The act provides  $500 million from the stimulus package for data center expenses, of  which $350 million is slated for the building infrastructure and part  of the remaining funding for IT-related upgrades. These requirements are intended to  ensure, among other things, that   ●  funds are awarded and distributed in a prompt, fair, and reasonable  ●  the recipients and uses of all funds are transparent to the public, and  the public benefits of these funds are reported clearly, accurately,  and in a timely manner;  ●  funds are used for authorized purposes and instances of fraud,  waste, error, and abuse are mitigated;  ●  projects funded under the act avoid unnecessary delays and cost  ●  program goals are achieved, including specific program outcomes  and improved results on broader economic indicators. Attention to Key IT Management Areas Will Help SSA in Its Data Center Initiative

An effort as central to SSA’s ability to carry out its mission as its  planned new data center requires effective IT management. These  capabilities include, but are not limited to  ●  strategic planning to describe an organization’s goals, the strategies  it will use to achieve desired results, and performance measures;  ●  developing and using an agencywide enterprise architecture, or  modernization blueprint, to guide and constrain IT investments;  ●  establishing and following a portfolio-based approach to investment  implementing information security management that ensures the  integrity and availability of information. For example, a  strategic plan that identifies interdependencies within and across  modernization projects helps ensure that these are understood and  managed, so that projects—and thus system solutions—are  effectively integrated. Given that the new data center is to form the  backbone of SSA’s automated operations, it is important that the  agency identify goals, resources, and dependencies in the context of  its strategic vision. An enterprise architecture consists of  models that describe (in both business and technology terms) how  an entity operates today and how it intends to operate in the future;  it also includes a plan for transitioning to this future state. It provides  these perspectives both for the enterprise’s current environment  and for its target environment, as well as a transition plan for  moving from one to the other. In short, it is a blueprint for  organizational change. Like an IT strategic plan (with which an enterprise architecture  should be closely aligned), an enterprise architecture is an  important tool to help SSA ensure that its data center initiative is  successful. Using an enterprise architecture will help the agency  ensure that the planning and implementation of the initiative take  full account of the business and technology environment in which  the data center and its systems are to operate. An agency should establish and follow  a portfolio-based approach to investment management in which IT  investments are selected, controlled, and monitored from an  agencywide perspective. For example, SSA had not applied  its investment management process to a major portion of its IT  budget. Robust investment management controls are important  tools for achieving these goals. For example, developing accurate  cost estimates—an important aspect of investment management— helps an agency evaluate resource requirements and increases the  probability of program success. We have issued a cost estimating  guide that provides best practices that agencies can use for  developing and managing program cost estimates that are  comprehensive, well-documented, accurate, and credible, and that  provide management with a sound basis for establishing a baseline  to formulate budgets and measure program performance. Finally, the Recovery Act emphasizes the importance of energy  efficiency and green building projects. For any organization that depends on  information systems and computer networks to carry out its mission  or business, information security is a critical consideration. It is  especially important for government agencies like SSA, where  maintaining the public’s trust is essential. Further, because a data center is the backbone of an organization’s  operations and service delivery, continuity of operations is a key  concern. Data centers need to be designed with the ability to  efficiently provide consistent processing of operations. Data  centers are vulnerable to a variety of service disruptions, including  accidental file deletions, network failures, systems malfunctions,  and disasters. An agency needs to articulate, in a well  defined plan, how it will process, retrieve, and protect electronically  maintained information in the event of minor interruptions or a full- blown disaster.
Why GAO Did This Study

The American Recovery and Reinvestment Act of 2009 (Recovery Act) provides resources to the Social Security Administration (SSA) to help replace its National Computer Center. This data center, which is 30 years old, houses the backbone of the agency's automated operations, which are critical to providing benefits to nearly 55 million people, issuing Social Security cards, and maintaining earnings records. The act makes $500 million available to SSA for the replacement of its National Computer Center and associated information technology (IT) costs. In this testimony, GAO was asked to comment on key IT management capabilities that will be important to the success of SSA's data center initiative. To do so, GAO relied on previously published products, including frameworks that it has developed for analyzing IT management areas. GAO has not performed a detailed examination of SSA's plans for this initiative, so it is not commenting on the agency's progress or making recommendations.

What GAO Found

For an effort as central to SSA's mission as its planned new data center, effective practices in key IT management areas are essential. For example: (1) Effective strategic planning helps an agency set priorities and decide how best to coordinate activities to achieve its goals. For example, a strategic plan identifying interdependencies among modernization project activities helps ensure that these are understood and managed, so that projects--and thus system solutions--are effectively integrated. Given that the new data center is to form the backbone of SSA's automated operations, it is important that the agency identify goals, resources, and dependencies in the context of its strategic vision. (2) An agency's enterprise architecture describes both its operations and the technology used to carry them out. A blueprint for organizational change, an architecture is defined in models that describe (in business and technology terms) an entity's current operation and planned future operation, as well as a plan for transitioning from one to the other. An enterprise architecture can help optimize SSA's data center initiative by ensuring that its planning and implementation take full account of the business and technology environment. (3) For IT investment management, an agency should follow a portfoliobased approach in which investments are selected, controlled, and monitored from an agencywide perspective. By helping to allocate resources effectively, robust investment management processes can help SSA meet the accountability requirements and align with the goals of the Recovery Act. For example, projects funded under the act are to avoid unnecessary delays and cost overruns and are to achieve specific program outcomes. Investment management is aimed at precisely such goals: for example, accurate cost estimating (an important aspect of investment management) provides a sound basis for establishing a baseline to formulate budgets and measure program performance. Further, the act emphasizes energy efficiency--also a major concern for data centers, which have high power and cooling requirements. Investment management tools are important for evaluating the most cost-effective approaches to energy efficiency. (4) Finally, information security should be considered throughout the planning, development, and implementation of the data center. Security is vital for any organization that depends on information systems and networks to carry out its mission--especially for government agencies like SSA, where maintaining the public's trust is essential. One part of information security management is contingency and continuity of operations planning--vital for a data center that is to be the backbone of SSA's operations and service delivery. Data centers are vulnerable to a variety of service disruptions, including accidental file deletions, network failures, systems malfunctions, and disasters. Accordingly, it is necessary to define plans governing how information will be processed, retrieved, and protected in the event of minor interruptions or a full-blown disaster. These capabilities will be important in helping to ensure that SSA's data center effort is successful and effectively uses Recovery Act funds.