Information Technology: Federal Agencies and OMB Need to Continue to Improve Management and Cybersecurity
Fast Facts
The federal government has spent billions on information technology projects that have failed or performed poorly. Some agencies have had massive cybersecurity failures. These IT efforts often suffered from ineffective management.
We testified about 2 issues on our High Risk List: 1) IT acquisitions and operations management and 2) cybersecurity.
Since 2010, agencies have implemented
64% of our 1,376 recommendations on IT acquisitions and operations
79% of our 3,409 recommendations on cybersecurity
Much remains to be done. For example, most agencies have not assigned key IT responsibilities to the chief information officer, as required.
Highlights
What GAO Found
Federal agencies and the Office of Management and Budget (OMB) have taken steps to improve the management of information technology (IT) acquisitions and operations and ensure the nation's cybersecurity through a series of initiatives. As of July 2020, federal agencies had fully implemented 64 percent of the 1,376 IT management-related recommendations that GAO has made to them since fiscal year 2010. Likewise, agencies had implemented 79 percent of the 3,409 security-related recommendations that GAO has made since fiscal year 2010. However, significant actions remain to be completed to build on this progress.
Chief Information Officer (CIO) responsibilities. Laws such as the Federal Information Technology Acquisition Reform Act (FITARA) and related guidance assign 35 key responsibilities to agency CIOs to help address longstanding IT management challenges. In August 2018, GAO reported that none of the 24 selected agencies had established policies that fully addressed the role of their CIO. GAO recommended that OMB and the 24 agencies take actions to improve the effectiveness of CIOs' implementation of their responsibilities. Although most agencies agreed or did not comment, only four of the 27 recommendations have been implemented.
CIO IT acquisition review. According to FITARA, covered agencies' CIOs are required to review and approve IT contracts. Nevertheless, in January 2018, GAO reported that most of the CIOs at 22 covered agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. Since then, agencies implemented 29 out of 39 recommendations made to improve CIO oversight for these acquisitions. Implementing the remaining 10 could increase CIOs' authority and improve the management of IT contracts.
Consolidating data centers. OMB launched an initiative in 2010 to reduce data centers. According to the 24 covered agencies, this initiative has resulted in approximately $4.7 billion in cost savings from fiscal years 2012 through 2019. Even so, additional work remains. As of July 2020, OMB and agencies implemented 133 of the 204 recommendations made to improve the reporting of related cost savings and to achieve optimization targets. Implementing the remaining recommendations could yield additional cost savings.
Managing software licenses. Effective management of software licenses can help avoid purchasing too many licenses that result in unused software. In May 2014, GAO reported that better management of licenses was needed to achieve savings and made 135 recommendations to improve such management. Agencies have implemented 123 of the 135 recommendations. Implementing the remaining 12 could reduce spending and duplication.
Ensuring the nation's cybersecurity. GAO continues to designate information security as a government-wide high-risk area due to increasing cyber-based threats and the persistent nature of security vulnerabilities. Since fiscal year 2010, GAO has made 3,409 recommendations to agencies aimed at addressing cybersecurity challenges. As of July 2020, 79 percent of the recommendations have been implemented. Until the remaining recommendations are addressed, agencies' information and IT systems will be increasingly susceptible to the existing multitude of cyber-related threats.
Why GAO Did This Study
Each year, the federal government invests over $90 billion in IT. Even so, IT investments have too often failed or contributed little to mission-related outcomes. Increasingly sophisticated threats and frequent cyber incidents also underscore the need for effective information security. To focus attention on these concerns, GAO has included both the management of IT acquisitions and operations and cybersecurity on its high-risk list.
For this statement, GAO summarized its key related reports and assessed agencies' progress in implementing the reports' recommendations. Specifically, GAO reviewed the implementation of recommendations on (1) CIO responsibilities, (2) IT acquisition review requirements, (3) data center consolidation, (4) the management of software licenses, and (5) cybersecurity.
Recommendations
Since fiscal year 2010, GAO has made 1,376 recommendations to OMB and agencies to address shortcomings in IT acquisitions and operations, as well as 3,409 recommendations to agencies to improve the security of federal systems. These recommendations addressed, among other things, implementation of CIO responsibilities, oversight of the data center consolidation initiative, management of software licenses, and the efficacy of security programs. Implementing these recommendations is essential to strengthening federal agencies' IT acquisitions, operations, and cybersecurity efforts.