Information Technology: DOD's Acquisition Policies and Guidance Need to Incorporate Additional Best Practices and Controls

In response to our report, DOD agreed that incorporation of additional best practices in its acquisition policies and guidance should be undertaken or considered. Further, DOD has updated the acquisition guidebook to incorporate most of the missing practices that we identified in our report and the following 12 recommendations address. DOD's actions are generally consistent with our recommendation.

DOD has developed an Enterprise Integration tool kit that endorses and supports the best practice of reusing reports, interfaces, and conversions that have been built or acquired by other programs. According to the Software Engineering Institute, system reuse is a key part of the product line requirements best practice. Under DOD's planned approach to consider product line requirements in acquisition, Enterprise Integration toolkit reuse covers such items as software modules or components, which developers are encouraged to use. DOD's actions are largely consistent with our recommendation.

DOD agreed that communication of acquisition management activities to all stakeholders is a best practice. DOD 5000 acquisition policies and procedures and related guidance now provide for program managers and acquisition officials to conduct acquisition oversight through integrated product teams as a way to communicate information. These policies and procedures are largely consistent with our recommendation.

DOD has updated the DOD 5000 acquisition policies and procedures and related guidance to include acquisition risk management, including references to a risk management guide that provides for identifying the status of risks at each phase and milestone of the acquisition process. Further, it describes what is to be done to manage and mitigate the risks. This is largely consistent with our recommendation.

DOD has added this best practice activity to its DOD 5000 Acquisition guidance. In the guidebook, DOD added a section entitled, "Modifying Commercial off-the-Shelf Software (COTS)" which discusses ways to avoid modifying the COTS product. For example, the guidebook notes that modifying the core code of a COTS product should be avoided. Further, it adds that the business processes inherent in the COTS product should be adopted, not adapted, by the organization implementing the product. DOD not only discouraged the modification of commercial components but also noted that should the product need to be modified, a business process re-engineering approach should be considered. This is largely consistent with our recommendation.

DOD agreed that a best practice to modify deployed versions of system components should be incorporated. Accordingly, DOD's 5000 acquisition guidance cites the application of configuration management and incorporates configuration change controls. However, the guidance does not address whether the modifications are centrally controlled and whether unilateral user release changes are precluded.

According to DOD, acquisition decisions about commercial components based on research, analysis, and evaluation of components interdependencies is considered in the Joint Capabilities Integration and Development System (JCIDS) process and is to be addressed in the Information Support Plan (ISP). Further, DOD has incorporated a section on the ISP in the DOD 5000 acquisition guidebook. Specifically, the guidebook notes that the ISP is to identify and resolve implementation issues concerning acquisition programs, as well as provide managers with a method of identifying information-related dependencies. This is largely consistent with our recommendation.

DOD agreed that change management activities, such as those described in this recommendation, are best practices and it points to its Enterprise Integration tool kit as containing a change management roadmap that addresses organizational change, readiness, and preparing users for changes to their roles and responsibilities. This tool kit provides relevant change management information for the technology development phase of the acquisition process. As such, it is largely consistent with our recommendation.

DOD agreed that change management activities, such as those described in this recommendation, are best practices and it points to its Enterprise Integration tool kit as containing a change management roadmap that addresses organizational change, readiness, and preparing users for using the system to execute their jobs. This tool kit provides relevant change management information for the technology development phase of the acquisition process. As such, it is largely consistent with our recommendation.

DOD 5000 acquisition policies and procedures and related guidance now cite and reference the use of information on contractors' past performance, which can include the ability to implement commercial components. This is largely consistent with our recommendation.

DOD has incorporated a section on systems engineering in its DOD 5000 acquisition guidebook that discusses tradeoffs throughout a system's life cycle. In addition, the Joint Capabilities Integration and Development System require that three analyses be conducted before a capability is acceptable to enter the technology development phase of the acquisition process. These analyses are to be used at investment decision points in making tradeoffs among various available capabilities (including to those available in commercial components) relative to the architectural environment in which the system is to operate, defined system requirements, and existing cost/schedule constraints.