EOUSA Has Yet to Institutionalize Key IT Management Disciplines

Research into the IT management practices that are employed by leading  public- and private-sector organizations has identified key institutional IT  management disciplines that are interrelated and critical to ensuring,  among other things, the integrity, security, and efficiency of IT systems. However, none has been  institutionalized, meaning that they are not fully defined in accordance  with best practices and what has been defined has not been fully  implemented. However, the office has not,  for example, defined procedures for project oversight. Until the office develops and implements a  plan for establishing mature IT investment management processes  (including all critical processes for building the investment management  foundation), EOUSA will not have the full suite of capabilities it needs to  ensure that project selection and control processes are repeatable or that it  has the best mix of investments to meet agency priorities. Currently, EOUSA is not fully satisfying any of these tenets of effective  security. While EOUSA is guided by many Justice security policies, it has not yet  implemented key security controls that are needed to satisfy them. Nevertheless, key aspects of each discipline have  yet to be institutionalized, leaving the office challenged in its ability to  achieve the department’s strategic goal of improving the integrity, security,  and efficiency of its IT systems. Recommendations

To strengthen the office’s IT management capacity and increase its chances  of improving the integrity, security, and efficiency of its IT systems, we  recommend that the Attorney General direct the EOUSA Director to treat  institutionalization of EA management, IT investment management, IT  security management, and system acquisition management as priorities  by developing and implementing action plans to address the weaknesses in  each discipline that are identified in this report. Objective, Scope, and Methodology

Our objective was to determine the extent to which the Executive Office  for United States Attorneys (EOUSA) has institutionalized key information  technology (IT) management capabilities to achieve the Department of  Justice’s strategic goal of improving the integrity, security, and efficiency of  its IT systems. EOUSA has not gained this maturity level. As  stated in the report, while a contingency plan was developed for the  replacement network, it was not prepared in accordance with federal  guidelines.
Why GAO Did This Study

The Executive Office for United States Attorneys (EOUSA) of the Department of Justice is responsible for managing information technology (IT) resources for the United States Attorneys' Offices. GAO was asked to determine the extent to which EOUSA has institutionalized key IT management capabilities that are critical to achieving Justice's strategic goal of improving the integrity, security, and efficiency of its IT systems.

What GAO Found

To varying degrees, EOUSA has partially defined and implemented certain IT management disciplines that are critical to successfully achieving the Justice Department's strategic goal of improving the integrity, security, and efficiency of its IT systems. However, it has yet to institutionalize any of these disciplines, meaning that it has not defined existing policies and procedures in accordance with relevant guidance, and it has yet to fully implement what it has defined. In particular, while EOUSA has developed an enterprise architecture--a blueprint for guiding operational and technological change--the architecture was not developed in accordance with certain best practices. In addition, while the office has implemented certain process controls for selecting, controlling, and evaluating its IT investments, it has not yet implemented others that are necessary in order to develop an effective foundation for investment management. Further, it has not implemented important management practices that are associated with an effective security program. In contrast, it has defined--and is implementing on a major system that we reviewed--most, but not all, of the management practices associated with effective systems acquisition. Institutionalization of these IT management disciplines has not been an agency priority and is not being guided by plans of action or sufficient resources. Until each discipline is given the priority it deserves, EOUSA will not have the IT management capabilities it needs to effectively achieve the department's strategic goal of improving the integrity, security, and efficiency of its IT systems.