Collectively, these divisions support  NASA’s approach to IT strategic and workforce planning, governance  boards and practices, and cybersecurity. NASA Has Not Yet Effectively Established and Implemented Leading IT Management Practices

NASA has not yet effectively established and implemented leading IT  management practices for strategic planning, workforce planning,  governance, and cybersecurity. The agency has taken recent action to improve its IT governance  structure; however, it has not yet fully established that structure,  documented improvements to its investment selection process, fully  implemented investment oversight leading practices, or fully defined  its policies and procedures for IT portfolio management. NASA has not fully established an effective approach to managing  agency-wide cybersecurity risk. NASA Has Improved Its IT Strategic Plan, but Has Not Yet Established a Comprehensive Plan

In addition to calling for agencies to fully document the strategic planning  process, leading practices from OMB guidance and our prior research  and experience at federal agencies have shown that an agency should  develop a comprehensive and effective IT strategic plan that (1) is aligned  with the agency’s overall strategy; (2) identifies the mission of the agency,  results-oriented goals, and performance measures that permit the agency  to determine whether implementation of the plan is succeeding; (3)  includes strategies, with resources and time frames, that the governing IT  organization intends to use to achieve desired results; and (4) provides  descriptions of interdependencies within and across projects so that they  can be understood and managed. Until NASA incorporates the key  elements of a comprehensive IT strategic plan, it will lack critical  information needed to align information resources with business  strategies and investment decisions. Of the  eight key IT workforce planning activities that we previously outlined,  NASA partially implemented five and did not implement three. Until NASA implements all of the key IT  workforce planning activities discussed in this report, the agency will have  difficulty anticipating and responding to changing staffing needs. While the IT governance boards are meeting regularly, they are  not consistently operating as intended. For example, NASA’s process does not fully define how investment risks  are to be evaluated. Not all IT investments followed the established oversight process. In accordance with its policy, NASA has designated an Acting SAISO. Conclusions

NASA continues to pursue efforts to improve IT strategic planning,  workforce planning, IT governance, and cybersecurity, but consistently  lacks the documented processes needed to ensure that policies and  leading practices are fully addressed. Until NASA leadership fully addresses these leading practices, its ability  to overcome its longstanding weaknesses and ensure effective oversight  and management of IT across the agency will remain limited. (Recommendation 7)
The Administrator should direct the Chief Information Officer to  establish an agency-wide approach to managing cybersecurity risk  that includes a cybersecurity strategy that, among other things, makes explicit  the agency’s risk tolerance, accepted risk assessment  methodologies, a process for consistently evaluating risk across  the organization, response strategies and approaches for  monitoring risk over time, and priorities for risk management  investments; (Recommendation 8) an information security program plan that fully reflects the  agency’s IT security functions and services and agency-wide  privacy controls for protecting information; (Recommendation 9)  and policies and procedures with well-defined roles and  responsibilities that are integrated and reflect NASA’s current  security practices and operating environment. In its  comments, which are reproduced in appendix II, NASA concurred with  seven of the recommendations, partially concurred with two  recommendations, and did not concur with one recommendation. Appendix I: Objective, Scope, and Methodology

The National Aeronautics and Space Administration Transition  Authorization Act of 2017 included a provision for us to review the  effectiveness of the agency’s approach to overseeing and managing  information technology (IT), including its ability to ensure that resources  are aligned with agency missions, cost effective, and secure. Our  specific objective for this review was to address the extent to which the  National Aeronautics and Space Administration (NASA) has established  and implemented leading IT management practices in strategic planning,  workforce planning, governance, and cybersecurity. To address this objective, we compared NASA’s IT management policies,  procedures, and other documentation to criteria established by federal  laws and leading practices.
Why GAO Did This Study

NASA depends heavily upon IT to conduct its work. The agency spends at least $1.5 billion annually on IT investments that support its missions, including ground control systems for the International Space Station and space exploration programs.
The National Aeronautics and Space Administration Transition Authorization Act of 2017 included a provision for GAO to review the effectiveness of NASA's approach to overseeing and managing IT, including its ability to ensure that resources are aligned with agency missions and are cost effective and secure. Accordingly, GAO's specific objective for this review was to determine the extent to which NASA has established and implemented leading IT management practices in strategic planning, workforce planning, governance, and cybersecurity. To address this objective, GAO compared NASA IT policies, strategic plans, workforce gap assessments, and governance board documentation to federal law and leading practices. GAO also assessed NASA IT security plans, policies, and procedures against leading cybersecurity risk management practices.

What GAO Found

The National Aeronautics and Space Administration (NASA) has not yet effectively implemented leading practices for information technology (IT) management. Specifically, GAO identified weaknesses in NASA's IT management practices for strategic planning, workforce planning, governance, and cybersecurity.
NASA has not documented its IT strategic planning processes in accordance with leading practices. While NASA's updated IT strategic plan represents improvement over its prior plan, the updated plan is not comprehensive because it does not fully describe strategies for achieving desired results or describe interdependencies within and across programs. Until NASA establishes a comprehensive IT strategic plan, it will lack critical information needed to align resources with business strategies and investment decisions.
Of the eight key IT workforce planning activities, the agency partially implemented five and did not implement three. For example, NASA does not assess competency and staffing needs regularly or report progress to agency leadership. Until NASA implements the key IT workforce planning activities, it will have difficulty anticipating and responding to changing staffing needs.
NASA's IT governance does not fully address leading practices. While the agency revised its governance boards, updated their charters, and acted to improve governance, it has not fully established the governance structure, documented improvements to its investment selection process, fully implemented investment oversight practices and ensured the Chief Information Officer's visibility into all IT investments, or fully defined policies and procedures for IT portfolio management. Until NASA addresses these weaknesses, it will face increased risk of investing in duplicative investments or may miss opportunities to ensure investments perform as intended.
NASA has not fully established an effective approach to managing agency-wide cybersecurity risk. An effective approach includes establishing executive oversight of risk, a cybersecurity risk management strategy, an information security program plan, and related policies and procedures.
As NASA continues to collaborate with other agencies and nations and increasingly relies on agreements with private companies to carry out its missions, the agency's cybersecurity weaknesses make its systems more vulnerable to compromise. Until NASA leadership fully addresses these leading practices, its ability to ensure effective management of IT across the agency and manage cybersecurity risks will remain limited.

What GAO Recommends

GAO is making 10 recommendations to NASA to address the deficiencies identified in NASA IT strategic planning, workforce planning, governance, and cybersecurity. NASA concurred with seven recommendations, partially concurred with two, and did not concur with one. GAO maintains that all of the recommendations discussed in this report remain valid.