Table 2 identifies 14 selected IT  oversight responsibilities for DHS’s component CIOs. To address challenges with its IT environment, in 2009, the Secret  Service initiated the IITT investment, which is intended to modernize and  enhance the component’s infrastructure, communications systems,  applications, and processes. In particular, IITT is a portfolio of programs  and projects that are meant to, among other things, improve systems  availability in support of the Secret Service’s business operations,  increase interoperability with other government systems and networks,  enhance the component’s system and network security, and enable  scalability to support growth. Nevertheless, we have continued to report that significant work remains  for DHS to improve these management functions. The Secret Service CIO Fully Implemented Most of the Required Responsibilities

Of the 14 selected responsibilities established for component-level CIOs  in DHS’s IT management policies, the Secret Service CIO had fully  implemented 11 responsibilities and had partially implemented 3  responsibilities. OCIO officials  also stated that they regularly receive verbal, undocumented feedback  from users on the system and they plan to conduct a documented  user satisfaction survey on this system by September 2018. The Secret Service took steps to establish a strategic  workforce planning process for its IT workforce. However, OCIO did not identify all required knowledge and skills  needed to support this office’s functions. Until OCIO regularly  analyzes the IT workforce to identify its competency needs and any  gaps it may have, OCIO will be limited in its ability to determine  whether its IT workforce has the necessary knowledge and skills to  meet its mission and goals. Additional efforts to fully implement the  remaining 3 responsibilities, including ensuring that all IT contracts are  reviewed, as appropriate; ensuring that the Secret Service’s enterprise  governance policy appropriately specifies the CIO’s role in developing  and reviewing the component’s IT budget formulation and execution; and  ensuring agile projects measure product quality and post-deployment  user satisfaction, will further position the CIO to effectively manage the  Secret Service’s IT portfolio. The Secret Service’s  lack of (1) a strategic workforce planning process, including the  identification of all required knowledge and skills, assessment of  competency gaps, and targeted strategies to address specific gaps in  competencies and staffing; (2) targeted recruiting activities, including  metrics to monitor the effectiveness of the recruitment program and  adjustment of the recruitment program and hiring efforts based on  metrics; (3) a training program, including the identification of required  training for IT staff, ensuring that staff take required training, and  assessment of performance data regarding the training program; and (4)  a performance management system that includes all relevant technical  competencies, greatly limits its ability to ensure the timely and effective  acquisition and maintenance of the Secret Service’s IT infrastructure and  services. In its comments, the department concurred with  all 13 of our recommendations and provided estimated completion dates  for implementing each of them. Appendix I: Objectives, Scope, and Methodology

Our objectives were to evaluate the extent to which: (1) the U.S. Secret  Service (Secret Service) Chief Information Officer (CIO) has  implemented selected information technology (IT) oversight  responsibilities, (2) the Secret Service has implemented leading  workforce planning and management practices for its IT workforce, and  (3) the Secret Service and the Department of Homeland Security (DHS)  have implemented selected performance and progress monitoring  practices for the Information Integration and Technology Transformation  (IITT) investment. 5. 8. In addition, related to our assessments of the Secret Service’s  implementation of the five selected overall workforce areas, we assessed  each area as follows, based on the implementation of the three selected  practices within each area:
Fully implemented: The Secret Service provided evidence that it had  fully implemented all three of the selected practices within the  workforce area;
Substantially implemented: The Secret Service provided evidence that  it had either  fully implemented two selected practices and partly implemented  the remaining one selected practice within the workforce area, or  fully implemented one selected practice and partly implemented  the remaining two selected practices within the workforce area;
Partially implemented: The Secret Service provided evidence that it  had partly implemented each of the three selected practices within the  workforce area;
Minimally implemented: The Secret Service provided evidence that it partly implemented two selected practices and not implemented  the remaining one selected practice within the workforce area, or partly implemented one selected practice and not implemented  the remaining two selected practices within the workforce area; or
Not implemented: The Secret Service did not provide evidence that it  had implemented any of the three selected practices within the  workforce area.
Why GAO Did This Study

Commonly known for protecting the President, the Secret Service also plays a leading role in investigating and preventing financial and electronic crimes. To accomplish its mission, the Secret Service relies heavily on the use of IT infrastructure and systems. In 2009, the component initiated the IITT investment—a portfolio of programs and projects that are intended to, among other things, improve systems availability and security in support of the component's business operations.
GAO was asked to review the Secret Service's oversight of its IT portfolio and workforce. This report discusses the extent to which the (1) CIO implemented selected IT oversight responsibilities, (2) Secret Service implemented leading IT workforce planning and management practices, and (3) Secret Service and DHS implemented selected performance monitoring practices for IITT. GAO assessed agency documentation against 14 selected component CIO responsibilities established in DHS policy; 15 selected leading workforce planning and management practices within 5 topic areas; and two selected leading industry project monitoring practices that, among other things, were, in GAO's professional judgment, of most significance to managing IITT.

What GAO Found

The U.S. Secret Service (Secret Service) Chief Information Officer (CIO) fully implemented 11 of 14 selected information technology (IT) oversight responsibilities, and partially implemented the remaining 3. The CIO partially implemented the responsibilities to establish a process that ensures the Secret Service reviews IT contracts; ensure that the component's IT policies align with the Department of Homeland Security's (DHS) policies; and set incremental targets to monitor program progress. Additional efforts to fully implement these 3 responsibilities will further position the CIO to effectively manage the IT portfolio.
Of the 15 selected practices within the 5 workforce planning and management areas, the Secret Service fully implemented 3 practices, partly implemented 8, and did not implement 4 (see table). Within the strategic planning area, the component partly implemented the practice to, among other things, develop IT competency needs. While the Secret Service had defined general core competencies for its workforce, the Office of the CIO (OCIO) did not identify all of the technical competencies needed to support its functions. As a result, the office was limited in its ability to address any IT competency gaps that may exist. Also, while work remains to improve morale across the component, the Secret Service substantially implemented the employee morale practices for its IT staff.
Secret Service officials said the gaps in implementing the workforce practices were due to, among other things, their focus on reorganizing the IT workforce within OCIO. Until the Secret Service fully implements these practices for its IT workforce, it may be limited in its ability to ensure the timely and effective acquisition and maintenance of the component's IT infrastructure and services.
Of the two selected IT project monitoring practices, DHS and the Secret Service fully implemented the first practice to monitor the performance of the Information Integration and Technology Transformation (IITT) investment. In addition, for the second practice—to monitor projects on incremental development metrics—the Secret Service fully implemented the practice on one of IITT's projects and partially implemented it on another. In particular, OCIO did not fully measure post-deployment user satisfaction with the system on one project. OCIO plans to conduct a user satisfaction survey of the system by September 2018, which should inform the office on whether the system is meeting users' needs.

What GAO Recommends

GAO is making 13 recommendations, including that the Secret Service establish a process that ensures the CIO reviews all IT contracts, as appropriate; and identify the skills needed for its IT workforce. DHS concurred with all recommendations and provided estimated dates for implementing each of them.