agencies have made progress in developing and implementing the ISE,  we reviewed key statutes and policies, including the Intelligence Reform  and Terrorism Prevention Act of 2004 (Intelligence Reform Act) and the  Implementing Recommendations of the 9/11 Commission Act of 2007. To determine to what extent the Program Manager for the ISE and key  stakeholder agencies have defined an EA to support ISE implementation  efforts, we examined the extent to which (1) key current, or “as-is,” and  future, or “to-be,” EA content and a plan for transitioning from the current  to the future environment have been established; (2) the Office of the  Program Manager has established a structure for effectively managing  ISE architecture development and implementation; and (3) key federal  agencies have defined their information sharing segment architectures  (ISSA) to support ISE implementation. An EA should also include a sequencing plan for  transitioning from the current environment to the future environment.
Why GAO Did This Study

Recent planned and attempted acts of terrorism on U.S. soil underscore the importance of the government's continued need to ensure that terrorism-related information is shared in an effective and timely manner. The Intelligence Reform and Terrorism Prevention Act of 2004, as amended, mandated the creation of the Information Sharing Environment (ISE), which is described as an approach for sharing terrorism-related information that may include any method determined necessary and appropriate. GAO was asked to assess to what extent the Program Manager for the ISE and agencies have (1) made progress in developing and implementing the ISE and (2) defined an enterprise architecture (EA) to support ISE implementation efforts. In general, an EA provides a modernization blueprint to guide an entity's transition to its future operational and technological environment. To do this work, GAO (1) reviewed key statutes, policies, and guidance; ISE annual reports; and EA and other best practices and (2) interviewed relevant agency officials.

What GAO Found

Since GAO last reported on the ISE in June 2008, the Program Manager for the ISE and agencies have made progress in implementing a discrete set of goals and activities and are working to establish an "end state vision" that could help better define what the ISE is intended to achieve and include. However, these actions have not yet resulted in a fully functioning ISE. Consistent with the Intelligence Reform and Terrorism Prevention Act of 2004 (Intelligence Reform Act), the ISE is to provide the means for sharing terrorism-related information across five communities--homeland security, law enforcement, defense, foreign affairs, and intelligence--in a manner that, among other things, leverages ongoing efforts. To date, the ISE has primarily focused on the homeland security and law enforcement communities and related sharing between the federal government and state and local partners, to align with priorities the White House established for the ISE. It will be important that all relevant agency initiatives--such as those involving the foreign affairs and intelligence communities--are leveraged by the ISE to enhance information sharing governmentwide. The Program Manager and agencies also have not yet identified the incremental costs necessary to implement the ISE--which would allow decision makers to plan for and prioritize future investments--or addressed GAO's 2008 recommendation to develop procedures for determining what work remains. Completing these activities would help to provide a road map for the ISE moving forward. The administration has taken steps to strengthen the ISE governance structure, but it is too early to gauge the structure's effectiveness. The Program Manager and ISE agencies have developed architecture guidance and products to support ISE implementation, such as the "ISE Enterprise Architecture Framework," which is intended to enable long-term business and technology standardization and information systems planning, investing, and integration. However, the architecture guidance and products do not fully describe the current and future information sharing environment or include a plan for transitioning to the future ISE. For example, the EA framework describes information flows for only 3 of the 24 current business processes. In addition, the Program Manager's approach to managing its ISE EA program does not fully satisfy the core elements described in EA management best practices. For example, an EA program management plan for the ISE does not exist. The Program Manager stated that his office's approach to developing ISE architecture guidance is based on, among other things, the office's interpretation of the Intelligence Reform Act. Nevertheless, the act calls for the Program Manager to, among other things, plan for and oversee the implementation of the ISE, and officials from the key agencies said that the lack of detailed and implementable ISE guidance was one limiting factor in developing agency information sharing architectures. Without establishing an improved EA management foundation, including an ISE EA program management plan, the federal government risks limiting the ability of ISE agencies to effectively plan for and implement the ISE and more effectively share critical terrorism-related information.

What GAO Recommends

GAO recommends that in defining a road map for the ISE, the Program Manager ensure that relevant initiatives are leveraged, incremental costs are defined, and an EA program management plan is established that defines how EA management practices and content will be addressed. The Program Manager generally agreed with these recommendations.