For these reasons, we  designated the implementation of the department and its  transformation as high risk; we also pointed out that failure to  effectively address DHS’s management challenges and program  risks could have serious consequences for our national security. In addition, these organizations establish these controls and  capabilities within a governance structure that centralizes  leadership in an empowered CIO. DHS Is Making Progress but Has Yet to Fully Institutionalize IT Management Controls and Capabilities

Over the last 3 years, our work has shown that the department has  continued to work to establish effective corporate governance and  associated IT management controls and capabilities, but progress in  each of the key areas has been uneven, and more remains to be  accomplished. Until it fully institutionalizes effective governance  controls and capabilities, it will be challenged in its ability to  leverage IT to support transformation and mission results. Enterprise Architecture

Leading organizations recognize the importance of having and using  an enterprise architecture, or corporate blueprint, as an  authoritative operational and technical frame of reference to guide  and constrain IT investments. With  respect to the depth and detail of these descriptions (which are the  focus of most of our 41 prior recommendations), the department has  reported progress, such as (1) completing its first inventory of  information technology systems, a key input to its description of the  “as-is” environment; (2) establishing departmentwide technology  standards; (3) developing and beginning to implement a plan for  introducing a shared services orientation to the architecture,  particularly with regard to information services (e.g., network, data  center, e-mail, help desk, and video operations); and (4) finalizing  content for the portion of its architecture that relates to certain  border security functions (e.g., the alien detention and removal  process that is a major facet of the department’s new Strategic  Border Initiative). IT Investment Management

Through IT investment management, organizations define and  follow a corporate process to help senior leadership make informed  decisions on competing options for investing in IT. Systems Development and Acquisition Management

Managing systems development and acquisition effectively requires  applying engineering and acquisition discipline and rigor when  defining, designing, developing and acquiring, testing, deploying,  and maintaining IT systems and services. Information Security Management

Effective information security management depends on establishing  a comprehensive program to protect the information and  information systems that support an organization’s operations and  assets. Since it was established, both we and the department’s inspector  general (IG) have reported that although the department continues  to improve its IT security, it remains a major management challenge For example, within its first year the department had appointed a  chief information security officer and developed and disseminated  information system security policies and procedures, but it had not  completed a comprehensive inventory of its major IT systems—a  prerequisite for effective security management. . DHS Is Making Some Progress in Implementing IT Systems and Infrastructure

A gauge of DHS’s progress in managing its IT investments is the  extent to which it has deployed and is currently operating more  modern IT systems and infrastructure. To the department’s credit,  our reviews have shown progress in these areas, and DHS has  reported other progress. In summary, they show that DHS IT  programs are not being managed consistently: some programs are at  least partially implementing certain program management best  practices, but others are largely disregarding most of the practices. IT investment alignment with the enterprise architecture. Reliable cost estimates. For  example, they did not include detailed work breakdown structures  defining the work to be performed, so that associated costs could be  identified and estimated. Implementing  the IT management processes that I have been describing requires  that programs have the right people—not only people who have the  right knowledge, skills, and abilities, but also enough of them to do  the job.
Why GAO Did This Study

Information technology (IT) is a critical tool for the Department of Homeland Security (DHS), not only in performing its mission today, but also in transforming how it will do so in the future. In light of the importance of this transformation and the magnitude of the associated challenges, GAO has designated the implementation of the department and its transformation as high risk. GAO has reported that in order to effectively leverage IT as a transformation tool, DHS needs to establish certain institutional management controls and capabilities, such as having an enterprise architecture and making informed portfolio-based decisions across competing IT investments. GAO has also reported that it is critical for the department to implement these controls and associated best practices on its many IT investments. In its past work, GAO has made numerous recommendations on DHS institutional controls and on individual IT investment projects. The testimony is based on GAO's body of work in these areas, covering the state of DHS IT management both on the institutional level and the individual program level.

What GAO Found

DHS continues to work to institutionalize IT management controls and capabilities (disciplines) across the department. Among these are (1) having and using an enterprise architecture, or corporate blueprint, as an authoritative frame of reference to guide and constrain IT investments; (2) defining and following a corporate process for informed decision making by senior leadership about competing IT investment options; (3) applying system and software development and acquisition discipline and rigor when defining, designing, developing, testing, deploying, and maintaining systems; (4) establishing a comprehensive information security program to protect its information and systems; (5) having sufficient people with the right knowledge, skills, and abilities to execute each of these areas now and in the future; and (6) centralizing leadership for extending these disciplines throughout the organization with an empowered Chief Information Officer. Over the last 3 years, the department has made efforts to establish and implement these IT management disciplines, but it has more to do. Despite progress, for instance, in developing its enterprise architecture and its investment management processes, much work remains before these and the other disciplines are fully mature and institutionalized. For example, although the department recently completed a comprehensive inventory of its major information systems--a prerequisite for effective security management--it has not fully implemented a comprehensive information security program, and its other institutional IT disciplines are still evolving. The department also has more to do in deploying and operating IT systems and infrastructure in support of core mission operations, such as border and aviation security. For example, a system to identify and screen visitors entering the country has been deployed and is operating, but a related exit capability largely is not. Also, a government-run system to prescreen domestic airline passengers is not yet in place. Similarly, some infrastructure has been delivered, but goals related to consolidating networks and e-mail systems, for example, remain to be fully accomplished. Similarly, GAO's review of key nonfinancial systems show that DHS has more to do before the IT disciplines discussed above are consistently employed. For example, these programs have not consistently employed reliable cost estimating practices, effective requirements development and test management, meaningful performance measurement, strategic workforce management, and proactive risk management, among other recognized program management best practices. Until the department fully establishes and consistently implements the full range of IT management disciplines embodied in best practices and federal guidance, it will be challenged in its ability to manage and deliver programs.