IT Systems Supporting the 2020 Census

The Bureau’s redesign of the census relies on the acquisition and  development of many new and modified systems. Several of the key  systems are expected to be provided as CEDCAP enterprise systems  under the purview of the IT Directorate. Eleven of these projects are intended to deliver one or more IT solutions. The Bureau has  taken steps to implement these recommendations, but has not fully  implemented them. Key activities in project  monitoring and control include determining progress against the plan by comparing actual cost and  schedule against the documented plan for the full scope of the project  and communicating the results;  identifying and documenting when significant deviations in cost and  schedule performance (i.e., deviations from planned cost and  schedule that, when left unresolved, preclude the project from  meeting its objectives) have occurred;  taking timely corrective actions, such as revising the original plan,  establishing new agreements, or including additional mitigation  activities in the current plan, to address issues when performance  deviates significantly from the plan; monitoring the status of risks periodically, which can result in the  discovery of new risks, revisions to existing risks, or the need to  implement a risk mitigation plan; and  implementing risk mitigation plans that include sufficient detail such as  start and completion dates and trigger events and dates, which  provide early warning that a risk is about to occur or has just occurred  and are valuable in assessing risk urgency. The Internet  and Mobile Data Collection project and Survey (and Listing) Interview  Operational Control project fully met one of the best practices in  monitoring and controlling, but partially met the other four best practices. Specifically, the  CEDCAP program has established a process for taking corrective  actions to address issues when needed and, as of April 2016, Bureau  officials stated they have not needed to take any corrective actions to  address CEDCAP program issues. Without effective processes for managing these  interdependencies, the Bureau is limited in its ability to understand the  work needed by both programs to meet agreed upon milestones, mitigate  major risks, and ensure that requirements are appropriately identified. Consequently, the two programs have been manually  identifying activities within their master schedules that are dependent on  each other, and rather than establishing one dependency schedule, as  best practices dictate, the programs have each developed their own  dependency schedule and meet weekly with the intent of coordinating  these two schedules. Nonetheless, this process has proven to be ineffective, as it has  contributed to the misalignment between the programs’ schedules. These tests were intended to, among other things, help  define requirements around critical functions. Adequately protecting mobile devices—The 2020 Census will be  the first one in which the Census Bureau will provide mobile devices  to enumerators to collect PII from households who did not self- respond to the survey. Continued focus on these considerable challenges will be important as  the Bureau begins to develop and/or acquire systems and implement the  2020 design. However, this has not always been the case. Specifically, until the two programs  establish schedules that are completely aligned, develop an integrated list  of all interdependent risks, and finalize processes for managing  requirements, both programs are at risk of not delivering their programs  as expected. Finally, while the large-scale technological changes for the 2020  Decennial Census introduce great potential for efficiency and  effectiveness gains, it also introduces many information security  challenges, including educating the public to offset inevitable phishing  scams. In its  comments, the department agreed with all eight of our recommendations  and indicated that it will be taking actions in response to our  recommendations. Given that the Bureau is in the early stages of  conducting research and developing requirements in this area and there  is only a year remaining before the 2018 Census end-to-end test begins,  we maintain that the lack of experience and specific requirements related  to non-ID response validation is highly concerning, and our  recommendation to make this a high and immediate priority or consider  alternative approaches needs to be implemented. Appendix I: Objectives, Scope, and Methodology

Our objectives were to (1) describe the status of the 12 Census  Enterprise Data Collection and Processing (CEDCAP) projects, (2)  evaluate the extent to which the U.S. Census Bureau (Bureau) is  implementing best practices in monitoring and controlling selected  CEDCAP projects, (3) determine the extent to which the Bureau is  adequately managing the interdependencies between the CEDCAP and  2020 Census programs, and (4) describe the key information security  challenges the Bureau faces in implementing the 2020 Census design. To describe the key information security challenges the Bureau faces in  implementing the 2020 Census design, we reviewed documentation on  the 2020 Census design—including the 2020 Census Operational Plan,  CEDCAP and 2020 Census program risk registers, and a report  developed by a contractor for the 2020 Census—and interviewed staff  within the Bureau’s Office of the Chief Information Security Officer.
Why GAO Did This Study

The Department of Commerce's U.S. Census Bureau plans to significantly change the methods and technology it uses to count the population with the 2020 Decennial Census. The Bureau's redesign of the census relies on the acquisition and development of many new and modified systems. Several of the key systems are to be provided by an enterprise-wide initiative called CEDCAP, which is a large and complex modernization program intended to deliver a system-of-systems for all survey data collection and processing functions.
GAO's objectives for this review included (1) evaluating the extent to which the Bureau is implementing best practices in monitoring and controlling three selected CEDCAP projects, (2) determining the extent to which the Bureau is adequately managing the interdependencies between the CEDCAP and 2020 Census programs, and (3) describing key information security challenges the Bureau faces in implementing the 2020 Census design. GAO selected the three high-priority projects planned for the 2020 design; reviewed Bureau documentation such as project plans and schedules and compared them against relevant guidance; and analyzed information security reports and documents.

What GAO Found

The three selected Census Enterprise Data Collection and Processing (CEDCAP) projects (of 12 total) in GAO's review partially met best practices for monitoring and controlling. For example, the projects fully met the best practice of establishing a process for taking corrective actions if issues are identified, but they did not fully meet the practice of identifying significant performance deviations. Until project officials implement missing practices, they will be limited in their abilities to monitor and control costs, schedules, and performance.
The 2020 Census program is heavily dependent upon CEDCAP to deliver the key systems needed to support the 2020 Census redesign. However, while the two programs have taken steps to coordinate their schedules, risks, and requirements, they lacked effective processes for managing their interdependencies. Specifically:
Among tens of thousands of schedule activities, the two programs are expected to manually identify activities that are dependent on each other, and rather than establishing one integrated dependency schedule, the programs maintain two separate dependency schedules. This has contributed to misalignment in milestones between the programs.
The programs do not have an integrated list of interdependent program risks, and thus they do not always recognize the same risks that impact both programs.
Among other things, key requirements have not been defined for validating responses from individuals who respond to the census using an address instead of a Bureau-assigned identification number, because of the Bureau's limited knowledge and experience in this area. The lack of knowledge and specific requirements related to this critical function is concerning, given that there is about a year remaining before the Census end-to-end test begins in August 2017 (which is intended to test all key systems and operations to ensure readiness for the 2020 Census).
Officials have acknowledged these weaknesses and reported that they are taking, or plan to take, steps to address the issues. However, until these interdependencies are managed more effectively, the Bureau will be limited in understanding the work needed by both programs to meet milestones, mitigate major risks, and ensure that requirements are appropriately identified.
While the large-scale technological changes for the 2020 Decennial Census introduce great potential for efficiency and effectiveness gains, they also introduce many information security challenges. For example, the introduction of an option for households to respond using the Internet puts respondents at greater risk for phishing attacks (requests for information from authentic-looking, but fake, e-mails and websites). In addition, because the Bureau plans to allow its enumerators to use mobile devices to collect information from households that did not self-respond to the survey, it is important that the Bureau ensures that these devices are adequately protected. The Bureau has begun efforts to address many of these challenges; as it begins implementing the 2020 Census design, continued focus on these considerable security challenges will be critical.

What GAO Recommends

GAO is making eight recommendations to the Department of Commerce in the areas of project monitoring and control and in managing interdependencies related to schedule, risk, and requirements. The department agreed with all eight recommendations and indicated that it will be taking actions to address them.