This is the accessible text file for GAO report number GAO-09-733 entitled 'Electronic Records Archive: The National Archives and Records Administration's Fiscal Year 2009 Expenditure Plan' which was released on July 24, 2009. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. Report to Congressional Committees: United States Government Accountability Office: GAO: July 2009: Electronic Records Archive: The National Archives and Records Administration's Fiscal Year 2009 Expenditure Plan: GAO-09-733: GAO Highlights: Highlights of GAO-09-733, a report to congressional committees. Why GAO Did This Study: Since 2001, the National Archives and Records Administration (NARA) has been developing an Electronic Records Archive (ERA) to preserve and provide access to massive volumes of electronic records independent of their original hardware and software. The ERA system is to include a base system for federal records and a separate system for presidential records, known as the Executive Office of the President (EOP) system. The 2009 Omnibus Appropriations Act requires NARA to submit an expenditure plan for ERA to congressional appropriation committees. GAO’ s objectives were to (1) determine whether NARA’s fiscal year 2009 plan meets the legislative conditions set forth in the 2009 Omnibus Appropriations Act, (2) provide an update on NARA’s progress in implementing recommendations made in GAO’s review of NARA’s 2008 expenditure plan, and (3) provide any other observations about the expenditure plan and the ERA acquisition. To do this, GAO reviewed the expenditure plan, interviewed NARA officials, and reviewed program data and documentation. What GAO Found: NARA’s fiscal year 2009 expenditure plan satisfies the six legislative conditions in the 2009 Omnibus Appropriations Act. NARA implemented one of GAO’s prior recommendations and partially implemented the other. Specifically, NARA developed a risk mitigation plan for the EOP system in the event that it was not ready in time for the presidential transition in January 2009. In addition, NARA began including summaries of performance against ERA cost and schedule estimates in its monthly reports to Congress. However, during its review, GAO found methodological weaknesses that could limit NARA’s ability to accurately report on program cost, schedule, and performance (see below). GAO made four observations on NARA’s expenditure plan and the ERA acquisition: * The expenditure plan does not specifically identify whether completed system increments include all planned functionality or what functionality will be included in future increments, including the outcomes NARA expects from the remainder of its fiscal year 2009 funding. Until NARA fully describes the outcomes expected from this funding, Congress will lack important information for evaluating the agency’s requests for funds. * The expenditure plan states that it relies on Earned Value Management (EVM), a tool for project management intended to provide objective reports of program status. However, NARA is not fully implementing practices necessary to make effective use of EVM, limiting the reliability of its progress reports. Without consistently following these best practices, NARA will be hindered in accurately monitoring and reporting on the cost, schedule, and performance of the ERA system. * Although NARA certified initial operating capability for the EOP system in December 2008, less than 3 percent of the electronic records from the Bush Administration had been ingested into the system at the time of GAO’s review, and NARA did not expect the remainder to be ingested until October 2009. In the interim, NARA is using systems developed in accordance with its risk mitigation plan to support the search, processing, and retrieval of presidential records. These systems cost less than $600,000, compared with the $40 million NARA has obligated for the EOP system. Until NARA completely ingests the Bush Administration records into EOP, it will be unable to use the system for its intended purpose. * NARA lacks a contingency plan for the ERA system in the event of a failure or disruption. While NARA identified 11 security weaknesses related to contingency planning during system testing and planned actions to address them, it has completed only 1 of the 11 planned actions. Further, NARA does not have a fully functional backup and restore process for ERA, a key component for ensuring system availability. Until NARA fully develops and tests a contingency plan, it risks prolonged unavailability of the ERA system in the event of a failure or disruption. What GAO Recommends: GAO is recommending, among other things, that NARA take steps to improve the information in its expenditure plan and progress reports. In comments on a draft of this report, the Acting Archivist agreed with four of the five recommendations and outlined steps NARA was taking to address them. View [hyperlink, http://www.gao.gov/products/GAO-09-733] or key components. For more information, contact David A. Powner at (202) 512- 9286 or pownerd@gao.gov. [End of section] Contents: Letter: Conclusions: Recommendations for Executive Action: Agency Comments and Our Evaluation: Appendix I: Briefing to Staff of Congressional Committees on NARA's Fiscal Year 2009 Expenditure Plan: Appendix II: Comments from the National Archives and Records Administration: Appendix III: GAO Contact and Staff Acknowledgments: Abbreviations: EAC: estimate at completion: EOP: Executive Office of the President: ERA: Electronic Records Archive: EVM: Earned Value Management: FISMA: Federal Information Security Management Act: IOC: initial operating capability: NARA: National Archives and Records Administration: NIST: National Institute of Standards and Technology: OMB: Office of Management and Budget: SA-CMM: Software Acquisition-Capability Maturity Model: SEI: Software Engineering Institute: WBS: work breakdown structure: [End of section] United States Government Accountability Office: Washington, DC 20548: July 24, 2009: The Honorable Richard J. Durbin: Chairman: The Honorable Susan M. Collins: Ranking Member: Subcommittee on Financial Services and General Government: Committee on Appropriations: United States Senate: The Honorable José E. Serrano: Chairman: The Honorable Jo Ann Emerson: Ranking Member: Subcommittee on Financial Services and General Government: Committee on Appropriations: House of Representatives: Since 2001, the National Archives and Records Administration (NARA) has been developing an Electronic Records Archive (ERA) to preserve and provide access to massive volumes of electronic records independent of their original hardware or software. NARA plans for the system to manage the entire life cycle of electronic records, from their ingestion through preservation and dissemination to customers. The system is being deployed in phases, or increments, and is to include a "base" system for federal records and a separate system for presidential records, referred to as the Executive Office of the President (EOP) system. According to NARA, the first increment of the base system achieved initial operating capability (IOC) in June 2008. NARA certified IOC for the EOP system in December 2008. As mandated by the 2009 Omnibus Appropriations Act,[Footnote 1] NARA is required to submit an expenditure plan to congressional appropriations committees before obligating multi-year funds for the ERA program. In March 2009, NARA finalized the expenditure plan to support its request for $67 million in ERA funding for fiscal year 2009, which is comprised of $45.8 million in multi-year funds and $21.2 million in single-year funds.[Footnote 2] As in the previous year, the plan must satisfy six legislative conditions, including a review by GAO. Our objectives in reviewing the plan were to (1) determine whether NARA's fiscal year 2009 expenditure plan satisfies the applicable legislative conditions, (2) provide an update on NARA's progress in implementing our prior expenditure plan review recommendations, and (3) provide any other observations about the expenditure plan and the ERA acquisition. To assess compliance with the legislative conditions, we analyzed the expenditure plan submitted by NARA in March 2009 and reviewed its budget submission to the Office of Management and Budget (OMB), along with other program data and documentation. To determine whether NARA had implemented our prior recommendations, we obtained and reviewed the agency's mitigation plan for the EOP system and its monthly reports to Congress. To develop observations on the ERA expenditure plan and acquisition, we analyzed the expenditure plan; reviewed agency and contractor documents, agency data, and federal guidance; and interviewed NARA officials. To assess the reliability of computer-generated data used in the development of this report, we conducted an on-site review of the ERA systems, reviewed Inspector General reports on NARA's financial systems and computer controls, interviewed NARA officials about data reliability controls, and compared the data to previously reported data. Based on these reviews, we believe the data are sufficiently reliable for the purposes of this engagement. We conducted this performance audit from March 2009 to July 2009 at NARA's College Park, Maryland, location and at the Allegany Ballistics Laboratory at Rocket Center, West Virginia, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. On May 13, 2009, we briefed your staffs on the results of our review. This report transmits the material we used at the briefing and provides the recommendations that we made to the Acting Archivist of the United States. The full briefing materials, including details on our scope and methodology, are reprinted as appendix I. In summary, we made the following major points: * NARA's fiscal year 2009 expenditure plan satisfies the six legislative conditions contained in the 2009 Omnibus Appropriations Act. * NARA implemented one of the recommendations we made last year and partially implemented the other: - We recommended that NARA develop a risk mitigation plan to ensure indexing and searching of records from the Bush Administration in the event that the EOP system was not complete in time for the January 2009 presidential transition. NARA finalized its plan in November 2008. It stated that, in the event that records could not be ingested into EOP in a timely manner, NARA intended to acquire hardware and software to replicate the systems containing the data and use them to retrieve requested records. - We recommended that, to improve the utility of information provided to Congress, NARA include summary measures of project performance against ERA cost and schedule estimates in its monthly reports. In July 2008, NARA began including this information as an appendix to its monthly reports to Congress. However, during our review, we found methodological weaknesses that could limit NARA's ability to accurately report on program cost, schedule, and performance. * We made four observations related to the ERA program and fiscal year 2009 expenditure plan: - Cost, schedule, and performance data in the expenditure plan do not provide a clear picture of ERA system progress. The plan does not specifically identify whether completed increments included all previously planned functionality or what functionality will be provided in future increments. For example, the plan does not specify what outcomes NARA expects to achieve with the remainder of its fiscal year 2009 funding. NARA officials attributed the plan's lack of specificity to ongoing negotiations with its contractor. Until NARA fully describes the outcomes expected for the remainder of the year, congressional appropriators will lack information important for evaluating the agency's request for ERA funds. - NARA's expenditure plan states that it relies on Earned Value Management (EVM),[Footnote 3] an important tool for project management and control that is intended to provide, among other things, objective reports of program status. However, NARA is fully addressing only 5 of the 13 practices required to effectively implement EVM, which limits the reliability of its progress reports. NARA officials attributed these weaknesses, in part, to documentation that did not accurately reflect the program's current status. Without consistently following these best practices, NARA will be hindered in accurately monitoring and reporting on the cost, schedule, and performance of the ERA system. - Although NARA certified initial operating capability for the EOP system in December 2008, the system is not currently fulfilling its intended purpose. At the time of our briefing, less than 3 percent of the Bush Administration electronic records NARA received had been successfully ingested into the system. NARA officials estimated that the records would not be fully ingested until October 2009. Agency officials attributed delays in part to unexpected difficulties, such as data not being extracted in expected formats and incomplete replication of one type of data. In the interim, NARA is primarily supporting search, processing, and retrieval of presidential records using the replicated systems described in the risk mitigation plan that we recommended the agency develop last year, which cost less than $600,000 to put in place, compared to the nearly $40 million NARA has obligated for EOP. Until NARA completely and accurately ingests the Bush Administration presidential records into the EOP system, it will be unable to use the system for its intended purpose and will incur additional costs maintaining the systems it is now using to support requests for these records. - NARA lacks a contingency plan for the ERA system in the event of a system failure or disruption. While NARA identified 11 security weaknesses related to contingency planning during acceptance testing and listed actions planned to address them, NARA has completed only 1 of the 11 planned actions. Further, NARA does not have a fully functional backup and restore process for the ERA system, a key component of planning for system availability in the event of a failure or disruption. According to NARA officials, a full system contingency plan is under development. However, until such a plan is tested and implemented, NARA risks prolonged unavailability of the ERA system in the event of a failure or disruption. Conclusions: While NARA has continued to make progress on the ERA system, that progress cannot be fully quantified because NARA's expenditure plan does not clearly identify what functions have already been delivered, how much was spent to provide each function, or how much is required to maintain the delivered increments. NARA's current plan similarly lacks details on the functions to be provided in future increments and the costs associated with them, including development efforts scheduled to take place in the remainder of this year. In addition, although NARA has been using Earned Value Management to track program cost, schedule, and performance, weaknesses in its EVM data limit NARA's ability to accurately report on the project's progress. Without more specific and accurate information on the immediate and long-term goals of the program and the outcomes expected from its resulting efforts, NARA will be hindered in effectively monitoring and reporting on the cost, schedule, and performance of the ERA system, and congressional appropriators will lack information necessary to evaluate the agency's requests for funds. Although NARA certified that the EOP portion of the ERA system had achieved initial operating capability as planned in December 2008, the system has been of limited use because of delays in ingesting electronic records into the system. Further, even though it has obligated nearly $40 million on EOP, NARA has instead answered requests for Bush electronic records by using existing systems or replicating White House systems that cost less than $600,000. Under its current schedule, the Bush Administration records will not be fully ingested into the system until October 2009. However, even when the data are fully ingested, the system's lack of a complete, fully tested contingency plan increases the risk that a system failure or disruption will result in the system being unavailable for several days or more. Recommendations for Executive Action: We recommend that the Archivist of the United States take the following actions: * Report to Congress on the specific outcomes to be achieved by ERA program funding for the remainder of fiscal year 2009. * Provide detailed information in future expenditure plans on what was spent and delivered for deployed increments of the ERA system and cost and functional delivery plans for future increments. * Strengthen the earned value process so that it follows the practices described in GAO's guide and more reliable cost, schedule, and performance information can be included in future expenditure plans and monthly reports. * Include in NARA's next expenditure plan an analysis of the costs and benefits of using the EOP system to respond to presidential records requests compared to other existing systems currently being used to respond to such requests. * Develop and implement a system contingency plan for ERA that follows contingency guidance for federal systems. Agency Comments and Our Evaluation: In written comments on a draft of this report, which are reprinted in appendix II, the Acting Archivist of the United States stated that she appreciated the insight into the expenditure plan observations addressed in the report. She stated that she was pleased to note our recognition that the Fiscal Year 2009 ERA Expenditure Plan met the legislative conditions. In addition, the Acting Archivist summarized actions taken or planned in response to four of our five recommendations. Specifically, she stated that NARA provided a briefing to Congress on the specific outcomes to be achieved by the ERA program on April 27, 2009, and that further detail will be added to the next expenditure plan to address costs and functions delivered to date and what is planned for future increments. She further stated that NARA is in the process of upgrading its EVM system and will strive to comply with all 13 best practices. Finally, the Acting Archivist stated that an ERA Contingency Plan has been developed and is in final review. The Acting Archivist disagreed with our observation that the EOP system is not currently fulfilling its intended purpose. She stated that this observation failed to differentiate between what the system is capable of doing and the work currently being done on the system. She added that the system does provide required functionality--including searching any records ingested in the system--and that all the remaining data from the Bush Administration will be ingested by the end of the fiscal year. The Acting Archivist also stated that the problem was with the copies of the records that NARA received from the White House, not with the EOP system, and that the data issues have been resolved. We disagree with the Acting Archivist's statements because the EOP system still lacks the capability to search and retrieve all Bush Administration records in NARA's possession. Specifically, as we reported in our briefing, NARA used the EOP system to satisfy one request for presidential records during the first 3 months of the transition, but used the less expensive replicated systems to answer another 24 requests. In addition, before the transition, NARA estimated that it would not complete ingesting data until May 2009, limiting the capability of the system in the transition's early months regardless of the replication errors that ultimately occurred. Finally, the Acting Archivist's estimate that the Bush data will not be fully ingested until the end of the fiscal year further highlights the fact that NARA still possesses Bush Administration electronic records that cannot be searched using EOP. Until all the Bush Administration records are ingested, the EOP system will not be performing its stated function. Regarding our recommendation that NARA include in its next expenditure plan an analysis of the costs and benefits of using the EOP system to respond to presidential records requests compared to the systems currently being used, the Acting Archivist stated that it did not seem cost-effective to conduct a retrospective analysis as to whether there might have been technology solutions for systems that have already been retired. However, NARA has not yet provided evidence that the mitigation plan systems have been retired. In addition, we are not recommending a study of past alternatives, but a study of the ongoing costs and benefits of using the EOP system compared with the technology used under NARA's risk mitigation plan. This would provide the agency with useful information in planning future spending, given that NARA was able to respond to requests for Bush Administration records using systems costing significantly less than what has been spent to date on the EOP system. Such an analysis could also inform the contingency plan the Acting Archivist said is being finalized in response to our recommendation. We are sending copies of this report to the Archivist of the United States. The report will also be available at no charge on the GAO Web site at [hyperlink, http://www.gao.gov]. If you or your staffs have any questions concerning this report, please contact me at (202) 512-9286 or by e-mail at pownerd@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. David A. Powner Director, Information Technology Management Issues: [End of section] Appendix I: Briefing to Staff of Congressional Committees on NARA's Fiscal Year 2009 Expenditure Plan: Slide presentation: Review of NARA’s Fiscal Year 2009 Electronic Records Archive Expenditure Plan: Briefing for Staff Members of the: * Subcommittee on Financial Services and General Government, Senate Committee on Appropriations, and; * Subcommittee on Financial Services and General Government, House Committee on Appropriations: May 13, 2009. Contents: Introduction: Objectives, Scope, and Methodology: Results in Brief: Background: Results: Conclusions: Recommendations for Executive Action: Agency Comments and our Evaluation: Attachments: 1. Details on NARA’s EVM Compared with Best Practices. 2. Comments from the Acting Archivist of the United States. [End of section] Introduction: Since 2001, the National Archives and Records Administration (NARA or the Archives) has been working to develop a modern Electronic Records Archive (ERA). This major information system is estimated to cost more than $550 million and is intended to preserve and provide access to massive volumes of all types and formats of electronic records, including presidential records, independent of their original hardware or software. NARA plans for the system to manage the entire life cycle of electronic records, from their ingestion through preservation and dissemination to customers. It is to consist of: * infrastructure elements, including hardware and operating systems; * business applications that will support the transfer, preservation, dissemination, and management of all types of records; and; * a means for public access via the Internet. Because of the system’s complexity, NARA awarded a contract to Lockheed Martin to develop ERA in phases, or increments, the first of which was originally scheduled to achieve initial operating capability (IOC) in September 2007. However, the contractor did not meet the original cost and schedule milestones due, in part, to productivity issues with its initial development team. In response, NARA and Lockheed Martin agreed to a revised schedule and strategy, consisting of a two-pronged development approach. * First, they agreed to continue development of the original system but delayed capabilities to later increments. According to NARA, IOC for this system, now referred to as the “base” ERA system, was achieved in June 2008 as planned under the revised schedule. * Second, NARA conducted parallel development of a separate system dedicated initially to receiving electronic records from the outgoing Bush Administration in January 2009. This system, referred to as the Executive Office of the President (EOP) system, uses a different architecture from that of the ERA base: it was built on a commercial product that was to provide the basic requirements for processing presidential electronic records, such as rapid ingestion of records and the ability to search content. NARA believed that if it could not ingest the Bush records in a way that supported search and retrieval immediately after the transition, it risked not being able to effectively respond to requests from Congress, the new administration, and the courts for these records—a critical agency mission. NARA certified the EOP system for IOC in December 2008. As mandated by the Omnibus Appropriations Act,[Footnote 4] NARA is required to submit an expenditure plan before obligating multiyear funds for the ERA program. As in the previous year, the plan must satisfy the following legislative conditions: * meet the capital planning and investment control review requirements established by the Office of Management and Budget (OMB), including Circular A-11; * comply with the agency’s enterprise architecture; * conform to the agency’s enterprise life-cycle methodology; * comply with the acquisition rules, requirements, guidelines, and system acquisition management practices of the federal government; * be approved by the agency and OMB; and; * be reviewed by GAO. On March 6, 2009, the agency finalized the 2009 expenditure plan that was submitted to the House and Senate appropriations committees to support its request for $67 million in ERA funding for fiscal year 2009, which is comprised of $45.8 million in multi-year funds and $21.2 million in single-year funds.[Footnote 5] [End of introduction] Objectives, Scope, and Methodology: Our objectives were to: * determine whether NARA’s fiscal year 2009 expenditure plan satisfies the applicable legislative conditions, * provide an update on NARA’s progress in implementing our prior expenditure plan review recommendations, and, * provide any other observations about the expenditure plan and the ERA acquisition. To assess compliance with the legislative conditions, we: * reviewed NARA’s fiscal year 2009 exhibit 300 submission[Footnote 6] to OMB to determine the extent to which the agency has complied with OMB’s capital planning and investment control requirements; * obtained and reviewed data on NARA’s enterprise architecture to determine the status of the agency’s enterprise architecture efforts; * reviewed NARA’s enterprise systems development life cycle methodology that includes processes for managing system investments, configuration management, and risks, and reviewed related documentation concerning how these processes were implemented for the ERA project, such as minutes of oversight boards and the risk management plan; * reviewed internal assessments of ERA; * obtained and reviewed OMB’s approval of the expenditure plan; and; * reviewed and analyzed the fiscal year 2009 expenditure plan submitted by the agency in March 2009. To determine the status of our two prior recommendations, we obtained and reviewed monthly congressional reports and the EOP mitigation plan. We reviewed these documents to determine whether NARA (1) developed a risk mitigation plan to ensure indexing and searching of records from the Bush Administration in the event that the EOP system was not complete in time for the January 2009 presidential transition and (2) included earned value data in its monthly reports to Congress. To develop observations on the ERA expenditure plan and acquisition, we analyzed the cost and schedule information contained in the expenditure plan, reviewed agency and contractor documents such as EOP test results— including acceptance tests and security and risk assessments—and cost and schedule reports, and performed analysis of Earned Value Management (EVM)[Footnote 7] data and key processes used in NARA’s EVM system. We also reviewed federal requirements for contingency planning and NARA plans for corrective action on issues identified. In addition, we interviewed NARA officials. We did not evaluate the controls over the procedures used to transfer records from the White House to NARA or controls over processes used to determine which records were presidential records. To assess the reliability of the cost and schedule information contained in the expenditure plan, we interviewed NARA officials in order to gain an understanding of the data and discuss our use of the data in this briefing. In addition, we compared schedule information in the fiscal year 2009 plan with information in the fiscal year 2008 plan and the ERA integrated schedule. We did not, however, assess the accuracy and reliability of the information reported in these documents. We conducted this performance audit from March 2009 to May 2009 at NARA’s College Park, Maryland, location in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. [End of Objectives, Scope, and Methodology] Results in Brief: NARA’s fiscal year 2009 plan satisfies the six legislative conditions contained in the 2009 Omnibus Appropriations Act. NARA implemented one of the recommendations we made last year, and partially implemented the other: * We recommended that NARA develop a risk mitigation plan to ensure indexing and searching of records from the Bush Administration in the event that the EOP system was not complete in time for the January 2009 presidential transition. NARA finalized its plan in November 2008. It stated that, in the event that records could not be ingested into EOP in a timely manner, NARA intended to acquire hardware and software to replicate the systems containing the data and use them to retrieve requested records. * We recommended that, to improve the utility of information provided to Congress, NARA include summary measures of project performance against ERA cost and schedule estimates in its monthly reports. In July 2008, NARA began including an Earned Value Summary as an appendix to its monthly reports to Congress. However, after reviewing NARA’s earned value data, we found methodological weaknesses that could limit NARA’s ability to accurately report on program cost, schedule, and performance (these weaknesses are discussed further below). We have four observations related to the ERA program and fiscal year 2009 expenditure plan: * Cost, schedule, and performance data in the expenditure plan do not provide a clear picture of ERA system progress. The plan does not specifically identify whether completed increments included all previously planned functionality or what functionality will be provided in future increments. For example, the plan does not specify what outcomes NARA expects to achieve with the remainder of its fiscal year 2009 funding. NARA officials attributed the plan’s lack of specificity to ongoing negotiations with its contractor. Until NARA fully describes the outcomes expected for the remainder of the year, congressional appropriators will lack information important for evaluating the agency’s request for ERA funds. * NARA’s expenditure plan states that it relies on Earned Value Management (EVM), an important tool for project management and control that is intended to provide, among other things, objective reports of program status. However, NARA is fully addressing only 5 of the 13 practices required to effectively implement EVM, which limits the reliability of its progress reports. NARA officials attributed these weaknesses, in part, to documentation that did not accurately reflect the program’s current status. Without consistently following these best practices, NARA will be hindered in accurately monitoring and reporting on the cost, schedule, and performance of the ERA system. * Although NARA certified initial operating capability for the EOP system in December 2008, the system is not currently fulfilling its intended purpose. Less than 3 percent of the Bush Administration electronic records NARA received have been successfully ingested into the system. NARA officials estimate that the records will not be fully ingested until October 2009. Agency officials attributed delays in part to unexpected difficulties, such as data not being extracted in expected formats and incomplete replication of one type of data. In the interim, NARA is primarily supporting search, processing, and retrieval of presidential records using the replicated systems described in the risk mitigation plan we recommended the agency develop last year, which cost less than $600,000 to put in place, compared to nearly $40 million it has obligated for EOP. Until NARA completely and accurately ingests the Bush Administration presidential records into EOP, it will be unable to use the system for its intended purpose and will incur additional costs maintaining the systems it is now using to support requests for these records. * NARA lacks a contingency plan for the ERA system in the event of a system failure or disruption. While NARA identified 11 security weaknesses related to contingency planning during acceptance testing and listed actions planned to address them, NARA has completed only one of the 11 planned actions. Further, NARA does not have a fully functional backup and restore process for the ERA system, a key component of planning for system availability in the event of a failure or disruption. According to NARA officials, a full system contingency plan is under development. However, until such a plan is tested and implemented, NARA risks prolonged unavailability of the ERA system in the event of a failure or disruption. We are recommending that the Archivist of the United States take the following actions: * Report to Congress on the specific outcomes to be achieved by ERA program funding for the remainder of fiscal year 2009. * Provide detailed information in future expenditure plans on what was spent and delivered for deployed increments of the ERA system and cost and functional delivery plans for future increments. * Strengthen the earned value process so that it follows the practices described in GAO’s guide and more reliable cost, schedule, and performance information can be included in future expenditure plans and monthly reports. * Include in NARA’s next expenditure plan an analysis of the costs and benefits of using the EOP system to respond to presidential records requests compared to other existing systems currently being used to respond to such requests. * Develop and implement a system contingency plan for ERA that follows contingency guidance for federal systems. In written comments on a draft of this briefing, the Acting Archivist of the United States agreed with 4 of our 5 recommendations. Regarding our recommendation that NARA report on the costs and benefits of using the EOP system to answer requests for presidential records compared to other systems, the Acting archivist stated that such a comparison would not be valid because of the differing capabilities of the systems and that the EOP system has accomplished enormous amounts of work. We disagree that a comparison of the costs and benefits of EOP and other systems would be invalid, because a valid analysis should account for the differences in capabilities. In addition, we noted that the replicated systems currently used to answer requests include nearly half of the records transferred to NARA and have been used to answer most of the requests received to date. [End of Results in Brief] Background: The ability to find, organize, use, share, appropriately dispose of, and save records—-the essence of records management-—is vital for the effective functioning of the federal government. In the wake of the transition from paper-based to electronic processes, records are increasingly electronic, and the volumes of electronic records produced by federal agencies are vast and rapidly growing, providing challenges to NARA as the nation’s record keeper and archivist. Besides sheer volume, other factors contributing to the challenge of electronic records include their complexity and their dependence on software and hardware. Specifically, the computer operating systems and the hardware and software that are used to create electronic documents can become obsolete. If they do, they may leave behind records that cannot be read without the original hardware and software. Further, the storage media for these records are affected by both obsolescence and decay. Media may be fragile, have limited shelf life, and become obsolete in a few years. For example, few computers today have disk drives that can read information stored on 8- or 5¼-inch diskettes, even if the diskettes themselves remain readable. Another challenge is the growth in electronic presidential records. The Presidential Records Act gives the Archivist of the United States responsibility for the custody, control, and preservation of presidential records upon the conclusion of a President’s term of office.[Footnote 8] The act states that the Archivist has an affirmative duty to make such records available to the public as rapidly and completely as possible consistent with the provisions of the act. In response to widely recognized challenges, the Archives began a research and development program to develop a modern archive for electronic records. In 2001, NARA hired a contractor to develop policies and plans to guide the overall acquisition of an electronic records system. In December 2003, the agency released a request for proposals for the design of ERA. In August 2004, NARA awarded two firm- fixed-price[Footnote 9] contracts for the design phase, totaling about $20 million—one to Harris Corporation and the other to Lockheed Martin Corporation. On September 8, 2005, NARA announced the selection of Lockheed Martin Corporation to build the ERA system. The total value of the cost plus award fee[Footnote 10] contract with Lockheed through 2012 is about $317 million. As of fiscal year 2008, NARA has paid Lockheed $111.9 million for system development. The purpose of ERA is to ensure that the records of the federal government are preserved for as long as needed, independent of the original hardware or software that created them. ERA is to provide the technology to ensure that anyone, anywhere, anytime can access NARA’s electronic records holdings with the current technology that will be in use. The system is to enable the general public, federal agencies, and NARA staff to search and access information about all types of federal records, whether in NARA custody or not, as well as to search for and access electronic records stored in the system. Using various search engines, the system is to provide the ability to create and execute searches, view search results, and select assets for output or presentation. Figure 1 provides a simplified depiction of the system’s business concept. Figure 1: Overview of ERA Business Concept: [Refer to PDF for image: illustration] Business positions: Records appraisers: * Disposition agreements; * Templates. Transferring entities: * Transfer agreements; * Transfer packages. Records processors: * Arrangements; * Descriptions; * Access rights. Records preservers: * Preservation planning; * Processing. NARA managers: * Task approvals; * Business processes. All of the above entities interact with the ERA system and its' components: * Ingest; * Preservation; * Dissemination; * Records management; * Archival storage; * Local services and control. Outside of the ERA system, but interacting with it are: * Access reviewers; * Financial systems; * Researchers, general public, and NARA staff; * System administrators; * Space/inventory management. Source: NARA data. [End of figure] As currently planned, the ERA system is to consist of six major components. * Ingest will enable the transfer of electronic records from federal agencies. * Archival Storage will enable stored records to be managed in a way that guarantees their integrity and availability. * Dissemination will enable users to search descriptions and business data about all types of records, and to search the content of electronic records and retrieve them. * Records Management will support scheduling,[Footnote 11] appraisal, [Footnote 12] description, and requests to transfer custody of all types of records, as well as ingesting and managing electronic records, including the capture of selected records data (such as origination date, format, and disposition). * Preservation will enable secure and reliable storage of files in formats in which they were received, as well as creating backup copies for off-site storage. * Local Services & Control will regulate how the ERA components communicate with each other, manage internal security, and enable telecommunications and system network management. NARA currently plans to deliver these components in five separate increments: * Increment 1 was deployed in two releases. Release 1 established the ERA base system—the hardware, software, and communications needed to deploy the system. Release 2 enabled functional archives with the ability to preserve electronic data in their original format, enable disposition agreements and scheduling, and receive unclassified and sensitive data from four federal agencies; according to NARA officials, this increment was completed in June 2008. * Increment 2 includes the EOP system, which was designed to handle records from the Executive Office of the President.[Footnote 13] The EOP system uses an architecture based on a commercial off-the-shelf product that supplies basic requirements, including rapid ingest of records and immediate and flexible search of content. Increment 2 includes basic case management for special access requests.[Footnote 14] This release was certified for initial operating capability (IOC) in December 2008. * The second release of Increment 2 and Increments 3 through 5 are to provide additional ERA functionality, such as public access. Figure 2 shows the current incremental timetable for deploying ERA and the functionality planned for each increment. Figure 2: ERA Acquisition Approach: [Refer to PDF for image: timeline] August 2004: NARA awarded two design contracts to Harris Corporation and to Lockheed Martin Corporation. March 2012: Full Operating Capability: Full use of the ERA system. Increment 1: September 2005 through June 2008: September 2005: NARA selected Lockheed Martin Corporation to develop the ERA system. Release 1: * Foundational system for ERA. Release 2: * Functional archives with the ability to preserve electronic data in original format; * Disposition agreements and scheduling; * Unclassified and sensitive data. June 2008: Initial Operating Capability: First use of the ERA system. Increment 2: November 2007 through September 2009: * EOP system: - Content search; - Basic case management for special access requests; - Ingest and transformation of data; - Extract/transform and load data. June 2008: Initial Operating Capability: First use of the ERA system. Increment 3: September 2009 through September 2010: * Preservation processing; * Description of records; * Authenticity check[A]; * Preservation assessment[A]; * Public access. Increment 4: September 2010 through September 2011: * Redaction[A]; * Expanded preservation and capacity; * Full appraisal and preservation plans[A]; * FOIA processing. Increment 5: September 2011 through September 2012: * Expanded preservation and capacity; * Collaboration with agencies[B]. March 2012: Full Operating Capability: Full use of the ERA system. [A] Functionality moved forward from previous increment. [B] Functionality moved from Increment 2. Source: NARA data. [End of figure] Since 2002, we have issued several reports on ERA and its development. [Footnote 15] In May 2008,[Footnote 16] we testified that the development of the ERA base was proceeding according to the revised schedule, although it faced challenges in meeting several testing deadlines. We also testified that the timely completion of the EOP system was uncertain, in part, due to ongoing negotiations between NARA and Lockheed Martin on system capabilities, timframes, and limited information about the nature of the records to be delivered. In September 2008[Footnote 17] we reported that NARA did not fully comply with its enterprise life-cycle methodology because it had not yet developed a mitigation plan to process the outgoing administration’ s records into the ERA system at the time of the January 2009 presidential transition. NARA intended to develop a mitigation plan at the end of 2008, when it expected to know more about the types and volume of the presidential records that it would receive. We reported that this proposed schedule would leave NARA little time to prepare for and implement the plan. As of April 2009, the life-cycle cost for ERA through March 2012 was estimated at $551.4 million; the total life-cycle cost includes not only the development contract costs, but also program management, research and development, and program office support, among other things. Table 1 shows the amount spent for ERA in fiscal year 2008. Table 2 shows the reported spending from the program’s inception to the end of fiscal year 2008. Table 1: Summary of Fiscal Year 2008 ERA Spending: Project category: Development Contract—Lockheed Martin[A]; Fiscal year 2008 spending: $41.6 million. Project category: Program Management; Fiscal year 2008 spending: $7.4 million. Project category: Program Office Support Team; Fiscal year 2008 spending: $4.8 million. Project category: Research and Development; Fiscal year 2008 spending: $4.0 million. Project category: Integrated Deployment and Support; Fiscal year 2008 spending: $3.1 million. Project category: Independent Verification and Validation; Fiscal year 2008 spending: $1.6 million. Project category: Net Adjustments; Fiscal year 2008 spending: -$0.9 million[B]. Project category: Total[C]; Fiscal year 2008 spending: $61.6 million. Source: GAO analysis of NARA data. [A] Amount includes Operations and Maintenance. [B] End of Year Recoveries. [C] Total may not equal the sum of individual items due to rounding. Note: NARA spent $30,231 towards security, but this is equal to zero when converted into millions and rounded to one decimal place. [End of table] Table 2: Summary of ERA Spending from Fiscal Year 2002 through Fiscal Year 2008: Project category: Development Contract—Lockheed Martin; Spending: $111.9 million. Project category: System Analysis and Design Contracts—Lockheed Martin and Harris Corporation; Spending: $40.8 million. Project category: Program Management; Spending: $31.2 million. Project category: Program Office Support Team; Spending: $22.8 million. Project category: Research and Development; Spending: $18.3 million. Project category: Integrated Deployment and Support; Spending: $8.9 million. Project category: Independent Verification and Validation; Spending: $5.6 million. Project category: Security; Spending: $0.2 million. Project category: Net Adjustments; Spending: -$2.4 million[A]. Project category: Total; Spending: $237.4 million[B]. Source: GAO analysis of NARA data. [A] Recoveries of prior year funds, adjustments to obligations incurred, obligations against prior years, and carryover funds expiring at the end of fiscal year 2009. [B] Total number may not equal the sum of individual items due to rounding. [End of table] In March 2009, NARA submitted a fiscal year 2009 expenditure plan as required to obtain the release of multiyear funds for ERA. The Omnibus Appropriations Act states that the agency could not obligate these funds until the appropriations committees reviewed and approved the expenditure plan. As of March 31, 2009, the appropriations committees have released $28.5 million of fiscal year 2009 multi-year funds with $17.3 million remaining to be released. Single-year funds appropriated for fiscal year 2009 totaled $21.2 million. NARA’s estimated ERA obligations for fiscal year 2009, including both single-year and multi-year funds, are $67.6 million. NARA plans to spend $11.1 million of this amount on EOP, and the remainder on the ERA base system and ERA program. As of March 31, 2009, NARA had obligated $23.9 million. Table 3 shows how NARA planned to distribute funds across the ERA program in fiscal year 2009. Table 3: Summary of NARA’s Fiscal Year 2009 Estimated Obligations for ERA: Project category: Development Contract; Description: Activities performed under the ERA system acquisition contract with Lockheed Martin (includes EOP); Estimated obligations: $44.4 million. Project category: Program Management; Description: Salaries and benefits, supplies, equipment, and telecommunications; Estimated obligations: $9.0 million. Project category: Research and Development; Description: Research performed with other agencies; Estimated obligations: $4.5 million. Project category: Program Office Support Team; Description: Labor, contracts, and materials to support ERA program management; Estimated obligations: $5.0 million. Project category: Integrated Deployment and Support; Description: Interagency agreements for ERA facilities[A]; Estimated obligations: $2.8 million. Project category: Independent Verification and Validation[B]; Description: Verification and validation activities; Estimated obligations: $1.9 million. Project Total; Estimated obligations: $67.6 million.[C] Source: GAO analysis of NARA data. [A] ERA facilities include Allegany Ballistics Lab at Rocket Center, West Virginia, and the Naval Meteorology and Oceanography Command at Stennis, Mississippi. [B] NARA contracted with Northrop Grumman to perform independent verification and validation on policies and plans produced by the ERA program and contract deliverables produced by Lockheed Martin. [C] Total may not equal the sum of individual items due to rounding. Note: NARA estimated obligations of $30,000 towards security, but this is not shown in the table because the amount is equal to zero when converted into millions and rounded to one decimal place. [End of table] [End of Background] Results: Legislative Conditions: Objective 1: NARA’s expenditure plan satisfies the fiscal year 2009 legislative conditions. Table 4: Fiscal Year 2009 Expenditure Plan Provisions for Satisfying Legislative Conditions: Legislative condition: 1. Meets OMB capital planning and investment control review requirements; Expenditure plan provisions: OMB requires agencies to develop capital planning and investment control review processes that help ensure that projects are being implemented at acceptable cost and within reasonable and expected time frames, and that they are contributing to observable improvements in mission performance. NARA meets this condition; it provides control over cost, schedule, and performance through the activities of the ERA Oversight Group, which meets weekly to review ERA progress, and the Information Technology Executive Committee. These committees, which meet regularly, include senior agency leadership and other agency stakeholders. NARA has also implemented a policy and process for semiannual reviews of ongoing information technology investments, including interdependencies with ERA, through an agencywide capital planning and investment control process. Legislative condition: 2. Complies with NARA’s enterprise architecture; Expenditure plan provisions: OMB requires NARA to include ERA in its agency-level enterprise architecture, which is updated on a yearly basis. NARA has developed an agency-wide enterprise architecture that includes ERA. The current agency enterprise architecture—version 5.0— includes ERA and consists of several component architectures, including business, data, systems, application, operations, and information technology security architectures. According to NARA officials, the agency is in the process of drafting the next version of its enterprise architecture—version 5.5—and plans to submit it to OMB for review in late May 2009. In addition, OMB requires that any major IT investment be mapped to and support the Federal Enterprise Architecture. The business case for the investment must also demonstrate the relationship between the investment and the business, performance, data, services, application, and technology layers of the agency’s architecture. NARA’s budget submission business case for the ERA system certifies compliance with these requirements and was approved by OMB. Legislative condition: 3. Conforms with NARA’s enterprise life cycle methodology; Expenditure plan provisions: The ERA project conforms to NARA’s life cycle methodology. For example, the expenditure plan includes descriptions of the incremental approach the agency has adopted for acquiring ERA and its management of program risks. In particular, the risk management methodology calls for the agency to identify and categorize risks, qualify the probabilities and consequences of the risks, specify a strategy to mitigate each risk, communicate risk status, and formulate actions needed to mitigate the risk. NARA manages risks using an agency-level risk review board, a program-level risk review board, and a technical risk review team. In addition, the ERA program office produces monthly reports that include top identified risks and specify associated mitigation strategies. The office also generates reports of pending or active risks from its risk management database that specify the probability and consequences of identified risks. Further, risk status is communicated to the ERA Executive Oversight Group, OMB, and Congress on a monthly basis. The monthly reports also identify executive actions needed to mitigate risks. Legislative condition: 4. Complies with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the federal government[A]; Expenditure plan provisions: The quality of software is governed largely by the quality of the processes involved in developing or acquiring it and maintaining it. Carnegie Mellon University’s Software Engineering Institute (SEI),[B] recognized for its expertise in software processes, has developed models and methods that define and determine organizations’ software process maturity. NARA satisfied this provision. Specifically, NARA (1) conducted internal assessments in 2002 and 2004 that used the institute’s SA-CMM[C] methods to determine the maturity of ERA’s system policies, processes, and practices and (2) implemented a process to address the assessment’s recommendations. NARA also conducted internal quality audits on its processes in late 2008. In December 2008, NARA’s quality management team conducted an assessment of the Communications and Risk Management components of the ERA system. The audits revealed that the teams responsible for managing these components of the program were utilizing current communication and risk management plans in the management of their respective areas. Legislative condition: 5. Approved by NARA and OMB; Expenditure plan provisions: * NARA—March 2009; * OMB—March 2009. Legislative condition: 6. Reviewed by GAO; Expenditure plan provisions: GAO—May 15, 2009, briefing to congressional appropriations subcommittees. Sources: GAO analysis of NARA data and the Omnibus Appropriations Act, 2009. [A] We did not review the program’s compliance with the Federal Acquisition Regulation or other federal requirements beyond those encompassed by the Software Engineering Institute’s Capability Maturity Model. [B]SEI is a federally funded research and development center operated by Carnegie Mellon University and sponsored by the Department of Defense. Its objective is to provide leadership in software engineering and in the transition of new software engineering technology into practice. [C] The Software Acquisition-Capability Maturity Model (SA-CMM) identifies key process areas that are essential to effectively managing software-intensive system acquisitions. [End of table] Results: Prior Recommendation Status: Objective 2: NARA has partially implemented our previous recommendations: In July 2008, we made two recommendations to NARA—developing a mitigation plan and enhancing ERA project oversight. NARA implemented one of our recommendations and partially implemented the other. Table 5: Status of NARA’s Progress in Implementing Prior GAO Recommendations: Prior GAO recommendation: Mitigation Plan—Develop a mitigation plan for indexing and searching the electronic records from the outgoing Bush Administration in the event that the EOP system is not complete. The plan should be completed in time to be fully implemented for the January presidential transition. Implementation status: Implemented; Status as of fiscal year 2009 plan: In November 2008, NARA finalized its mitigation plan to assure acceptance and ingestion of presidential electronic records. For two high-priority EOP data sets, the plan stated that NARA would obtain copies of the proprietary software used by the Bush White House and use those programs to answer related requests until those data could be successfully ingested into EOP. Prior GAO recommendation: Oversight of the ERA Project—Ensure that summary measures of project performance against ERA cost and schedule estimates are included in future monthly reports to Congress. Implementation status: Partially implemented; Status as of fiscal year 2009 plan: In July 2008, NARA began including an Earned Value Summary as an appendix to its monthly reports to Congress. Summary data included ERA’s schedule and cost performance status. Similar data were included in subsequent reports. However, our review of NARA’s earned value methodology, discussed further below, raises questions about NARA’s ability to accurately report on project cost, schedule, and performance. Source: GAO analysis of NARA data. [End of table] Results: Observations: Objective 3: Observations about NARA’s ERA Acquisition and Expenditure Plan: Observation 1: Cost, schedule, and performance data in the expenditure plan do not provide a clear picture of system progress. NARA’s expenditure plan should include a sufficient level and scope of information for Congress to understand what system capabilities and benefits are to be delivered, by when, and at what costs, and what progress is being made against the commitments that were made in prior expenditure plans. However, NARA’s plan does not clearly show what functions have been delivered to date or what functions will be included in future increments and at what cost. As of fiscal year 2008, NARA has spent $237.4 million for ERA, or about 43 percent of the program’s estimated life-cycle costs through 2012. NARA’s expenditure plan describes the results achieved with ERA funding at a high level. For example, as described in the plan, Increment 1, also known as the ERA base, includes the system hardware and software as well as some capability to preserve electronic data in their original format. Also, according to the plan, Increment 2, the EOP system, includes the capability to perform content searching and basic case management for presidential records. However, the plan does not provide a complete picture of what capabilities were delivered in these increments. In addition, even though NARA reported that planned functionality in both of these increments had been deferred to future increments, the plan does not provide cost estimates for the deferred functionality. As a result, it is not possible to fully identify what functionality has been delivered to date and at what cost. Additionally, NARA states it will spend $21.3 million to continue development of Increment 3, including implementing a common architecture, extending storage capabilities, and providing public access and preservation capabilities. However, NARA’s fiscal year 2009 plan lacks specifics about the scope of these improvements. For example, it does not quantify by how much it will extend storage capacity. Also, NARA’s plan does not specify when these functions will be completed or how much will be spent on each one. Finally, while NARA’s plan reports that fiscal year 2009 funds will be used to support operations and maintenance of the completed base and EOP increments, it does not specify how much will be needed to address issues deferred when the systems were accepted. For example, the plan does not specify the funding required during the fiscal year to address issues in the EOP system that were identified but deferred when the system was certified for initial operating capability in December 2008. NARA officials subsequently estimated that such efforts will cost $1.1 million. NARA officials attributed the plan’s lack of specificity to ongoing negotiations with Lockheed Martin. NARA provided broad descriptions of tasks for future development to Lockheed and is currently working with the contractor to refine them, and expects Lockheed to provide a proposal for accomplishing these tasks in May 2009. It is also in negotiations over the costs of addressing issues that were deferred at IOC. Without more specific information on what functionality has been and will be delivered and the costs associated with those functions, NARA and other interested parties will have limited abilities to measure overall program progress. In addition, until NARA specifies how it will use funds requested for the remainder of the year, congressional appropriators will lack information important for evaluating NARA’s request. Observation 2: NARA is not consistently following best practices in Earned Value Management. NARA’s expenditure plan states that, in managing ERA, the agency uses Earned Value Management (EVM) tools and requires the same of its contractors. EVM, if implemented appropriately, can provide objective reports of project status, produce early warning signs of impending schedule delays and cost overruns, and provide unbiased estimates of a program’s total costs. We recently published a set of best practices on cost estimation that addresses the use of EVM.[Footnote 18] Comparing NARA’s EVM data to those practices, we determined that NARA fully addressed only 5 of the 13 practices. For example, we found weaknesses within the EVM performance reports, including contractor reports of funds spent without work scheduled or completed, and work completed and funds spent where no work was planned. In addition, the program has not recently performed an integrated cost- schedule risk analysis. This type of analysis provides an estimate of the how much the program will cost upon completion and can be compared to the estimate derived from EVM data to determine if it is likely to be sound. NARA officials attributed these weaknesses, in part, to documentation that did not accurately reflect the program’s current status. By not consistently adhering to identified best practices, NARA’ s program management data may be unreliable, likely hindering NARA’s ability to accurately monitor and report on program costs, schedule, and performance. Further detail on these best practices and our assessment can be found in attachment 1. Observation 3: Although NARA certified initial operating capability for EOP, the system is not currently fulfilling its intended purpose. NARA designed and developed the EOP system to support the transfer of electronic records at the end of the George W. Bush Administration as required by the Presidential Records Act. In fiscal year 2008, NARA obligated $27.9 million for the planning and development of EOP in order for the system to be ready for the presidential transition. The system was to ingest the electronic records and to support search, processing, and retrieval of records—particularly for “special access” requests[Footnote 19] for the ongoing business of Congress and the next administration—immediately after the presidential transition on January 20, 2009. Responding to special access requests from the current administration, Congress, and the courts is a critical part of NARA’s mission and one of the major capabilities intended for the EOP system. In December 2008, NARA certified IOC for the EOP system, based on successful completion of acceptance and security testing. In January 2009, NARA took custody of approximately 78.4 terabytes[Footnote 20] of unclassified Bush Administration electronic records, which agency officials characterized as all such records. Before the transition, NARA had estimated that it was going to receive almost 124 terabytes of presidential records. According to NARA officials, the difference between the estimated volume of records and the actual records received is due to inaccurate information provided by the previous administration. NARA copied the records data to large storage arrays, which were initially stored in the Washington, D.C. area, then moved to the ERA facility in West Virginia, where ingestion of records into EOP takes place. As of April 27, only 2.3 terabytes of data have been fully ingested from the first storage array into the EOP system, where they are available for search and retrieval. This constitutes about 3 percent of all Bush Administration unclassified electronic records. NARA currently estimates that ingest of all 78.4 terabytes of unclassified records will not be complete until October 2009. Before the transition, NARA has estimated that ingest would be completed by May 2009. NARA officials attributed delays, in part, to unexpected difficulties. For example, according to NARA officials, once they started using the EOP system, they discovered that records from certain White House systems were not being extracted in the expected format. As a result, it had to develop additional software tools to facilitate the full extraction of data from White House systems prior to ingest into EOP. In addition, in April 2009, NARA discovered that 31 terabytes of priority data that had been partially ingested between December 2008 and January 2009 was neither complete nor accurate because it was taken from an incomplete copy of the source system. NARA has started to re- copy data from what it believes to be a complete version of the source data. Because the records had not been ingested into the EOP system, NARA had to use other systems to respond to requests for presidential records. As of April 24, 2009, NARA had received 43 special access requests for information on the Bush Administration. Only one of these requests used EOP for search, and no responsive records were found. To respond to 24 of these requests, NARA used the replicated White House systems described in its risk mitigation plan, which called for acquiring the software and related hardware used by the White House to manage a records management system and an image database. According to NARA officials, these replicated systems cost $570,000 to put into service. The sources used to respond to the 42 requests that did not use EOP are listed in table 6 below. Table 6: Sources Used by NARA to Respond to Special Access Requests: Source used to respond to requests: Replicated records management system; Number of requests: 22. Source used to respond to requests: Replicated image database; Number of requests: 2. Source used to respond to requests: Classified electronic records system; Number of requests: 8. Source used to respond to requests: Copies of original electronic records; Number of requests: 3. Source used to respond to requests: Hand search of hard copy records; Number of requests: 5. Source used to respond to requests: Other[A]; Number of requests: 5. Source: GAO analysis of NARA data. [A] Other includes requests where no search was required to locate paper records, a request forwarded to another agency, and a request that was put on hold. Note: Three requests were answered using both the replicated records management system and the classified electronic records system. [End of table] Until NARA completely and accurately ingests the Bush presidential records into EOP, it will be unable to use the system for its intended purpose and will incur additional costs in maintaining the systems it is now using to support requests for Bush presidential records. Observation 4: NARA lacks a contingency plan for ensuring continuity of the ERA system. Contingency planning is a critical component of information protection. If normal operations are interrupted, network managers must be able to detect, mitigate, and recover from service disruptions while preserving access to vital information. Therefore, a contingency plan details emergency response, backup operations, and disaster recovery for information systems. It is important that these plans be clearly documented, communicated to potentially affected staff, updated to reflect current operations, and regularly tested. The Federal Information Security Management Act[Footnote 21] (FISMA) requires each agency to develop, document, and implement an information security program that includes plans and procedures to ensure continuity of operations for information systems that support the agency’s operations and assets. The National Institute of Standards and Technology (NIST) requires that agencies’ systems have contingency plans and that the plans address, at a minimum, identification and notification of key personnel, plan activation, system recovery, and system reconstitution. Specifically, NIST identifies 10 security control activities related to contingency planning, including developing a formal contingency plan, training employees on their contingency roles and responsibilities, and identifying a geographically separate alternative processing site to support critical business functions in the event of a system failure or disruption. [Footnote 22] NARA has not developed a contingency plan for the ERA system to ensure availability in the event of a system failure or disruption. In December 2008, NARA issued an assessment that detailed the results of an evaluation of the security features associated with the ERA system. This assessment identified weaknesses related to all 10 of the contingency planning control activities, which were attributed to the system not having the required contingency plans. OMB guidance[Footnote 23] requires that when an agency identifies security weaknesses, it must also develop a plan of action to address the identified weaknesses, including the resources required to fix the weaknesses, the scheduled completion date of each fix, and the current status of the mitigation. Accordingly, NARA developed a plan of action and milestone document which was to detail all the primary risk elements present in the system and the corresponding plan of actions to mitigate or correct identified deficiencies before the ERA system reached IOC. However, while the initial plan of action and milestones discussed fixes for eight contingency planning control activities, it did not address two others—contingency planning policies and procedures and telecommunications services. For those eight control activities mentioned in the document, no timetable was provided for completion to address the identified issues. A subsequent planning document was developed that provided further detail on the identified risks. The revised plan of action and milestones document provided the scheduled dates of completion as well as the current status of the mitigation activities. However, this version did not mention the various risk categories (i.e., “low,” “medium,” “high”) and used a variety of terms to describe the status of each weakness (e.g., “pending,” “planned,” “ongoing”) without providing clear definitions of their meaning. Further, 10 of 11 items in the plan of action to address contingency planning weaknesses remain open as of April 2009. In addition, NIST standards require that agencies back up information contained within a system and employ a mechanism that would restore the system after a disruption or failure. Following product acceptance tests for EOP, NARA reported that the backup and restore functions for the commercial off-the-shelf archiving product used at the ERA facility in West Virginia tested successfully, but there were concerns about the amount of time required to execute the process. In lab tests, the restore process took about 56 hours for 11 million files.[Footnote 24] This is significant because, while the backup is being performed, the replication of data must be stopped; otherwise it could bring the system to a halt. Subsequently, NARA officials stated that they have conducted two successful backups, but the restore process had not been fully tested to ensure that the combined backup and restore capability can be successfully implemented. The most recent backup, conducted at Rocket Center on March 20, 2009, took 95 hours and 38 minutes for 11.25 terabytes of data, but NARA could not provide any documentation to substantiate the success of the backups or information on the length of time needed to perform the restore function. NARA considered the initial backup and restore test a success because it met the requirements set for the contractor. According to NARA’s requirements documentation, among other things, the Backup and Recovery service was supposed to “provide the capability to recover EOP ERA records as required to re-establish the system,” and “provide the capability to recover application files to re-establish the EOP ERA system.” However, as in the examples cited, none of the backup/restore requirements specified how long the backup and restore process should take. According to NARA officials, a full system contingency plan is currently under development. Without a complete and successfully tested contingency plan, there is an increased risk that, in the event of a major system failure or disruption, NARA would not be able to effectively restore its information and ensure system availability. Such a significant risk severely limits the reliability of the system. [End of Results] Conclusions: While NARA has continued to make progress on the ERA system, that progress cannot be fully quantified because NARA’s expenditure plan does not clearly identify what functions have already been delivered, how much was spent to provide each function, or how much is required to maintain the delivered increments. NARA’s current plan similarly lacks details on the functions to be provided in future increments and the costs associated with them, including development efforts scheduled to take place in the remainder of this year. In addition, although NARA has been using Earned Value Management to track program cost, schedule, and performance, weaknesses in its EVM data limit NARA’s ability to accurately report on the project’s progress. Without more specific and accurate information on the immediate and long-term goals of the program and the outcomes expected from its resulting efforts, NARA will be hindered in effectively monitoring and reporting on the cost, schedule, and performance of the ERA system and congressional appropriators will lack information necessary to evaluate the agency’s requests for funds. Although NARA certified that the EOP portion of the ERA system had achieved initial operating capability as planned in December 2008, the system has been of limited use because of delays in ingesting electronic records into the system. Further, even though it has obligated nearly $40 million on EOP, NARA has instead answered requests for Bush electronic records using existing systems or replicated White House systems that cost less than $600,000. Under its current schedule, the Bush Administration records will not be fully ingested into the system until October 2009. However, even when the data are fully ingested, the system’s lack of a complete, fully tested contingency plan increases the risk that a system failure or disruption will result in the system being unavailable for several days or more. [End of Conclusions] Recommendations for Executive Action: We recommend that the Archivist of the United States take the following actions: * Report to Congress on the specific outcomes to be achieved by ERA program funding for the remainder of fiscal year 2009. * Provide detailed information in future expenditure plans on what was spent and delivered for deployed increments of the ERA system and cost and functional delivery plans for future increments. * Strengthen the earned value process so that it follows the practices described in GAO’s guide and more reliable cost, schedule, and performance information can be included in future expenditure plans and monthly reports. * Include in NARA’s next expenditure plan an analysis of the costs and benefits of using the EOP system to respond to presidential records requests compared to other existing systems currently being used to respond to such requests. * Develop and implement a system contingency plan for ERA that follows contingency guidance for federal systems. [End of Recommendations for Executive Action] Agency Comments and Our Evaluation: In written comments on a draft of this briefing, the Acting Archivist of the United States agreed with 4 of our 5 recommendations. Specifically, in response to our recommendation that NARA report to Congress on the specific outcomes to be achieved during the remainder of the year, she indicated that a briefing on that subject was provided on April 27, 2009. In addition, she agreed to: * ensure that future expenditure plans include more details on the costs and functions of future increments, * strive to comply with EVM best practices, and, * complete the ERA system contingency plan. Regarding our recommendation that NARA report on the costs and benefits of using the EOP system to answer requests for presidential records compared to other systems, the Acting Archivist raised several points. First she wrote that the EOP system is accomplishing an enormous amount of work at exceptional speed, and that the system has the capability to transfer and ingest records as they became available. However, as indicated in our briefing, the EOP system has been of limited use to answering the requests received to date. Further, the ingest of presidential records into the system required the use of additional software tools and is now scheduled to take 5 months longer than NARA estimated before the transition, even though NARA received a significantly lower volume of records than anticipated. The Acting Archivist also wrote that EOP supports functions other than the search of presidential records, such as the lifecycle management of presidential records, and that comparisons between the replicated systems and EOP are not valid. While we acknowledge that EOP was designed to perform functions other than search, we disagree that a comparison between EOP and other systems would not be valid. Instead, we believe that an appropriate analysis of the costs and benefits of using the various systems should account for the need to satisfy non- search requirements, such as lifecycle management of records, using systems other than EOP. Finally, the Acting Archivist wrote that the replicated systems were being used for a small subset of records. However, these systems include nearly half of the records NARA received, by volume. In addition, these same records have been the subject of most of the requests received to date. We also addressed the Acting Archivist’s technical comments, as appropriate. [End of Agency Comments and Our Evaluation] Attachment 1: Details on NARA’s EVM Compared with Best Practices: NARA’s EVM processes only partially adhere to the thirteen practices that GAO has identified as necessary in developing a reliable EVM process.[Footnote 25] Specifically, NARA fully adhered to 5 of the 13 best practices in implementing EVM, partially adhered to 6, and did not adhere to 2. While NARA’s EVM data indicate that the project is meeting cost and some schedule targets, not adhering to best practices does not allow NARA to effectively measure progress or forecast cost overruns. See table 7 for details. Table 7: NARA Earned Value Management Compared with Best Practices: Best practice: Define the Scope with a Work Breakdown Structure (WBS); Explanation: The WBS, a critical component of EVM that defines the work to be performed, should be the basis of the cost estimate and the project schedule (i.e. the baseline). The WBS progressively deconstructs the deliverables of the entire effort through lower-level WBS elements and control accounts. GAO assessment: Partially met; We were unable to trace business functionality to the WBS. As such there is no certainty that the baseline is comprehensive. Best practice: Identify Who Will Do the Work; Explanation: To ensure that someone is accountable for every WBS element, it is useful to determine levels of accountability within the EVM system. GAO assessment: Met. Best practice: Schedule the Work to a Timeline; Explanation: Developing a schedule provides a time sequence for the duration of the program’s activities and helps everyone understand both the dates for major milestones and the activities that drive the schedule. GAO assessment: Partially met; The Defense Contract Management Agency has identified areas of concern with the integrated schedule. For example, no resources are assigned within the schedule, there are several instances of broken logic, and there are actual dates that are recorded as being in the future. Best practice: Estimate Resources and Authorize Budgets; Explanation: Budgets should be authorized as part of the EVM process, and they must authorize the resources needed to do the work. GAO assessment: Partially met; We found multiple types of data anomalies within the EVM performance reports. Specifically, the contractor reported: * Dollars were spent, but no work was scheduled or completed. * Work was scheduled and accomplished, but no dollars were spent. * Work was completed and dollars spent, but no work planned. In addition, the contractor did not explain key variances in these reports. For example, * the contractor performed $5.9M worth of work for $1.4M, and, * the contractor performed $2.7M worth of work at a cost of $1.9M. Best practice: Determine an Objective Measure for Earned Value; Explanation: Performance measurement is key to earned value because performance represents the value of work accomplished. These measures are used to report progress in achieving milestones and should be integrated with technical performance measures. GAO assessment: Partially met; Initially there was a large amount of work not being measured objectively. The program has requested that the contractor turn some of these into objective measures. For example, all quality assurance work was changed after the December 2008 integrated baseline review. However, there still are several examples of non- discrete work such as all the annual program execution costs. Best practice: Develop the Performance Measurement Baseline; Explanation: The performance measurement baseline represents the cumulative value of the planned work overtime. It takes into account that program activities occur in a sequenced order, based on finite resources, with budgets representing those resources spread over time. GAO assessment: Partially met; Not all increments are included in the EVM baseline. Specifically, the baseline includes Increments 1 and 2, but does not include Increments 3 through 5. Best practice: Execute the Work Plan and Record All Costs; Explanation: Actual costs are recorded by the accounting system and are reconciled with the value of the work performed so that effective performance measurement can occur. GAO assessment: Met. Best practice: Analyze EVM Performance Data and Record Variances from the Performance Measurement Baseline Plan; Explanation: Because programs all carry some degree of risk and uncertainty, cost and schedule variances are normal. EVM guidelines provide for examining cost and schedule variances at the control account level at least monthly and for focusing management attention on variances with the most risk to the program. GAO assessment: Met. Best practice: Forecast Estimates at Completion (EAC) Using EVM; Explanation: Managers should rely on EVM data to generate EACs at least monthly. A best practice is to continually reassess the EAC, obviating the need for periodic bottom-up estimating. GAO assessment: Met. Best practice: Conduct an Integrated Cost-Schedule Risk Analysis; Explanation: An integrated schedule can be used, in combination with risk analysis data (often including traditional 3-point estimates of duration) and Monte Carlo simulation software, to estimate schedule risk and the EAC. GAO assessment: Not met. The program has not performed an integrated cost-schedule risk analysis. Program officials stated that they plan on doing this with Increment 3. Best practice: Compare EACs from EVM with EAC from Risk Analysis; Explanation: The integrated cost-schedule risk analysis produces a cumulative probability distribution for the program’s cost. This estimate can be compared to the estimate using EVM extrapolation techniques. If their results are in general agreement, their conclusions are probably sound. If not, one or the other method (or both) should be reviewed for changes and revisions. GAO assessment: Not met. Since the program has not performed an integrated cost-schedule risk analysis, they are not able to calculate a risk-adjusted EAC. Best practice: Take Management Action to Mitigate Risk; Explanation: Management should focus on corrective actions and identify ways to manage cost, schedule, and technical scope to meet program objectives. It should also keep track of all risks and analyze EVM data trends to identify future problems. GAO assessment: Partially met: * Multiple risk lists exist but are not consistent (e.g. implementation of an e-mail application was identified on only two of the three risk lists). * The program was providing quarterly reviews of high risk issues. However, these have stopped since the change of presidential administrations. Best practice: Update the Performance Measurement Baseline as Changes Occur; Explanation: Because changes are normal, guidelines allow for incorporating changes—unless it is a retroactive change to the performance data (with the exception of error correction). However, it is imperative that changes be incorporated into the EVM system as soon as possible to maintain the validity of the performance measurement baseline. GAO assessment: Met. Source: GAO analysis of agency data. [End of table] [End of Attachment 1] Attachment 2: Comments from the Acting Archivist of the United States: National Archives and Records Administration: 8601 Adelphi Road: College Park, Maryland 20740-6001: May 11, 2009: Mr. David A. Powner: Director Information Technology Management Issues: Government Accountability Office (GAO): 441 G Street NW: Washington DC, 20548: Dear Mr. Powner: Thank you for the opportunity to review and comment on the draft presentation titled Review of NARA's Fiscal Year 2009 Electronic Records Archives Expenditure Plan before it is briefed to the staff members of the Subcommittee on Financial Services and General Government, Senate Appropriations Committee and the Subcommittee on Financial Services and General Government, House Appropriations Committee. We are pleased to note the recognition of the progress made towards implementing the Electronics Records Archives (ERA) Program. We also appreciate the insight into the Expenditure Plan observations addressed in GAO's presentation. We would like to take this opportunity to address the recommendations in your presentation. Regarding your recommendation that the agency provide a report to Congress on the specific outcomes Tube achieved by ERA program, a briefing on that topic was provided by the Chief Information Office, on April 27, 2009. We note your recommendation that future Expenditure Plans include more detailed information on what was spent and delivered for deployed increments of the ERA system and cost and functional delivery plans for future increments. We will ensure that future Expenditure Plans include more details for increments to be deployed both from a functional and cost basis. In addition, we will work with our contacts at the Office of Management and Budget in an effort to make the ERA Expenditure Plan available at an earlier date. We believe it would be extremely helpful to NARA that, if specific guidance exists on what detailed information should appear in the Expenditure Plan, it be provided. We appreciate GAO's guidance on Earned Value Management (EVM) and the information provided in its recently released Cast Estimating and Assessment Guide dated March 2009. While this Guide was not available during the period covered by this review, NARA fully adheres to 5 of the 13 best practices in implementing EVM, and partially adheres to 6. We are in the process of upgrading our EVM system and will strive to comply with all 13 best practices both internally and on our contracts that require EVM. The finding that the EOP system is not currently fulfilling its intended purpose neglects to differentiate between what the system is capable of doing and the work being done an the system. The system does provide required functionality and is in fact accomplishing an enormous amount of work at exceptional speed It assist be noted that the ability to search EOP records is only one aspect of the functions Lobe performed by LOP system, and that equally important are the fundamental requirements for quality assurance over transfer and ingest and comprehensive and detailed lifecycle management of the ingested records. The existing systems now being used to bridge the gap for searching records until all the EOP data is ingested into the system will not address those areas. The system has provided the required functionality to transfer and ingest COP records as those retards became available. As stated in the report, transfer and ingest challenges have included such problems as data not being extracted in expected formats and incomplete replication of one type of data. The comparison of costs of the ERA EOP system and the technology used under the contingency plan is not valid. The contingency plan was constructed and executed as a short term solution to specific problems in the transfer of records from the Bush Administration. Meeting the short term needs for which it was intended entailed using the most convenient technological solution possible. Had it been intended as a sustainable approach. NARA would have had to take a much more comprehensive approach, resulting in higher costs and a probable time frame longer than the solution was needed. Moreover, the contingency plan was implemented only for a small subset of the records. Regarding your last recommendation, an ERA Contingency Plan is currently under development, and will he provided to you upon completion. Again, we thank you for this opportunity and look forward to our future interactions as we continue the ERA acquisition process. Sincerely, Signed by: Michael J. Kraft, for: Adrienne C. Thomas: Acting Archivist of the United States: [End of Attachment 2] [End of section] Appendix II: Comments from the National Archives and Records Administration: National Archives and Records Administration: 8601 Adelphi Road: College Park, Maryland 20740-6001: July 9, 2009: Government Accountability Office: Director of Information Technology Management Issues: Mr. David A. Powner: 441 G Street NW: Washington DC, 20548: Dear Mr. Powner: We thank you for the opportunity to review and comment on the report entitled Electronic Records Archive: The National Archives' Fiscal Year 2009 Electronic Archives Expenditure Plan (GAO-09-733). We appreciate the insight into the Expenditure Plan observations addressed in the report and would like to take this opportunity to address the recommendations. We are pleased to note your recognition that the FY 2009 ERA Expenditure Plan meets all six legislative conditions required for release of the appropriated multi-year funds. Regarding your recommendations on areas outside the scope of the Expenditure Plan legislative requirements, we have the following comments. The level of detail provided in the Expenditure Plan was addressed in a briefing to Congress on the specific outcomes to be achieved by the ERA program on April 27, 2009. We will add details to the next Expenditure Plan addressing costs and functions delivered to date, and what is planned for future increments. In addition, we will work with the Office of Management and Budget in an effort to make the ERA Expenditure Plan available at an earlier date. We appreciate GAO's guidance on Earned Value Management (EVM) and the information provided in its recently released Cost Estimating and Assessment Guide dated March 2009. Although this Guide was not available when the Expenditure Plan was written, NARA is pleased to note that GAO concluded that NARA fully adheres to 5 of the 13 best practices and partially adheres to 6. We are in the process of upgrading our EVM system and will strive to comply with all 13 best practices. The comment that the EOP system is not currently fulfilling its intended purpose fails to differentiate between what the system is capable of doing and the work being done on the system. The system does provide required functionality and is in fact accomplishing an enormous amount of work at exceptional speed. All the data will be ingested by the end of the fiscal year. Additionally, NARA can and does use the ERA EOP instance to search any records ingested into the system. NARA did use contingency systems at the end of the Bush 43 Administration for two of the 62 different sets of electronic records. NARA implemented this temporary measure for a period of less than six months because of problems with the copies of the electronic records transferred to NARA by the EOP, not problems with the ERA system. The ERA system was ready to process these records if they had been transferred according to the specifications negotiated with the EOP. Issues with that data are now resolved and the data is in the ERA EOP. Use of the contingency systems was terminated at the end of June. The recommendation regarding a cost comparison between the ERA EOP and the contingency systems is problematic since it does not seem cost- effective to conduct a retrospective analysis as to whether there might have been technology solutions for systems that have already been retired. Finally, the report minimizes the cost of longterm use of the full set of legacy systems. The report reflects only software licenses and operational support for only two of the contingency systems. It does not reflect costs NARA would have incurred if the EOP had not loaned NARA the proprietary hardware on which the two contingency systems resided, or the costs of software development for extending the full set of legacy systems in order to meet the ERA EOP requirements. Regarding your last recommendation, an ERA Contingency Plan has been developed and is in final review. We will provide a copy when the review process is completed. Again, we appreciate GAO's recognition that NARA has satisfied the legislative conditions for release of ERA funds. We thank you for this opportunity and look forward to our future interactions as we continue the ERA acquisition process. Sincerely, Signed by: Adrienne C. Thomas Acting Archivist of the United States: [End of section] Appendix III: GAO Contact and Staff Acknowledgments: GAO Contact: David A. Powner (202) 512-9286 or pownerd@gao.gov: Staff Acknowledgments: In addition to the individual named above, key contributions to this report were made by James R. Sweetman, Jr., Assistant Director; Monica Perez Anatalio; Nabajyoti Barkakati; Carol Cha; Barbara Collier; Tisha Derricotte; Jennifer Echard; Pamlutricia Greenleaf; Kush Malhotra; Lee McCracken; and Tarunkant Mithani. [End of section] Footnotes: [1] Omnibus Appropriations Act, 2009, Pub. L. No. 111-8, div. D, title V, 123 Stat. 524, 667 (Mar. 11, 2009). [2] ERA's fiscal year 2009 budget authority totaled $67.6 million, which includes $0.6 million carried over from multi-year funds appropriated in previous years. [3] EVM is a project management tool that integrates the technical scope of work with schedule and cost elements for investment planning and control. It compares the value of work accomplished in a given period with the value of the work expected in that period. Differences in expectations are measured in both cost and schedule variances. OMB requires agencies to use EVM in their performance-based management systems for the parts of an investment in which development effort is required or system improvements are under way. [4] Omnibus Appropriations Act, 2009, Pub. L. No. 111-8, div. D, title V, 123 Stat. 524, 667 (Mar. 11, 2009). [5] ERA’s fiscal year 2009 budget authority totaled $67.6 million which includes $0.6 million carried over from multi-year funds appropriated in previous years. [6] Agencies develop an exhibit 300, also known as the Capital Asset Plan and Business Case Summary, to justify each request for a major information technology investment. OMB sets forth requirements for the exhibit 300 in Circular A-11, Part 7, Planning, Budgeting, Acquisition, and Management of Capital Assets. [7] EVM is a project management tool that integrates the technical scope of work with schedule and cost elements for investment planning and control. It compares the value of work accomplished in a given period with the value of the work expected in that period. Differences in expectations are measured in both cost and schedule variances. OMB requires agencies to use EVM in their performance-based management systems for the parts of an investment in which development effort is required or system improvements are under way. [8] 44 U.S.C. 2203(f)(1). [9] According to the Federal Acquisition Regulation, a firm-fixed-price contract provides for a price that is not subject to any adjustment on the basis of the contractor’s cost experience in performing the contract. [10] A cost plus award fee contract is a cost reimbursement contract that provides for a fee consisting of a base amount fixed at inception of the contract plus an award amount that may be given based upon a judgmental evaluation by the government of contract performance. [11] A record schedule is a document that describes agency records, establishes a period for their retention by the agency, and provides mandatory instructions for what to do with them when they are no longer needed for current government business. [12] Records appraisal is the process of determining the value and the final disposition of records, making them either temporary or permanent. [13] NARA’s original EOP plans included a National Security System. NARA subsequently deferred the capability to ingest classified national security data, stating that the volume to be transferred from the Bush Administration did not support the establishment of a full scale classified EOP system as planned. Instead, NARA migrated the classified data from the Bush Administration to an existing classified NARA presidential library system. [14] These are requests NARA receives from the current and former administrations, Congress, and the courts for access to presidential records. [15] GAO, Information Management: Challenges in Managing and Preserving Electronic Records, [hyperlink, http://www.gao.gov/products/GAO-02-586] (Washington, D.C.: June 17, 2002). Records Management: Planning for the Electronic Records Archives Has Improved, [hyperlink, http://www.gao.gov/products/GAO-04-927] (Washington, D.C.: Sept. 23, 2004); Information Management: Acquisition of the Electronic Records Archives Is Progressing, [hyperlink, http://www.gao.gov/products/GAO-05-802] (Washington, D.C.; July 15, 2005); Electronic Records Archives: The National Archives and Records Administration’s Fiscal Year 2006 Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO-06-906] (Washington, D.C.: Aug. 18, 2006); and Information Management: The National Archives and Records Administration’s Fiscal Year 2007 Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO-07-987] (Washington, D.C.: July 27, 2007). [16] GAO, Information Management: Challenges in Implementing an Electronic Records Archive, [hyperlink, http://www.gao.gov/products/GAO-08-738T] (Washington, D.C.: May 14, 2008). [17] GAO, Information Management: The National Archives and Records Administration’s Fiscal Year 2008 Expenditure Plan, [hyperlink, http://www.gao.gov/products/GAO-08-1105] (Washington, D.C.: Sept. 26, 2008). [18] GAO, GAO Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, [hyperlink, http://www.gao.gov/products/GAO-09-3SP] (Washington, D.C.: March, 2009). [19] These are requests NARA receives from the current and former administrations, Congress, and the courts for access to presidential records. The priorities are determined by NARA’s Office of Presidential Libraries based on experience with the records of previous administrations. [20] A terabyte is about one trillion bytes or about 1,000 gigabytes. [21] FISMA was enacted as title III, E-Government Act of 2002, Pub. L. No. 107-347 (Dec. 17, 2002). [22] National Institute of Standards and Technology, Recommended Security Controls for Federal Information Systems, Special Publication 800-53 Revision 1 (Gaithersburg, MD: December 2006). [23] Office of Management and Budget, “Guidance for Preparing and Submitting Security Plans of Action and Milestones,” Memorandum for the Heads of Executive Departments and Agencies, Mitchell E. Daniels, Jr., Director, M-02-01, October 17, 2001. [24] NARA estimates that it has received more than 300 million files from the Bush Administration. [25] GAO, Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Capital Program Costs, [hyperlink, http://www.gao.gov/products/GAO-09-3SP] (Washington, D.C.: March 2009). [End of section] GAO's Mission: The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO's commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to [hyperlink, http://www.gao.gov] and select "E-mail Updates." Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s Web site, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: E-mail: fraudnet@gao.gov: Automated answering system: (800) 424-5454 or (202) 512-7470: Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov: (202) 512-4400: U.S. Government Accountability Office: 441 G Street NW, Room 7125: Washington, D.C. 20548: Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov: (202) 512-4800: U.S. Government Accountability Office: 441 G Street NW, Room 7149: Washington, D.C. 20548: