According to DOD and other relevant guidance,  acquisition management includes, among other things, such key IT  management control areas as architectural alignment, economic  justification, requirements management, risk management, security  management, and system quality measurement. Thus  far, key IT management controls associated with this framework have not  been implemented on Navy Cash. As a result, the program, as  defined, has not been shown to be the most cost-effective investment  option. Even if investment in the proposed Navy Cash solution is shown to be a  wise and prudent course of action, the manner in which Navy Cash is  being acquired and deployed is not adequate because (1) requirements  have not been adequately developed and managed; (2) program risks have  not been effectively managed; (3) security has not been effectively  managed; and (4) system quality has not been adequately measured. Program officials acknowledged these weaknesses and attributed them to,  among other things, turnover of staff in key positions and their focus on  deploying the system. As a result, it is important  that all these weaknesses be addressed to reduce the risk of delivering a  system solution that falls short of expectations. Moreover, it has not been economically justified on the basis  of reliable estimates of cost and benefits over the system’s expected life. Navy Cash has not been assessed and defined in a way to ensure that it is  not duplicative of the Eagle Cash and EZpay programs, both of which  provide for the use of smart card technology for electronic retail  transactions in support of the Air Force and the Army. This means that aspects of Navy Cash  could be potentially duplicative of these other programs, and thus DOD  may not be pursuing the most cost-effective solution to meet its mission  needs. Moreover, it does not include FMS’s portion of the  program’s cost, which is estimated to be about $100 million over a 14-year  period. Specifically,    program requirements have not been adequately developed and managed;    program risks have not been effectively managed;    security has not been adequately managed; and    data needed to measure two aspects of system quality—trends in  unresolved change requests and evaluation of user satisfaction with the  system—have not been collected and used. As another example, a system requirement for  automatically deploying software patches to operational systems was not  defined. Navy Cash’s Risks Have Not Been Effectively Managed

Proactively managing program risks is a key acquisition management  control that, if done properly, can increase the chances of programs  delivering promised capabilities and benefits on time and within budget. In  particular, plans, processes, and procedures are not in place that provide  for identifying, controlling, and disclosing risks, and risk management  roles and responsibilities have not been assigned to key stakeholders. Recommendations

Because of the uncertainty surrounding whether Navy Cash, as defined,  represents a cost-effective solution, we recommend that the Secretary of  Defense direct the Secretary of the Navy to limit further investment of  modernization funding in the program to only (1) deployment to remaining  ships of already developed and tested capabilities; (2) correction of  information security vulnerabilities and weaknesses on ships where it is  deployed and operating; and (3) development of the basis for an informed  decision as to whether further development and modernization is  economically justified and in the department’s collective best interests. As a result, we appropriately conclude in our report that such  failures to effectively manage Navy Cash security places the  confidentiality, integrity, and availability of deployed and operating  shipboard devices, applications, and financial data at increased risk of  being compromised. Appendix I: Objective, Scope, and Methodology

Our objective was to determine whether the Department of the Navy  (DON) is effectively implementing information technology management  controls on Navy Cash.
Why GAO Did This Study

GAO has designated the Department of Defense's (DOD) multi-billion dollar business systems modernization efforts as high risk, in part because key information technology (IT) management controls have not been implemented on key investments, such as the Navy Cash program. Initiated in 2001, Navy Cash is a joint Department of the Navy (DON) and Department of the Treasury Financial Management Service (FMS) program to create a cashless environment on ships using smart card technology, and is estimated to cost about $320 million to fully deploy. As requested, GAO analyzed whether DON is effectively implementing IT management controls on the program, including architectural alignment, economic justification, requirements development and management, risk management, security management, and system quality measurement against relevant guidance.

What GAO Found

Key IT management controls have not been effectively implemented on Navy Cash, to the point that further investment in this program, as it is currently defined, has not been shown to be a prudent and judicious use of scarce modernization resources. In particular, Navy Cash has not been (1) assessed and defined in a way to ensure that it is not duplicative of programs in the Air Force and the Army that use smart card technology for electronic retail transactions and (2) economically justified on the basis of reliable analyses of estimated costs and expected benefits over the program's life. As a result, DON cannot demonstrate that the investment alternative that it is pursuing is the most cost-effective solution to satisfying its mission needs. Moreover, other management controls, which are intended to maximize the chances of delivering defined and justified system capabilities and benefits on time and within budget, have not been effectively implemented. System requirements have not been effectively managed. For example, neither policies nor plans that define how system requirements are to be managed, nor an approved baseline set of requirements that are justified and needed to cost-effectively meet mission needs, exist. Instead, requirements are addressed reactively through requests for changes to the system based primarily on the availability of funding. Program risks have not been effectively managed. In particular, plans, processes, and procedures that provide for identifying, mitigating, and disclosing risks have not been defined, nor have risk-related roles and responsibilities for key stakeholders. System security has not been effectively managed, thus putting the confidentiality, integrity, and availability of deployed and operating shipboard devices, applications, and data at increased risk of being compromised. For example, the mitigation of system vulnerabilities by applying software patches has not been effectively implemented. Key aspects of system quality are not being effectively measured. For example, data for determining trends in unresolved system change requests, which is an indicator of system stability, as well as user feedback on system satisfaction, are not being collected and used. Program oversight and management officials acknowledged these weaknesses and cited turnover of staff in key positions and their primary focus on deploying Navy Cash as reasons for the state of some of these IT management controls. Collectively, this means that, after investing about 6 years and $132 million on Navy Cash and planning to invest an additional $60 million to further develop the program, the department has yet to demonstrate through verifiable analysis and evidence that the program, as currently defined, is justified. Moreover, even if further investment was to be demonstrated, the manner in which the delivery of program capabilities is being managed is not adequate. As a result, the program is at risk of delivering a system solution that falls short of cost, schedule, and performance expectations.