Cloud computing strategy. IT Shared Services Strategy. Three of the agencies agreed with our  recommendations; two partially agreed; and two agencies had no  comments. Specifically, data from the IT Dashboard shows that, in 2015, 5,233 of the  government’s nearly 7,000 investments were spending all of their funds  on O&M activities. Spending on O&M Has Increased over 7 Years

Over the past 7 fiscal years, O&M spending has increased, while the  amount invested in developing new systems has decreased by about  $7.3 billion since fiscal year 2010. Additionally, OMB has not identified an associated goal with its non- provisioned IT measure that is part of PortfolioStat process. Until OMB develops a specific goal associated with measuring non- provisioned services, OMB and agencies will be limited in their ability to  evaluate progress that has been made and whether or not they are  achieving their goals to increase the amount spent on development  activities and provisioned IT services. Several O&M investments were rated as moderate to high risk in fiscal  year 2015. IT Investments Are Becoming Obsolete and Agencies Are Not Required to Identify Investments That Need Attention

Legacy IT investments across the federal government are becoming  increasingly obsolete. Specifically, many use outdated languages and old  parts. In addition, some legacy systems may use parts that are obsolete and  more difficult to find. For instance, Defense is still using 8-inch floppy  disks in a legacy system that coordinates the operational functions of the  United States’ nuclear forces. For example, Treasury reported systems that were  about 56 years old. Agencies reported having plans to modernize or  replace each of these investments and systems. Conclusions

Of the more than $80 billion that the 26 agencies reported spending for  federal IT in fiscal year 2015, the agencies spent about $61 billion on  O&M. Further, agencies did  not consistently perform required analysis on at-risk investments. Until  agencies fully review at-risk O&M investments, the government’s  oversight of such investments will be impaired and its spending could be  wasteful. Several  aging investments are using unsupported components, many of which did  not have specific plans for modernization or replacement. This is contrary  to OMB’s draft initiative, which calls for agencies to analyze and review  O&M investments. Until this policy is finalized and implemented, the  federal government runs the risk of continuing to maintain investments  that have outlived their effectiveness and are consuming resources that  outweigh their benefits. Further, to address obsolete IT investments in need of modernization or  replacement, we recommend that the Secretaries of Agriculture,  Commerce, Defense, Energy, Health and Human Services, Homeland  Security, State, the Treasury, Transportation, and Veterans Affairs; the  Attorney General; and the Commissioner of Social Security direct their  respective agency CIOs to identify and plan to modernize or replace  legacy systems as needed and consistent with OMB’s draft guidance,  including time frames, activities to be performed, and functions to be  replaced or enhanced. Energy’s plan to consider OMB’s  guidance when it is finalized is consistent with the intent of our  recommendation. Appendix I: Objectives, Scope and Methodology

Our objectives were to (1) assess the extent to which federal agencies  have invested in operating and maintaining existing information  technology (IT), (2) evaluate the oversight of at-risk legacy investments,  and (3) assess the age and obsolescence of federal IT. For our first objective, our review included the Office of Management and  Budget (OMB) and the 26 agencies that report to OMB’s IT Dashboard. For all three objectives, to identify specific reasons for changes in  spending and specific information on individual systems or investments,  we focused on the 12 agencies with the highest planned IT spending for  fiscal year 2015, given that these agencies make up over 90 percent of  reported federal IT spending:
Department of Agriculture,
Department of Commerce,
Department of Defense,
Department of Energy,
Department of Health and Human Services,
Department of Homeland Security,
Department of Justice,
Department of State,
Department of the Treasury,
Department of Transportation,
Department of Veterans Affairs, and
Social Security Administration. To assess the extent to which federal agencies have invested in  operating and maintaining existing IT, we reviewed data reported to OMB  as part of the budget process to determine operations and maintenance  (O&M) spending for fiscal years 2010 through 2017.
Why GAO Did This Study

The federal government invests more than $80 billion on IT annually, with much of this amount reportedly spent on operating and maintaining existing (legacy) IT systems. Given the magnitude of these investments, it is important that agencies effectively manage their O&M.
GAO's objectives were to (1) assess federal agencies' IT O&M spending, (2) evaluate the oversight of at-risk legacy investments, and (3) assess the age and obsolescence of federal IT.
To do so, GAO reviewed OMB and 26 agencies' IT O&M spending for fiscal years 2010 through 2017. GAO further reviewed the 12 agencies that reported the highest planned IT spending for fiscal year 2015 to provide specifics on agency spending and individual investments.

What GAO Found

The federal government spent about 75 percent of the total amount budgeted for information technology (IT) for fiscal year 2015 on operations and maintenance (O&M) investments. Such spending has increased over the past 7 fiscal years, which has resulted in a $7.3 billion decline from fiscal years 2010 to 2017 in development, modernization, and enhancement activities.
Specifically, 5,233 of the government's approximately 7,000 IT investments are spending all of their funds on O&M activities. Moreover, the Office of Management and Budget (OMB) has directed agencies to identify IT O&M expenditures known as non-provisioned services that do not use solutions often viewed as more efficient, such as cloud computing and shared services. Agencies reported planned spending of nearly $55 billion on such non-provisioned IT in fiscal year 2015. OMB has developed a metric for agencies to measure their spending on services such as cloud computing and shared services, but has not identified an associated goal. Thus, agencies may be limited in their ability to evaluate progress.
Many O&M investments in GAO's review were identified as moderate to high risk by agency CIOs, and agencies did not consistently perform required analysis of these at-risk investments. Further, several of the at-risk investments did not have plans to be retired or modernized. Until agencies fully review their at-risk investments, the government's oversight of such investments will be limited and its spending could be wasteful.
Federal legacy IT investments are becoming increasingly obsolete: many use outdated software languages and hardware parts that are unsupported. Agencies reported using several systems that have components that are, in some cases, at least 50 years old. For example, Department of Defense uses 8-inch floppy disks in a legacy system that coordinates the operational functions of the nation's nuclear forces. In addition, Department of the Treasury uses assembly language code—a computer language initially used in the 1950s and typically tied to the hardware for which it was developed. OMB recently began an initiative to modernize, retire, and replace the federal government's legacy IT systems. As part of this, OMB drafted guidance requiring agencies to identify, prioritize, and plan to modernize legacy systems. However, until this policy is finalized and fully executed, the government runs the risk of maintaining systems that have outlived their effectiveness. The following table provides examples of legacy systems across the federal government that agencies report are 30 years or older and use obsolete software or hardware, and identifies those that do not have specific plans with time frames to modernize or replace these investments.

What GAO Recommends

GAO is making 16 recommendations, one of which is for OMB to develop a goal for its spending measure and finalize draft guidance to identify and prioritize legacy IT needing to be modernized or replaced. GAO is also recommending that selected agencies address at-risk and obsolete legacy O&M investments. Nine agencies agreed with GAO's recommendations, two agencies partially agreed, and two agencies stated they had no comment. The two agencies that partially agreed, Defense and Energy, outlined plans that were consistent with the intent of our recommendations.