Information Technology: Additional OMB and Agency Actions Are Needed to Achieve Portfolio Savings

OMB took action to address this recommendation. Specifically, OMB memorandum M-15-14 on implementing the Federal Information Technology Acquisition Reform Act (FITARA) defined chief information officer responsibilities for managing information technology in a "common baseline" and required agencies to complete a self-assessment identifying conformity with or gaps with this common baseline by August 15, 2015. From this self-assessment, agencies were also required to provide a draft FITARA implementation plan outlining the actions they plan to take to implement FITARA and address gaps in current processes. In November 2015, OMB told GAO that all Chief Financial Officer Act agencies had submitted their self-assessments and their draft FITARA Implementation Plans.

While OMB did not specifically require agencies to perform the recommended actions, the agency issued guidance aimed at improving the quality of reported data and reducing duplication, which meets the intent of the recommendation. For example, in June 2015, OMB issued guidance (M-15-14) for implementing IT reform legislation commonly referred to as the Federal Information Technology Acquisition Reform Act or FITARA. The guidance, among other things, requires agencies to develop an improvement plan if OMB or the agency Chief Information Officer determines that investment data that are required to be reported on a monthly basis are not timely or reliable. The guidance also requires agencies to hold quarterly PortfolioStat reviews with OMB during which they are to discuss how they use category management to consolidate commodity IT assets, eliminate duplication between assets, and improve procurement and management of hardware, software, network, and telecom services. Furthermore, during the PortfolioStat reviews, agencies are to share lessons-learned related to commodity IT procurement policies and efforts to establish enterprise-wide inventories of related information. In addition, during fiscal year 2016, OMB issued three memoranda for improving the management and acquisition of desktops and laptops, mobile devices, and software licenses (M-16-02, M-16-20, and M-16-12 respectively,) which require agencies to maintain inventories of these commodity IT assets and reduce the number of contract vehicles used to purchase them. These memorandums issued by OMB should increase agencies' ability to identify further opportunities for reducing wasteful, duplicative, or low-value investments.

While OMB did not specifically require the Federal Chief Information Officer to disclose the limitations of data reported on agencies' consolidation efforts and associated savings and cost avoidance as GAO recommended in November 2013, the agency began identifying agencies with incomplete, improperly formatted, or missing data in its public reports of agencies' savings beginning in fiscal year 2017. In April 2018, OMB told GAO that it identifies errors as part of the process of analyzing agencies' cost savings and flags the agencies whose data includes errors on the Federal IT Dashboard cost savings page. OMB stated that it does this to be transparent about issues encountered when processing the data (18#600599). As noted in GAO's report, disclosing limitations in reported data provides the public and other stakeholders with crucial information needed to understand the status of PortfolioStat and agencies' progress in meeting the goals of the initiative.

After we made the recommendation, OMB stopped requiring that agencies submit PortfolioStat action plans and instead shifted to tracking the status of the actions agencies agreed to take based on the results of PortfolioStat sessions. For example, in its June 2015 memorandum for implementing provisions of the IT reform legislation commonly referred to as the Federal Information Technology Acquisition Reform Act (OMB M-15-14), OMB instructed agencies to report on their efforts to address PortfolioStat action items at least quarterly. In addition, in May 2017, OMB specifically instructed agencies to report on the status of PortfolioStat and other action items in their quarterly reports on IT reform initiatives. These actions taken by OMB address the intent of our recommendation.

The department of Agriculture provided evidence of several actions which together demonstrate that it has developed a complete commodity IT baseline. Specifically, In September 2016, we reported that the department had a complete inventory of enterprise IT and business systems - two of three categories of IT assets that make up a commodity IT baseline as defined by the Office of Management and Budget at the time of our review (see GAO-16-511). We also found that the department had processes in place to regularly update this inventory and ensure its reliability. In addition, in August 2018, the department provided evidence of its inventory of IT infrastructure assets (the third category of IT assets that make up a commodity IT baseline) and process for ensuring it is complete. For example, the department provided documentation describing the processes used by the Office of the Chief Information Officer, directorates and IT asset owners to manage various IT infrastructure assets inventories that include desktops and laptops, mainframes and servers, and telecommunications equipment and services. Further, the department provided the resulting inventories of these processes and documentation showing these inventories' use in the department's budget formulation and acquisition processes.

As evidence that it addressed the first action plan element, in August 2018, the Department of Agriculture provided its Integrated IT Governance Framework Guidebook which identifies the CIO as a voting member of the Executive Review Board, the highest level decision-making body for IT spending. The Guidebook also states that the Integrated Advisory Board, a governance board composed of three councils, provides advice and recommendations to the CIO on IT matters. As evidence that it addressed the second action plan element, in August 2018, the department provided its 2017 Portfolio Review template for identifying wasteful, low-value, or duplicative investments.

Between May 2018 and October 2019, the department provided evidence of several processes it had in place to identify additional opportunities to reduce duplicative, low-value or wasteful investments. For example, in August 2018, the department provided the Chief Information Officer's (CIO) Scoring Criteria it uses to evaluate the health and usefulness of major and non-major investments as part of its portfolio reviews. There are different categories of criteria (for example, risk management) and they are used to evaluate and prioritize investments quarterly. In addition, the department provided an August 2018 report to the Office of Management and Budget including investments with CIO ratings to show its use of the scoring criteria. The department also provided its September 2019 IT Governance Framework, its September 2019 Capital Planning and Investment Control guide, among other documents, as examples of other processes it has in place to identify opportunities to reduce duplicative, low-value, and wasteful investments.

We obtained support for savings related to the Infrastructure Consolidation/Enterprise Data Center Consolidation initiative through our ongoing work on data center optimization (see for example GAO-14-713). In updates it provided to GAO between August 2018 and October 2019, the department stated that it did not have the support for the remaining initiatives for fiscal years 2013 through 2015 or later years because OMB had the determined the cost savings estimates to be "closed" due to lack of detailed information and confirmation.

Between March and April 2020, the department of Commerce provided evidence that it had implemented the recommendation. Specifically, the department provided evidence, including data call memos and instructions for its fiscal year 2021 budget formulation process, showing how this process is used to capture all systems in the systems inventory. In addition, the department provided evidence showing each system's mapping to the enterprise architecture. The department also provided evidence of quality assurance and validation activities it performs to ensure the accuracy and completeness of the systems inventory data and mapping to the enterprise architecture.

Between March and April 2020, the department of Commerce provided evidence that it had implemented the recommendation. Specifically, the department provided evidence, including data call memos and instructions for its fiscal year 2021 budget formulation process, showing how this process is used to capture all IT systems it its systems inventory. Since the process is to account for 100 percent of department's IT spending, the commodity IT baseline is included in the systems inventory. The department also provided its inventory as of March 2020 and evidence of quality assurance activities to ensure its completeness and accuracy.

While the Department of Defense partially concurred with the recommendation, it took several actions over the past few years which demonstrate that it has implemented it by developing IT asset inventories and processes to regularly update them. For example, in September 2016, in GAO-16-511, we reported that the department had a systems inventory-the DOD IT Portfolio Repository-- which included business and enterprise IT systems, two categories of systems included in OMB's definition for a commodity IT baseline definition. We also reported that the department regularly updated this inventory through real-time updates, annual system reviews and supplemental data quality reviews. In addition, as part of our review of selected agencies' efforts to reduce IT contract duplication summarized in GAO-20-567, the department provided a breakdown of its IT spending into categories (IT consulting, IT hardware, IT outsourcing, IT security, IT software, and telecommunications) and showed that it had updated the categories every year from fiscal years 2016 to 2019. The department also provided documentation of recent actions to update its IT asset inventory. For example, it provided an April 2020 DOD System and Application Rationalization Guide which includes instructions for DOD components to create application and systems inventories, assess the value and technical fitness of the applications, dispose of them accordingly, and reflect decisions in the budget formulation process. In January 2021, the department also provided its November 2020 memorandum for Category Management Purchasing Solutions for Commodity Laptops and Desktops. The memo, among other things, instructs DOD components to report their IT hardware inventory to the department CIO to meet OMB quarterly reporting requirements. We believe these actions collectively support the department's implementation of our recommendation to develop a commodity IT baseline.

The Department of Defense reported its disagreement with the recommendation, as well as efforts to address it, at the time we made it, stating that the OMB PortfolioStat commodity IT construct does not work within the department's decentralized federated management approach, which is used for all major decision-making processes. However, the department took several actions which show that it has implemented the recommendation. For example, as part of our review of selected agencies' efforts to reduce IT contract duplication summarized in GAO-20-567, the department provided a breakdown of all of its IT assets into categories of IT spending (IT consulting, IT hardware, IT outsourcing, IT security, IT software, and telecommunications) and showed that it had updated the numbers every year from fiscal years 2016 to 2019. Additionally, in January 2021, the department provided its November 2020 IT Category Management: Commodity Laptop and Desktop Purchasing Solutions memo which, among other things, instructs all DOD components to report their IT hardware inventory to the department CIO to meet OMB quarterly reporting requirements. These actions describe efforts to consolidate commodity it spending under the department CIO.

The department of Defense concurred with the recommendation and stated that it already reported data center consolidation savings and would continue to realize savings from the Enterprise Software Initiative, other strategic sourcing efforts and the implementation of the General Fund Enterprise Business System initiatives. Through other engagements, in August 2016, we had collected support for data center consolidation and Enterprise Software Initiative savings for fiscal years 2013 to 2015. In January 2019, the Office of the Chief Information Officer's Director for Performance Management told us that the department had not been tracking savings generated by other commodity IT initiatives due to the difficulty in doing so, however, it was tracking an "other" category of savings from various OMB IT reform initiatives through OMB's integrated data collection instrument process. As evidence, the department provided an August 2018 report to OMB which showed actual and estimated savings for a number of IT reform initiatives for fiscal years 2011 to 2019. We believe the evidence provided meets the intent of the recommendation and is sufficient to close it as implemented.

The Department of Defense concurred with the recommendation and, as of February 2021, had provided evidence that this recommendation was fully implemented. Specifically, regarding the action plan element to consolidate commodity IT spending under the agency chief information officer (CIO), the department provided the Army Corps of Engineers' IT Capital Planning and Investment Management regulation, which describes the Army Corps CIO's role in facilitating the process for pre-selecting, selecting, managing, and evaluating IT investments. In regards to the action plan element to target duplicative systems or contracts that support common business functions for consolidation, the department provided its November 2020 IT Category Management: Commodity Laptop and Desktop Purchasing Solutions memo that describes the department's efforts to use common purchasing solutions for the acquisition of laptops and desktops. The memo is applicable to all Department of Defense components, including the Army Corps of Engineers. Regarding the action plan element to establish criteria for identifying duplicative, wasteful, and low-value investments, the department pointed again to Army Corps' capital planning and investment management regulation, which includes a process for conducting performance and technical reviews as a means to determining whether investments should be terminated or modified. Lastly, regarding the action plan element to establish a process for identifying duplicative, wasteful, and low-value investments and a schedule for eliminating them from the portfolio, the department pointed to the Evaluate component of the capital planning and investment management process. According to the regulation, as part of this component, the IT investments' executive sponsor is to assess IT investments for their impact on business outcomes relative to the agency's missions and goals. Additionally, the CIO or Senior Regional Information Officer is to determine whether the technical objectives of the investment are met. The executive sponsor and CIO or Senior Regional Information Officer are to determine whether investments will be terminated or modified as a result of these assessments. The regulation notes that the process applies to local and regional investments which are valued at $100,000 or more in the directorates and offices within the Army Corps of Engineers, and the process can be tailored for investments which fall under that threshold. In terms of a schedule, the regulation notes that the performance and technical reviews performed by the executive sponsor and CIO or Senior Regional Information Officer can occur anytime throughout the year.

The Department of Defense agreed with the recommendation, and, as of February 2021, we had obtained evidence that had been fully implemented. Specifically, in April 2018, the Department of Defense provided a May 2014 order outlining guidance to plan and prepare for its deployment of the Electronic Capital Planning and Investment Control (eCPIC) system. According to that document, the system deployment was to occur in three phases and be completed by January 2015. In addition, in February 2021, we obtained publicly available documentation showing that the agency had migrated to eCPIC, and subsequently to Folio, the successor to the eCPIC application.

As evidence that it addressed the first action plan element, in March 2017, the Department of Energy reported that it had established senior executive level governance boards (including the Chief Information Officer) to oversee information management policy and commodity IT investment decisions for the department. These boards were identified in the department's plan for implementing the information technology acquisition reform provisions commonly referred to as FITARA. Specifically, the plan (which was submitted to OMB) described the Chief Information Officer's responsibilities for overseeing and making decisions for all IT resources and assets primarily through involvement with the governance boards and collaboration with other senior executives. As evidence that it addressed the second action plan element, in June 2018, the department provided its March 2017 IT capital planning guide including criteria for identifying wasteful, low-value, or duplicative investments. For example, the guide includes selection criteria used by program and staff offices in making funding decisions. In addition, the guide describes processes for (1) conducting post implementation reviews using criteria to help inform future selection decisions and (2) performing operational analyses that should lead to recommendations about the continued use, modification, or termination of assets. While the department did not specifically address whether it reported the criteria to OMB, the capital planning guide references several reports to OMB resulting from the processes described (e.g., the department's budget, business cases, monthly updates to the IT dashboard).

In September 2016, we reported that the Environmental Protection Agency's (EPA) Registry of Environmental Protection Agency Applications, Models and Databases (READ) system had a complete inventory of enterprise IT and business systems-two of three categories of IT assets that make up a commodity IT baseline-and that the agency had processes in place to regularly update this inventory to ensure its completeness (see GAO-16-511). Between July 2020 and February 2022, EPA provided evidence that it maintained an inventory of infrastructure assets-the third category of assets-in its READ system and other tracking systems. By taking action to develop a complete commodity IT baseline, EPA has greater assurance that it will effectively identify consolidation opportunities that could yield considerable cost savings or avoidance.

As of February 2022, EPA provided evidence that it had addressed the three elements in the recommendation. Specifically, regarding the element to consolidate commodity IT spending under the agency CIO, in June 2019, the agency provided its IT Acquisition Approval Procedures that require the CIO, or a delegated representative, to approve all acquisitions containing IT hardware, software, and services. For the element to establish targets for commodity IT spending reductions and deadlines for meeting those targets, EPA provided its Mandatory Requirements for Use of Common Contract Solutions procedure document. According to the document, the agency is required to use EPA and federal strategic sourcing vehicles and Best in Class solutions, in accordance with OMB's directions for moving toward government-wide mandatory use of common contract solutions. EPA officials also reported that the agency conducts annual reviews of its IT portfolio, during which the CIO holds a meeting with each program office and region to discuss their IT spending and planning, and to identify ways to increase the efficiency and effectiveness of the agency's IT investments. According to the officials, the CIO's office undertakes a data collection and analysis ahead of each portfolio review meeting to inform these discussions. Lastly, the EPA officials stated that the agency has three mechanisms to address the third element of the recommendation relating to identifying wasteful, low-value, or duplicative investments. These mechanisms are (1) the CIO's annual IT portfolio reviews mentioned above, (2) the new application review process, and (3) the Chief Architect's annual investment review. The officials noted that the IT portfolio reviews are specifically intended to (a) have a collaborative conversation with programs and regions to ensure IT Investments are effectively serving EPA's mission, (b) identify and reduce duplication, (c) identify actions to optimize EPA's IT portfolio. Regarding the new application review process, in February 2022, EPA officials stated that it applies to new applications that are in the concept phase before the specific technologies to build them have been selected and its purpose is to avoid duplication of applications, promote the re-use of applications and functionality across the agency, and increase the use of shared services. Finally, EPA officials described the Chief Architect's annual review of EPA's IT investments-including applications-- to ensure compliance with IT investment management and enterprise architecture policies and to identify low-value and duplicative applications. They stated that the Chief Architect shares findings with the investment and application owners and provides recommendations to the CIO.

As of December 2021, EPA had take action to fully implement this recommendation. Specifically, in June 2019, the agency provided documentation of the signed contract and performance work statement for the acquisition of the managed print service. In addition, in December 2021, the agency provided documentation to support its migration of end user computing to shared services. Specifically, EPA provided requests for end user computing services through a contract with a service provider. EPA stated that these requests were used to purchase the tools needed to complete enterprise upgrades. Agencies are required to report on their consolidation and migration efforts to OMB as part of their reporting of IT budget data. By implementing this recommendation, EPA has helped to ensure accountability for results.

In August 2014, GSA provided GAO a status report showing completion of the migration of the contract writing module to shared services in the February-March 2014 time frame. GSA also provided a November 2013 PortfolioStat action plan to OMB that listed GAO's recommendation as an action item. However, OMB's quarterly data collection process did not allow for submission of progress reports, so GSA was not able to submit quarterly reports. Instead, GSA prepared quarterly status updates officials stated they would have submitted to OMB if a reporting mechanism had become available. We believe that GSA's actions fulfill our recommendation.

In November 2016, HHS provided its plan for implementing provisions of the Federal Information Technology Acquisition Reform Act. The plan, among other things, describes the department's strategy to consolidate commodity IT spending under the department Chief Information Officer through the use of IT Steering Committees. Specifically, according to the plan, the IT Steering Committees are to identify common solutions, ensure effective use of HHS resources, and help eliminate redundant investments. These committees, which are chaired by the HHS CIO, focus on one of three portfolio/domain areas: Administration and Management, Health and Human Services, and Scientific Research. The Administration and Management domain focuses on commodity IT investments.

In December 2013, HUD provided a commodity IT baseline. It was comprised primarily of services because HUD was (1) operating under a fully outsourced infrastructure managed services model with two vendors providing consolidated departmental IT infrastructure operations, (2) using an Interagency Agreement (IAA) with the Department of Treasury's Administrative Resource Center (ARC) for financial management services. We had previously reviewed evidence of the interagency agreement with Treasury. In February 2016, we received evidence of the department's other managed service arrangements.

In December 2013, HUD provided decision criteria which the department stated would be used to prioritize funding requests for its FY14/FY15 internal expenditure plan and assist in identifying wasteful, low-value, and duplicative investments. These criteria address strategic alignment, business value, risk reduction, ability to execute, and operational management for different types of investment. We are monitoring HUD's actions to use these and other criteria in our efforts to follow up on a related recommendation made in GAO-15-56.

In September 2014, HUD provided evidence that it had completed the migration of the HR End-to-End Performance Management module to a shared service at the beginning of fiscal year 2014.

In March 2016, the Department of the Interior provided its commodity IT baseline and its Information Technology Budget Object Class and User Product Codes Guidance which support the department's efforts to improve the commodity IT baseline. In April 2017, the department provided its updated guidance. The guidance has evolved over time to allow the department to more accurately and completely track IT products and services and thereby develop a complete commodity IT baseline. We believe the department's actions to develop and use the guidance are sufficient to address this recommendation.

Between February 2015 and November 2015, the Department of the Interior provided updates on its efforts to establish criteria to identify wasteful, low-value, or duplicative investments. The department also demonstrated how it used the criteria for the fiscal year 2017 budget formulation process.

In March 2016, the Department of the Interior confirmed that it had completed the migration of its Enterprise Form System to a shared service by December 2014 and provided documentation showing that is was operational. The department stated it had not reported its progress in completing the migration to OMB because the agency was no longer requiring quarterly updates.

Between October 2019 and December 2020, the Department of Justice provided evidence that it had implemented the recommendation. Specifically, in October 2019, the department told GAO that it aligns all IT investments to the enterprise architecture by assigning them to enterprise architecture business reference model codes as part of the budget formulation process. The department also provided a list of investments mapped to business reference model codes. In December 2020, the department provided its updated Budget Oversight Standards and Procedures document. The document shows that the budget process includes steps for the enterprise architecture team to evaluate new IT investments' alignment with the enterprise architecture before they are captured in the department's portfolio management tool.

In November 2018, officials from the Department of Justice's office of the Chief Information Officer told us that OMB had moved away from the action plan reporting requirements from the time of our engagement to new requirements focused on data center optimization and the use of common vehicles for purchasing desktops, laptops, and mobile devices. [Note: we were aware of OMB's new focus on data center optimization efforts and desktops, laptops, and mobile devices, and the associated requirements through ongoing work.] They stated they were working to address the new requirements and provided evidence to support this claim. Specifically, they stated they were reporting on their efforts to consolidate data centers and meet associated cost savings targets and also on their efforts to use approved purchasing vehicles for desktops and laptops, and mobile devices. They provided examples of status reports submitted to OMB through the integrated data collection process, including a first quarter fiscal year 2018 report on data center optimization and a February 2018 mobile devices service summary. We believe the department's actions meet the intent of the recommendation (to reduce commodity IT spending) and are sufficient to close the recommendation as implemented.

The Department of Labor completed its commodity IT baseline and submitted it to OMB in August 2014 as part of the required quarterly reporting through the integration data collection tool. In July 2015, the department provided the guidance used to collect and review the commodity IT baseline information as evidence of a process to ensure the quality of the information collected.

In February 2018, the Department of Labor (DOL) provided documentation that describes its efforts to consolidate IT spending under the agency Chief Information Officer (CIO). Specifically, the department provided its Information Technology Acquisition Review Board charter and FY18 IT Spend Plan Guidance which both describe the CIO's role in reviewing and approving all planned agency IT acquisitions. In regards to establishing targets and deadlines for reducing commodity IT spending, DOL has an overall commodity IT cost savings/avoidance target and deadline established by OMB and reports to OMB on its progress in meeting them through the quarterly integrated data collection submission process. DOL officials stated that the department had not established targets for its individual efforts because (1) its key efforts (WebEX and Cloud Email) were not expected to generate savings and (2) OMB was no longer requiring separate targets. We believe the department's actions sufficiently address this recommendation.

The Department of Labor completed the consolidation of nine e-mail systems into a shared cloud-based e-mail service in September 2014. A status report provided to GAO by the department in July 2015, a department fiscal year 2017 IT Modernization and Integration document, other publically-available documents provide evidence of this. In addition, project progress and completion were reported on the IT dashboard.

In June 2021, NASA provided evidence of several actions it had taken that addressed the recommendation. For example, the agency provided its August 2020 NASA Information Technology Program and Project Management Requirements policy which specifies key decision points in the IT development and deployment lifecycle at which IT programs, projects, initiatives, and activities are to be assessed by the Enterprise Architecture group. In addition, NASA provided a November 2020 enterprise architecture policy which outlines roles and responsibilities for the development, maintenance, and implementation of the enterprise architecture. According to the policy, the agency is to use the enterprise architecture to guide and provide insight into the agency's IT investments. NASA officials also stated that the agency aligns the enterprise architecture with the Technology Business Management (TBM) framework, including the towers and sub-towers. Officials stated that, as part of NASA's capital planning and investment control processes, the agency collects and reports information within the agency's IT portfolio against the TBM framework on an annual basis. They provided documentation showing that the agency had aligned IT spend for fiscal years 2021 and 2022 by TBM Framework cost pool and cost towers as evidence. Finally, the agency provided an IT application inventory that aligned applications to the OMB Business Reference Model and NASA's IT applications architecture. Officials also provided plans for a project to ensure the completeness and accuracy of the inventory. As a result of these actions to address the recommendation, NASA has increased ability to identify opportunities to reduce low-value, duplicative, or wasteful investments.

In May 2015, NASA stated that OMB was tracking new action items identified during its recent PortfolioStat review and, as a result, was no longer tracking the initial action items which were the subject of our recommendation. In July 2015, the agency provided a report updating OMB of the status of the new action items as supporting evidence. NASA, nevertheless subsequently addressed the four action items in our recommendation in its November 2015 plan for implementing the statutory IT acquisition reform provisions commonly referred to as the Federal Information Technology Acquisition Reform Act. [Note: In June 2015, OMB issued guidance requiring all covered agencies to develop this implementation plan.]

In July 2015, NASA provided evidence it had completed the consolidation of the NASA Integrated Communications Services Consolidated Configuration Management System in April 2014.

Subsequent to the issuance of the report, OMB changed its PortfoioStat action item requirements for agencies. In July 2015, the National Archives and Records Administration (NARA) provided GAO a quarterly report it had submitted to OMB showing the status of the new PortfolioStat action item requirements as of June 2015, including one action item associated with improving access controls and another associated with deploying and using web analytics. Many of action items were still in progress. In March 2018, NARA provided GAO an updated quarterly report showing that it had completed all new action item requirements listed in the June 2015 quarterly report.

In September 2014, NSF reported that while OMB had not requested updates to the 2012 PortfolioStat action plan, NSF had prepared documents (for OMB) which addressed the action plan elements in our recommendation. As evidence of this, in July 2015, NSF provided GAO its Information Resource Management Plan for 2013 - 2017 which it stated addresses both elements of the recommendation. Our review of the plan showed that it described the consolidation of commodity IT spending under the agency CIO. Specifically, the plan stated that NSF's CIO has oversight and control of funding requests, budget execution, IT planning and spending, and financial reporting. The plan also described the CIO's authority in each of the key areas identified in OMB M-11-29, including commodity IT. Related to establishing criteria for identifying wasteful, low-value, or duplicative investments, the Information Resource Management Plan stated that the CIO and IT governance boards work together to both quantitatively and qualitatively evaluate proposed IT investments. In addition, the plan stated that the agency uses the IT budget review process to identify low-value or potentially duplicative investments. According to the plan, NSF's approach to investment valuation includes: (1) evaluation and prioritization of investment proposals; (2) a variety of criteria, such as expected return on investment and alignment with NSF's strategic goals and priorities; and (3) several factors, including the investment's importance to agency mission, level of risk, and adherence to cost, schedule, and performance goals.

As evidence that it developed a commodity IT baseline, in March 2017, NRC provided an information technology (IT) asset inventory submitted to OMB in May 2016, and reports listing mobile devices and services, desktops and laptops, and software licenses submitted to OMB in February 2017. NRC also provided evidence of actions to centralize the commodity IT baseline under the Chief Information Officer, establish controls to ensure commodity IT spending data is appropriately captured and categorized, and restructure its portfolio to ensure transparency into how IT funds, including commodity IT, are budgeted and executed. In May 2017, NRC provided a current snapshot of its systems, software, and hardware inventories. We reviewed the inventories and found that they listed IT assets associated with IT infrastructure, enterprise IT and business systems, the three asset categories included in OMB?s definition of commodity IT. We believe NRC's actions are sufficient to address this recommendation.

In August 2014, NRC reported progress on action items from its 2013 PortfolioStat session which differed from the action items identified in our recommendation based on new OMB priorities. In July 2015, the agency also reported it was working on a plan outlining actions for meeting Chief Information Officer responsibilities, a new OMB priority identified in June 2015 guidance for implementing provisions of IT acquisition reform legislation enacted in December 2014. We verified that the plan was issued in November 2015 and that action items from the 2013 PortfolioStat session, such as optimize investment management and improve mobile contract management, were implemented.

In January 2023, OPM provided evidence of actions it had taken which address the recommendation's intent to provide the CIO visibility into IT spending. Specifically, it provided evidence of actions to ensure its CIO review and approve IT procurements requests. OPM also provided its April 2022 Software Asset Management Policy which includes a process for maintaining its software inventory. In addition, OPM reported other actions it had taken or planned to take to continue to maintain its commodity IT baseline, including creating a dashboard to view the hardware and software on its network. As a result of these actions, OPM has greater assurance that it will effectively identify consolidation opportunities that could yield considerable cost savings or avoidance.

In January 2023, OPM described actions it had taken that address both action plan elements. For example, it described efforts it had taken to consolidate multiple communication and collaboration tools into a single enterprise solution (Microsoft Teams) and provided a contract authorization memo as evidence. OPM also described efforts to establish its Enterprise Cloud initiative in FY 2022. It stated that, through this initiative, it was transitioning on-premise systems and applications to the cloud, consolidating applications that were operating in other cloud environments, and developing new applications in the cloud. OPM provided evidence of the authorization to operate for the MS Azure cloud environment. By taking these actions, OPM is in a better position to fully realize the benefits of the PortfolioStat initiative, which are to help reduce duplication and achieve cost savings.

In January 2023, OPM provided evidence that it had addressed the recommendation. Specifically, the agency provided evidence of a contract it had awarded for help desk support services in fiscal year 2022. The contract which includes a 24/7 remote call center and cloud-based automatic call distribution solution is intended to provide enhancements for self-service support and automation services to improve the customer experience. OPM also provided evidence of a cloud computing environment it had set up to migrate its on-premise systems and applications. [Note: The agency provided this example instead of the migration of the IT asset inventory to shared services which it told us it was no longer pursuing in February 2021.] By taking these actions, OPM is in a better position to fully realize the benefits of the PortfolioStat initiative, which are to help reduce duplication and achieve cost savings.

Between May 2017 and October 2018, SBA provided evidence that it had developed a complete commodity IT baseline. Among other things, the agency provided its documented IT Asset Management Lifecycle Management Process which includes steps for creating and continuously monitoring hardware and software assets. SBA also provided outputs of this process, including a hardware asset inventory, a software asset inventory, an approved software list, and a system and application summary list. We reviewed these inventories and found that they included all the categories and types of commodity IT specified by OMB in its original PortfolioStat memo (M-12-10),

Between May 2017 and February 2020, SBA provided evidence that it described all four action plan elements and therefore fully implemented the recommendation. Specifically, in May 2017, SBA demonstrated that it had described actions to consolidate commodity IT spending under the Chief Information Officer (CIO), the first action plan element. Among other things, the agency provided standard operating procedures for its Government Acquisition Program, which specify that the CIO is to have responsibility for all policy, procedures and documentation regarding IT acquisitions. Further, in July 2019, SBA provided evidence that it had addressed the action plan elements associated with (1) establishing targets for commodity IT spending reductions and deadlines for meeting those targets and (2) targeting duplicative systems or contracts that support common business functions for consolidation. Specifically, the agency provided congressional budget justification documents and annual performance reports for fiscal years 2019 and 2020, which include annual targets for IT cost savings and avoidance and deadlines for implementing actions (e.g.,such Office of the CIO reviews of IT investments to reduce duplication of products and services) to help meet those targets. The reports also describe efforts to eliminate duplicative products and services, and combine multiple instances of IT assets to achieve greater efficiency. Finally, in February 2020, SBA provided its Capital Planning and Investment Control (CPIC) standard operational procedures as evidence that it had described a process to identify and remove low-value, wasteful, and duplicative investments, the fourth action plan element in our recommendation. The procedures state that the Select phase of the CPIC process helps the agency identify duplicative and wasteful investments. Additionally, the Control phase discusses corrective actions for investments that are being terminated and a timeline for implementing them.

In November 2013, we reported that SSA had developed a complete commodity IT baseline but did not have a process for ensuring its completeness. Between September 2014 and November 2018, SSA provided evidence of its process for developing a complete commodity IT baseline through its Special Expense Item process which it uses to develop IT funding requests. Specifically, in July 2016, the agency provided an instruction set for the process. The instruction set identified specific definitions for commodity IT assets that are covered in the process. In July 2018, SSA told us that while the commodity IT definition had been removed from the instruction set, the SEI process applied to all IT resources and was used by all groups developing IT requests. The agency provided a data call memo for the fiscal year 2020 President's Budget formulation which confirmed the process's continued use and applicability to all IT resources. With this evidence, we consider the recommendation closed

Between September 2014 and December 2017, SSA provided several documents showing progress and completion (in September 2014) of its effort to migrate the Geospatial Architecture initiative to a shared service. In April 2018, the agency provided evidence that it had reported on the status of the initiative to OMB .

In November 2017, the Department of State provided documentation of its October 2017 Enterprise Architecture Investment Review process as evidence that the department reflects 100 percent of its IT investments in the enterprise architecture. The process includes four steps that allow the department to ensure that investments are aligned with the enterprise architecture throughout their lifecycle. In July 2018, the department also provided the enterprise architecture alignment reports for several investments as evidence that it is using the process.

In February 2019, the Department of State provided evidence that it had addressed each of the four elements in the recommendation. Specifically, for the first element, the department provided presentations for PortfolioStat meetings with OMB as evidence that it has described and reported progress on its efforts to consolidate spending under the agency CIO. These presentations include information on the department's progress in implementing FITARA, which include elements for the CIO's role in budget formulation, budget execution, and acquisition. For the second element (regarding establishing targets for commodity IT spending reductions and deadlines for meeting them, we reported in GAO-18-264 that the department had exceeded its and OMB's planned targets for data center optimization for fiscal years 2016 and 2017. We believe that this addresses the action plan element as data centers contain several of commodity IT items included in the commodity IT baseline definition at the time of our review (e.g., mainframes and servers). Regarding the third action plan element, the department provided documentation of its efforts to move at least two commodity IT areas to shared services and report it to OMB. For example, it provided excerpts from the department's third quarter fiscal year 2018 integrated data collection report to OMB , which shows progress in consolidating contract vehicles for wireless services (through the State Messaging, Archive, and Retrieval Toolset initiative) and IT refresh and support services (through the Global IT Modernization Program). Finally, the department provided several documents to address the fourth action plan element to target duplicative systems or contracts for consolidation. These documents include (1) plans to eliminate contracts for its consolidation of laptops and desktops in accordance with OMB's Category Management Policy; (2) a November 2017 Transition Plan to Consolidate Mobile Services; and (3) the department's IT Strategic Plan for fiscal years 2019 to 2022 which include the department's plans for reducing duplication and driving costs down by fiscal year 2022 through centralized, integrated, and optimized Platforms as a Service and Infrastructure as a Service and a streamlined IT acquisition process.

Between October 2015 and November 2017, the department provided evidence that it had completed the migration the Foreign Affairs Network and content publishing and delivery services to shared services and had reported on the initiatives through the annual budget process. The evidence provided includes an internal document communicating the completion of its project to migrate the content publishing and delivery services to shared services and a departmental email and bureau announcements informing the recipients that the Chief Information Officer granted the Foreign Affairs Network shared service the authority to process sensitive but unclassified information.

In September 2015, the department stated that it would be incorporating these action plan elements as part of the Federal Information Technology Acquisition Reform Act (FITARA) guidance it would be implementing over the next few months. The FITARA implementation plan issued in December 2015 describes the department's framework for addressing the elements that had not been fully described in the PortfolioStat action plan originally required by the Office of Management and Budget. It also addresses steps for addressing gaps in CIO responsibilities supporting these elements.

In September 2018, the department provided us its project closeout report showing that it had completed the migration of 12 operating administrations to the O365 Exchange Online email shared service in January 2017. The department also provided us reports it had submitted to OMB showing the completion of the migration effort as of August 2018.

As of June 2022, Treasury had addressed the action plan element associated with establishing criteria for identifying wasteful, low-value, or duplicative investments. Specifically, in September 2018, the department reported that each bureau is responsible for developing, implementing, and maintaining its own governance and planning processes and that these processes, among other things, include a select phase in which bureaus identify work requests for the upcoming calendar and budget year, determine if the requests meet established selection criteria, and prioritize the requests. The department stated that the bureau CIOs review their IT portfolio annually with the Treasury CIO. Regarding the action plan element to consolidate commodity IT spending under the agency CIO, in November 2022, Treasury created a Technology Business Management (TBM) Program Data Governance document, which established department-wide policy for the level of detail of planned expenditure reporting to the CIO for all transactions that include IT resources. Treasury also adopted the TBM framework as a standard taxonomy for categorizing IT costs throughout the department. With the adoption of the framework, the CIO has increased visibility into IT resources, including commodity IT spending, which is the intent of the action plan element.

In September 2014, the department of the Treasury reported that it had taken several actions to identify opportunities to reduce duplicative, low-value, or wasteful investments, including establishing four new governance bodies and engaging them in performing annual reviews of bureaus' portfolios and monthly investment reviews. In addition, the department provided evidence to support its claims. For example, in September 2018, the department provided an example of an annual review of the Internal Revenue Service's portfolio and a monthly review of the bureau's investments. As a result of the actions taken, the department is better positioned to reduce duplicative, low-value, or wasteful investments.

In September 2015, the Department of Treasury provided fiscal year 2013-2015 cost savings and avoidance data for its Do Not Pay Business Center and Fiscal IT Data Center Consolidation initiatives, as well as the methodology for calculating these savings and avoidance. Regarding the Business Process Management Status initiative, the department stated that it had stopped reporting cost savings and avoidance data to the Office of Management and Budget because the data had previously been reported by a former Bureau of Engraving and Printing official and no current employee could verify its validity.

In June 2017, USAID provided its IT Portfolio Management Program Charter and other evidence demonstrating the agency's process for reflecting 100 percent of its investments in the enterprise architecture through maintenance of the system inventory and the evaluation of future investments. Specifically, during the first phase of the IT Portfolio Management Program, all investments are reviewed and approved by the Investment Review Committee (IRC), at which point they enter the second phase. Investments in the second phase are reviewed by the Office of the Chief Information Officer to ensure their alignment with the Enterprise Transition Roadmap. Investments found to be aligned with the Roadmap are approved for project implementation and move forward into the last phase, which means that they are operational. At that point, investments are added to USAID's system inventory.

In October 2015, the US Agency for International Development provided evidence of having developed a complete commodity IT baseline including enterprise IT, business, and infrastructure assets.

In response to this recommendation, in May 2016, USAID provided a Decommissioning Plan it had issued that month. The plan, based on the agency's IT asset inventory and other sources, describes USAID's approach for decommissioning and retiring redundant or sub-optimal IT investments. It also lists systems and technology that were decommissioned in fiscal year 2014 and 2015 and provides estimated time frames for decommissioning additional systems and technology in fiscal year 2016 and beyond. USAID also provided documentation of its processes for preventing duplicate technologies, including the Office of the Chief Information Officer process for concept intake, the IT acquisition assessment and authorization process, the software approval review process, and use of the Enterprise Architecture Analysis and Reporting Tool.

In August 2014, the US Agency for International Development provided evidence of having migrated its Telecommunications and Operations Center to shared services in October 2012. In October 2015, the agency provided evidence of having completed the migration of email to shared services. Consistent with OMB guidance, the agency has been reporting cost savings and avoidance associated with these efforts to OMB on a quarterly basis through the submission of integrated data collection reports.

In June 2019, the department of Veterans Affairs (VA) provided evidence that it had described efforts to target duplicative products and systems that support common business functions for consolidation. First, the department provided a document describing its transition to a new IT product line management process. According to the document, the process is to include the establishment of groupings of like capabilities to reduce duplication by developing a common site picture across VA's Office of Information Technology through the use of multiple frameworks and portfolios. It also calls for Product Line Managers to, among other things, rationalize the product line by identifying redundancy among products. Second, the department provided a document describing its Legacy Systems Modernization process. According to the document, the process includes a working group whose goal is to collaborate with business units and components within the Office of Information Technology to (1) assess systems based on four main categories (i.e., functionality and system status; cost and schedule; security and technical; and operations); and (2) determine systems targeted for migration/consolidation, modernization, and/or retirement/decommissioning by focusing on efforts to identify dependencies, overlaps, and inconsistencies.

In its December 2013 statement of actions to address our recommendations, the Department of Veterans Affairs stated that it had not moved its dedicated fax servers to a shared service as planned because the return on investment was estimated to be significantly lower than planned. The department stated that the initiative was instead being reprioritized and considered for a future budget cycle. In December 2015, the department stated that it had decided it would no longer pursue the initiative because an analysis performed in fiscal year 2014 indicated very little, if any, cost savings would be achieved. The department provided integrated data collection reports showing quarterly updates on the initiative to OMB.

In June 2019, VA officials stated that the department's transition to IT product line management process and the work of its Legacy Systems Modernization Working Group represented the department's efforts to address our recommendation. To support its claims, the department provided descriptions of the IT product line management process and responsibilities of the Legacy Systems Modernization Working Group showing how they both contribute to the identification of opportunities to reduce duplicative, low-value, or wasteful investments. In December 2019, VA provided documentation showing that it had used the IT product line management structure and Legacy Systems Modernization Working group to identify opportunities to reduce duplicative, low-value, or wasteful investments for two product lines. Specifically, the department provided a draft disposition schedule for retiring and decommissioning 10 systems and modernizing seven others for the Education and Vocation Rehabilitation product line. The department also provided results of the Legacy Systems Modernization Working Group's assessment of systems in the Digital Experience product line and a corresponding draft disposition schedule for decommissioning three systems, retiring and decommissioning two systems, and modernizing at least one system.

Between December 2013 and July 2019, the department provided several updates for each of the four initiatives in our recommendation which combined fully address the recommendation. First, for the Server Virtualization initiative, in December 2015, the department reported that the scope of the initiative had increased and that the cost avoidance estimates were being revised accordingly. In June 2019, officials informed us that the department had saved $16.5 million a year over the past 5 years from the initiative and provided the supporting cost analysis. The analysis provides cost information for the initiative for fiscal years 2009 to 2019. Second, for the Elimination of Analog Fax Lines initiative, in December 2015, the department reported that the initiative was no longer being pursued because an analysis performed in fiscal year 2014 found that it would result in very little, if any, cost savings. As a result, we determined that the recommendation was no longer applicable for the initiative. Third, for the Renegotiate Microsoft Enterprise License Agreement ( ELA) initiative, in July 2019, VA officials provided an independent government cost estimate containing support for the estimate for the Microsoft ELA covering the period of April 2012 through March 2017. The cost estimate provides true-up, contract service agreement, and optional services cost estimate information for Microsoft Office 365 Lastly, for the One CPU Policy initiative, the department informed us that the initiative was eliminated in late 2013 because it was no longer considered a cost savings initiative and therefore, no cost estimate was performed for it. As a result, we determined that the recommendation was no longer applicable for the initiative. [Note: in June 2019, the department told us that what was formerly the Once CPU policy initiative had evolved into the VA IT One initiative and been combined with the One Device policy to take advantage of opportunities for cost avoidance by managing the number and type of IT devices issued to individual employees and contractors who receive government furnished equipment. The department provided documentation supporting this consolidation and its January 2019 implementation date.]