This is the accessible text file for GAO report number GAO-08-759 entitled 'Telecommunications: Agencies Are Generally Following Sound Transition Planning Practices, and GSA Is Taking Action to Resolve Challenges' which was released on July 28, 2008. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to the Committee on Homeland Security and Governmental Affairs, U.S. Senate: United States Government Accountability Office: GAO: June 2008: Telecommunications: Agencies Are Generally Following Sound Transition Planning Practices, and GSA Is Taking Action to Resolve Challenges: GAO-08-759: GAO Highlights: Highlights of GAO-08-759, a report to the Committee on Homeland Security and Governmental Affairs, U.S. Senate. Why GAO Did This Study: The General Services Administration (GSA) is responsible for ensuring that federal agencies have access to the telecommunications needed to meet mission requirements. GSA’s current telecommunications program, called FTS2001, has contracts in place that will expire by June 2010. Thus, agencies face the difficult task of transitioning their services to a successor program, known as Networx. GAO was asked to determine (1) the extent to which agencies are following sound transition planning practices and (2) the actions GSA is taking to identify and resolve common transition challenges affecting agencies. In performing this work, GAO selected six agencies based on, among other things, their FTS2001 charges; reviewed transition planning at these agencies and GSA; and analyzed GSA documentation of actions to address transition challenges. What GAO Found: Selected agencies—the Departments of Homeland Security, Commerce, and Agriculture and the Small Business Administration, U.S. Army Corps of Engineers, and the U.S. Nuclear Regulatory Commission—are generally following sound transition planning practices previously identified by GAO (see table below). For example, all have established telecommunications inventories, and most have established transition plans that include transition preparation tasks and time lines. However, other key practices are not being fully implemented at three agencies. For example, Commerce does not plan to clearly define all key transition roles and responsibilities, Homeland Security does not plan to identify local and regional points of contact, and the Nuclear Regulatory Commission does not plan to establish measures of success based on its transition objectives. With limited time available to finalize planning and begin transitions, agencies that do not address gaps in their planning or follow through on plans risk delaying their transitions and increase the likelihood of incurring unnecessary costs. As facilitator for all transition management activities, GSA has identified numerous common challenges that agencies face in making the transition to Networx, and it is taking action to resolve them. GSA uses various forums to identify these challenges, which include ensuring cooperation from incumbent contractors, defining agencies’ responsibilities for information security during the transition, and the use of a transition inventory application developed by GSA. To resolve these challenges, GSA has, among other things, modified FTS2001 contracts to help ensure contractor cooperation, developed guidance to clarify information security responsibilities, and established support teams to assist agencies in using the inventory application developed by GSA. GSA’s actions should reduce the likelihood that these challenges will hinder transition efforts. Table: Sound Transition Planning Practices: 1. Establish an accurate telecommunications inventory and an inventory maintenance process. 2. Identify strategic telecommunications requirements and use this to shape the agency’s management approach and guide efforts when identifying resources and developing a transition plan. 3. Establish a structured management approach that includes a dedicated transition management team, key management processes (project management, configuration management, and change management), and clear lines of communication. 4. Identify the funding and human capital resources that the transition effort will require. 5. Develop a transition plan that includes transition objectives, measures of success, a risk assessment, and a detailed time line. Source: GAO. [End of table] What GAO Recommends: GAO recommends that Commerce, Homeland Security, and the Nuclear Regulatory Commission address gaps in transition planning. Commenting on a draft, Commerce agreed with the report, Homeland Security disagreed with five of seven recommendations, while the Nuclear Regulatory Commission agreed with one of two. However, failure to follow sound planning practices could put agency transitions at risk. To view the full product, including the scope and methodology, click on [hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-08-759]. For more information, contact Linda Koontz at (202) 512-6240 or KoontzL@gao.gov. [End of section] Contents: Letter: Results in Brief: Background: Selected Agencies Are Generally Following Sound Transition Planning Practices: GSA Is Taking Action to Identify and Resolve Common Transition Challenges: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Objectives, Scope, and Methodology: Appendix II: Comments from the General Services Administration: Appendix III: Comments from the Department of Commerce: Appendix IV: Comments from the U.S. Nuclear Regulatory Commission: Appendix V: Comments from the Department of Homeland Security: Appendix VI: GAO Contact and Staff Acknowledgments: Tables: Table 1: Telecommunications Inventory: Table 2: Strategic Analysis of Telecommunications Requirements: Table 3: Structured Transition Management Approach: Table 4: Resource Identification: Table 5: Transition Plan: Figures: Figure 1: Expiration of FTS2001 Contracts: Figure 2: Transition Time Line: Abbreviations: ACE: U.S. Army Corps of Engineers: DHS: Department of Homeland Security: DOC: Department of Commerce: FAR: Federal Acquisition Regulation: GSA: General Services Administration: IMC: Interagency Management Council: IT: Information Technology: NRC: U.S. Nuclear Regulatory Commission: OMB: Office of Management and Budget: SBA: Small Business Administration: TWG: Transition Working Group: USDA: U.S. Department of Agriculture: United States Government Accountability Office: Washington, DC 20548: June 27, 2008: The Honorable Joseph Lieberman: Chairman: The Honorable Susan M. Collins: Ranking Member: Committee on Homeland Security and Governmental Affairs: United States Senate: The General Services Administration (GSA) is responsible for ensuring that federal agencies have access to the telecommunications services and solutions that they need to meet mission requirements. As federal agencies have evolved in their use of telecommunications, so too has GSA's development of contracts to help support their needs. Currently, these telecommunications contracts not only support agencies' basic telephony needs, but also provide an acquisition vehicle for wireless and satellite services, as well as managed network services and information technology (IT) security services. In fiscal year 2007 alone, federal agencies spent approximately $960 million on services acquired through the contracts under GSA's current telecommunications program, known as FTS2001. The FTS2001 contracts are set to expire by June 2010. In preparation for the end of its current telecommunications contracts, GSA developed a successor program, known as Networx, and awarded telecommunications contracts under this program in March and May 2007. Agencies must now undertake the difficult task of transitioning their telecommunications services to the Networx contracts. This transition will involve more than 135 agencies, about 50 types of services, and thousands of voice and data circuits. It could be the largest telecommunications services transition ever undertaken by the federal government and will require coordination among agencies, GSA, and a host of telecommunications contractors. This report responds to your request that we determine (1) the extent to which federal agencies are following sound transition planning practices and (2) the actions GSA is taking to identify and resolve common transition challenges affecting agencies. To determine the extent to which agencies are following sound transition planning practices, we selected six agencies for review from those that incurred FTS2001 charges in excess of $1 million for fiscal year 2006. We selected agencies that would ensure a representation of (1) executive departments, subagencies, and independent agencies; (2) varying levels of attendance in the Transition Working Group, an agency forum that is assisting GSA in its efforts to plan for the transition; and (3) a range of agency spending for FTS2001 in excess of $1 million. Based on these criteria, we selected the Departments of Homeland Security, Commerce, and Agriculture and the Small Business Administration, U.S. Army Corps of Engineers, and U.S. Nuclear Regulatory Commission. We then obtained and reviewed documentation (including strategic plans, telecommunications inventories, and transition-related plans) and interviewed officials from each of the selected agencies. We assessed this agency information against sound telecommunications transition planning practices that we identified in a report issued in 2006.[Footnote 1] In that report, we stated that organizations preparing for a telecommunications transition should: * establish a telecommunications inventory, * perform a strategic analysis of telecommunications requirements, * establish a structured transition management approach, * identify resources, and: * develop a transition plan. Each of these sound planning practices consists of various components (for example, developing a transition plan consists of (1) identifying and documenting objectives and measures of success, (2) determining risks that could affect success, and (3) defining transition preparation tasks and developing a time line for these tasks). For the current report, we classified the status of agency transition planning efforts to address the practice components as "fully implemented," if the agency has fully implemented the sound practice component; "plans to fully implement," if the agency has plans to fully implement the component; or "no plans to fully implement," if the agency does not have plans to fully implement it. We discussed our assessments with agency officials and made adjustments as appropriate. To determine actions that GSA is taking to identify and resolve challenges, we analyzed transition guidance and other Networx documentation developed by GSA and the Interagency Management Council's Transition Working Group, such as presentations, meeting minutes, projected time lines, and a pre-award transition guide. We also interviewed officials from GSA, FTS2001 incumbent vendors, Networx vendors, and the six agencies selected for review. We conducted this performance audit from September 2007 through June 2008, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. A detailed discussion of our objectives, scope, and methodology can be found in appendix I. Results in Brief: The selected agencies are generally following sound telecommunications transition planning practices that we previously identified. For example, all have established telecommunications inventories for conducting their transitions, and all have ensured that identified telecommunications needs and opportunities are aligned with their respective missions, long-term IT plans, and enterprise architecture plans. Further, most have established transition plans that include transition preparation tasks and a time line that allows for periodic reporting. However, three agencies are not fully implementing other key practices and do not plan to do so. For example, Commerce does not plan to define all key transition roles and responsibilities, Homeland Security does not plan to identify local and regional points of contact, and the U.S. Nuclear Regulatory Commission does not plan to establish measures of success based on transition objectives--all of which activities are components of the sound management practices that we identified. Agency officials provided various reasons for not following these practices, including reliance on other entities and processes to carry them out. For example, Commerce officials stated that the department did not plan to define all responsibilities for the transition because the department's transition manager and each of its components will be responsible for undefined roles. Homeland Security officials stated that they do not plan to identify local contacts because they believe the department's current process for communicating telecommunications changes will be adequate for the transition. U.S. Nuclear Regulatory Commission officials stated that instead of establishing measures to assess progress toward the agency's transition goals, they plan to use GSA-established measures related to transition progress. Nonetheless, the time remaining for agencies to conduct their telecommunications transitions is limited; thus, agencies that do not address gaps in transition planning and follow through on their plans risk delaying their transitions and increase the likelihood that the government will incur unnecessary costs. GSA has identified a number of challenges facing agencies in making the transition to Networx contracts, and it is taking actions to resolve them. Through the use of various forums, such as the Interagency Management Council's Transition Working Group, GSA has identified challenges such as ensuring cooperation from incumbent contractors, defining agencies' responsibilities for information security during the transition, and using a transition inventory application developed by GSA. To resolve the challenges identified, GSA has taken a number of actions, including modifying FTS2001 contracts to help ensure contractor cooperation, developing guidance to clarify information security responsibilities, and establishing support teams to assist agencies in using the inventory application. GSA's actions should reduce the likelihood that these challenges will affect transition efforts. To reduce the risk that transition delays could lead to disruptions in agency telecommunications services or increased costs, we are making recommendations to the Secretaries of Commerce and Homeland Security and the Chairman of the U.S. Nuclear Regulatory Commission aimed at addressing gaps in their agencies' transition planning. We received comments on a draft of our report from five of the seven agencies reviewed. GSA, Commerce, the Nuclear Regulatory Commission, and Homeland Security provided written comments (which are reproduced in apps. II through V), and the Small Business Administration provided comments via e-mail. Two agencies, Agriculture and U.S. Army Corps of Engineers, indicated via e-mail that they had no comments. Three of the agencies generally agreed with our report, and two partially agreed. Agencies generally agreeing were GSA, the Department of Commerce, and the Small Business Administration. The Nuclear Regulatory Commission and the Department of Homeland Security disagreed with aspects of our findings and recommendations. * The Nuclear Regulatory Commission indicated that our report generally reflects the issues surrounding agency preparedness for transition. However, the responding official suggested that we remove our recommendation for the Commission to evaluate the costs and benefits of new technology or alternatives, because such an evaluation had been and would be conducted as part of its normal planning processes. Nonetheless, our recommendation remains because the Commission did not perform this activity for the transition to Networx. Commission officials also provided technical comments, which we incorporated into our report as appropriate. * Homeland Security agreed with two and disagreed with five of the seven recommendations directed toward the department, and it did not concur with one finding. The department agreed with our recommendations that it establish goals and measures of success and perform a transition risk assessment for the department's transition. It disagreed with the remaining recommendations, indicating that it was already taking actions in these areas. However, these actions are already reflected in our assessment and do not meet the sound practice standards on which we based our recommendations. For example, regarding telecommunications inventory maintenance, the department's comments acknowledged that it has not published a process document for maintaining its inventory of telecommunications service assets, but stated that it instructed its components to use documented GSA procedures to maintain their inventories. However, sound practices call for the agency to document the process to be used by its components for inventory maintenance to lessen the risk that changes to the inventory during and after transition would not be consistently and accurately captured. Finally, the department stated that it does not concur with a finding related to defining communications plans, indicating that the charter for its transition working group defines essential communications responsibilities and activities. Our report acknowledges that lines of communication have been established; however, the department's communications planning is incomplete because Homeland Security did not identify local and regional points of contact, as advocated by sound practices. Background: GSA's existing FTS2001 program is the successor to a line of programs that have provided long-distance telecommunications to the federal government. Made up of two large governmentwide contracts--one awarded to Sprint[Footnote 2] in December 1998 and one awarded to MCI[Footnote 3] in January 1999--the program is designed to meet agency needs for various telecommunication services. It also includes contractors that had been awarded local telecommunications contracts for selected metropolitan areas. GSA allowed these contractors to also offer long- distance services on the FTS2001 contracts--termed "crossover contracts."[Footnote 4] The original terms of the two FTS2001 contracts were set to expire in December 2006 and January 2007. However, to give itself time to finalize the contracts intended to succeed the FTS2001 contracts and to provide its customer agencies additional time to complete their transitions once the Networx contracts were awarded, GSA negotiated sole-source contracts (termed FTS2001 bridge contracts) with Sprint and MCI to provide continuity of service for agencies. These bridge contracts, which extend the terms of the FTS2001 contracts for no more than 42 months,[Footnote 5] began in December 2006 and January 2007 and are to expire at the end of May and June 2010, respectively. In October 2003, GSA announced its plans for the Networx program. In conjunction with a group of senior federal information resource officials known as the Interagency Management Council (IMC),[Footnote 6] GSA identified eight strategic goals for the program: * Service continuity--Contracts should include all services currently available under FTS2001 to facilitate a smooth transition. * Competitive prices--Prices should be better than those available elsewhere in the telecommunications marketplace. * High-quality service--Contracts should ensure a high quality of service throughout the life of the contracts using enforceable agreements. * Full service vendors--Vendors should be capable of providing a broad array of services and provide follow-on services to avoid duplication of administrative and contracting costs. * Alternative services--Agencies should be able to choose from a greater number of competing vendors that provide new, enhanced services and emerging technologies. * Transition support--Contracts should include provisions that facilitate transition coordination and support. * Performance-based contracts--Contracts should be performance based and include service-level agreements where possible. * Operations support--GSA should provide fully integrated ordering, billing, and inventory management. In addition, GSA identified goals specific to the Networx transition and indicated that the ability of GSA and the Networx contractors to deliver against these goals is essential to the overall success of the transition effort. These goals include: - minimizing service impact, - transitioning telecommunications services before the FTS2001 contracts expire, - expediting the availability of new services, and: - minimizing transition expenses. Under the Networx program, GSA awarded two multiple-award task and delivery order contracts--Networx Universal and Networx Enterprise-- having a combined estimated value of $20 billion. The contracts were awarded in March and May 2007, respectively. * GSA awarded Networx Universal contracts to AT&T, Verizon Business Services, and Qwest Government Services. Networx Universal offers voice and data services, wireless services, and management and application services, including video and audio conferencing, as well as mobile and fixed satellite services, with national and international coverage. * GSA awarded Networx Enterprise contracts to AT&T, Verizon Business Services, Qwest Government Services, Level 3 Communications, and Sprint Nextel. Networx Enterprise offers services similar to those of Networx Universal, with a focus on those that are Internet-based, and does not require coverage of as large a geographic area as does Networx Universal. Transition Responsibilities: Central to the successful transition from FTS2001 to Networx are transition planning and execution activities that involve GSA, the agencies, and FTS2001 and Networx contractors. GSA serves as a facilitator for all transition management activities and is using contracted support to assist in tracking transition activities in order to avoid delays and other problems that can arise throughout the process. GSA's primary responsibility is program management of both the FTS2001 and Networx programs. As part of this, GSA is responsible for: * providing guidance and assistance to agencies for the transition to Networx to ensure that unnecessary delays in agency transitions are avoided; * developing an overall Networx transition strategy, minimizing agency transition costs, and ensuring that all telecommunications services are transitioned in a timely manner; and: * tracking daily progress of transition efforts, performing program- level analysis to support transition goals and objectives, and resolving transition issues. The GSA organization carrying out these responsibilities is the Federal Acquisition Service, an organization formed in 2006 from the merger of GSA's Federal Technology Service, which had managed the FTS2001 program, and GSA's Federal Supply Service. To assist agencies with their transitions from the FTS2001 contracts, GSA is working with representatives of federal agencies, both directly and through the IMC. A subgroup of the IMC, the Transition Working Group (TWG), was established in May 2004 to assist with developing a consensus on common transition issues that affect multiple agencies. The TWG coordinates with GSA, agencies, and industry partners to ensure thorough advance planning and preparation efforts for the transition to Networx. The TWG also serves as a conduit for communications among GSA and its customer agencies. GSA's customer agencies--those federal agencies acquiring services through the FTS2001 program--have principal responsibility for the transition. These agencies are responsible for coordinating transition efforts with the incumbent and Networx contractors to ensure that existing services under FTS2001 are disconnected and that new services are ordered. GSA and the IMC have requested each of the customer agencies to appoint a transition manager and establish a transition team that will: - manage the agency's internal transition planning, preparation, and execution efforts and: - be responsible for interfacing with GSA, the IMC, and officials within the agency. Both the Networx contractors and incumbent FTS2001 contractors are responsible for supporting agencies in their transition planning and execution efforts: * Networx contractors will be responsible for delivering services ordered, developing program-level and agency-level transition plans, and communicating the status of transition activities with scheduled notices and reports. * Incumbent FTS2001 contractors are expected to complete all FTS2001 service disconnect orders requested by agencies and assist agency efforts to prepare for the transition by, for example, helping to identify inventory information and system requirements. GSA and Agencies Have Taken Steps to Address Difficulties Encountered in a Previous Transition: The previous transition of federal telecommunications services was a large and complex task that underscored the importance of proper transition management practices. In 2001, we reported[Footnote 7] that the transition to the current FTS2001 federal telecommunications contracts encountered delays and took more than 24 months, which hindered the timely achievement of program goals. We also reported that transition delays resulted in raised telecommunications costs. In total, an estimated $74 million in savings was lost due to delays in completing the transition to FTS2001. Subsequently, the TWG, in conjunction with GSA, identified 27 lessons learned from the previous transition. For example, lessons learned include (1) the need for GSA and agencies to identify funding for the transition early to ensure that resources are available and (2) the need to ensure that local agency sites are not responsible for delays due to access issues. Of the 27 lessons learned, 13 related to transition planning, 11 to transition execution, and 3 to transition monitoring. Together, the lessons learned affirmed that applying adequate transition practices--including planning, executing, and monitoring the transition--increases the likelihood of a successful transition from FTS2001 contracts to Networx. GSA and representatives of its customer agencies have taken actions to address these lessons learned. For example, to address funding for the transition, GSA and the TWG developed a Taxonomy and Allocation of Transition Costs document, which the IMC approved, that describes each type of transition cost and whether GSA or the agency would be responsible. And to help ensure that local agency sites are not responsible for delays, GSA has provided guidance to agencies on creating staffing and training plans to better ensure that those involved are prepared for the transition effort. GSA has also developed numerous guidance documents and presentations related to the transition, as well as several tools. Much of this information is maintained by GSA in two locations on the Internet--its public Web site at [hyperlink, http://www.gsa.gov/networx] and a Web site accessible only to agency transition managers and TWG members. Documentation developed includes, for example, a guide to assist agencies in selecting the vendor best suited to provide required services while giving all vendors fair opportunity to be considered for each order--known as the fair opportunity process[Footnote 8]. GSA has also developed numerous presentations on the transition from FTS2001 and briefings presented to agency transition managers. Further, GSA has developed tools specifically designed to aid agencies as they transition to Networx, such as a transition inventory application to help agencies identify and validate their transition inventories and a tool that agencies can use to price their services against the various Networx contract offerings. GSA Has Provided Agencies Incentives to Transition Early: With GSA's FTS2001 contracts set to expire by June 2010--within the next 2 years--agencies have a limited time frame within which to complete their transitions (see fig. 1). As mentioned earlier, the FTS2001 bridge contracts expire in May and June 2010. In addition, GSA's FTS2001 crossover contracts with Qwest, Verizon, AT&T, Winstar Communications, and SBC will expire between January 2008[Footnote 9] and May 2010. Therefore, agencies have approximately 2 years to transition all FTS2001 services before all FTS2001 contracts expire. Figure 1 depicts these expiration dates. Figure 1: Expiration of FTS2001 Contracts: This figure is a timeline of expiration of FTS2001 contracts. [See PDF for image] Source: GAO analysis of GSA data. [A] Upon contract expiration or termination, a continuity of service period provides an agency additional time to use FTS2001 services until the agency is able to transition to a successor contract. [End of figure] To address the approaching expirations, GSA is taking several actions. First, to provide an incentive to transition early, GSA and the IMC agreed upon milestones and associated criteria that, if met, would allow agencies to be reimbursed by GSA for certain transition-related costs. Second, in meetings with agency Chief Information Officers, GSA has emphasized the importance of conducting an efficient and timely transition as well as garnering executive-level buy-in for transition support. Third, GSA's Technology Service Managers have been in contact with agencies to ensure that they are working toward transitioning their FTS2001 services. Fourth, the collection of GSA documents, presentations, and tools is geared toward assisting agencies in planning and executing their transitions. Specifically, to qualify for reimbursements, an agency must comply with the following milestones (fig. 2 depicts these milestones against the transition time line): * By September 30, 2008, agencies are to complete "fair opportunity" decisions--that is, select their vendors--for all services to be transitioned from FTS2001 telecommunications contracts. * By January 1, 2010, agencies must submit all transition orders that will incur costs related to parallel operations. GSA will not reimburse any costs for parallel operations an agency orders after this date. * By April 1, 2010, agencies must submit all transition orders. GSA will not reimburse any costs for transition orders an agency places after this date. Figure 2: Transition Time Line: This figure is a timeline showing transition. [See PDF for image] Source: GAO analysis of GSA data. [End of figure] Our Prior Work Has Addressed Telecommunications Transition Planning: We have issued several reports on issues surrounding GSA's FTS2001 and Networx telecommunications programs. Specifically, we reported on difficulties encountered during the previous transition, agency preparation for the transition to Networx, sound transition planning practices, and GSA's cost estimation for the transition to Networx. In 2001, we reported on difficulties encountered during the transition to the FTS2001 program.[Footnote 10] We found that the collective effect of delays encountered during this complex transition jeopardized the timely achievement of FTS2001's program goals. Delays occurred for several reasons. For example, delays occurred because agency efforts to order services were impeded by the inability of GSA and the long- distance contractors to rapidly add, through a contract modification process, transition-critical services to the FTS2001 contracts. Other identified reasons for transition delays included that agencies were slow to place orders for transition services and that contractors had issues with staffing and billing that impaired their efforts to support agencies' transition activities. We also reported that encountered delays would, among other things, cause agency telecommunications costs to rise. In 2006, we reported on sound transition planning practices that agencies could use to improve the likelihood of a smooth transition.[Footnote 11] These planning practices are to: * establish a telecommunications inventory, * perform a strategic analysis of telecommunications requirements, * establish a structured transition management approach, * identify resources, and: * develop a transition plan. Each of these sound planning practices consists of various components (for example, developing a transition plan consists of (1) identifying and documenting objectives and measures of success; (2) determining risks that could affect success; and (3) defining transition preparation tasks and developing a time line for these tasks). We assessed the progress of six agencies in preparing for the transition and reported that although agencies were early in the planning process, they were generally planning to employ sound transition planning practices in their transition management efforts. However, officials at two of the agencies stated that they did not plan to fully identify necessary resources. Specifically, officials at the Department of Justice indicated that they would not need additional financial resources, even though they could not provide an analytical basis for their decision, and officials from the Department of Energy believed that because the agency's transition would be straightforward, identifying human capital needs would not be necessary. We also reported that GSA had provided agencies with guidance on performing some but not all of the sound transition planning practices we identified. As a result, we recommended that: * the Attorney General ensure that the Department of Justice's planning efforts include an analysis of the extent to which current financial resources would be sufficient to conduct an effective transition; * the Secretary of Energy ensure that the department's planning efforts included identification of human capital resources needed to conduct an effective transition; and: * the Administrator of General Services, in working with the IMC, develop and distribute guidance to ensure that our identified sound practices for transition planning were used. In response, the three agencies took action or indicated that they planned to take action to implement our recommendations. The Department of Justice's Chief Information Officer indicated that the department intended to analyze and determine its financial and other resource requirements for transition in the near future. However, as of April 1, 2008, it had not yet done so. The Department of Energy provided a transition plan that indicated that the need for human capital resources for the transition would be dependent on the Networx contractor or contractors chosen; once contractors were selected, the agency planned to re-examine its human capital needs to ensure that adequate support would be provided for transition execution. Finally, GSA provided guidance to agencies that addresses our identified sound transition planning practices. In 2007, we reported on GSA's development of cost estimates for the transition to Networx, stating that while it had adequate funding to support its anticipated transition costs, it did not use sound analysis when developing its estimate.[Footnote 12] Accordingly, to ensure that future cost estimates by GSA were sound and could be used as a reliable basis for decisions, we recommended that the Administrator of General Services establish an agencywide policy requiring that cost estimates be developed using best practices. In addition, we recommended that the Administrator revise the transition cost estimate for Networx using best practices after the award of contracts under the Networx program. To address these recommendations, GSA established an agencywide policy requiring that its cost estimates be developed using best practices. Regarding the revision of its transition cost estimate, GSA officials indicated that once a significant number of agencies have made their fair opportunity decisions, it will recalculate the transition cost estimate, brief the IMC, and provide the results to us. Officials stated that GSA will brief the IMC in June 2008 on the revised transition estimate. Selected Agencies Are Generally Following Sound Transition Planning Practices: The selected agencies are generally following the sound telecommunications transition planning practices that we identified in our 2006 report.[Footnote 13] For example, all have established telecommunications inventories for conducting their transitions, and all have ensured that identified telecommunications needs and opportunities are aligned with their respective missions, long-term IT plans, and enterprise architecture plans. However, key practices are not being fully implemented at three agencies: Commerce, Homeland Security, and the U.S. Nuclear Regulatory Commission. Officials of these agencies provided various reasons for not following these practices, including reliance on other entities and processes to carry them out. For example, for the key practice of establishing a structured transition management approach, one of the practice components is identifying key local and regional transition officials and points of contact who are responsible for disseminating information. Homeland Security did not plan to identify such local and regional points of contact; officials stated that when telecommunications changes occur, the department will rely on processes already in place to convey information through departmental channels to local contacts. However, in view of the potentially large number of locations and short time frames involved in the transition, relying on the standard process could be risky. If Homeland Security does not identify all of its local points of contact before it begins transitioning services, communication difficulties could produce delays in providing the required site access for vendors (such delays occurred during the previous transition). Agencies that do not address such gaps in transition planning and follow through on their plans risk delaying their transitions and increase the likelihood that the government will incur unnecessary costs. Agencies Have Identified Transition Inventories, but Processes for Maintaining Them Are Not Yet in Place: As described in our 2006 report, sound transition planning practices include establishing an accurate inventory of current telecommunications assets and services. First, agencies should have a detailed and complete transition inventory that represents all of their facilities, components, field offices, and any other managed sites. It should include information such as telecommunications services, traffic volumes, equipment, and applications being used. Second, agencies should have a documented inventory maintenance process that can be used to ensure that inventories remain current and reflect changes leading up to, during, and after the transition. Once established, an inventory maintenance process can ensure that changes are captured and allow agencies to audit vendor bills against their inventories throughout the life of the contract. Agencies should begin efforts to establish a telecommunications inventory early because the development of an accurate and reliable inventory is important to ensuring that the agency will be prepared to transition quickly. Agencies can use their transition inventories to identify opportunities for optimizing their current technology during strategic planning and to help determine areas for optimization and/or sharing of IT resources across the agency. Table 1 summarizes the extent to which transition planners have established telecommunications inventories at the U.S. Army Corps of Engineers (ACE), Department of Homeland Security (DHS), Department of Commerce (DOC), U.S. Nuclear Regulatory Commission (NRC), Small Business Administration (SBA), and U.S. Department of Agriculture (USDA). Table 1: Telecommunications Inventory: Sound practice components: The agency has identified complete telecommunications inventories at every site, facility, and component for the transition from FTS2001; ACE: Practice component has been fully implemented; DHS: Practice component has been fully implemented; DOC: Practice component has been fully implemented; NRC: Practice component has been fully implemented; SBA: Practice component has been fully implemented; USDA: Practice component has been fully implemented. Sound practice components: The agency has a documented process for updating and maintaining its inventories; ACE: Practice component has been fully implemented; DHS: Agency does not plan to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Agency plans to fully implement practice component. Source: GAO analysis. [End of table] As the table shows, all agencies have addressed the first of the two components of this practice. All six identified telecommunications inventories that are sufficient for conducting their transitions.[Footnote 14] Those agencies with established telecommunications transition inventories are likely to be better prepared to address strategic considerations and avoid unnecessary transition delays associated with inventory identification. However, four of the six agencies had not documented a process to maintain their inventories to ensure that they remain current, although three had developed plans to do so: * Agriculture and Commerce have drafted inventory maintenance processes. * NRC's transition manager stated that the agency plans to develop a maintenance process as part of its efforts to establish an expense management system. Homeland Security does not plan to develop such a process. Homeland Security's transition manager stated that the department did not have a documented inventory maintenance process or policy at its headquarters or any of its components. The transition manager stated that the department has instructed its components to maintain their inventories. However, there was no documentation of this instruction, and the department did not have plans to document a maintenance process. Without a documented inventory maintenance process, agencies may not consistently and accurately capture the changes to their telecommunications inventories during and after transition, hindering their ability to ensure that they are billed appropriately by the vendor or to determine areas for optimization and sharing of telecommunications and IT resources across the agency. Half of the Agencies Have Incorporated Strategic Needs into Transition Planning: Sound transition planning practices, as described in our earlier work, include identifying strategic telecommunications requirements and incorporating them into transition planning. To accomplish this, agencies should use an inventory of existing services to determine current and future telecommunications needs. Agencies should also use the transition as an opportunity to identify areas for optimization or sharing of telecommunications and IT resources across the agency. The costs and benefits of introducing new technology and alternatives for meeting the agency's telecommunications needs should be evaluated. Further, the identified needs and opportunities should be aligned with the agency's mission, long-term IT plans, and enterprise architecture plans.[Footnote 15] The agency's telecommunications requirements should shape the agency's management approach to the transition and guide other efforts, such as identifying and allocating resources and developing a transition plan. Table 2 summarizes the extent to which the six agencies have performed a strategic analysis of telecommunications requirements. Table 2: Strategic Analysis of Telecommunications Requirements: Sound practice components: The agency has identified current and future telecommunications needs, areas for optimization and sharing, and the costs and benefits of any options; ACE: Practice component has been fully implemented; DHS: Agency does not plan to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency does not plan to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Practice component has been fully implemented. Sound practice components: The agency has determined that needs and opportunities are aligned with its mission, long-term IT plans, and enterprise architecture plans; ACE: Practice component has been fully implemented; DHS: Practice component has been fully implemented; DOC: Practice component has been fully implemented; NRC: Practice component has been fully implemented; SBA: Practice component has been fully implemented; USDA: Practice component has been fully implemented. Source: GAO analysis. [End of table] As the table shows, all six agencies have addressed the second of the two components of this practice: all have determined that needs and opportunities are aligned with their missions, long-term IT plans, and enterprise architecture plans. However, only half (Agriculture, ACE, and SBA) have fully implemented the other component: identifying current and future telecommunications needs, areas for optimization and sharing, and the costs and benefits of any options. One agency (Commerce) has plans to fully implement this component. That is, Commerce has determined its current and future telecommunications needs and, according to officials, plans to identify areas for optimization and sharing, as well as costs and benefits, before completing the fair opportunity process. However, two agencies (NRC and Homeland Security) do not have plans to fully implement this practice: * NRC had identified current and future needs and established long-term plans to meet those needs, but it does not plan to evaluate the costs and benefits of alternatives to meeting its telecommunications needs for this transition. NRC officials stated that they plan to transition only existing services, and alternatives would not be evaluated until after transition. * Although Homeland Security's transition plans address strategic needs, the department did not evaluate the costs and benefits of new technology or alternatives for meeting its telecommunications needs. Homeland Security officials stated that they felt this activity was not appropriate because they did not have the choice not to transition to Networx. Without assessing the costs and benefits of alternatives for meeting their needs, NRC and Homeland Security may not be taking full advantage of the transition as an opportunity to optimize their telecommunications services, such as by upgrading and optimizing their telecommunications services, or shifting service to more cost-effective technology. Further, if agencies do not incorporate strategic requirements into their planning, they risk making decisions that are not aligned with their long-term goals. Most Agencies Have Developed or Plan to Develop a Structured Transition Management Approach: The sound transition planning practices that we identified in our earlier work include establishing a structured transition management approach. This entails establishing a transition management team involved in all phases of the transition and clearly defining responsibilities for key transition activities, such as project management, asset management, contract and legal expertise, human capital management, and information security management. The agency should also ensure a comprehensive understanding of the transition by identifying those who will be involved and how transition plans, including transition objectives, will be communicated. This also involves communicating what is going to happen and when, such as the frequency of status updates and meetings, and should include alerting and educating end users to changes or disruptions. Key local and regional transition officials and points of contact should be identified who are responsible for disseminating information to employees and working with the vendor to facilitate transition execution. In addition, the agency should ensure that it uses established project management, configuration management, and change management processes during the transition. Project management processes can be used to plan and manage transition-related activities, providing a structure that incorporates performance measurement and project-level control. Configuration management processes help ensure integrity and traceability as change occurs. Change management processes help employees prepare for the procedure and technology changes that may accompany a transition, reducing the risk that improvement efforts will fail. Table 3 summarizes the extent to which the six agencies have established a structured transition management approach. Table 3: Structured Transition Management Approach: Sound practice components: The agency has established a transition management team and clearly defined responsibilities for key transition roles; ACE: Practice component has been fully implemented; DHS: Agency does not plan to fully implement practice component; DOC: Agency does not plan to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Agency plans to fully implement practice component; USDA: Agency plans to fully implement practice component. Sound practice components: The agency has identified communication plans in order to facilitate information sharing during transition planning and execution; ACE: Agency plans to fully implement practice component; DHS: Agency does not plan to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Agency plans to fully implement practice component. Sound practice components: The agency is using project management, configuration management, and change management processes in the management of its transition planning efforts; ACE: Practice component has been fully implemented; DHS: Agency plans to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Agency plans to fully implement practice component; USDA: Agency plans to fully implement practice component. Source: GAO analysis. [End of table] With regard to the first component of this practice, one agency (ACE) established a transition management team and defined all key transition roles and responsibilities; the remaining five agencies have established management teams, but have yet to define all roles and responsibilities. Specifically, three agencies had not yet defined responsibilities for certain roles, but planned to do so: * Agriculture had not defined the role of legal expertise in its transition efforts, but it has requested support and was awaiting a response from its Office of General Counsel. * SBA had yet to define responsibility for asset management, but officials indicated that they plan to do so. * NRC had yet to define responsibility for information security management, but officials indicated that they planned to do so. The remaining two agencies did not plan to fully implement this sound practice component: * Commerce officials stated that the responsibilities for asset and human capital management will rest with the department's transition manager and each individual component; therefore, the department did not plan to define responsibilities for these roles. * Homeland Security officials stated that roles such as asset management, legal expertise, human capital management, and information security management would not be assigned by name because expertise in these areas would be available as needed. However, by not defining key roles and responsibilities for the transition, these agencies risk extending their transition period as they attempt to assign appropriate personnel and update them on transition progress and issues. With regard to the second component of this practice, one agency (SBA) identified communications plans and local and regional points of contact. Four additional agencies plan to fully address this sound practice component. Specifically: * Agriculture developed a communications plan, and its transition plans indicated that it will identify transition points of contact by the end of fiscal year 2008. * Commerce officials stated that they plan to develop transition and communications plans that will include transition points of contact. * A contractor supporting ACE's transition is required to develop a communications plan, and the ACE transition plan indicates that the contractor is in the process of identifying transition points of contact. * NRC officials stated that they plan to develop a communications plan as part of the agency's transition plan, which is to include transition points of contact. However, one agency (Homeland Security) does not plan to fully implement this sound practice component. Specifically, although it has established lines of communication, it had not identified local and regional points of contact to facilitate transition execution, because, according to department officials, when telecommunications changes occur, the department has a process in place to convey information through departmental channels to local contacts, and officials believe that this process will be adequate for any changes that are part of the transition. However, in view of the potentially large number of locations and short time frames involved in the transition, relying on the standard process could be risky. If Homeland Security does not identify all of its local points of contact before it begins transitioning services, communication difficulties could produce delays in providing the necessary site access for vendors (such delays occurred during the previous transition). With regard to the third component of this practice, ACE is the only agency currently using all three key management processes--project management, configuration management, and change management processes- -in the management of its transition, but the other five agencies were using at least one of these management processes and planned to use all three. Officials at the five agencies generally provided policies or other documents indicating that all three processes would be used or stated that they planned to implement those not yet in use.[Footnote 16] Agencies that do not use a sound management approach risk additional financial costs, extended time lines, and disruptions to the continuity of their telecommunication systems. Further, without establishing lines of communication and identifying local and regional points of contact, agencies may lack the quality of information that is necessary for comprehensive understanding, accountability, and shared expectations at all levels. Most Agencies Have Identified or Plan to Identify Resources Necessary for the Transition: Our sound transition planning practices include ensuring that the resources required to successfully plan for the transition are identified. To do so, the agency should identify any funding requirements for its transition planning efforts to ensure that resources needed are available. The organizational need for investments should be identified and the agency should assess benefits versus costs to justify any resource requests. Cost-benefit analyses and return-on- investment calculations are common methods used to justify requests. Transition planning costs that should be considered include transition project management, software and hardware upgrades, and establishing reliable inventories. The agency should also determine staffing levels that may be required throughout the transition effort, as well as ensure that personnel with the right skills are in place to support the transition effort. As mentioned earlier, some of the skills needed are project management, asset management, contract and legal expertise, human capital management, and information security expertise. Further, the agency should require training for those carrying out the transition or operating and maintaining newly transitioned technology. Identifying the need for resources early in the planning process is likely to help to avoid unnecessary spending and delays during the transition. Further, the resources allocated to the transition effort should reflect the level of change identified in the agency's strategic analysis of telecommunications requirements; that is, if the agency chooses to implement new technology, it must budget resources accordingly. Table 4 summarizes the extent to which the six agencies have identified resources for their transitions. Table 4: Resource Identification: Sound practice components: The agency has identified the level of funding needed to support transition planning, and justified organizational resource requests; ACE: Agency does not plan to fully implement practice component; DHS: Agency does not plan to fully implement practice component; DOC: Practice component has been fully implemented; NRC: Agency does not plan to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Practice component has been fully implemented. Sound practice components: The agency has identified human capital needs for the entire transition effort; ACE: Agency plans to fully implement practice component; DHS: Agency does not plan to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Practice component has been fully implemented. Sound practice components: The agency has required training for the transition; ACE: Practice component has been fully implemented; DHS: Practice component has been fully implemented; DOC: Agency plans to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Agency plans to fully implement practice component. Source: GAO analysis. [End of table] As table 4 shows, three agencies addressed the first component of this practice, having identified the level of funding needed to support transition planning efforts and justified organizational resource requests. However, three did not: Homeland Security, NRC, and ACE did not address funding requirements for their transition planning efforts before planning their transitions and, among other things, identifying inventories. Instead, the three agencies moved forward with performing transition planning using existing resources without having analyzed the sufficiency of these resources. At this late point in the planning process, performing such an analysis is no longer feasible. With regard to the second component, two agencies (SBA and Agriculture) have identified staffing levels that will be needed throughout the transition, and three plan to do so. ACE and Commerce provided evidence of efforts under way to identify staffing resources that will be needed, and NRC officials stated that they plan to address staffing levels in the agency's transition plan. Homeland Security indicated that although staffing specific to the transition effort was not identified, staffing for the transition was taken into consideration as part of the department's acquisition for a wide-area network under Networx. However, Homeland Security did not provide documentation to demonstrate that this sound practice component had been addressed. Without determining staffing needs for its transition effort, Homeland Security risks underestimating the complexity and demands of the transition, which may lead to delays and unexpected costs. As the table shows, three agencies have fully implemented the third component: Homeland Security, ACE, and SBA have required training for those involved in the transition. Of the remaining agencies, Commerce has a draft policy requiring those involved with the transition to meet certain training requirements, and a draft Agriculture transition plan indicated that training requirements will be addressed. NRC officials stated that they plan to identify training requirements in the agency's transition plan. As illustrated by lessons learned from the previous transition, agencies that do not fully analyze their transition-related resource needs may be underestimating the complexity and demands of the transition effort. Further, unexpected costs may arise that lead to delays and unnecessary spending that could have been avoided. The Agencies Have Generally Established Transition Plans, but None Have Established Measures of Success: The sound transition planning practices we identified include developing a transition plan that identifies transition objectives, measures of success, and risks, and that approaches the transition planning process as a critical project with a detailed time line. To facilitate this practice, agencies' transition management teams should undertake the following three activities: * The agency should identify transition objectives and measures of success. Transition objectives should be based on the agency's strategic analysis of telecommunications requirements and aligned with the agency's overall mission and business objectives. Measures of success should be based on these transition objectives. They are a key tool to help managers assess progress. * The agency should identify agency-specific risks that could affect transition success. The importance of the risks should be evaluated relative to the agency's mission-critical systems and continuity of operations plans. Knowing what risks exist and how to mitigate them appropriately will lessen problems and delays during the transition. This risk assessment should also include an analysis of information security risks to determine what controls are required to protect networks and what level of resources should be expended on controls. * The agency should develop a transition plan that depicts a management strategy with clearly defined transition preparation tasks and includes a time line that allows for periodic reporting. This time line should take into account priorities relative to the agency's mission-critical systems, contingency plans, and identified risks. Table 5 identifies the extent to which the agencies have developed plans for the transition. Table 5: Transition Plan: Sound practice components: The agency has identified and documented agency-specific transition objectives and measures of success; ACE: Agency plans to fully implement practice component; DHS: Agency does not plan to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency does not plan to fully implement practice component; SBA: Agency plans to fully implement practice component; USDA: Agency plans to fully implement practice component. Sound practice components: The agency has identified agency-specific risks that could affect transition success including information security risks; ACE: Agency plans to fully implement practice component; DHS: Agency does not plan to fully implement practice component; DOC: Agency plans to fully implement practice component; NRC: Agency plans to fully implement practice component; SBA: Agency plans to fully implement practice component; USDA: Agency plans to fully implement practice component. Sound practice components: The agency has clearly defined transition preparation tasks and developed a time line; ACE: Agency plans to fully implement practice component; DHS: Practice component has been fully implemented; DOC: Practice component has been fully implemented; NRC: Agency plans to fully implement practice component; SBA: Practice component has been fully implemented; USDA: Practice component has been fully implemented. Source: GAO analysis. [End of table] Four of the agencies have plans to fully implement the first component of this sound practice, with three having documented agency-specific transition objectives and the remaining planning to do so. And while none had yet established measures of success, officials at all four stated that they plan to do so. However, NRC and Homeland Security do not plan to fully address this component. * Although NRC officials stated that they plan to establish transition objectives, they do not plan to establish measures of success. Instead of establishing measures to assess progress toward agency goals, NRC officials stated that they plan to use GSA-established measures related to governmentwide transition progress. * Homeland Security officials stated that transition goals were discussed, but evidence was not provided, and the department had no plans to establish measures of success. Without documenting objectives for the transition, Homeland Security may find it difficult to provide those involved in the transition with clear expectations. Those agencies that do not establish measures of success based on documented objectives will lack information that could be used to track progress toward transition objectives and inform management decisions. Five agencies plan to fully implement the second component of this sound practice: identifying agency-specific risks that could affect transition success. Specifically, for ACE, Agriculture, and Commerce, the agencies' transition plans indicate that agency-specific transition risks will be identified. For SBA, a memorandum indicated that a formal risk assessment will be performed before the transition to Networx. For NRC, officials stated that risks will be addressed in the agency's transition plan and that information security risks will be addressed during the agency's fair opportunity process. One agency, however, did not have plans to fully address this sound practice component. Homeland Security performed a high-level risk assessment, but this assessment did not address risks to mission- critical systems, continuity of operations plans, or information security risks, which are key components of this practice. Homeland Security officials stated that information security risk assessments will be performed in accordance with federal requirements, but they do not intend to identify information security risks specific to their transition effort. If they do not analyze risks relevant to the transition, agencies may encounter problems and delays during the transition because they are not adequately prepared to mitigate risks. Four of the agencies fully implemented the third step of this practice, having transition plans that depicted a management strategy with clearly defined transition preparation tasks and included a time line that allowed for periodic reporting. The remaining two agencies' transition plans indicate that they will fully implement this sound practice component. Agencies that do not document measurable objectives and clearly define transition tasks that take into account agency priorities and risks may find it difficult to provide those involved in the transition with clear expectations or gauge transition success. Specifically, without measurable objectives, managers will lack information that could be used to track progress toward transition objectives and inform management decisions. GSA Is Taking Action to Identify and Resolve Common Transition Challenges: GSA is working with agencies and various forums to identify and resolve transition challenges facing agencies in making the transition to the Networx contracts. In working with agencies and vendors through such forums as the Interagency Management Council's Transition Working Group, and a transition help desk, GSA has identified challenges related to incumbent contractor support during the transition, defining responsibilities of agencies during the transition to ensure information security compliance, and use of a transition inventory application developed by GSA. To resolve the challenges, GSA has, among other things, modified incumbent FTS2001 contracts to help ensure contractor support during the transition, developed guidance to clarify agencies' information security responsibilities, and established support teams to assist agencies in using the inventory application developed by GSA. GSA Is Working through Various Forums to Identify Common Transition Challenges: As the lead agency for the Networx transition, GSA is responsible for ensuring that unnecessary delays in agency transitions are avoided, as well as minimizing agency transition costs and ensuring that all telecommunications services are transitioned in a timely manner. As part of its efforts to address its transition responsibilities, GSA is using various forums to identify transition challenges: * Transition Working Group (TWG)--A subgroup of the Interagency Management Council, TWG was created in May 2004 and serves as the primary avenue through which common transition challenges affecting agencies are identified. TWG is a bi-weekly forum for agency representatives. It promotes collective government planning related to the transition and assists with developing a consensus on common issues that affect multiple agencies. * Direct interaction with individual agencies--GSA interacts directly with agencies to provide them with individual assistance related to its various contract offerings, including FTS2001 and Networx. GSA has Technology Service Managers who are assigned to specific agencies to serve as single points of contact for GSA's contract offerings and provide support to agencies for, among other things, selection, ordering, implementation, and maintenance of FTS2001 and Networx services. GSA indicated that agencies can contact their Technology Service Managers to raise challenges specific to their agency. In addition to the Technology Service Managers, GSA's Director of Network Services Programs has been meeting individually with agency Chief Information Officers and other executive-level leadership to educate them on the benefits of Networx and prepare for the transition from FTS2001. * Regular interaction with vendors--GSA interacts with vendors in a number of ways, including regular meetings, vendor-required reporting to GSA, and GSA-initiated information requests. Specifically, GSA meets regularly with FTS2001 and Networx vendors (as often as weekly) to facilitate information sharing and to identify and resolve concerns or challenges. Vendors are also required to submit monthly status reports to GSA as well as provide quarterly program reviews. GSA has also requested information from its vendors to address specific issues. For example, GSA recently sent a request for information to the vendors to solicit strategies for enabling agency compliance with a recent initiative by the Office of Management and Budget (OMB) to improve governmentwide information security by reducing the number of Internet connections. * Networx Help Desk--The help desk is a resource for agencies and GSA to track and resolve agency-reported issues such as transition planning concerns, assistance with GSA tools, and identification of transition inventories. This help desk is part of GSA's Transition Coordination Center, a GSA-established team of GSA personnel and contractors tasked with facilitating the transition to Networx. The help desk addresses individual agency concerns or questions and develops weekly reports of help desk tickets that are reviewed and tracked by GSA. Using these tickets, GSA has created a knowledge database and identified frequently asked questions that are available for review by agencies. GSA officials stated that through the help desk they could likely identify vendors who deliver services late or provide inadequate support during the transition. As a result of GSA's efforts, a number of challenges have been identified: * Incumbent contractor cooperation--The FTS2001 contracts lacked requirements for the incumbent vendors to provide a certain level of support to meet agencies' needs during the transition to Networx. * Organizational conflicts of interest--Agencies found that they were unable to use current contractors providing telecommunications support to assist with the transitions to Networx if the particular contractors were also subcontractors of a Networx vendor. * Information security compliance--Agencies did not have a clear understanding of their responsibilities during the transition related to existing information security requirements. * GSA transition inventory application--Agencies encountered difficulties using an application developed by GSA to assist agencies in identifying their transition inventories. * Agencies' statements of work--Delays in the transition process could result from statements of work developed by agencies that include unclear requirements. * Contract modification process--Modifications to the Networx contracts require time and effort of both GSA and the vendors and may extend the amount of time required for an agency to transition. * OMB security initiative--The OMB initiative to reduce the number of government Internet connections (mentioned previously) may require agencies to revisit their Networx transition planning efforts. * Expansion of protest rights--Recent legislation permits protests of orders above $10 million under multiple-award task and delivery order contracts such as Networx; if an order is protested, it may delay an agency's transition. More detail on these challenges is presented in the discussion following. GSA Has Taken Action to Resolve Common Transition Challenges: GSA has taken various actions to resolve the identified common transition challenges. Incumbent Contractor Cooperation: In September 2006, TWG members expressed concern that FTS2001 incumbent vendor contracts did not include certain transition-related provisions. Specifically, the contracts did not require FTS2001 incumbent vendors to assist in the transition process by providing the ability for agencies to "fall back" on the incumbent vendors' services if a specific transition effort encountered difficulties. Agencies requested clarification on the level of effort required of the incumbent vendor to reestablish agency telecommunications services until transition issues could be remedied. GSA modified the FTS2001 contracts, including the FTS2001 crossover contracts, to address these issues. Specifically, all but two FTS2001 crossover contracts were modified to include requirements for incumbent vendors to restore agency services in the event of problems with transition to new services. (GSA officials indicated that the remaining two contracts already included language to address this concern.) Modifications included provisions for the incumbent contractors to make a reasonable effort to promptly reactivate service if there was a problem with the successor contractor's service and it was necessary to fall back to the incumbent's service. In addition, modifications state that the incumbent contractor's point of contact should be available during scheduled cutovers to handle fallback requests. The inclusion of these terms in the FTS2001 contracts should help to reduce the risk that agencies' telecommunications transitions will be disrupted by the lack of cooperation by incumbent contractors, as well as help to ensure that unnecessary delays are avoided if agencies encounter difficulties in transitioning to a new contractor. Organizational Conflicts of Interest: During a September 2007 meeting, TWG members identified a concern regarding contractor organizational conflicts of interest.[Footnote 17] Specifically, agencies found that they were unable to use certain current contractors providing telecommunications support to assist with the transition to Networx because these contractors were also subcontractors of Networx vendors, and the agencies' use of such a subcontractor could give a Networx vendor an unfair competitive advantage. The Federal Acquisition Regulation (FAR) calls for the exercise of good judgment to resolve a potential organizational conflict of interest and requires appropriate action to avoid, neutralize, or mitigate the potential conflict.[Footnote 18] To address this challenge, GSA has modified Networx contracts to allow agencies to use their existing contractor support within defined boundaries. For example, the modification requires contractors supporting an agency to (1) avoid situations with the risk of unauthorized disclosure of information, (2) refuse to divulge information about the agency's program, and (3) report conflicts of interest. The modification also calls for contractors to train their employees on the Procurement Integrity Act[Footnote 19] and its penalties. Thus, GSA has established a framework for agencies and contractors to follow that is intended to address potential or actual organizational conflicts of interest. Agencies remain responsible for taking steps to avoid, neutralize, and mitigate conflicts of interest in using contractors. Information Security Compliance: The TWG expressed concern that responsibilities related to the Federal Information Security Management Act of 2002[Footnote 20] were unclear. Specifically, agencies were unsure of their responsibilities for information security under Networx versus those of GSA and the vendors. For example, agencies requested clarification on government responsibility to certify and accredit[Footnote 21] the public network during transition and GSA's information security responsibilities as the agency providing the contract vehicle for telecommunications services. GSA, in consultation with OMB, has provided guidance to agencies that addresses information security concerns for transition. Specifically, a GSA briefing to agencies clarifies that agencies are responsible for determining the impact of the transition on the certification and accreditation of their systems. In addition, GSA clarified that its responsibilities, as the manager of the contract vehicle, includes, among other things, reviewing contractor security plans and reports in accordance with the provisions of the contract; monitoring and resolving security issues during the life of the contract; conducting post-award certification and accreditation of contract awardees' support systems; and conducting certification and accreditation on GSA's billing system related to Networx. GSA's actions should help ensure that information security during the transition will be adequately addressed. GSA Transition Inventory Application: The TWG indicated that agencies were having difficulties using an application developed by GSA to validate their telecommunications inventories for the transition. In January 2007, GSA created an initial governmentwide inventory using FTS2001 vendor billing reports, with the intention of using it to track transition status and aid agencies in planning for their transitions. To assist in this effort, GSA required agencies to validate their inventory using a GSA inventory application. As agencies worked to validate these inventories, the TWG indicated that agencies encountered difficulties with the application and that the process for validating their inventories was not clearly defined. To address this challenge, GSA has taken several actions. GSA has issued user guidance for its inventory application and has briefed the TWG on the inventory validation process. GSA has also established inventory assistance teams to work with agencies to identify and validate their inventories. These inventory assistance teams are assigned at the request of an agency and include GSA personnel and contracted support staff. From September to December 2007, inventory assistance teams worked with 43 agencies to provide assistance with validating their inventories. As a result, when GSA established a baseline in January 2008 of the government's inventory to be used to measure transition progress, federal agencies had validated about 92 percent of the almost 4.1 million records in the inventory. As a result of its actions, GSA has increased the chances of a successful transition by helping to ensure that agencies have available to them accurate inventory information. Agencies' Statements of Work: GSA and several of the Networx vendors identified concerns about the quality of agency statements of work and possible delays as a result of unclear statements of work. An agency will develop a statement of work when its telecommunications requirements cannot be met using existing offerings in the Networx contract. Since statements of work are particular, those with unclear requirements could extend the time required for GSA to review and determine whether a modification is necessary. According to Networx vendors, an unclear statement of work may also require additional time as they review it to clarify and understand agency requirements. Lack of clarity may also result in an agency receiving disparate proposals from vendors, which may not all meet the agency's particular needs. Finally, GSA officials stated that there are fewer contracting staff (the personnel responsible for reviewing agency statements of work) assigned to Networx than were assigned to FTS2001. A limited number of staff may increase the amount of time needed for GSA's review of agency statements of work. GSA is taking action to address concerns related to the quality of statements of work. First, GSA has developed a "Fair Opportunity and Statement of Work Guide," intended to provide agencies with a set of uniform ordering guidelines to obtain services under the Networx contacts. This guide addresses the definition and documentation of agency requirements, describes how to determine if a statement of work is needed, and states that GSA has advisory and consulting services available to agencies. Second, GSA officials stated that after an agency submits its finalized statement of work to GSA, it is reviewed for possible legal, pricing, contracting, management, and technical issues, as well as to determine whether there are opportunities for the agency's needs to be met using existing Networx service offerings. If concerns or errors are identified, the statement of work is rejected, the agency is briefed on the cause of rejection, and the agency must revise its statement of work. Finally, to address the limited number of contracting staff, GSA officials stated that they plan to add additional staff to better facilitate the contract review process. The actions being taken by GSA should help address issues regarding the quality of statements of work developed by agencies and submitted to vendors. Contract Modification Process: Contract modifications require time and effort, from both GSA and the vendors, to negotiate the terms of the modification and eventually extend the amount of time required for an agency to transition. In addition to its responsibility for overseeing the transition, GSA has administrative responsibility for processing and authorizing contract modifications. Modifications to the Networx contract are essential to allow agencies to place orders against requirements that are within the scope of the Networx contract, but that are not currently available as fixed price contract items. Contract modifications can also be initiated (1) by a vendor desiring to add or change specific service offerings or (2) as a result of a Networx program need determined by GSA. Also, as previously discussed, GSA officials stated that they have fewer personnel assigned to Networx who are responsible for reviewing and incorporating contract modifications than were assigned to the transition to FTS2001. To address concerns with the contract modification process, GSA identified existing and planned actions. First, the initial review of agencies' statements of work is, in part, designed to identify whether a modification is necessary. Second, GSA developed a contract modification guide to inform those involved of the process for modifying contracts. Third, in April 2008, it took steps to automate certain aspects of the contract modification process. For example, contractors can now draft, submit, and update contract modifications using an Internet-based application. In addition, according to GSA officials, contractors can also use this application to track the modification throughout the process. Last, the previously mentioned planned increase in contract review staff will also be used to facilitate the processing of contract modifications. As a result of actions taken, GSA is making progress in meeting its goals for processing contract modifications. Its "Fair Opportunity and Statement of Work Guide" indicates that the majority of modifications should be completed within 30 business days. As of May 2008, the time to complete a contract modification varied from 1 business day to more than 106 business days; about 49 percent of its modifications had been made within 30 days. However, many of these took place before GSA had implemented its automated contract modification tools. These tools and the other actions GSA has taken have the potential to minimize contract modification delays. OMB Security Initiative: In November 2007, OMB issued a memorandum to improve governmentwide information security. This initiative, called the Trusted Internet Connections initiative, seeks to lessen information security risks by reducing the number of Internet connections maintained by the government. OMB has asked agencies to analyze and resolve any effects of this initiative on, among other things, planning related to the agencies' use of the Networx contracts. Therefore, agencies may have to revisit their Networx transition planning efforts if, for example, they find it necessary to reconfigure their networks to enable the use of fewer Internet connections. In response to this initiative, GSA asked Networx vendors to identify (1) how they can help agencies to meet the goals of the initiative and (2) any concerns. GSA summarized the vendors' feedback and on February 25, 2008, it presented the results to OMB, which is leading the initiative in conjunction with Homeland Security. The summary indicated multiple areas of support that vendors are willing to provide agencies, such as assisting agencies in performing a complete inventory and discovery of all agency Internet connections. In addition, it indicated that the Networx contracts may need to be modified to allow vendors to offer several of these services. GSA stated that detailed requirements for this initiative have yet to be fully developed by Homeland Security and that, as of May 2, 2008, no specific modifications to existing Networx contract offerings have been identified as necessary. GSA is, however, working with Homeland Security to define detailed requirements for a new service offering under Networx to provide a trusted Internet portal service; it expects this service to be available to the agencies by November 2008. The actions GSA is taking and has planned should help to ensure that the Networx contracts can be used by agencies to address OMB's Trusted Internet Connections initiative. Expansion of Protest Rights: Recent legislation permits protests of orders above $10 million under multiple-award task and delivery order contracts such as Networx.[Footnote 22] Beginning May 27, 2008, the recently enacted National Defense Authorization Act for Fiscal Year 2008 authorizes bid protests of such orders; previously, protests were authorized only when an order increased the scope, period, or maximum value of the contract under which the order was issued. The protest of an agency's order may affect the time available to the agency to complete its transition. Although officials stated that the impact of this legislation on agency transitions cannot be known at this time, GSA has briefed IMC members, TWG members, and agency transition managers on this legislation. The briefing provided information on the terms of the legislation, and informed agencies of their expected responsibilities as well as GSA's expected role. For example, the briefing indicated that GSA may be asked to provide input in the event of a protest, but the agency that issued the order would have primary responsibility to defend the protest. In addition, GSA revised its "Fair Opportunity and Statement of Work Guide" to reflect this new legislation. Further, officials stated that they are responding to agency questions, through the Networx help desk, regarding the bid protest process. GSA's actions have helped to inform agency transition officials of their responsibilities and the impact this legislation may have on their ordering process. Conclusions: Transitioning federal telecommunications services is a large and complex undertaking. The previous transition resulted in significant delays and increased costs, taking more than 2 years to complete, which underscores the importance of making necessary preparations before starting such an effort. For the current transition, selected agencies are generally following our sound transition practices, which should help them avoid some of the delays experienced previously. However, Homeland Security, Commerce, and NRC are not planning to fully implement key sound practices. Because the period to conduct their telecommunications transitions is limited, agencies will be better prepared if they consistently implement all of the sound practices. If they do not, they risk being unable to complete their transitions before the expiration of the FTS2001 contracts and increase the likelihood that the government will incur unnecessary costs. In managing its $20 billion Networx program, GSA has taken actions to identify and resolve common transition challenges, including developing guidance for agency statements of work and creating teams to assist agencies in establishing transition inventories. These actions should help to reduce the risk that challenges will lead to unnecessary transition delays and costs for agencies. Going forward, GSA's responsibility as facilitator for the Networx transition will continue to require it to proactively identify and resolve common transition challenges, complete actions planned to resolve already identified challenges, and monitor transition progress. Recommendations for Executive Action: To reduce the risk that transition delays could lead to disruptions in service and increased costs, we are making the following 10 recommendations: We recommend that the Secretary of Commerce direct the department's Chief Information Officer to define the roles of asset and human capital management for the department's transition. We recommend that the Chairman of the U.S. Nuclear Regulatory Commission direct the commission's Chief Information Officer to: * establish measures of success based on the transition objectives that the agency plans to develop and: * evaluate the costs and benefits of new technology or alternatives to meeting its telecommunications needs. We recommend that the Secretary of Homeland Security direct the department's Chief Information Officer to address the gaps in its transition planning. Specifically, the Chief Information Officer should: * document the department's processes for maintaining telecommunications inventories; * evaluate the costs and benefits of new technology or alternatives to meeting its telecommunications needs; * clearly define the roles of asset management, legal expertise, human capital management, and information security expertise for the department's transition; * identify local and regional points of contact; * include in the department's planning efforts the identification of human capital resources needed to conduct an effective transition; * establish goals and measures of success for the department's transition efforts to help managers assess progress; and: * perform a transition risk assessment that addresses risks to mission- critical systems, continuity of operations plans, and risks to information security. Agency Comments and Our Evaluation: In commenting on a draft of our report, three of the seven agencies reviewed generally agreed with our report, and two agencies partially agreed. GSA, Commerce, NRC, and Homeland Security provided written comments (which are reproduced in apps. II through V), and SBA provided comments via e-mail. Two agencies, Agriculture and U.S. Army Corps of Engineers, indicated via e-mail that they had no comments. Officials from GSA, Commerce, and SBA generally agreed with our findings: * The Acting Administrator of GSA concurred with the information pertaining to GSA and expressed appreciation for our acknowledgment of the actions the agency had taken. * Commerce's Chief Information Officer indicated that the report provided a fair assessment of the department's progress and status to date. * A program manager in SBA's Office of Congressional and Legislative Affairs indicated that SBA was satisfied with our findings regarding the agency. NRC and the Department of Homeland Security partially agreed with our report. NRC's Executive Director for Operations indicated that our report generally reflects the issues surrounding agency preparedness for transition. However, the official suggested that we remove our recommendation that the Commission evaluate the costs and benefits of new technology or alternatives because such an evaluation had been and would be conducted as part of the agency's normal planning processes. However, our recommendation remains because the Commission did not perform this activity specifically for the transition to Networx. Performing such an analysis would provide the Commission with the opportunity to optimize its telecommunications services in the light of its present and projected needs. The Executive Director also provided technical comments, which we incorporated into our report as appropriate; our assessment of these comments is contained in appendix IV. The Acting Director of Homeland Security's Departmental Audit Liaison Office indicated partial agreement with our report. In particular, regarding our recommendations that Homeland Security establish goals and measures of success and perform a transition risk assessment, the department agreed that a more structured communication of transition objectives and a specific risk management process for transition would be beneficial. However, this official indicated that the department disagreed with five of our recommendations and with a finding regarding its transition communications planning. The department's comments reiterated information on actions that it had taken in these areas that it considered to meet the goals of the sound practices. However, these actions are already reflected in our assessment. The specific areas of disagreement are as follows: * Regarding our recommendation that the department document its processes for maintaining telecommunications inventories, the official acknowledged that the department does not have a documented inventory maintenance process, but stated that our observation was in conflict with our finding that it had identified a complete telecommunications inventory. The official added that the department has instructed its components to maintain their inventories using a GSA tool and documented GSA procedures. However, our finding that the department had established an inventory for transition is not in conflict with the recommendation. While the department had addressed one component of this sound practice by establishing an inventory for transition, it had not taken the necessary action to address the other component; it had not documented the process to be used by its components for inventory maintenance. Specifically, this sound practice component calls for a documented inventory maintenance process to lessen the risk that changes to the inventory during and after transition would not be consistently and accurately captured. * Regarding our recommendation that the department evaluate the costs and benefits of new technology or alternatives to meeting its telecommunications needs, the official indicated that this was in conflict with our related finding that the department had aligned needs and opportunities with its mission, long-term IT plans, and enterprise architecture plans. The official added that its fair opportunity efforts will include service and cost analyses. However, our recommendation is not in conflict with the identified finding. Specifically, although the department's transition plans addressed strategic needs, it had not performed an analysis of costs and benefits of new technology or alternatives for meeting those needs. Regarding decisions made during the fair opportunity process, our recommendation refers to the sound transition practice of performing a strategic analysis based on agencywide telecommunications needs, with the results of this analysis being used to shape the agency's transition management approach, transition plan development, and allocation of resources. In contrast, the fair opportunity process involves selecting a vendor for the agency's service orders; at that point in the process, the agency should have already identified services to order. Therefore, to be effective, an agency's evaluation of costs and benefits of new technology and alternatives would need to take place before the department's fair opportunity efforts. * Regarding our recommendation that the department clearly define the roles of asset management, legal expertise, human capital management, and information security expertise, the official indicated that the department can call upon these specialty disciplines as needed. However, by taking this approach, Homeland Security risks encountering delays as officials attempt to assign personnel in a time of need and bring them up to date on transition progress and issues. Defining such roles at the outset, as advocated by sound transition planning practices, would help avoid such delays. * Regarding our recommendation that the department identify local and regional points of contact, the official stated that we had suggested that the department should identify all personnel that might be involved in any kind of telecommunication change and stated that such an effort would include thousands of individuals across the department and all IT field support personnel. Rather than contacting all these personnel, the Acting Director indicated that the department had taken steps to alert key managers at each component. However, this sound practice does not involve identifying all personnel that might be involved in any telecommunications change, but rather only identifying those contacts that will be responsible for facilitating the transition. For example, a contact is needed for each location where service is provided to facilitate physical access to equipment during a transition. Homeland Security's decision to not identify all contacts responsible for facilitating the transition does not follow sound transition planning practices and increases the risk that it will experience delays in providing the necessary site access for vendors. * Regarding our recommendation that the department identify human capital resources needed to conduct an effective transition, the official indicated the department did identify funding and staffing for transition planning. However, our recommendation is that Homeland Security determine human capital resources needed throughout the entire transition effort--not simply the planning effort. * The official acknowledged that Homeland Security had not published a Networx transition communications plan, but stated that the charter for its transition work group defined essential communications and activities. Our report indicates that the department has established lines of communication in its charter, but as previously discussed, it had not identified local and regional points of contact. Thus, the department's communications planning is incomplete. If Homeland Security does not identify all of its local points of contact before it begins transitioning services, communication difficulties could produce delays in providing the necessary site access for vendors. As agreed with your staff, unless you publicly announce the contents of this report earlier, we plan no further distribution of this report until 30 days from the report date. At that time, we will send copies of this report to other interested congressional committees, the Administrators of General Services and the Small Business Administration; the Chairman of the U.S. Nuclear Regulatory Commission; and the Secretaries of Agriculture, Commerce, Defense, and Homeland Security. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your staff have any questions about this report, please contact me at (202) 512-6240 or by e-mail at koontzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix VI. Signed by: Linda D. Koontz: Director, Information Management Issues: [End of section] Appendix I: Objectives, Scope, and Methodology: Our objectives were to determine (1) the extent to which federal agencies are following sound transition planning practices and (2) the actions the General Services Administration (GSA) is taking to identify and resolve common transition challenges affecting agencies. To determine the extent to which agencies are following sound transition planning practices, we selected six agencies for review. Using FTS2001 billing data provided by GSA, we identified total charges for each agency for fiscal year 2006. These totals ranged from over $145,000,000 to as low as $28 for 127 separate entities. We then reduced the number of entities under consideration to a more manageable number by identifying agencies with total charges in excess of $1 million for fiscal year 2006. From this group of agencies, we made a judgmental selection of six agencies that were representative of (1) varying types of organization, including executive departments, subagencies, and independent agencies; (2) varying levels of attendance in the Transition Working Group, an agency forum that is assisting GSA in its efforts to plan for the transition; and (3) the entire range of agency charges in excess of $1 million. The departments and agencies selected for review were the Department of Homeland Security; Department of Commerce; U.S. Department of Agriculture; Small Business Administration; U.S. Army Corps of Engineers, a component of the Department of Defense; and U.S. Nuclear Regulatory Commission. Because we judgmentally selected the agencies in our review, we cannot conclude that our results represent the entire federal government's level of preparation. However, the six cases studied illustrate various challenges that agencies may face in planning for the transition to Networx. To determine the extent to which the selected agencies have made adequate preparations for their upcoming transitions, we obtained and reviewed agency documentation, including but not limited to strategic plans, telecommunications inventories, and transition-related plans, and interviewed agency officials. We then assessed this information against the five sound transition planning practices identified in our prior report on agency transition planning.[Footnote 23] These practices are (1) establish a telecommunications inventory, (2) perform a strategic analysis of telecommunications requirements, (3) establish a structured transition management approach, (4) identify resources, and (5) develop a transition plan. Each of these sound planning practices consists of various components (for example, developing a transition plan consists of (1) identifying and documenting objectives and measures of success; (2) determining risks that could affect success; and (3) defining transition preparation tasks and developing a time line for these tasks). Based on our assessment, we classified the status of agency transition planning efforts to address each sound practice component as "fully implemented," if the agency has fully implemented the sound practice component; "plans to fully implement," if the agency has plans to fully implement the component; or "no plans to fully implement," if the agency does not have plans to fully implement it. We discussed our assessments with agency officials and made adjustments as appropriate. To evaluate one of the sound practices, establishing a telecommunications inventory, we developed criteria to assess the extent to which agencies had identified complete transition inventories. First, based on data provided by GSA, we determined whether each agency had validated 90 percent or more of its inventory. Second, we administered a questionnaire to determine whether each agency had adequate quality control mechanisms in place to identify and maintain its inventory.[Footnote 24] If these two criteria were met, we considered the inventory to be sufficient for a telecommunications transition. To determine the actions that GSA is taking to identify and resolve common transition challenges affecting agencies, we reviewed transition guidance and other Networx documentation developed by GSA and the Transition Working Group (TWG) of the Interagency Management Council (IMC), including presentations, meeting minutes, projected time lines, GSA's "Fair Opportunity and Statement of Work Guide," and the TWG's "Networx Transition Guide (Pre-Award)"; interviewed FTS2001 incumbent vendors and Networx vendors (AT&T, Level3 Communications, Qwest, Sprint, and Verizon Business) and the six agencies selected for review; and interviewed GSA officials to identify challenges, guidance, and GSA current and planned actions for the Networx transition. We assessed GSA's efforts to resolve identified challenges by analyzing documentation and testimonial evidence from GSA on any actions taken to address them. We performed our work at the Washington, D.C., area offices of the Department of Homeland Security, Department of Commerce, Department of Defense, Small Business Administration, U.S. Army Corps of Engineers, U.S. Department of Agriculture, U.S. Nuclear Regulatory Commission, and the General Services Administration. We conducted this performance audit from September 2007 through June 2008, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of section] Appendix II: Comments from the General Services Administration: GSA: U.S. General Services Administration: 1800 F Street. NW: Washington, DC 20405-0002: Telephone (202) 501.0800 Fax: (202) 2t9-1243 [hyperlink, http://www.gsa.gov]: GSA Administrator: June 11, 2008: The Honorable Gene L. Dodaro: Acting Comptroller General of the United States: U.S. Government Accountability Office: Washington, DC 20548: Dear Mr. Dodaro: The U.S. General Services Administration (GSA) thanks you for the opportunity to review and comment on the draft report, "Telecommunications: Agencies Are Generally Following Sound Transition Planning Practices, and GSA Is Taking Action to Resolve Challenges" (GAO-08-759). We concur with the information pertaining to GSA and appreciate your acknowledgement of the actions we have taken. If you have any questions, please contact me. Staff inquiries may be directed to Mr. Kevin Messner, Associate Administrator, Office of Congressional and Intergovernmental Affairs, at (202) 501-0563. Sincerely, Signed by: David L. Bibb: Acting Administrator: cc: Ms. Linda Koontz: Director: Information Management Issues: U.S. Government Accountability Office: Washington, DC 20548: [End of section] Appendix III: Comments from the Department of Commerce: United States Department Of Commerce: Chief Information Officer: Washington, D.C. 20230: June 12, 2008: Ms. Linda Koontz: Director, Information Management Issues: Government Accountability Office: 441 G. Street, N.W.: Washington, D.C. 20548: Dear Ms. Koontz: Thank you for the opportunity to review the draft report, GAO 08-729 – Telecommunications: Agencies Are Generally Following Sound Transition Planning Practices, and GSA Is Taking Action to Resolve Challenges, dated June 2008. The report provides a thorough examination and assessment of Federal government activities, and procedures to support the transition from the GSA's Telecommunications program, FTS2001 to the successor program, Networx. The report provides a fair assessment of the Department of Commerce progress and status to date. We have no substantial comments or changes to recommend at this time. Please let us know if you have questions or need additional information. Our Department of Commerce point of contact is Ms. Demetria Blyther, she can be reached at (202) 482-0267 or at DBlytheru@doc.gov. Sincerely, Signed by: Suzanne Hilding: Chief Information Officer: [End of section] Appendix IV: Comments from the U.S. Nuclear Regulatory Commission: Note: GAO comments supplementing those in the report text appear at the end of this appendix. United States Nuclear Regulatory Commission: Washington 20555-0001: June 13, 2008: Ms. Linda Koontz, Director: Information Management Issues: Government Accountability Office: 441 G Street, NW: Washington, D.C. 20548: Dear Ms. Koontz: The U.S. Nuclear Regulatory Commission (NRC) appreciates the opportunity to provide comments on the draft report entitled, "Telecommunications: Agencies Are Generally Following Sound Transition Planning Practices, and GSA Is Taking Action to Resolve Challenges" (GAO-08-759). The NRC's comments are enclosed for your consideration and inclusion in the final report as mentioned in your letter of May 27, 2008. Please direct any questions or concerns that you may have on NRC's comments to Mr. Jesse Arildsen, at (301) 415-1785 or email to Jesse.Arildsen@nrc.gov. Sincerely, Signed by: R. W. Borchardt: Executive Director for Operations: Enclosure: As stated: cc: J. Sweetman, GAO: U.S. Nuclear Regulatory Commission Comments on GAO Draft Report, "Telecommunications: Agencies Are Generally Following Sound Transition Planning Practices, And GSA is Taking Action To Resolve Challenges" (GAO-08-759): In general, the document reflects the issues surrounding agency preparedness to transition from the existing FTS 2001 Bridge contracts to the new Networx contracts provided by the General Services Administration (GSA). However, additional credit could be given to the Interagency Management Council (IMC) for solving agency problems. Many of the solutions that were put in place by GSA were as a result of a collegial effort between the IMC member agencies and the GSA Networx Program Management Office. (Reference Page 6, second paragraph first sentence) (See comment 1.): The U.S. Nuclear Regulatory Commission's (NRC) telecommunications infrastructure requirements are driven by the Information Technology requirements in support of the agency mission and goals. The FTS 2001 and FTS 2001 Bridge contracts offered many full service features which allowed the NRC to expand its telecommunications infrastructure in support of agency requirements. NRC has been able to realize cost avoidance measures and other benefits while participating in the program. As NRC infrastructure and application requirements mature, the agency will evaluate the Networx advanced offerings which may prove beneficial. The telecommunications infrastructure at the NRC is planned as a component of the overall agency Enterprise Architecture and future enhancements will be vetted through our Capital Planning and Investment Control processes. (Reference Page 24, second paragraph). (See comment 2.): The GSA Networx Program Management Office in conjunction with the IMC Transition Working Group (TWG) spent a considerable amount of time and effort to define how the Government would monitor, track, collate, and report Transition status and progress. Tools were developed such as the Transition Management Portal (TMP) to allow both GSA and the Agencies to view the status of transition from both a government wide perspective as well as individual agency perspective. This tool along with others (i.e. Transition Baseline Inventory (TBI)) was developed in order to conform to previous GAO guidance with respect to the transition. (Reference Page 32, second paragraph.) (See comment 3.): The introduction of the Office of Management and Budget (OMB) Trusted Internet Connection (TIC) as a "transition" challenge is not categorized correctly. The transition of services as defined by GSA is, ". as the movement of services from the FTS2001 contracts to Networx and continues until the disconnection of all services from the FTS2001 contracts." Since the TIC is not a current service offering under either the FTS 2001 or the Networx contracts, it should be considered as an implementation rather than a transition issue. An agency that takes time to consider the TIC alternatives as part of their transition will experience delays in their Fair Opportunity selections and execution of transition tasks. (Reference Page 36, fifth paragraph.) (See comment 4.): Two recommendations are made to the NRC in the report. It is suggested that the first suggestion be modified to say: * establish measures of success based upon agency specific transition objectives that the agency plans to develop using the tools provided by GSA and the IMC as source data It is further suggested that the second suggestion be removed, since an evaluation of costs and benefits of new technology or alternatives to meet the agency telecommunications needs has been and will be conducted as a part of NRC's normal planning processes. (Reference Page 45 "Recommendations", third paragraph.) (See comment 5.): Enclosure: The following is GAO's response to the U.S. Nuclear Regulatory Commission's letter dated June 13, 2008. GAO Comments: 1. We clarified our report to better reflect the role of the IMC. 2. NRC's comment references our statement that it did not plan to evaluate the costs and benefits of alternatives to meeting its telecommunications needs. The official stated that, as its requirements mature, the agency will evaluate the Networx advanced offerings that may prove beneficial. However, sound transition planning calls for performing a cost benefit and analysis specifically for the agency's transition effort as part of a strategic analysis that should be used to shape the agency's transition management approach, transition plan development, and allocation of resources. NRC has not performed this activity for the transition. 3. NRC's comment references our statement that it did not plan to establish measures of success to assess progress toward its goals. NRC indicated that it plans to use GSA-established measures related to transition progress and identified various tracking tools. However, NRC has not established agency-specific objectives for its transition and, by limiting measures of success to those established by GSA, NRC may lack information that could be used to track its progress in achieving its own goals and to inform its own management decisions. 4. We disagree with NRC's statement that the introduction of the Office of Management and Budget's Trusted Internet Connection (TIC) initiative should not be characterized as a transition issue. As NRC goes on to state, agencies that take time to address considerations relative to TIC may experience delays in their efforts to transition. We consider this a challenge that may affect agency transitions. 5. We do not agree with the suggested modification to our recommendation. NRC's suggestion would limit its measures of success to those emphasized by GSA, such as measures of transition progress. However, sound practices call for agencies to establish measures for each of its transition objectives to help managers assess the extent to which those objectives are achieved. [End of section] Appendix V: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: Homeland Security: June 16, 2008: Ms. Linda D. Koontz: Director, Information Management Issues: United States Government Accountability Office: Washington, DC 20548: Dear Ms. Koontz: Thank you for the opportunity to review and comment on the Government Accountability Office's (GAO's) Draft Report GAO-08-759 entitled Telecommunications: Agencies are Generally Following Sound Transition Planning Practices, and GSA Is Taking Action to Resolve Challenges. In regard to the recommendations in the draft report, the Department has a few concerns regarding GAO's portrayal of the state of the Department of Homeland Security's (DHS's) Networx transition activities. Recommendation #1— DHS does not concur: * document the department's processes for maintaining telecommunications inventories; Response: GAO indicated that DHS has not published a process document for inventory of telecommunications service assets. This observation is in conflict with the related finding that we have identified a complete telecommunications inventory. It is true the DHS HQ has not published a process document for inventory of telecommunications service assets. Instead, via our Networx Transition Work Group (NTWG), DHS has instructed all components to maintain the GSA Transition Baseline Inventory, housed at GSA, using documented GSA procedures for doing so. DHS HQ, with GSA input, monitors and reports the degree to which components comply with this inventory methodology. DHS provided artifacts of the monitoring effort, hence the finding that DHS has a complete telecommunications inventory. Recommendation #2 - DHS does not concur: * evaluate the costs and benefits of new technology or alternatives to meeting its telecommunications needs; Response: This observation is in conflict with a related finding that DHS has aligned needs, opportunities and plans. DHS briefed the GAO audit team on several occasions regarding the enabling role that Networx transition plays in our Infrastructure Transformation Program. GAO representatives were also briefed and provided artifacts regarding the fair opportunity efforts for OneNet and non-OneNet telecommunication services. DHS fair opportunity efforts represent service and cost analyses which are subject to formal contracting officer approval. Recommendation #3 - DHS does not concur: * clearly define the roles of asset, legal, human capital, and information security management for the department's transition; Response: GAO indicated that DHS has not established a transition management team and has not assigned, by name, key transition roles. DHS has formally chartered the NTWG with membership from all major components. The NTWG meets biweekly and artifacts of meeting proceedings were provided to GAO. DHS provided names for those responsible for managing the telecommunications service inventory (NTWG members), the name of the contracting officer assigned to the OneNet fair opportunity and the name of the attorney that was consulted on the OneNet fair opportunity, and the name of the Chief Information Security Officer. It is true that DHS did not provide the name of a member of the Chief Human Capital Officer's staff, as the Networx transition effort had not required such services. All specialty disciplines (legal, contracting, human capital, information security) are available to the NTWG as needed and have been called upon where needed. DHS has demonstrated the ability to draw upon these services where needed. Recommendation # 4 - DHS does not concur: * identify local and regional points of contact; Response: GAO indicated that DHS had not properly identified local and regional points of contact for transition efforts. GAO has requested we identify the national, regional and local telecommunications ordering officials involved in the transition effort. GAO subsequently clarified this request to be all personnel that might be involved in any kind of telecommunication change. We advised GAO that this would be thousands of individuals across the Department and, most notably, all the IT field support personnel. The draft report fails to recognize that implementation of telecommunication changes, as entailed in the Transition to Networx, is executed by individual components of the Department, with each component having a differing command and control infrastructure. The Department has taken proactive steps to engage, alert and inform the key managers at each component and is tracking overall migration progress. Recommendation #5 - DHS does not concur: * include in the department's planning efforts the identification of human capital resources needed to conduct an effective transition; Response: GAO indicated that DHS did not identify funding for transition planning and did not identify funding for human capital needs. It is a meaningful clarification that GAO queries in this area are not associated with the transition work itself, but are instead focused on the exactitude to which DHS planned to plan. DHS did identify funding and staffing for OneNet transition planning as part of the Infrastructure Transformation Program. DHS offered artifacts to this effect, but was advised such artifacts were not applicable. It is true that DHS did not identify funding or staffing for the planning of non- OneNet services (e.g., switched voice, calling cards, etc.), but execution of the transition activities (e.g., an effective working group, a complete inventory, fair opportunity decisions, etc.) are clear indicators of success. Recommendation #6 & #7 - DHS concurs: * establish goals and measures of success for the department's transition efforts to help managers assess progress; * perform a transition risk assessment that addresses risks to mission- critical system systems, continuity of operations plans, and risks to information security. Response: Transition objectives are defined as part of the Infrastructure Transformation Program in the form of wide area network consolidation goals and the project plan for OneNet. Transition objective for non- OneNet services (i.e., transfer of all FTS2001 services to Networx before FTS2001 contract expiration) was set at initial NTWG meeting. Meeting minutes for this initial NTWG session did not clearly articulate this goal. Risk management is a key element in the OneNet solicitation, which was provided as an artifact. Risk management is also inherent in the OneNet, and all information systems, certification and accreditation processes, dictated under the Federal Information Security Management Act, with which DHS complies. DHS agrees that more structured communication of transition objectives and a specific risk management process for transition would be beneficial. GAO Finding (pages 25 and 27) - DHS does not concur: * lack of a communications plan; Response: While it is true the DHS has not published a Networx transition communications plan, the NTWG charter, provided to GAO, defines essential communications responsibility and activities. Thank you again for the opportunity to comment on this draft report and we look forward to working with you on future homeland security issues. Penelope G. McCormack: Acting Director: Departmental Audit Liaison Office: [End of section] Appendix VI: GAO Contact and Staff Acknowledgments: GAO Contact: Linda D. Koontz (202) 512-6240 or koontzl@gao.gov: Staff Acknowledgments: In addition to the individual named above, key contributions were made to this report by James R. Sweetman, Jr., Assistant Director; Gerard Aflague; Barbara Collier; Jamey A. Collins; Eric Costello; Joel Grossman; Amos Tevelow; Hai V. Tran; and Merry Woo. [End of section] Footnotes: [1] GAO, Telecommunications: Full Adoption of Sound Transition Planning Practices by GSA and Selected Agencies Could Improve Planning Efforts, GAO-06-476 (Washington, D.C.: June 6, 2006). [2] Sprint Corporation merged with Nextel Communications, Inc., to form Sprint Nextel Corporation in August 2005. [3] MCI merged with Verizon to form Verizon Business in January 2006. [4] In August 2001, GSA allowed contractors that had been awarded local telecommunications contracts in selected metropolitan areas, through GSA's Metropolitan Area Acquisition program, to offer long-distance services on the FTS2001 contracts. This process is termed "crossover." [5] GSA negotiated sole-source contracts for a 24-month period with three 6-month optional periods, for a total of 42 months. [6] The council was established in 1992 to provide a forum and focal point for agency participation in planning and overseeing GSA's long- distance telecommunications services. [7] GAO, FTS2001: Transition Challenges Jeopardize Program Goals, GAO- 01-289 (Washington, D.C.: Mar. 30, 2001). [8] 41 U.S.C. § 253j(b) requires civilian agencies to provide all contractors awarded multiple award task-and-delivery order contracts a fair opportunity to be considered for each order in excess of $2,500 that is to be issued under any of the contracts, unless one of the statute's exceptions applies. As recently amended, subsection 253j(d) establishes enhanced competition requirements for this process applicable to orders over $5 million. Similar requirements apply to the Department of Defense under 10 U.S.C. § 2304c. In addition, section 803 of the National Defense Authorization Act for Fiscal Year 2002 requires that an order for services in excess of $100,000 issued under a multiple award contract by or on behalf of the Department of Defense be made on a competitive basis unless a contracting officer justifies an exception in writing. Pub. L. No. 107-107 (Dec. 28, 2001). [9] Verizon's FTS2001 crossover contract is currently operating under a continuity of service clause that provides an additional 24 months for agencies to transition to a new contract. [10] GAO-01-289 and GAO, FTS2001: Contract Transition Delays and Their Impact on Program Goals, GAO-01-544T (Washington, D.C.: Apr. 26, 2001). [11] GAO, Telecommunications: Full Adoption of Sound Transition Planning Practices by GSA and Selected Agencies Could Improve Planning Efforts, GAO-06-476 (Washington, D.C.: June 6, 2006). [12] GAO, Telecommunications: GSA Has Accumulated Adequate Funding for Transition to New Contracts but Needs Cost Estimation Policy, GAO-07- 268 (Washington, D.C.: Feb. 23, 2007). [13] GAO-06-476. [14] In determining the extent to which agencies had established transition inventories, we reviewed agency data quality controls in place as well as the extent to which each agency had validated its transition inventory. If an agency had sufficient controls in place and had validated at least 90 percent of its inventory, its inventory was considered sufficient for conducting a transition. See appendix I for a complete description of our methodology. [15] An enterprise architecture is an institutional blueprint that defines how an enterprise operates today, in both business and technology terms, and how it intends to operate in the future. [16] Specifically, Agriculture and Homeland Security are currently using certain management processes, and agency policies indicate that all will be used. SBA is currently using project management, and officials stated they plan to use change and configuration management processes. Commerce provided a draft policy and evidence of contractor support to indicate that project, configuration, and change management processes will be used in its management of the transition. NRC provided agency policy requiring the use of these processes and officials stated that they plan to use them. [17] "Organizational conflicts of interest" means that because of other activities or relationships with other persons, a person is unable or potentially unable to render impartial assistance or advice to the government, or the person's objectivity in performing the contract work is or might be otherwise impaired, or a person has an unfair competitive advantage. FAR 2.101. [18] FAR 9.505. [19] Among its requirements, the Procurement Integrity Act prohibits the disclosure of source selection and contractor bid or proposal information before the award of a federal agency procurement contract to which the information relates. 41 U.S.C. § 423. [20] The Federal Information Security Management Act of 2002 (FISMA) sets forth a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support federal operations and assets. E-Government Act of 2002, Title III, Pub. L. No. 107-347 (Dec. 17, 2002). [21] Certification and accreditation is the requirement that agency management officials formally authorize information systems to process information, thereby accepting the risk associated with their operation. [22] Pub. L. No. 110-181, § 843 (Jan. 28, 2008) (to be codified in relevant part at 10 U.S.C. § 2304c (defense) and 41 U.S.C. § 253j (civilian)). [23] GAO-06-476. [24] In one case in which the GSA was not able to provide inventory information (NRC), we used that agency's responses to the questionnaire on quality control to determine whether both criteria were met. GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Mail or Phone: The first copy of each printed report is free. Additional copies are $2 each. A check or money order should be made out to the Superintendent of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more copies mailed to a single address are discounted 25 percent. Orders should be sent to: U.S. Government Accountability Office: 441 G Street NW, Room LM: Washington, D.C. 20548: To order by Phone: Voice: (202) 512-6000: TDD: (202) 512-2537: Fax: (202) 512-6061: To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: