Data Center Optimization: Agencies Report Progress, but Oversight and Cybersecurity Risks Need to Be Addressed
Fast Facts
The Office of Management and Budget has been working with federal agencies to reduce the number of outdated or duplicative federal data centers. In fiscal year 2019, agencies closed 102 centers, and planned to close 184 more.
OMB also narrowed the definition of a data center, recategorizing about 2,000 facilities and excluding them from federal reporting requirements. But many of these facilities—access points into federal IT systems—will continue operating. Each one is a potential target for cyberattacks.
We recommended that OMB require agencies to continue to report on these facilities to ensure effective cybersecurity oversight.
Data Centers Closed, Planned for Closure, and Remaining for Fiscal Year 2019, as of August 2019
Bar chart
Highlights
What GAO Found
The 24 agencies participating in the Office of Management and Budget's (OMB) Data Center Optimization Initiative (DCOI) reported progress toward achieving OMB's fiscal year 2019 goals for closing unneeded data centers. As of August 2019, 23 of the 24 reported that they had met, or planned to meet, their fiscal year closure goals, and would close 286 facilities in doing so (see figure). Agencies also reported plans to close at least 37 of the remaining data centers.
Agency-reported Data Centers Closed, Planned for Closure, and Remaining, as of August 31, 2019
OMB issued revised guidance in June 2019 that narrowed the scope of the type of facilities that would be defined as a data center. This revision eliminated the reporting of over 2,000 facilities government-wide. OMB had previously cited cybersecurity risks for these types of facilities. Without a requirement to report on these, important visibility is diminished, including oversight of security risks.
The 24 DCOI agencies have reported a total of $4.7 billion in cost savings from fiscal years 2012 through 2019. Of the 24 agencies, 23 reported in August 2019 they had met, or planned to meet, OMB's fiscal year 2019 savings goal of $241.5 million. One agency did not complete a plan, but planned to do so in the future. Agencies also reported plans to save about $264 million in fiscal year 2020.
The 24 agencies reported progress against OMB's three revised data center optimization metrics for virtualization, advanced energy monitoring, and server utilization. For a new fourth metric (availability), the data were not sufficiently reliable to report on because of unexpected variances in the information reported by the agencies. As of August 2019, eight agencies reported that they met all three targets for the metrics GAO reviewed, five met two targets, and six met one target. In addition, one agency had not established any targets, and four agencies reported that they no longer owned any data centers.
While the three revised metrics' definitions included the key characteristics of being clearly defined and objective, none included statistical universe parameters that enable determinations of progress. Specifically, these metrics call for counts of the actual numbers of (1) virtualized servers, (2) data centers with advanced energy metering, and (3) underutilized servers; but the metrics did not include a count of the universe of all servers and all data centers. Accordingly, percentages cannot be calculated to determine progress–for example, the number of virtualized servers may increase, but if the universe of servers increases at a higher rate, then progress would actually be negative.
Why GAO Did This Study
In December 2014, Congress enacted federal IT acquisition reform legislation that included provisions related to ongoing federal data center consolidation efforts. OMB's Federal Chief Information Officer launched DCOI to build on prior data center consolidation efforts; improve federal data centers' performance; and establish goals for inventory closures, cost savings and avoidances, and optimization performance.
The 2014 legislation included a provision for GAO to annually review agencies' data center inventories and strategies. This report addresses (1) agencies' progress and plans for data center closures and savings; and (2) agencies' progress against OMB's June 2019 revised data center optimization metrics. To do so, GAO assessed the 24 DCOI agencies' data center inventories as of August 2019, reviewed their reported cost savings documentation, evaluated their data center optimization strategic plans, and assessed their progress against OMB's established optimization targets. GAO also compared OMB's revised metrics to key characteristics of an effective performance measure.
Recommendations
To improve DCOI reporting and performance, GAO is making four recommendations to OMB, and four to three selected agencies. The three agencies agreed with the recommendations while OMB did not state whether it agreed or disagreed. GAO continues to maintain that the four recommendations to OMB are warranted.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Office of Management and Budget | The Director of the Office of Management and Budget should (1) require that agencies explicitly document annual data center closure goals in their DCOI strategic plans and (2) track those goals on the IT Dashboard. (Recommendation 1) |
The Office of Management and Budget (OMB) did not agree or disagree with the recommendation. OMB never implemented the recommendation and in 2022 the recommendation became invalid. The need for OMB to oversee agencies' data center closure goals on the IT dashboard was part of the Data Center Optimization Initiative (DCOI). The statutory authorization in the Federal Information Technology Acquisition Reform Act that required OMB and the 24 CFO Act agencies to complete DCOI ended on October 1, 2022. As a result, GAO will no longer monitor the implementation of this recommendation.
|
| Office of Management and Budget | The Director of the Office of Management and Budget should require agencies to report in their quarterly inventory submissions those facilities previously reported as data centers, even if those facilities are not subject to the closure and optimization requirements of DCOI. (Recommendation 2) |
The statutory authorization in FITARA for the Data Center Optimization Initiative (DCOI) expired on October 1, 2022. As a result, OMB no longer plans to update the DCOI guidance. GAO will no longer monitor the implementation of this recommendation.
|
| Office of Management and Budget | The Director of the Office of Management and Budget should document OMB's decisions on whether to approve individual data centers when designated by agencies as either a mission critical facility or as a facility not subject to DCOI. (Recommendation 3) |
The Office of Management and Budget (OMB) took action to address this recommendation. As of June 2021, OMB's data center inventory has a column to document when a facility was marked as a mission critical facility. The inventory also has a column to document OMB decisions to approve a data center's exemption from DCOI requirements. Subsequently, an official in OMB's Office of the Federal CIO confirmed that those columns serve to document OMB's approval of those agency decisions. By implementing this recommendation, OMB helps ensure that the appropriate agency data centers are subject to DCOI and contribute towards the initiative's goals.
|
| Office of Management and Budget | The Director of the Office of Management and Budget should take action to address the key performance measurement characteristics missing from the DCOI optimization metrics, as identified in this report. (Recommendation 4) |
The Office of Management and Budget (OMB) no longer needs to take action to address this recommendation. As of April 2023, the statutory authorization in FITARA for the Data Center Optimization Initiative (DCOI) has expired. Due to the expiration of Federal Data Center Consolidation Initiative statutory requirements, OMB no longer plans to update the DCOI guidance. GAO no longer intends to monitor the implementation of this recommendation.
|
| Department of Agriculture | The Secretary of Agriculture should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 5) |
In comments on our report, the Department of Agriculture (Agriculture) agreed with our recommendation and stated that it planned to meet the cost savings target in 2020. In May 2021, Agriculture reported $11.43 million in data center related cost savings, which exceeded its goal of $3 million in cost savings for fiscal year 2020. By meeting its data center savings goal, the department is better able to support the Office of Management and Budget's goals for the Data Center Optimization Initiative.
|
| Office of the Secretary for DOC | The Secretary of Commerce should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 6) |
In comments on our report, the Department of Commerce (Commerce) agreed with our recommendation and described actions that they planned to take in order to address the recommendation. In May 2021, Commerce reported $4 million in data center related cost savings, which exceeded its goal of $0 in cost savings for fiscal year 2020. By meeting its data center savings goal, the department is better able to support the Office of Management and Budget's goals for the Data Center Optimization Initiative.
|
| Office of the Secretary for DOC | The Secretary of Commerce should take action to meet its data center optimization metric targets established under DCOI by OMB. (Recommendation 7) |
In comments on GAO's report, the Department of Commerce agreed with GAO's March 2020 recommendation. Subsequently, Commerce has taken action to implement the recommendation. As of August 2021, Commerce reported that it had met all four fiscal year 2021 targets for OMB's data center optimization metrics. By meeting its data center optimization metrics, Commerce is better able to support OMB's goals for the Data Center Optimization Initiative.
|
| National Aeronautics and Space Administration | The Administrator of the National Aeronautics and Space Administration should take action to achieve its data center-related cost savings target established under DCOI by OMB. (Recommendation 8) |
In comments on our report, the National Aeronautics and Space Administration (NASA) agreed with our recommendation and described actions that the agency planned to take to address the recommendation. In May 2021, NASA reported $0.2 million in data center related cost savings, which met its goal for fiscal year 2020 cost savings. By meeting its data center savings goal, the agency is better able to support the Office of Management and Budget's goals for the Data Center Optimization Initiative.
|