Within  SBI, SBInet is the program for acquiring, developing, integrating, and  deploying an appropriate mix of surveillance technologies and command,  control, communications, and intelligence (C3I) technologies. Limited Definition of SBInet Deployments, Capabilities, Schedule, and Life Cycle Management Process Increases Program’s Exposure to Risk

Important aspects of SBInet—the scope, schedule, and development and  deployment approach—remain ambiguous and in a continued state of flux,  making it unclear and uncertain what technology capabilities will be  delivered and when, where, and how they will be delivered. Further, the approach that is being used to define, develop, acquire, test,  and deploy SBInet is similarly unclear and has continued to change. Scope and Timing of Planned Deployments and Capabilities Are Not Clear and Stable

The scope and timing of planned SBInet deployments and capabilities  have not been clearly established, but rather have continued to change  since the program began. Specifically, the program office does not yet have an approved  integrated master schedule to guide the execution of SBInet. While  the program office recently issued guidance that is consistent with  recognized leading practices, this guidance was not finalized until  February 2008, and thus was not used in performing a number of key  requirements-related activities. In the absence of well-defined guidance,  the program’s efforts to effectively define and manage requirements have  been mixed. For example, the program has taken credible steps to include  users in the definition of requirements. However, several requirements  definition and management limitations exist. Program Office Has Taken Steps to Involve Users in Developing High-Level Requirements

One of the leading practices associated with effective requirements  development and management is engaging system users early and  continuously. According to the System Program Office, the  operational requirements, system requirements, and various system  component requirements have been baselined. This test management plan should define the schedule of high- level test activities in sufficient detail to allow for more detailed test  planning and execution to occur, define metrics to track test progress and  report and address results, and define the roles and responsibilities of the  various groups responsible for different levels of testing. Specifically, the SBInet Test and Evaluation Master Plan, which  documents the program’s test strategy and is being used to manage system  testing, has yet to be approved by the SBInet Acting Program Manager,  even though testing activities began in June 2008. As of July 2008, agency  officials reported that component-level tests had not been completed and  were not scheduled to occur. In light of these  circumstances and risks surrounding SBInet, our soon to be issued report  contains eight recommendations to the department aimed at reassessing  its approach to and plans for the program—including its associated  exposure to cost, schedule, and performance risks—and disclosing these  risks and alternative courses of action for addressing them to DHS and  congressional decision makers. The recommendations also provide for  correcting the weaknesses surrounding the program’s unclear and  constantly changing commitments and its life cycle management approach  and processes, as well as implementing key requirements development  and management and testing practices.
Why GAO Did This Study

The Department of Homeland Security's (DHS) Secure Border Initiative (SBI) is a multiyear, multibillion-dollar program to secure the nation's borders through, among other things, new technology, increased staffing, and new fencing and barriers. The technology component of SBI, which is known as SBInet, involves the acquisition, development, integration, and deployment of surveillance systems and command, control, communications, and intelligence technologies. GAO was asked to testify on its draft report, which assesses DHS's efforts to (1) define the scope, timing, and life cycle management approach for planned SBInet capabilities and (2) manage SBInet requirements and testing activities. In preparing the draft report, GAO reviewed key program documentation, including guidance, plans, and requirements and testing documentation; interviewed program officials; analyzed a random probability sample of system requirements; and observed operations of the initial SBInet project.

What GAO Found

Important aspects of SBInet remain ambiguous and in a continued state of flux, making it unclear and uncertain what technology capabilities will be delivered and when, where, and how they will be delivered. For example, the scope and timing of planned SBInet deployments and capabilities have continued to be delayed without becoming more specific. Further, the program office does not have an approved integrated master schedule to guide the execution of the program, and the nature and timing of planned activities has continued to change. This schedule-related risk is exacerbated by the continuous change in, and the absence of a clear definition of, the approach that is being used to define, develop, acquire, test, and deploy SBInet. SBInet requirements have not been effectively defined and managed. While the program office recently issued guidance that is consistent with recognized leading practices, this guidance was not finalized until February 2008, and thus was not used in performing a number of important requirements-related activities. In the absence of this guidance, the program's efforts have been mixed. For example, while the program has taken steps to include users in developing high-level requirements, several requirements definition and management limitations exist. These include a lack of proper alignment (i.e., traceability) among the different levels of requirements, as evidenced by GAO's analysis of a random probability sample of requirements, which revealed large percentages that were not traceable backward to higher level requirements, or forward to more detailed system design specifications and verification methods. SBInet testing has also not been effectively managed. While a test management strategy was drafted in May 2008, it has not been finalized and approved, and it does not contain, among other things, a high-level master schedule of SBInet test activities, metrics for measuring testing progress, and a clear definition of testing roles and responsibilities. Further, the program office has not tested the individual system components to be deployed to the initial deployment locations, even though the contractor initiated testing of these components with other system components and subsystems in June 2008. In light of these circumstances, our soon to be issued report contains eight recommendations to the department aimed at reassessing its approach to and plans for the program, including its associated exposure to cost, schedule and performance risks, and disclosing these risks and alternative courses of action to DHS and congressional decision makers. The recommendations also provide for correcting the weaknesses surrounding the program's unclear and constantly changing commitments and its life cycle management approach and processes, as well as implementing key requirements development and management and testing practices.