The department’s fiscal year 2018 IT budget  request states that DOD plans to spend about $8.7 billion in fiscal year  2018 on its defense business systems. The NDAA for Fiscal Year 2016 Included Provisions for Managing Defense Business Systems

The NDAA for Fiscal Year 2016 included provisions requiring DOD to  perform certain activities aimed at ensuring that its business system  investments are managed efficiently and effectively. DOD Has Made Progress in Complying with Legislative Provisions for Managing Defense Business Systems, but More Remains to Be Done

DOD has taken steps to address provisions of the NDAA for Fiscal Year  2016 related to defense business system investments. The department fully addressed the act’s requirement related to defense  business system oversight. DOD Issued Guidance that Addresses New Certification Requirements, and the Military Departments Have Made Mixed Progress in Issuing Supporting Guidance

In addition to guidance for addressing the aforementioned legislative  requirements for business systems management, the NDAA for Fiscal  Year 2016 requires the Secretary to direct the DCMO and the CMO of  each of the military departments to issue and maintain supporting  guidance, as appropriate and within their respective areas of  responsibility. Specifically, the act requires that, for any fiscal year in which funds are  expended for development or sustainment pursuant to a covered defense  business system program, the appropriate approval official is to review  the system to determine if the system: has been, or is being, reengineered to be as streamlined and efficient  as practicable, and whether the implementation of the system will  maximize the elimination of unique software requirements and unique  interfaces;  is in compliance with the business enterprise architecture or will be in  compliance as a result of planned modifications; has valid, achievable requirements, and a viable plan for  implementing those requirements (including, as appropriate, market  research, business process reengineering, and prototyping activities); has an acquisition strategy designed to eliminate or reduce the need  to tailor commercial off-the-shelf systems to meet unique  requirements, incorporate unique requirements, or incorporate unique  interfaces to the maximum extent practicable; and  is in compliance with the department’s auditability requirements. As of  November 2017, however, Navy had not established a plan for when  it expects to publish finalized certification guidance. DOD Has Efforts Underway to Improve Its Business Enterprise Architecture, but Its IT Architecture Is Not Complete

According to the NDAA for Fiscal Year 2016, DOD is to develop and  maintain a defense business enterprise architecture to guide the  development of integrated business processes within the department. For example, only 25 percent of the survey respondents  reported that the business architecture effectively enabled DOD to  routinely produce timely, accurate, and reliable business and financial  information for management purposes. However, the department has not yet demonstrated that it  has delivered the capabilities described by the plan; thus, we will continue  to monitor DOD’s progress to fully address this recommendation. Nevertheless, while the architecture includes content describing the  department’s current and target information enterprise, which is  consistent with OMB guidance, it does not include a transition plan that  provides a road map for improving the department’s IT and computing  infrastructure. Until DOD ensures that its business architecture is integrated into its IT  enterprise architecture, the department may not be able to ensure that its  business strategies capitalize on technologies and that its IT  infrastructure will support DOD’s business priorities and related business  strategies. In addition, DOD’s plans for updating its IT architecture do not  address how the department intends to integrate its business and IT  architectures, as called for by the act. In the comments, the department stated that it  concurred with three of the recommendations and partially concurred with  three of the recommendations. While DOD reported taking this action, we do not agree that the  department has complied with our recommendation. Without a transition plan that provides a road map for improving the  department’s IT and computing infrastructure, including for each of its  business processes, it will be difficult for the department to rely on its  personnel to timely and proactively manage and direct modernization  efforts of such a magnitude as DOD’s systems modernization efforts. Specifically, we determined to what extent DOD has  1.  established guidance for effectively managing its defense business  2.  developed and maintained a defense business enterprise architecture  and information technology (IT) enterprise architecture, in accordance  with relevant laws and Office of Management and Budget (OMB)  policies and guidance;  3.  used the Defense Business Council to provide advice to the Secretary  on developing the business enterprise architecture, reengineering the  department’s business processes, developing and deploying business  systems, and developing requirements for business systems; and  4.  ensured that covered business systems are reviewed and certified in  accordance with the act. We also interviewed cognizant officials responsible for managing defense  business system investments at DOD, including the military departments.
Why GAO Did This Study

DOD spends billions of dollars each year on systems that support its key business areas, such as personnel and logistics. For fiscal year 2018, DOD reported that these business system investments are expected to cost about $8.7 billion. The NDAA for Fiscal Year 2016 requires DOD to perform activities aimed at ensuring that business system investments are managed efficiently and effectively, to include taking steps to limit their complexity and cost.
The NDAA also includes a provision for GAO to report every 2 years on the extent to which DOD is complying with the act's provisions on business systems. For this report, GAO assessed, among other things, the department's guidance for managing defense business system investments and its business and IT enterprise architectures (i.e., descriptions of DOD's current and future business and IT environments and plans for transitioning to future environments). To do so, GAO compared the department's system certification guidance and architectures to the act's requirements. GAO also interviewed cognizant DOD officials.

What GAO Found

The Department of Defense (DOD) has made progress in complying with most legislative provisions for managing its defense business systems, but additional actions are needed. For example, the National Defense Authorization Act (NDAA) for Fiscal Year 2016 required DOD and the military departments to issue guidance to address five requirements for reviewing and certifying the department's business systems. While DOD has issued guidance addressing all of these requirements, as of February 2018, the military departments had shown mixed progress.
● Fully addressed: The department provided evidence that it fully addressed this requirement.
◐ Partially addressed: The department provided evidence that it addressed some, but not all, portions of this requirement.
◌ Not addressed: The department did not provide any evidence that it addressed this requirement.
Source: GAO analysis of Department of Defense documentation. | GAO-18-130
The military departments' officials described plans to address the gaps in their guidance; however, none had defined when planned actions are to be completed. Without guidance that addresses all five requirements, the military departments risk developing systems that, among other things, are overly complex and costly to maintain.
DOD has efforts underway to improve its business enterprise architecture, but its information technology (IT) architecture is not complete. Specifically, DOD's business architecture includes content called for by the act. However, efforts to improve this architecture to enable the department to better achieve outcomes described by the act, such as routinely producing reliable business and financial information for management, continue to be in progress. In addition, DOD is updating its IT enterprise architecture, which describes, among other things, the department's computing infrastructure. However, the architecture lacks a road map for improving the department's IT and computing infrastructure for each of the major business processes. Moreover, the business and IT enterprise architectures have yet to be integrated, and DOD has not established a time frame for when it intends to do so. As a result, DOD lacks assurance that its IT infrastructure will support the department's business priorities and related business strategies.

What GAO Recommends

GAO is making six recommendations, including that DOD and the military departments establish time frames for, and issue, required guidance; and that DOD develop a complete IT architecture and integrate its business and IT architectures. DOD concurred with three and partially concurred with three recommendations. GAO continues to believe all of the recommendations are warranted as discussed in this report.