DOD Business Systems Modernization: Planned Investment in Navy Program to Create Cashless Shipboard Environment Needs to Be Justified and Better Managed

The department has taken actions consistent with our recommendation. Regarding part 1 of the recommendation, the department limited the use of modernization funding to fielding and maintaining the currently developed and tested Navy Cash system. Further, it continued this approach when installing the system on the remaining ships. Regarding part 2, the Navy fielded software security patches automatically to ships on which Navy Cash is deployed and operating and monitored that they were successfully applied. Regarding part 3, Navy completed a revised economic analysis in November 2009, which concluded that further development and modernization is economically justified. This analysis was then used as a basis to help inform the Milestone Decision Authority's January 26, 2010 decision to proceed with further investment.

The department took actions consistent with our recommendation. Regarding parts 1 and 2 of the recommendation, in November 2009, the department revised the Navy Cash economic analysis, including examining the smart card technology used by the Air Force and Army, and considered an alternative in which it would adopt one of these other systems rather than Navy Cash. However, it reported that this alternative was not technically feasible because although there was some overlap with the capabilities of the systems used by the Air Force and Army, these systems did not meet all of the Navy's requirements. For example, one Navy requirement was that the system help reduce the workload of shipboard disbursement personnel. Navy Cash met this requirement by providing sailors with cards that allow sailors to reload value on their cards without assistance from disbursement personnel, and that allow sailors to access personal funds in banks or credit unions ashore. The analysis stated that the systems used by the Air Force and Army did not have these capabilities and, thus, did not meet Navy requirements. Regarding part 3 of the recommendation, the Navy Cash program shared the results of the economic analysis with the Milestone Decision Authority, who used the results in deciding to approve, in January 2010, further investment in the Navy Cash program.

The department has taken steps to address this recommendation. Specifically, in December 2009, the department revised its 2002 economic analysis for the Navy Cash program to address the cost-estimating best practices that we reported as missing, comply with relevant OMB guidance, and incorporate data on actual benefits. For example, the revised analysis now provides more current estimates of the program's cost and benefits, it considers the costs and benefits of three alternative solutions, and it includes data on actual benefits being achieved, such as reduced labor costs. Thus, the revised economic analysis should provide a more reliable basis for investment decision making.

The Navy provided evidence that it has implemented an automated patch management process as part of an update to the Navy Cash system. The system also allows the viewing of metrics related to patch deployment.

The Navy Cash Program Office has developed a Plan of Action and Milestones in accordance with OMB and NIST guidance to identify and track progress in planning, implementing, evaluating, and documenting remedial actions for information security vulnerabilities in the Navy Cash system.

The Navy, in coordination with its Treasury FMS partner, has acted to address this recommendation. Specifically, in July, 2012, Treasury FMS provided the Navy Cash program executive with a security assessment report that included an assessment of Navy Cash security controls, identified threats, identified individuals with access to sensitive information, and assessed vulnerabilities and efforts to remediate vulnerabilities. In addition, Treasury provided the program with a certification statement regarding the security of the Navy Cash system, as well as new policies that FMS established with its financial agent regarding personnel security measures, and additional physical security measures. Further, the Navy Cash program executive stated in July 2012 that the program would work with Treasury to update the memorandum agreement to reflect the security guidelines that are placed on the financial agent.

In August 2011, the Navy provided evidence that it had updated its contingency planning guide, tested its contingency plan, and documented the results.

In August 2011, the Navy provided evidence that it had updated its contingency planning guide, tested its contingency plan, and documented the results.

The Navy Cash program office developed a plan of action and milestones as part of the authority to operate that was granted to the Navy Cash system in December 2008. The plan of action and milestones documents security weaknesses, such as technical vulnerabilities, and the status and plans of action to mitigate these vulnerabilities based on the requirements in Department of Defense Instruction 8510.01.

The department concurred with the recommendation and, in response, took specific and appropriate actions: (1) In August 2011, the department revised requirements for its ongoing modernization of the Navy Cash system and developed detailed system requirements to guide the design and development of this effort. (2) In March 2009, it developed its policy for managing changes to requirements. The policy identifies what information must be included in change requests, how the requests are to be prioritized, and a standardized set of procedures for documenting, managing, controlling, and approving changes to requirements. Also, in July 2009, the charter for a change management approval group was approved, which defined specific responsibilities for the review of change requests and procedures for implementing approved requests. (3) To help maintain bi-directional traceability, in February 2009, the department revised quality assurance procedures to require that requirements be linked to test plans and to other related requirements to help ensure that no requirements are overlooked during testing and to identify how a change to a requirement might affect other related requirements.

The Navy has taken several actions that are consistent with our recommendation. First, the Navy Cash program office developed a risk management plan and a risk mitigation plan, which include a process for identifying, analyzing, and mitigating program risks. Second, the program office developed and periodically updates a risk inventory that includes, among other things, descriptions of program risks, and identifies the person responsible for managing each risk. Third, a risk management board was established to review each risk and the planned mitigation strategy, and to serve as a forum for affected stakeholders to state their risk-related concerns. Fourth, the program office tracks progress in mitigating the risks. Fifth, decision-making and oversight authorities (e.g. the milestone decision authority, as well as the Navy's Director of Disbursing, and the Treasury's manager of stored value programs) are apprised of risk status at bi-monthly Program Management Review meetings.

The department concurred with the recommendation, and in response, took appropriate actions. For example, to determine trends in unresolved change requests, it developed metrics on the number of new unresolved change requests, the number that were closed (resolved), and the associated cost for each of the past 4 fiscal years. These metrics are reported and monitored at monthly program management reviews. Regarding understanding user satisfaction with the system, the department conducted a survey in October 2010 of ships using the Navy Cash system. The program office analyzed the survey comments, identified areas for improvement, and, in December 2010, briefed department management on actions being undertaken to address those areas. For example, one area for improvement related to help desk responses that were sometimes slow or of poor quality. The program office stated that it would track help desk metrics to assure standards were met. Another area for improvement was the need to provide more "hands-on" training for shipboard disbursing and IT personnel to enable them to better troubleshoot and maintain the Navy Cash system. The program office stated that the training was being revised to include more hands-on training. As a result of these actions, the department has better information with which to monitor the quality of the Navy Cash system and more effectively manage the system.