Not since the creation  of the Department of Defense in 1947 has the federal government  undertaken a transformation of this magnitude. Other  DHS entities also are responsible, or share responsibility, for critical  information and technology management activities. DHS’s Progress in Dealing with Formidable Information and Technology Management Challenge Is Mixed

In the 18 months that it has been in operation, DHS has taken steps to  institute key elements of an effective information and technology  management structure. DHS’s mixed progress is not unexpected given the diversity of the inherited  agencies and the size and complexity of the department and the daunting  hurdles that it faces in integrating the systems and IT management  approaches of its many organizational components. To address the risks associated with DHS’s  departmental structures and specific IT investments, we have made  recommendations to the DHS CIO and other responsible entities—such as  the Coast Guard and TSA—to help the department successfully overcome  its information and technology management challenge. In commenting on a draft of this report, DHS did not address  whether it would implement these recommendations. DHS has not established a process to ensure that control reviews of IT  investments are performed in a timely manner. The DHS Secretary has recognized the criticality of information sharing in  the department’s strategic plan. Conclusions

DHS faces the formidable challenge of defining and implementing an  effective information and technology management structure at the same  time that it is developing and acquiring major IT systems that are critical to  meeting its mission needs. Although DHS has made progress in addressing  this challenge, it does not yet have a fully institutionalized structure in  place, which puts its pursuit of new and enhanced IT investments at risk of  not optimally supporting corporate mission needs and not meeting cost,  schedule, capability, and benefit commitments. In particular, still lacking in  the department’s IT strategic planning process—which is critical because it  defines what an agency seeks to accomplish and how that will be  achieved—are goals, performance measures, and milestones for significant  activities and whether DHS has appropriately skilled and deployed IT staff. Posthearing Questions Related to Proposed Department of Homeland  Security (DHS) Human Capital Regulations. Information Technology: OMB and Department of Homeland Security  Investment Reviews.
Why GAO Did This Study

In 2003 GAO designated the merger of 22 separate federal entities into the Department of Homeland Security (DHS) as a high risk area because of the criticality of the department's mission and the enormous transformation challenges that the department faced. Given that the effective use of information technology (IT) is a critical enabler of this merger, GAO has previously reported on a number of DHS efforts aimed at institutionalizing an effective information and technology governance structure and investing in new IT systems that are intended to better support mission operations. Now that DHS has been operating for over a year, GAO was asked to, based largely on its prior work, describe DHS's progress in meeting its information and technology management challenge.

What GAO Found

DHS's overall IT challenge is to standardize and integrate the legacy system environments and management approaches that it inherited from its predecessor agencies, while concurrently attempting to ensure that present levels of IT support for critical homeland security operations are not only maintained but improved in the near term. To accomplish this, the department is in the process of instituting seven information and technology management disciplines that are key elements of an effective information and technology management structure. DHS's progress in institutionalizing these key information and technology management elements has been mixed, and overall remains a work in progress. Such progress is not unexpected, given the diversity of the inherited agencies and the size and complexity of the department's mission operations. Nevertheless, because DHS has not yet fully institutionalized these governance elements, its pursuit of new and enhanced IT investments are at risk of not optimally supporting corporate mission needs and not meeting cost, schedule, capability, and benefit commitments. Accordingly, GAO has previously made recommendations relative to most of these areas to the department's chief information officer and other responsible DHS entities. Lastly, DHS has developed a draft IT strategic plan, which GAO finds lacking in explicit goals, performance measures, milestones, and knowledge of whether it has properly positioned IT staff with the right skills to accomplish these things.