In reporting on VA’s IT management over the past several years, we  have highlighted challenges the department has faced in enabling its  employees to help veterans obtain services and information more  quickly and effectively while also safeguarding personally  identifiable information. In response to the challenges that we and others have noted, the  department officially began its effort to provide the CIO with greater  authority over IT in October 2005. Multiple Factors Increasing Risk to Success of Realignment

Although VA has fully addressed two of six critical success factors  that we identified as crucial to a major organizational  transformation such as the realignment, it has not fully addressed  the other four factors, and it has not kept to its scheduled timelines  for implementing new management processes that are the  foundation of the realignment. Ensuring commitment from top leadership. The department has  fully addressed this success factor. Establishing a governance structure to manage resources. VA has not identified such an  implementation team to manage the realignment. In our view, having a dedicated implementation team to manage  major change initiatives is crucial to successful implementation of  the realignment. In a report released last week, we stated that although VA has  made progress in addressing security weaknesses, it has not yet  fully implemented key recommendations to strengthen its  information security practices. It has not implemented two of our  four previous recommendations and 20 of 22 recommendations  made by the department’s inspector general. Since the May 2006 security incident, VA has begun or has continued  several major initiatives to strengthen information security practices  and secure personally identifiable information within the  department. These initiatives include the realignment of its IT  management structure, as discussed earlier. Under the realignment,  the management structure for information security has changed. Thus, responsibility for  information security functions within the department is divided. VA officials indicated that the heads of the two organizations are  communicating about the department’s implementation of security  policies and procedures, but this communication is not defined as a  role or responsibility for either position in the new management  organization book, nor is there a documented process in place to  coordinate the management and implementation of the security  program. In addition to the realignment initiative, the department also has  others under way to address security weaknesses. These include  developing an action plan to correct identified weaknesses;  establishing an information protection program; improving its  incident management capability; and establishing an office to be  responsible for oversight of IT within the department. However,  implementation shortcomings limit the effectiveness of these  initiatives. Until the department addresses recommendations to resolve  identified weaknesses and implements the major initiatives it has  undertaken, it will have limited assurance that it can protect its  systems and information from the unauthorized use, disclosure,  disruption, or loss. We also made  recommendations to improve the department’s ability to protect its  information and systems, including the development of various  processes and procedures to ensure that tasks in the department’s  security action plans have time frames for implementation. 2 Addresses long- and short-term objectives, business direction, and their  impact on IT, the IT culture, communications, information, people,  processes, technology, development, and partnerships  2 Defines a structure of relationships and processes to direct and control the  See note a Identifies potential events that may affect the organization and manages  risk to be within acceptable levels so that reasonable assurance is provided  regarding the achievement of organization objectives  2 Creates, maintains, promotes, and governs the use of IT architecture  models and standards across and within the change programs of an  organization   1 Assesses all applications, services, and IT projects that consume resources  in order to understand their value to the IT organization  2 Manages the department’s information security program, as mandated by  the Federal Information Security Management Act (FISMA) of 2002  3 Generates ideas, evaluates and selects ideas, develops and implements  innovations, and continuously recognizes innovators and learning from the  experience  1 Plans, organizes, monitors, and controls all aspects of a project in a  continuous process so that it achieves its objectives  1 Manages and prioritizes all requests for additional and new technology  solutions arising from a customer’s needs  3 Determines whether and how well customers are satisfied with the services,  solutions, and offerings from the providers of IT  1 Provides sound stewardship of the monetary resources of the organization  3 Establishes a pricing mechanism for the IT organization to sell its services  to internal or external customers and to administer the contracts associated  with the selling of those services   3 Enables the IT organization to understand the marketplace it serves, to  identify customers, to “market” to these customers, to generate “marketing”  plans for IT services and support the “selling” of IT services to internal  customers  2 Ensures adherence with laws and regulations, internal policies and  procedures, and stakeholder commitments  1 Maintains information regarding technology assets, including leased and  purchased assets, licenses, and inventory  2 Enables an organization to provide the optimal mix of staffing (resources  and skills) needed to provide the agreed-on IT services at the agreed-on  service levels  2 Manages service-level agreements and performs the ongoing review of  service achievements to ensure that the required and cost-justifiable service  quality is maintained and gradually improved  1 Ensures that agreed-on IT services continue to support business  requirements in the event of a disruption to the business  3 Develops and exercises working relationships between the IT organization  and suppliers in order to make available the external services and products  that are required to support IT service commitments to customers   3 Promotes an integrated approach to identifying, capturing, evaluating,  categorizing, retrieving, and sharing all of an organization’s information  assets   2 Translates provided customer (business) requirements and IT stakeholder- generated requirements/constraints into solution-specific terms, within the  context of a defined solution project or program   1 Creates a documented design from agreed-on solution requirements that  describes the behavior of solution elements, the acceptance criteria, and  agreed-to measurements  3 Brings together all the elements specified by a solution design via  customization, configuration, and integration of created or acquired solution  components  See note a Validates that the solution components and integrated solutions conform to  design specifications and requirements before deployment   2 Addresses the delivery of operational services to IT customers by matching  resources to commitments and employing the IT infrastructure to conduct IT  operations  3 Ensures that all data required for providing and supporting operational  service are available for use and that all data storage facilities can handle  normal, expected fluctuations in data volumes and other parameters within  their designed tolerances.
Why GAO Did This Study

The Department of Veterans Affairs (VA) has encountered numerous challenges in managing its information technology (IT) and securing its information systems. In October 2005, the department initiated a realignment of its IT program to provide greater authority and accountability over its resources. The May 2006 security incident highlighted the need for additional actions to secure personal information maintained in the department's systems. In this testimony, GAO discusses its recent reporting on VA's realignment effort as well as actions to improve security over its information systems. To prepare this testimony, GAO reviewed its past work on the realignment and on information security, and it updated and supplemented its analysis with interviews of VA officials.

What GAO Found

VA has fully addressed two of six critical success factors GAO identified as essential to a successful transformation, but it has yet to fully address the other four, and it has not kept to its scheduled timelines for implementing new management processes that are the foundation of the realignment. That is, the department has ensured commitment from top leadership and established a governance structure to manage resources, both of which are critical success factors. However, the department continues to operate without a single, dedicated implementation team to manage the realignment; such a dedicated team is important to oversee the further implementation of the realignment, which is not expected to be complete until July 2008. Other challenges to the success of the realignment include delays in staffing and in implementing improved IT management processes that are to address long-standing weaknesses. The department has not kept pace with its schedule for implementing these processes, having missed its original scheduled time frames. Unless VA dedicates a team to oversee the further implementation of the realignment, including defining and establishing the processes that will enable the department to address its IT management weaknesses, it risks delaying or missing the potential benefits of the realignment. VA has begun or continued several major initiatives to strengthen information security practices and secure personally identifiable information within the department, but more remains to be done. These initiatives include continuing the department's efforts to reorganize its management structure; developing a remedial action plan; establishing an information protection program; improving its incident management capability; and establishing an office responsible for oversight and compliance of IT within the department. However, although these initiatives have led to progress, their implementation has shortcomings. For example, although the management structure for information security has changed under the realignment, improved security management processes have not yet been completely developed and implemented, and responsibility for the department's information security functions is divided between two organizations, with no documented process for the two offices to coordinate with each other. In addition, VA has made limited progress in implementing prior security recommendations made by GAO and the department's Inspector General, having yet to implement 22 of 26 recommendations. Until the department addresses shortcomings in its major security initiatives and implements prior recommendations, it will have limited assurance that it can protect its systems and information from the unauthorized disclosure, misuse, or loss of personally identifiable information.