	Background

According to the President’s budget, the federal government plans to  invest more than $96 billion for IT in fiscal year 2018—the largest amount  ever budgeted. These include the federal  IT acquisition reform legislation commonly referred to as the Federal  Information Technology Acquisition Reform Act (FITARA). The  Office of Management and Budget (OMB) and covered agencies are  to make detailed information on federal IT investments publicly  available, and agency CIOs are to categorize their investments by  level of risk. The Current Administration Has Undertaken Efforts to Improve, Modernize, and Strengthen the Security of Federal IT

Beyond the implementation of FITARA,  FISMA,  and related actions, the  current administration has also initiated other efforts intended to improve  federal IT. Agencies Have Not Fully Addressed the IT Acquisitions and Operations High-Risk Area

In the February 2017 update to our high-risk series, we reported that   agencies still needed to complete significant work related to the  management of IT acquisitions and operations  We stressed that OMB  and federal agencies should continue to expeditiously implement FITARA  and OMB’s related guidance, which include enhancing CIO authority,  consolidating data centers, and acquiring and managing software  licenses. Specifically,  from fiscal years 2010 through 2015, we made 803 recommendations to  OMB and federal agencies to address shortcomings in IT acquisitions and  operations. As of May 2018, OMB and agencies had fully implemented  489 (or about 61 percent) of the 803 recommendations. Overall, federal agencies would be better positioned to realize billions in  cost savings and additional management improvements if they address  these recommendations, including those aimed at implementing CIO  responsibilities, review of IT acquisitions; improving data center  consolidation; and managing software licenses. In a draft report on CIO responsibilities that we have provided to the  agencies for comment and plan to issue in June 2018, our preliminary  results suggest that none of the 24 agencies we reviewed had policies  that fully addressed the role of their CIO, as called for by federal laws and  guidance. In order to address challenges in implementing CIO responsibilities, we  intend to include in our draft report recommendations to OMB and each of  the selected 24 federal agencies to improve the effectiveness of CIOs’  implementation of their responsibilities for each of the six IT management  areas. In January 2018, we reported that most of the CIOs at 22 selected  agencies  were not adequately involved in reviewing billions of dollars of  IT acquisitions. For example, the Department of State did  not identify 1 percent of its IT contract obligations. As a result of these findings, we made 39 recommendations in our  January 2018 report. Agencies Have Made Progress in Consolidating Data Centers, but Need to Take Action to Achieve Planned Cost Savings

In our February 2017 high-risk update, we stated that OMB and agencies  needed to demonstrate additional progress on achieving data center  consolidation savings in order to improve the management of IT  acquisitions and operations. As of May 2018, 80 of these 160 recommendations remained  unimplemented. In 2016 and 2017, we made 81 recommendations to OMB and the 24  DCOI agencies to help improve the reporting of data center-related cost  savings and to achieve optimization targets. The  objective of software license management is to manage, control, and  protect an organization’s software assets. Effective management of these  licenses can help avoid purchasing too many licenses, which can result in  unused software, as well as too few licenses, which can result in  noncompliance with license terms and cause the imposition of additional  fees. As of May 2018, 78 of the 135 recommendations had not  been implemented. Improve its cyber incident detection, response, and mitigation  capabilities. Better oversee protection of personally identifiable information. Since 2010, we have made 2,733 recommendations to agencies aimed at  improving the security of federal systems and information. These  recommendations have identified actions for agencies to take to  strengthen technical security controls over their computer networks and  systems. As of May  2018, 793 of information security-related recommendations we have  made have not been implemented. In conclusion, FITARA and FISMA  present opportunities for the federal  government to address the high-risk areas on improving the management  of IT acquisitions and operations, and ensuring the security of federal IT,  thereby saving billions of dollars. Most agencies have taken steps to  execute key IT management and cybersecurity initiatives, including  implementing CIO responsibilities, requiring CIO review of IT acquisitions,  realizing data center consolidation cost savings, managing software  assets, and complying with FISMA  requirements.
Why GAO Did This Study

The federal government plans to invest almost $96 billion in IT in fiscal year 2018. Historically, IT investments have too often failed or contributed little to mission-related outcomes. Further, increasingly sophisticated threats and frequent cyber incidents underscore the need for effective information security. As a result, GAO added two areas to its high-risk list: IT security in 1997 and the management of IT acquisitions and operations in 2015.
This statement summarizes agencies' progress in improving IT management and ensuring the security of federal IT. It is primarily based on GAO's prior reports issued between February 1997 and May 2018 (and an ongoing review) on (1) CIO responsibilities, (2) agency CIOs' involvement in approving IT contracts, (3) data center consolidation efforts, (4) the management of software licenses, and (5) compliance with cybersecurity requirements.

What GAO Found

The Office of Management and Budget (OMB) and federal agencies have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the security of federal IT through a series of initiatives. As of May 2018, agencies had fully implemented about 61 percent of the approximately 800 IT management-related recommendations that GAO made from fiscal years 2010 through 2015. Likewise, since 2010, agencies had implemented about 66 percent of the approximately 2,700 security-related recommendations as of May 2018. Even with this progress, significant actions remain to be completed.
Chief Information Officer (CIO) responsibilities . Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assigned 35 key IT management responsibilities to CIOs to help address longstanding challenges. However, in a draft report on CIO responsibilities, GAO's preliminary results suggest that none of the 24 selected agencies have policies that fully address the role of their CIO, as called for by federal laws and guidance. GAO intends to recommend that OMB and each of the selected 24 agencies take actions to improve the effectiveness of CIO's implementation of their responsibilities.
IT contract approval . According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Consequently, GAO made 39 recommendations to improve CIO oversight over IT acquisitions.
Consolidating data centers . OMB launched an initiative in 2010 to reduce data centers, which was codified and expanded in FITARA. According to agencies, data center consolidation and optimization efforts have resulted in approximately $3.9 billion of cost savings through 2018. Even so, additional work remains. GAO has made 160 recommendations to OMB and agencies to improve the reporting of related cost savings and to achieve optimization targets; however, as of May 2018, 80 of the recommendations have not been fully addressed.
Managing software licenses . Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings, and made 135 recommendations to improve such management. Four years later, 78 of the recommendations remained open.
Improving the security of federal IT systems . While the government has acted to protect federal information systems, agencies need to improve security programs, cyber capabilities, and the protection of personally identifiable information. Over the last several years, GAO has made about 2,700 recommendations to agencies aimed at improving the security of federal systems and information. These recommendations identified actions for agencies to take to strengthen their information security programs and technical controls over their computer networks and systems. As of May 2018, about 800 of the information security-related recommendations had not been implemented.

What GAO Recommends

From fiscal years 2010 through 2015, GAO made about 800 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. Since 2010, GAO also made about 2,700 recommendations to federal agencies to improve the security of federal systems. These recommendations include those to improve the implementation of CIO responsibilities, the oversight of the data center consolidation initiative, software license management efforts, and the strength of security programs and technical controls. Most agencies agreed with these recommendations, and GAO will continue to monitor their implementation.