This is the accessible text file for GAO report number GAO-12-192R entitled 'Transportation Security Infrastructure Modernization May Enhance DHS Screening Capabilities, but It Is Too Early to Assess Results' which was released on December 8, 2011. This text file was formatted by the U.S. Government Accountability Office (GAO) to be accessible to users with visual impairments, as part of a longer term project to improve GAO products' accessibility. Every attempt has been made to maintain the structural and data integrity of the original printed product. Accessibility features, such as text descriptions of tables, consecutively numbered footnotes placed at the end of the file, and the text of agency comment letters, are provided but may not exactly duplicate the presentation or format of the printed version. The portable document format (PDF) file is an exact electronic replica of the printed version. We welcome your feedback. Please E-mail your comments regarding the contents or accessibility features of this document to Webmaster@gao.gov. This is a work of the U.S. government and is not subject to copyright protection in the United States. It may be reproduced and distributed in its entirety without further permission from GAO. Because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately. GAO-12-192R: December 8, 2011: The Honorable John D. Rockefeller, IV: Chairman: Committee on Commerce, Science, and Transportation: United States Senate: Subject: Transportation Security Infrastructure Modernization May Enhance DHS Screening Capabilities, but It Is Too Early to Assess Results: Dear Mr. Chairman: Securing transportation systems and facilities requires balancing security to address potential threats while facilitating the flow of people and goods that are critical to the U.S. economy and necessary for supporting international commerce. As we have previously reported, transportation systems and facilities are vulnerable and difficult to secure given their size, easy accessibility, large number of potential targets, and proximity to urban areas.[Footnote 1] The federal government has taken steps to ensure that transportation workers, particularly those who transport hazardous materials or seek unescorted access to secure areas of federally regulated maritime or aviation facilities, are properly vetted to identify whether they pose a security risk. These efforts are intended to reduce the probability of a successful terrorist or other criminal attack on the nation's transportation systems. To help enhance the security of the U.S. transportation system, the Department of Homeland Security (DHS) Transportation Security Administration's (TSA) Transportation Threat Assessment and Credentialing (TTAC) office[Footnote 2] is responsible for conducting background checks--known as security threat assessments--for various screening and credentialing programs established for maritime,surface, and aviation transportation workers.[Footnote 3] TSA's programs are largely focused on identifying security threats posed by those individuals seeking to obtain an endorsement, credential, access, and/ or privilege (hereafter called a credential) for unescorted access to secure or restricted areas of transportation facilities at maritime ports and airports, and for commercial drivers transporting hazardous materials. These screening and credentialing programs were created under various legal and regulatory authorities, and were established at different times. As a result, according to TSA, these programs and their supporting systems are made up of independent, stand-alone business processes and systems, making it difficult to adapt them to meet expected growth in demand, new requirements, and new capabilities. According to TSA, TTAC screens and/or provides credentials to an estimated 12.5 million individuals per year, and this number is estimated to increase to between 52.5 million to 62.5 million individuals by 2016. However, as indicated in the TTAC Infrastructure Modernization (TIM) program mission needs statement, TTAC does not currently have the capability to support these expanding populations in providing security threat assessment and credentialing services. [Footnote 4] To address this limitation, TTAC initiated TIM in 2008 to consolidate and standardize TSA's current screening and credentialing systems to better serve transportation worker populations, increase efficiencies, and reduce duplication.[Footnote 5] In April 2007, we reported that several DHS screening and credentialing programs-- including TSA programs--would benefit from additional coordination since they collect similar information, use similar background check processes, and operate separate enrollment facilities.[Footnote 6] We made three recommendations aimed at enhancing coordination and exploring options for coordinating and aligning background checks within DHS. DHS concurred and took actions that addressed these recommendations. For example, DHS established a credentialing framework initiative to help eliminate redundant activities across multiple screening and credentialing programs. This framework is also intended to guide screening and credentialing investments to improve DHS's ability to meet its mission by, among other things, leveraging investments across programs, reducing costs of implementing new capabilities, and seeking to coordinate DHS initiatives. DHS has an acquisition management process intended to, among other things, help ensure acquisition programs meet DHS mission needs. As part of this process, the DHS Acquisition Review Board is to conduct systematic reviews of acquisition programs and make recommendations on the appropriate direction for moving forward.[Footnote 7] The Acquisition Review Board is also expected to provide a consistent method for evaluating an acquisition's progress and status at critical points in the acquisition's life cycle, and is to work with the acquisition decision authority, a member of the Acquisition Review Board, to approve an acquisition to proceed to the next phase in its life cycle.[Footnote 8] Given the current efforts to coordinate DHS screening and credentialing programs on a departmentwide basis, you asked that we evaluate TSA's TIM implementation effort. Specifically, this report addresses how the TIM program is being implemented to leverage and enhance existing DHS screening and credentialing capabilities in accordance with DHS policy and acquisition directive and guidance. To address this objective, we reviewed pertinent DHS policies and guidance, such as DHS's acquisition management directive, capital planning and investment control guidance, and credentialing framework. [Footnote 9] We also reviewed TIM program documentation, such as the TIM mission needs statement (March 2009), TIM analysis of alternatives (March 2011), related life cycle cost estimates (March 2011 and August 2011),[Footnote 10] and whitepaper on DHS partnering opportunities (August 2011).[Footnote 11] To further inform our understanding of DHS's TIM program oversight, we reviewed DHS Acquisition Review Board decision memoranda and associated DHS governance tools such as the DHS screening portfolio and related enterprise architecture[Footnote 12] efforts at the DHS Office of the Chief Information Officer. We also interviewed TIM program officials at TSA and officials in DHS's Acquisition Program Management Division,[Footnote 13] Screening Coordination Office, and Office of the Chief Information Officer. In assessing the TIM program approach, we reviewed the information obtained through these endeavors to assess the extent to which options for leveraging, streamlining, and coordinating DHS screening and credentialing services and capabilities were identified and considered, as well as controls were designed to ensure DHS resources are effectively utilized to enhance DHS screening and credentialing capabilities. We conducted this performance audit from April 2011 to December 2011 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Results In Brief: While TSA initially focused on fixing gaps in TSA-managed screening and credentialing operations, it has since modified its TIM strategy to better leverage and enhance departmentwide capabilities, in accordance with DHS's credentialing framework and acquisition directive and guidance. For example, DHS required the TIM program to identify additional opportunities for leveraging DHS capabilities--or enterprise services--and identify cost efficiencies. TSA initially did not select a course of action that would leverage DHS capabilities beyond what TSA already had in place under its existing programs, such as using or establishing a consolidated enrollment service that could be used by TIM and other DHS components. During the course of our review, however, TSA began to identify capabilities that might be leveraged across DHS. For example, in accordance with DHS direction, in August 2011, the TIM program identified several opportunities for leveraging existing DHS background checking and vetting services. [Footnote 14] For instance, TSA is now working with DHS's Office of the Chief Information Officer and Screening Coordination Office to establish a common vetting service, which could reduce duplication among other DHS services. Eliminating redundant activities across multiple screening and credentialing programs could help support the goals of DHS's credentialing framework initiative. However, as of the date of this report, the programs that are to use this vetting service have not yet been determined. It is therefore too early to tell the extent to which, once implemented, these initiatives would enhance screening and credentialing capabilities across DHS. In commenting on a draft of this report, DHS did not state whether it concurred with the contents but noted that the TIM effort will capitalize on opportunities to leverage and, where possible, consolidate existing DHS capabilities. DHS also provided technical comments, which we have incorporated where appropriate. Background: Screening Coordination Office and the Credentialing Framework: Housed within DHS's Policy Directorate, the Screening Coordination Office was established in July 2006 in response to Homeland Security Presidential Directive 11 (HSPD-11), which announced a new U.S. policy to implement a coordinated and comprehensive approach to terrorist- related screening.[Footnote 15] As we reported in April 2007, one of the office's goals includes identifying opportunities to harmonize and enhance screening and credentialing processes across DHS's screening programs.[Footnote 16] In December 2006, the Screening Coordination Office issued a report identifying common problems, challenges, and needed improvements in the credentialing programs and processes across DHS. For example, the office identified that there was inefficient information and data collection and inconsistent vetting processes for similar programs. Among others, that report recommended that: (1) DHS establish a preference for "enroll once, use many" environments to promote sharing and reuse of information within DHS, so that component agencies do not have to build interfaces to the same systems to get to the information they need; (2) DHS design credentials that support multiple licenses, privileges, or status, based on the risks associated with the environments in which they are used; and (3) vetting be associated with like uses and like risks. In July 2008, and in response to that report, DHS established a credentialing framework initiative with the stated goal, among others, of improving credentialing processes across DHS by eliminating redundant activities, leveraging investments across programs, and reducing the costs of implementing new capabilities. The framework identifies the following six credentialing phases, or capabilities: (1) registration and enrollment; (2) eligibility vetting and risk assessment; (3) issuance; (4) verification and use; (5) expiration and revocation; and (6) redress/waiver. It also included trend analytics as another important activity that is to occur across the credentialing capabilities. Trend analytics is the ability to identify unusual activities across a credentialing program by looking at the entire credentialing process rather than just one part. Overview of DHS Acquisition Review Process: DHS's Acquisition Review Board is to review and approve acquisition programs at key stages in their life cycles before the acquisition program can move to the next phase.[Footnote 17] The DHS acquisition guidance has established four phases that constitute the acquisition life cycle: (1) "need" phase--identify a capability need (concludes with the DHS Acquisition Review Board granting the acquisition program approval to proceed at Acquisition Decision Event 1); (2) "analyze/select" phase--analyze and select the means to provide that capability (concludes with the Acquisition Review Board granting the acquisition program approval to proceed at Acquisition Decision Event 2A); (3) "obtain" phase--obtain the capability (the Acquisition Review Board may review the acquisition program multiple times, at Acquisition Decision Events 2B, 2C, before granting the acquisition program approval to proceed with particular acquisition activities; the phase concludes with the Acquisition Review Board granting the program approval to proceed at Acquisition Decision Event 3); and: (4) "produce/deploy/support" phase--produce, deploy, and support the capability (the Acquisition Review Board does not have a standard, defined role in this phase, but may also conduct additional reviews as necessary). Figure 1 presents the four DHS acquisition phases, including the documents presented for review as defined in DHS's acquisition directive. Figure 1: Overview of the DHS Acquisition Phases: [Refer to PDF for image: illustration] Need: Define the problem: Review mission need statement. ADE 1. Analyze/Select: Identify the alternatives and resource requirements: Review planning documents, including operational requirements document, acquisition program baseline, and acquisition plan. DHS approves selected acquisition approach. ADE 2A. Obtain: Develop and evaluate capabilities: DHS approves supporting acquisitions including small scale production. ADE 2B. DHS approves the acquisition to go into production. ADE 3. Produce/Deploy/Support: Produce & maintain those capabilities. Legend: ADE - Acquisition Decision Event. Sources: GAO analysis of DHS Acquisition Management Directive 102-01; and An Explosion (clipart). [End of figure] As required by DHS's acquisition directive and guidance, during the "need" phase, key planning documents, such as the mission needs statement, are to be completed. The purpose of the mission needs statement is to identify the need to be addressed by the department or DHS component's acquisition. Further, during the "analyze and select" phase, key documents, such as the analysis of alternatives, operational requirements document, and acquisition program baseline, are to be completed. The purpose of the analysis of alternatives is to identify alternative solutions and analyze or compare the alternatives based on cost, risk, and capability. The operational requirements document is to select user requirements and identify key performance parameters for the acquisition. Lastly, the acquisition program baseline is to serve as an agreement between the program office and the acquisition review board regarding the capability that will be provided, the timeframe in which it will be provided, and how much it will cost. It is to be used to measure program performance, and summarizes critical cost, schedule, and performance parameters that must be met to accomplish the goals of the investment. The acquisition program baseline must trace directly back to the mission gap expressed in the mission needs statement and the requirements detailed in the operational requirements document. TIM Acquisition History: Table 1 summarizes key TIM program events through September 2011. Table 1: Key TIM Program Events over Time: Date: December 2008; Key TIM program events: TTAC initiated the development of the TIM program. Date: June 11, 2009; Key TIM program events: TSA presented before the Acquisition Review Board on the status of the prototype. The program had an anticipated prototype deployment date of October 2009. The prototype was anticipated to be completed in fiscal year 2010. Date: February 18, 2010; Key TIM program events: The Acquisition Review Board approved the TIM program's transition from the "need" phase of the acquisition lifecycle to the "analyze/select" phase after approving the mission needs statement and determining there was a need for the program. The TIM program proceeded to conduct an analysis of alternatives; Subsequent to the Acquisition Review Board review, TSA terminated the TIM prototype after it proved unsuccessful due to unclear requirements definition. TSA proceeded with a new acquisition approach for TIM, which included pursuing full and open competition for a full scale development contract. TSA stated that this change in acquisition strategy resulted in a delay of over 6 to 8 months. TSA moved the anticipated date for awarding a full-scale development contract to fiscal year 2011. Date: March 11, 2011; Key TIM program events: TIM analysis of alternatives was completed. TSA subsequently endorsed the selection of the recommended alternative and forwarded it to DHS for concurrence. Date: May 6, 2011; Key TIM program events: TSA went before the Acquisition Review Board to obtain approval for the TIM program to issue a request for proposals. The program did not receive approval at that point to transition from the "analyze/select" phase of the acquisition lifecycle to the "obtain" phase. DHS directed the program to complete several actions in preparation for approval to move to the "obtain" phase. TSA moved the anticipated TIM contract award date to September or October 2011. Date: May 12, 2011; Key TIM program events: DHS granted TSA permission to release the request for proposals after incorporation of some specific changes. Date: May 23, 2011; Key TIM program events: TSA issued a request for proposals for the TIM program acquisition. The request for proposals closed on August 8, 2011. Date: September 15, 2011; Key TIM program events: The Acquisition Review Board provided verbal approval for the program to proceed to the "obtain" phase of the acquisition lifecycle, giving TSA permission to move forward with awarding a contract for acquiring TIM, pending approval from the DHS Under Secretary for Management. The board also forwarded key documents such as the operational requirements document and the acquisition program baseline to DHS approving authorities for signature and approval. Source: GAO summary of TIM program events based on TTAC and DHS information. [End of table] TIM Program Is Taking Steps to Leverage and Enhance DHS Capabilities Consistent with DHS Policy, but Efforts Are Too Early to Assess: As TSA has progressed toward implementing the TIM program, it has modified its strategy to leverage and enhance existing DHS capabilities, consistent with the DHS credentialing framework initiative and acquisition directive and guidance. The credentialing framework initiative seeks to coordinate and harmonize the numerous and disparate credentialing initiatives within DHS by identifying potential areas for elimination of duplicative efforts, services with a high likelihood of reuse, and an approach to target the development of high-priority services. In accordance with DHS's acquisition guidance, the TIM program went before the DHS Acquisition Review Board in February 2010 at the end of its "needs" phase to gain approval to enter the "analyze/select" phase. TSA presented the TIM program mission needs statement, which focused on fixing gaps in TSA's screening and credentialing programs, to the Acquisition Review Board. The Acquisition Review Board granted the program approval to proceed to the "analyze/select" phase. The mission needs statement acknowledged DHS's broader departmentwide credentialing requirements, such as promoting the reuse of enterprise services and standardization across DHS screening and credentialing programs, and had a stated goal of maximizing the use of the DHS and federal infrastructure to the maximum extent possible. Further, in granting the approval to proceed to the next phase, the Acquisition Review Board and TSA agreed that the analysis of alternatives for the TIM program would look outside of TSA's credentialing programs to other DHS modernization programs, include costs and benefits analyses, and assess any potential cost savings. The board and TSA also agreed that the TIM program would continue to work with DHS's Screening Coordination Office to develop business processes for vetting screening services at an enterprise level and define how the TIM program fits into the overall screening capability for DHS. TSA initially did not select a course of action that would leverage DHS capabilities beyond what TSA already had in place under its existing programs. Although TSA was directed to consider non-TSA alternatives, and DHS's credentialing framework calls for the implementation of coordinated approaches to screening-related activities, the TIM program's March 2011 analysis of alternatives did not lead to a solution that leveraged or established DHS capabilities-- or enterprise services--beyond what TSA already had in place under its existing programs.As reported in the TIM's analysis of alternatives, the recommended alternative that TSA chose as the most effective involved using TSA's existing capabilities for eligibility vetting and risk assessment, and purchasing commercial off-the-shelf software to provide the framework for some of the other capabilities for TIM. [Footnote 18] In an effort to meet the Acquisition Review Board's direction at Acquisition Decision Event 1--for TSA to look across other DHS modernization efforts at Customs and Border Protection, U.S. Citizenship and Immigration Services, and US-VISIT for possible reuse of enterprise services--the analysis of alternatives considered two alternatives that looked at leveraging one DHS program at Customs and Border Protection for implementing TIM.[Footnote 19] However, TSA's analysis did not present an approach that would use or consolidate a mix of DHS enterprise services from across different DHS component's programs to meet TIM program and future DHS needs, such as enrollment enterprise services from one DHS component and redress and waiver enterprise services from another component. Further, the analysis gave less weight to improving credentialing processes across DHS, thereby giving less importance to eliminating redundant activities across DHS and maximizing the reuse of existing DHS investments. According to the TIM Program Manager, when the analysis was conducted, DHS did not have the technology infrastructure and architecture necessary to facilitate such an approach, which would have required a significant rework of existing systems and processes. The TIM Program Manager further noted that the exercise of completing the analysis of alternatives and ensuing reviews highlighted existing challenges for leveraging capabilities across DHS and illustrated the need for DHS and its components to work together to mature DHS's capabilities. During the course of our review, TSA began to identify capabilities that might be leveraged across DHS. After TSA conducted the March 2011 analysis of alternatives and selected its approach for implementing the program, DHS required the TIM program to identify additional opportunities for leveraging DHS enterprise services and identifying cost efficiencies. For example, according to TIM program officials, DHS directed TSA to consider using a new DHS initiative known as DHS virtual cloud services.[Footnote 20]TSA subsequently incorporated virtual cloud services into the acquisition plans for the TIM program, allowing the program to leverage a pool of DHS information technology resources instead of having to purchase and invest in separate information technology systems, according to TIM program officials. A comparison of TSA's life cycle cost estimate for using DHS cloud technology versus purchasing technology systems shows an estimated reduction of approximately $137 million, or 20 percent, from $699 million to $562 million.[Footnote 21] Further, on May 6, 2011, the TIM program went before the DHS Acquisition Review Board for approval to issue a request for proposal and Acquisition Decision Event 2A, approval to progress to the "obtain" acquisition phase. Approval for Acquisition Decision Event 2A was withheld pending the completion of specified action items. For example, the Acquisition Review Board required TSA to complete a strategy for leveraging other services and related systems architectures in DHS instead of developing new technologies or capabilities, and, among other things, to identify possible services that the TIM program may provide to the department before it would approve the program. The board further required that a department- level executive steering committee with responsibility for governing the TIM program be established. To address the Acquisition Review Board's requirements, in August 2011 TSA issued a document titled DHS Services Reuse for TTAC Infrastructure Modernization, which identified several opportunities for partnering and reuse of existing DHS background checking and vetting services. The document did not identify opportunities to leverage non-background checking and vetting enterprise services--such as enrollment, credential issuance, and revocation--from other DHS screening and credentialing programs. However, the document identified that the TIM program's universal vetting and adjudication and redress service, especially its terrorist vetting component, has the potential for DHS-wide reuse as an enterprise service, or capability. TSA noted that it would continue to explore options to leverage existing credentialing services. Eliminating redundant activities across multiple screening and credentialing programs could help support the goals of DHS's credentialing framework initiative. According to DHS and TIM program officials, as of September 2011, the results of the DHS Services Reuse for TTAC Infrastructure Modernization have been used to inform the TIM program's implementation strategy and fit into DHS's screening and credentialing strategy. Specifically, TSA is working with the DHS Office of the Chief Information Officer and Screening Coordination Office to establish a common vetting enterprise service for use by TIM and other DHS programs, such as the U.S. Coast Guard and the Office of Infrastructure Protection housed in the National Program and Protection Directorate. However, according to Screening Coordination Office and TIM program officials, as of September 2011 the programs that are to use this vetting enterprise service have not yet been officially determined. Officials further stated that this capability is to replace stand-alone vetting services that are provided by various independent components, and DHS has not yet determined which component will be responsible for leading this effort, according to the officials. A Screening Governance Board is currently being established to look across DHS screening and credentialing programs to determine where existing capabilities can be leveraged so that efficiencies can be found. According to an official from the Screening Coordination Office, part of the board's role would be to help determine which programs could use the vetting enterprise service being developed as part of the TIM program, as well as which component would be responsible for leading the effort. However, the board does not have a charter and had not met as of the date of this report. According to an official from the Screening Coordination Office, the charter has been drafted and is expected to be finalized by the end of December, with the first official board meeting to take place by the beginning of calendar year 2012. DHS and TIM program officials believe that these efforts will produce increased efficiencies across DHS and reduce duplication and cost, but it is too soon to assess the results of these efforts. Concluding Observations: Given DHS's current budgetary environment, it is critical that new investments in screening and credentialing services capitalize on opportunities to leverage and, where possible, consolidate existing DHS capabilities. TSA has made progress in its recent efforts to work with DHS to establish a common vetting enterprise service across DHS in accordance with DHS's credentialing framework initiative, DHS acquisition guidance, and direction from the Acquisition Review Board. This effort could reduce the potential for duplication and enhance the effectiveness and efficiency of screening and credentialing initiatives across DHS. However, a number of uncertainties remain, including what programs will use the vetting enterprise service, who will lead it, and what capability will actually be obtained. It is therefore too early to tell whether, or to what extent, this service will be effective in leveraging and enhancing vetting capabilities across DHS and for the TIM program. As TSA moves forward in helping to implement the enterprise vetting service, it will be important for TSA to continue to partner with other DHS components to find any additional opportunities available for reuse by DHS and the TIM program. By exploring solutions that could eliminate duplication and increase efficiencies, TSA could help DHS achieve cost effective solutions to securing the nation. Agency Comments: We obtained written comments from DHS, which are reprinted in enclosure I. In its comments, DHS did not state whether it concurred with the contents of the draft report but noted that the TIM effort will capitalize on opportunities to leverage and, where possible, consolidate existing DHS capabilities. DHS also provided technical comments, which we have incorporated where appropriate. We are sending copies of this report to the Secretary of Homeland Security, appropriate congressional committees, and other interested parties. This report also is available at no charge on the GAO website at [hyperlink, http://www.gao.gov]. If you or your staff have any questions about this report, please contact me at (202) 512-4379 or lords@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in enclosure II. Sincerely yours, Signed by: Stephen M. Lord: Director, Homeland Security and Justice Issues: Enclosures - 2: [End of section] Enclosure I: Comments from the Department of Homeland Security: U.S. Department of Homeland Security: Washington, DC 20528: December 2, 2011: Mr. Stephen M. Lord: Director, Homeland Security and Justice Issues: U.S. Government Accountability Office: 441 G Street, NW: Washington, DC 20548: Re: Draft Report GAO-12-192R, "Transportation Security Infrastructure Modernization May Enhance DHS Screening Capabilities, but It Is Too Early to Assess Results" Dear Mr. Lord: Thank you for the opportunity to review and comment on this draft report. The U.S. Department of Homeland Security (DHS) appreciates the U.S. Government Accountability Office's (GAO's) work in planning and conducting its review and issuing this report. The Department is pleased to note GAO's positive recognition of the progress the Transportation Security Administration (TSA) has made in its recent efforts to establish a common vetting enterprise service across DHS. We also noted the report does not contain any recommendations. Please know the Department remains committed to continuing its work to enhance screening and credentialing capabilities. The following paragraphs provide additional insight along these lines. TSA employs an intelligence-driven risk-based approach to prevent terrorist attacks and to reduce the vulnerability of the Nation's transportation system to terrorism. TSA works collaboratively with industry partners to develop and implement programs that promote commerce, while enhancing security and mitigating risks to our Nation's transportation system. TSA conducts security threat assessments to determine whether an applicant seeking access to critical components of the Nation's transportation system poses or is suspected of posing a threat to transportation or national security. Perpetually vetting over 14 million records per day, TSA's vetting responsibilities have grown significantly in recent years and TSA responded by developing and implementing efficient, reliable, and cost-effective screening programs to identify any terrorist threats. The Transportation Threat Assessment and Credentialing Infrastructure Modernization (TIM) program will deliver unified and scalable enterprise architecture to improve vetting and credentialing services to current and future populations. The program will reduce the cost, risk, and time associated with implementing new business capabilities and on-boarding new populations, while improving the robust nature of the architecture, as well as on-going operations and maintenance services. Implementing TIM will help TSA support emerging vetting and credentialing population requirements with the following new mission capabilities: * Business to Government Partner Portal Services — directly processes enrollment requests and shares status information with airport badging offices via a Web portal. * 3rd Party/External System Interface Management Services — allows system-to-system interfacing with the United States Visitor and Immigrant Status Indicator Automated Biometric Identification System for processing airport biometrics (fingerprints). * Integrated Customer Relationship Management Services — enables improved security threat assessment workflow and more responsive customer service. * Enterprise Service Management — supports the transformation of the new and legacy system components into reusable services. * Enterprise Performance Reporting Management Service — provides monitoring and performance management capability to support end-to-end applicant processing. The TIM program aligns with TSA's strategy for innovative use of analytical technologies and techniques that identify and manage information regarding potential threats to persons, cargo, and commerce in the transportation arena. TIM is the first program to take part in the new DHS initiative known as DHS virtual cloud services. This modernization effort will capitalize on opportunities to leverage and, where possible, consolidate existing DHS capabilities. In addition, TIM has made progress while working with DHS to establish a common vetting enterprise service across DHS, in accordance with DHS's credentialing framework initiative. Again, thank you for the opportunity to review and comment on this draft report. General and technical comments were provided under separate cover. We look forward to working with you on future Homeland Security issues. Sincerely, Signed by: Jim H. Crumpacker: Director: Departmental GAO-OIG Liaison Office: [End of section] Enclosure II: GAO Contact and Staff Acknowledgments: GAO Contact: Stephen M. Lord, (202) 512-4379 or at lords@gao.gov. Staff Acknowledgments: In addition to the contact named above, Jessica Lucas-Judy, Assistant Director; David Alexander; Charles Bausell; Joseph P. Cruz; Chris Currie; Susan Czachor; Pawnee A. Davis; Geoffrey Hamilton; Richard Hung; Sairah Ijaz; Linda Miller; Sabine Paul; Nathan Tranquilli; and Rebecca Wilson made key contributions to this report. [End of section] Footnotes: [1] See GAO, Transportation Worker Identification Credential: Internal Control Weaknesses Need to Be Corrected to Help Achieve Security Objectives, [hyperlink, http://www.gao.gov/products/GAO-11-657] (Washington, D.C.: May 10, 2011). [2] According to TSA, the agency is making several enhancements to better align headquarters functions to enable its continued evolution to a high performance counterterrorism organization. This includes merging various TTAC functions with the Office of Intelligence to ensure vetting and intelligence informs daily operations. The TTAC Infrastructure Modernization program is to be housed under the TSA Office of Intelligence and Analysis while retaining the same program goals and objectives. [3] The security threat assessment includes a TSA review of applicant information and searches of domestic and international government databases to determine if the applicant meets specified eligibility requirements relating to, for example, immigration status and criminal history, as well as having known ties to terrorism. Screening and credentialing programs, as used in this report, is the entire process of determining a person's eligibility for a particular license, privilege, or status, from application for the privilege or credential through issuance, use, and expiration or potential revocation of the privilege or credential. According to TSA officials, TTAC also has the responsibility to provide security threat assessments for critical infrastructure workers, such as chemical plant workers. [4] For the purposes of this report, services refer to individual business services that one or more DHS components may have access to and use to support broader business capabilities, or DHS enterprise services. For example, criminal history checking is a service provided by the Federal Bureau of Investigation that may be used as part of vetting an individual. Multiple business services could be grouped together to provide a vetting capability, or enterprise business service for use by others across DHS. [5] Among others, the TIM program seeks to consolidate processes and systems for the following TTAC programs and populations: Hazardous Material Endorsement Threat Assessment Program (HTAP); Transportation Worker Identification Credential Program (TWIC); Alien Flight Student Program (AFSP); International Crew Vetting Program (CVP); and Aviation Programs, including the Indirect Air Carrier (IAC) Population, Aviation Workers (AW) Program, and the General Aviation (GA) Population. [6] See GAO, Transportation Security: DHS Efforts to Eliminate Redundant Background Check Investigations, [hyperlink, http://www.gao.gov/products/GAO-07-756] (Washington, D.C.: Apr. 26, 2007). [7] The DHS Acquisition Review Board was renamed the Investment Review Board as of October 1, 2011. [8] The DHS acquisition management process designates its acquisitions to be a level 1, 2, or 3 acquisition based on the acquisition's cost and risk parameters. Level 1 acquisitions are deemed to have the highest cost or risk parameters, and level 3 acquisitions are identified as having lower cost or risk parameters. The TIM program is designated a level 2 acquisition, with the DHS Under Secretary for Management designated as the program's acquisition decision authority. [9] DHS, Capital Planning and Investment Control Guide (Aug. 2010); DHS, Acquisition Management Directive 102-01 (Jan. 20, 2010); DHS, Acquisition Instruction/Guidebook 102-01-001 (Nov. 7, 2008); and DHS, Credentialing Framework Initiative (July 3, 2008). [10] Life cycle cost estimate figures reported in this product were provided by TSA. We asked TSA to explain the steps taken to construct, verify and validate the life cycle cost estimate data. TSA stated that commercial-off-the-shelf pricing information and DHS data center catalogs were used to identify cost data. To help ensure that all relevant costs and inputs were considered, TSA said a standardized work breakdown structure was constructed and tailored to the TIM program. It was then compared to similar systems to identify whether a critical piece could have been omitted. Cost data were input into a spreadsheet where initial calculations were made. Next, an automated cost estimating integrated tool was used to verify the data. Finally, TSA said all calculations were verified by hand. TSA included sunk costs in the life cycle cost estimates, and divided these costs into two categories--expended and not expended. In the March estimate, the obligated expended sunk costs were included, but the obligated unexpended sunk costs were not. However, in the August 2011 estimate, both obligated sunk cost categories were included. It is unclear what effect not including unexpended sunk costs in both estimates has on the reported cost savings. To identify the appropriate probability distributions for purposes of conducting Monte Carlo simulations, TSA said a variety of methods were used to arrive at probability distributions, such as using salary ranges, technical ranges, and permitting the automated cost estimating integrated tool to specify some boundaries based on subjective boundaries. While we did not assess the cost estimates against GAO's best practices criteria, based on the steps described by TSA, we determined the life cycle cost estimate to be sufficiently reliable to illustrate TSA's effort to estimate costs for TIM program technology acquisition alternatives. [11] TSA, DHS Services Reuse for TTAC Infrastructure Modernization (August 2011). [12] An enterprise architecture is a corporate blueprint that serves as an authoritative frame of reference for information technology investment decision making. According to DHS guidance, DHS's enterprise architecture is a management practice for aligning programs and projects to improve business performance and help agencies better execute their core missions. Enterprise architecture describes the current and future state of the agency, and lays out a plan for transitioning from the current state to the desired future state. [13] DHS's Acquisition Program Management Division became part of the Program Accountability and Risk Management Office as of October 1, 2011. [14] Background checking and vetting services refers primarily to the resolution of derogatory information--such as terrorism information, criminal history, or immigration violations--to evaluate whether the person applying for a DHS license, privilege, or status is known to have been, or is appropriately suspected of being, involved in a disqualifying activity. [15] See Homeland Security Presidential Directive 11: Comprehensive Terrorist-Related Screening Procedures (Aug. 27, 2004). HSPD-11 defines terrorist-related screening as the collection, analysis, dissemination, and use of information related to people, cargo, conveyances, and other entities and objects that pose a threat to homeland security. It also includes risk assessment, inspection, and credentialing. [16] See [hyperlink, http://www.gao.gov/products/GAO-07-756]. [17] DHS Acquisition Directive 102-01 established the Acquisition Review Board as a cross component group within the department that determines whether a proposed acquisition has met the requirements of key phases in the acquisition life-cycle framework and is able to proceed to the next phase and eventual full production and deployment. The board is comprised of the Acquisition Decision Authority (chair), the Under Secretary for Management, the Under Secretary for Science and Technology, the Assistant Secretary for Policy, the General Counsel, the Chief Financial Officer, the Chief Procurement Officer, the Chief Information Officer, the Chief Human Capital Officer, the Chief Administrative Officer, the Chief Security Officer, user representatives from components sponsoring the capability, and other officials within the department determined to be appropriate to the subject matter by the Acquisition Decision Authority. [18] Capabilities that commercial-off-the-shelf software would provide include enrollment, expiration, revocation, redress, and waiver. [19] Of the eight alternatives considered, two looked at leveraging U.S. Customs and Border Protection's Global Enrollment System capabilities. One alternative proposed to maximize reusing existing DHS capabilities by having U.S. Customs and Border Protection provide all screening and credentialing capabilities for TSA. However, TSA did not consider the alternative viable because, among other things, the analysis determined that TSA and U.S. Customs and Border Protection have very different missions. Another alternative, which TSA considered to be viable, also focused on having U.S. Customs and Border Protection provide TSA's registration, enrollment, and issuance services, and TSA continuing to provide the background checking/eligibility vetting and risk assessment service. However, TSA did not rank this alternative as effective for the recommended alternative. [20] DHS is implementing a private cloud capability within its two enterprise data centers to enhance sharing sensitive information across the Department. According to the DHS Chief Information Officer in an October 6, 2011 hearing on cloud computing, cloud services enable convenient, on-demand network access to a shared pool of computing resources to multiple users from a centralized source. Cloud Computing: What are the Security Implications, Hearing Before the Committee on Homeland Security, Subcommittee on Cybersecurity, Infrastructure Protection, and Security Technologies, 112th Cong. (2011) (statement by Richard Spires, Chief Information Officer, U.S. Department of Homeland Security). [21] The stated life cycle cost estimate figures are presented as reported by TIM program officials. As reported by TSA, these costs represent estimates at the 80 percent confidence levels and are reported in fiscal year 2011 dollars. Further, the life cycle costs were calculated for a 17-year period from Fiscal Year 2009 to 2025. We asked TSA officials to explain the steps taken to construct, verify, and validate the life cycle cost estimate data. While we did not assess the cost estimates against GAO's best practices criteria, based on the steps described by TSA, we determined the life cycle cost estimate to be sufficiently reliable to illustrate TSA's effort to estimate costs for TIM program technology acquisition alternatives. [End of section] GAO’s Mission: The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. Obtaining Copies of GAO Reports and Testimony: The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s website [hyperlink, http://www.gao.gov]. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. To have GAO e mail you a list of newly posted products, go to [hyperlink, http://www.gao.gov] and select “E- mail Updates.” Order by Phone: The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, [hyperlink, http://www.gao.gov/ordering.htm]. Place orders by calling (202) 512-6000, toll free (866) 801-7077, or TDD (202) 512-2537. Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information. Connect with GAO: Connect with GAO on facebook, flickr, twitter, and YouTube. Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts. Visit GAO on the web at [hyperlink, http://www.gao.gov]. To Report Fraud, Waste, and Abuse in Federal Programs: Contact: Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; E-mail: fraudnet@gao.gov; Automated answering system: (800) 424-5454 or (202) 512-7470. Congressional Relations: Ralph Dawn, Managing Director, dawnr@gao.gov, (202) 512-4400 U.S. Government Accountability Office, 441 G Street NW, Room 7125 Washington, DC 20548. Public Affairs: Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800 U.S. Government Accountability Office, 441 G Street NW, Room 7149 Washington, DC 20548.