GAO Issues Definitive List of Most Important Federal IT Acquisitions

With technology now at the center of every aspect of American life, the Government Accountability Office took a look at the state of federal IT acquisitions and came up with a list of the 16 most important technology buys going on right now.

Every federal agency and program office has at least one major IT project in the works, with many juggling several simultaneously. But a report released Tuesday puts a spotlight on major ongoing IT acquisitions that will have the biggest impact on some of the most critical government services like paying taxes, managing biometrics databases, making sure planes don’t crash and maintaining the health of soldiers and veterans.

“Our specific objective was to identify essential mission-critical IT acquisitions across the federal government and determine their key attributes,” GAO auditors wrote.

To find the most important IT acquisitions in government, GAO began by issuing a questionnaire to the 24 agencies covered under the CFO Act. All but one agency—the Defense Department—responded with their five most critical programs, giving auditors a starting list of 98 acquisitions.

After reviewing the Office of Management and Budget’s IT Dashboard, GAO added three more programs to the list—two for DOD and one for Treasury—bringing the total to 101.

Auditors then assigned point values to each acquisition based on how important the program is to accomplishing the agency’s mission. The analysis resulted in 20 programs scoring above 75.

“In order to provide a larger representation of agencies’ acquisitions across the federal government, we selected the two highest-rated IT acquisitions per agency,” and consulted with former Federal CIO Suzette Kent “to confirm that the acquisitions we selected were critical to federal government operations,” the report states.

The 16 programs have little in common besides their impact. Some are estimated to cost a few million dollars over a number of years, while others have price tags in the billions or are projected to take several decades. That said, agencies reported similar acquisition and program management issues.

“For example, agencies reported that workforce issues, technical challenges, schedule slippages, inadequate funding, and budget constraints occurred during the development stage,” GAO wrote.

Some other trends emerged, as well, including:

• Twelve projects reported workforce issues, “including contract transitions, inadequate skills among critical contract staff, or delaying in onboarding contractors and federal support.”
• Ten projects saw significant delays and schedule slippages, “due to, for example, changes in the acquisition’s strategy for development, contract delays and hiring freezes.”
• Nine were plagued by technical problems, “such as transitioning to a cloud environment, unexpected complexity of the system and cybersecurity vulnerabilities.”
• Eight ran into funding issues forced by “budget cuts and outdated code complexities that required more resources to solve than the agency initially estimated.”

GAO provided a rundown of each of the 16 programs, including summaries of the project’s goals, timelines, costs, changes and links to past oversight reports. From the latest report:

Agriculture: Modernize and Innovate the Delivery of Agricultural Systems

The MIDAS program—started in 2014—was established to “streamline and automated farm program processes,” including linking together all county Farm Service Agency offices to help farmers and ranchers update and access benefits. The program is projected to cost $568 million over 12 years.

Status per GAO: In July 2014, the Secretary of Agriculture halted any new development on MIDAS after two software releases due to concerns with the program’s performance and delays in defining the cost, schedule and scope for the remaining elements of MIDAS. In 2016, FSA began an analysis of alternatives to determine recommendations for the best path forward for existing MIDAS applications. FSA officials said that the analysis was still underway as of May 2020. FSA continues to maintain the MIDAS application with incremental improvements to existing functionality.

Dashboard Risk Rating: Low

Commerce: 2020 Decennial Census

The Census Bureau—a component of the Commerce Department—is conducting the most technically-advanced decennial count in U.S. history. As part of the many IT systems that have been bought or developed in-house, Census awarded an eight-year, $1.4 billion contract to integrate 52 distinct systems.

Status per GAO: As of April 2020, the Census Bureau, along with the technical integrator, had performed several major operational tests, including end-to-end testing, and had deployed applications and systems for 10 of 16 planned operational deliveries for the 2020 Decennial Census. According to the Decennial Contracts Execution Office, while the Census Bureau expected to complete the remaining operational deliveries by quarter three of 2021, the delivery schedule for these operational deliveries was impacted by the Coronavirus Disease 2019 pandemic. The Census Bureau planned to resume work related to these deliveries in June 2020 and was developing a revised schedule for deploying them in May 2020. These operational deliveries related to response processing, data products/dissemination, providing data for redistricting, island area census, and post enumeration survey.

Dashboard Risk Rating: Medium

Defense: Defense Healthcare Management System Modernization

The Defense Department is in the middle of a militarywide deployment of a new electronic health record management system. The effort is expected to greatly improve the quality of care for service members and, if all goes right, finally create an interoperable platform for sharing health data across the branches and with the Veterans Affairs Department.

The system—developed by the Leidos Partnership for Defense Health, which includes the Cerner EHR system—is set to cost $10.2 billion over two decades.

Status per GAO: As of May 2020, DOD had completed project initiation, defined initial requirements, initiated the design phase, and begun operational tests and evaluations for DHMSM. As of July 2020, DOD was in the implementation phase of the program and plans to have it fully implemented and operational by the end of the second quarter of fiscal year 2024. According to the DHMSM Program Manager, full implementation and deployment will begin once all designated initial operating capability sites have completely transitioned to the EHR system and no longer rely on legacy systems for day-to-day operations. The program deployed MHS GENESIS at its first initial operating capability site in February 2017 and its final initial operating capability site in October 2017. DOD plans to deploy MHS GENESIS in 23 additional multiple site deployments by the end of the second quarter of fiscal year 2024.

Dashboard Risk Rating: Medium

Defense: Global Combat Support System-Army

Once finished, the GCSS-Army will replace a myriad of legacy IT systems used to manage supplies, maintenance and military property under a single, enterprise system. The entire program is expected to cost $3.3 billion over 13 years.

Status per GAO: GCSS-Army is to be implemented in two increments. As of May 2020, the Army had completed GCSS-Army increment one during the first quarter of fiscal year 2018, and was in the process of implementing GCSS-Army increment two, which was initiated in January 2016. Increment two is to have three functionally distinct waves. Wave one (Enterprise Aviation), deployed its first release in January 2020, beginning the interface of Army’s current aviation logistics and maintenance information system (Aircraft Notebook) with GCSS-Army. The second release for wave one is intended to complete the interface of Aircraft Notebook with GCSS-Army and is scheduled to complete development and testing in July 2022. Wave two (Business Intelligence/Business Warehouse), scheduled for completion in December 2022, is to provide combatant commanders and senior leaders near real-time visibility of combat power by providing aviation readiness and Army prepositioned stocks data from GCSS-Army into reports and visualizations, among other things. Wave three, scheduled for fielding in January 2021, is to replace the Army’s legacy system used to maintain and manage current Army prepositioned stocks worldwide.

Dashboard Risk Rating: Low

Homeland Security: Student and Exchange Visitor Information System Modernization

In 2006, the Homeland Security Department started overhauling the IT systems used by Immigration and Customs Enforcement to manage information on foreign students, exchange visitors and their dependents “to address technical vulnerabilities,” GAO wrote. Much of that work was completed by May 2019, prompting DHS to issue a five-year, $182 million contract “for adaptive maintenance and for future improvements.”

Status per GAO: ICE was authorized by the Acquisition Review Board, through this acquisition, to use adaptive maintenance for additional improvements that advance system performance to further mitigate the remaining two vulnerabilities—person centric and paper certificates of eligibility vulnerabilities. The person-centric vulnerability is the inability to track an individual nonimmigrant and ensure accurate matching of interface data. The paper certificate of eligibility vulnerability is the reliance on paper forms in immigration processing. According to the SEVIS Program Management Office, to address these vulnerabilities, the SEVIS modernization effort will focus on enhancing searching algorithms and work with external stakeholders to implement a totally paperless process at the port of entry and improve interfaces that will allow timely access to electronic records.

Dashboard Risk Rating: Low

Homeland Security: U.S. Citizenship and Immigration Services Transformation

Since 2006, USCIS has been on a mission to modernize its paper-based immigration process, projected to cost $3.2 billion over 30 years. “Since its inception, we have reported that the program has faced management and development challenges, limiting its progress and ability to achieve its goals,” auditors wrote.

Status per GAO: The transformation program has two projects in progress: Citizenship and Immigrant. The objectives of the Citizenship project are to enhance the Electronic Immigration System, or ELIS, platform with additional capabilities to support digital processing of naturalization and citizenship product lines. The objectives of the Immigrant project are to enhance the ELIS platform with additional capabilities to support digital processing of lawful permanent resident and family-based adjustment of status workload. USCIS has been able to decommission 12 systems due to replacement by the transformation program, including the Reengineered Naturalization Application Casework System, the USCIS Legacy Electronic Filing System, and the legacy Electronic Immigration System.

Dashboard Risk Rating: Low

Interior: Automated Fluid Minerals Support System II

The Bureau of Land Management maintains the AFMSS system to track the use of fluid minerals such as oil, gas and geothermal, and manage permits and oversight of wells on public lands. The second generation of the system is being rolled out over 10 years—at a cost of $52.2 million—to add efficiencies, reduce paper and develop digital permitting and reporting processes.

Status per GAO: According to BLM’s AFMSS Project Manager, AFMSS II is being developed in modules, which allows for easier adaptability for system enhancements based on regulatory requirements, technological changes, and other business needs. As such, all phases of development were occurring simultaneously, with testing being initiated in 2015 and the initial operating capability occurring in May 2016. However, in March 2016, the acquisition was re-baselined because of change in scope, technical challenges, and shifting of system development life cycle approaches with the system’s new vendor. According to BLM’s AFMSS Project Manager, as of July 2020, AFMSS II was in the design, testing, development and implementation phase per its incremental development methodology. The bureau planned to deploy the newly-developed AFMSS II on February 2020 and decommission the prior iteration of AFMSS in August 2020, but both dates have been delayed due to the Coronavirus Disease 2019 pandemic.

Dashboard Risk Rating: Low

Justice: Next Generation Identification System

The Justice Department is overhauling its biometrics data system to add new data and analytical services to other law enforcement and national security partners. The NGI system will replace the Integrated Automated Fingerprinting Identification System, with the addition of new biometrics tools—including facial recognition—and better, faster access to criminal histories and other pertinent data.

The “continuous technical refresh” is currently scheduled for 14 years at the cost of $1.6 billion

Status per GAO: According to Criminal Justice Information Services, the NGI system recently improved its algorithm search capabilities for latent prints submitted by local, state and other federal agencies. In 2013, the FBI deployed a pilot test of iris recognition technology for NGI. Criminal Justice Information Services is moving toward an incremental development methodology for NGI, which should allow for adaptive planning, prioritization of the most valuable enhancements, and rapid responses to change. According to bureau officials, full NGI cloud adoption is scheduled for completion in September 2021.

Dashboard Risk Rating: Medium

Justice: Terrorist Screening System

At a cost of $712 million spread over 18 years, the FBI is consolidating all of its terrorist-related data systems—such as the terrorist watch list—into a single Terrorist Screening System while also adding new capabilities.

Status per GAO: According to TSC officials, several legacy systems were decommissioned between fiscal years 2017 and 2019. TSC added that production and deployments for new TSS applications and system enhancements are in a continuous development mode. The IT Unit Chief added that their IT staff continues to manage and provide technical functionality modifications for TSS such as performance profiling and analysis; encounter viewer and editor upgrades; administrative tool upgrades; among others—which are to provide accurate screening and adherence to national privacy laws and regulation benefits.

Dashboard Risk Rating: Not identified

State: Consular System Modernization

The State Department is trying to combine 90 different applications into a single platform capable of handling visa and passport applications, visa adjudications and insurance, and other services performed by consulates—at a cost of $618 million over 11 years.

Status per GAO: The ConsularOne initiative comprises six projects for modernizing consular services. As of July 2019, the bureau had deployed activities related to the first two projects: a service that provides the public the ability to apply, pay, and schedule an appointment online for transmitting citizenship to a child born abroad and an enterprise payment service. Due to the use of an incremental development approach, Bureau of Consular Affairs officials said that, as of November 2019, the CSM acquisition and supporting ConsularOne initiative were in the design, testing, pilot, implementation, and maintenance phases. Specifically, bureau officials stated that more than one service was being developed simultaneously, and, as a result, the CSM acquisition was in various phases of the systems development life cycle. Next steps for the system are completing functionality for the first two projects, which includes a major online passport renewal release with a completion date of December 2021.

Dashboard Risk Rating: Medium

Transportation: Automatic Dependent Surveillance-Broadcast

The ADS-B program is the “cornerstone technology” of the Federal Aviation Administration’s central modernization effort: the Next Generation Air Transportation System, also called simply NextGen. The state-of-the-art airspace surveillance systems is set to: increase capacity for areas with limited or no radar surveillance, increase safety for users of weather and traffic broadcast services, increase efficiency for airlines with future ADS-B cockpit applications, provide more accurate trajectory information for aircraft, and lead to cost avoidance for the FAA by reducing the current radar inventory. The project is slated to cost just over $5 billion over 29 years.

Status per GAO: The Surveillance and Broadcast Services Program Office established an implementation plan to develop and implement critical ADS-B services in four segments. These segments represent fiscal years 2007-2010, 2010-2014, 2014-2020, and 2020-2025. Activities for the current segment of ADS-B—2014-2020—include (1) continued provision of services and applications to achieve efficiency, safety, and cost savings benefits; (2) expanded surveillance coverage in the Gulf of Mexico to reduce delays; and (3) the implementation of a fuel-saving procedure in oceanic airspace. According to an official in FAA’s Air Traffic Systems, Surveillance and Broadcast Services Program Office, the program reached initial operational capability for 224 of 225 surveillance sites as of November 2019.

Dashboard Risk Rating: Low

Treasury: Customer Account Data Engine 2

The CADE 2 project seeks to aggregate taxpayer information into a single database, accessible by components across the IRS. While the system, as sold, will “benefit taxpayers by delivering timely, accurate and complete data for faster issue resolution and improved customer service,” the project is also “essential to reaching the agency’s data-centric vision for tax administration,” GAO wrote.

The project is billed at $1.7 billion over 12 years.

Status per GAO: CADE 2 involves multiple projects, each with different start dates and requirements. To limit risk and demonstrate incremental progress toward modernization, IRS plans to deliver CADE 2 in three phases, called transition states. The first transition state was completed in 2014. As of July 2020, the agency was implementing the second transition state for CADE 2, which is focused on reengineering the core components of the Individual Master File using a hybrid-agile and waterfall approach, conducting requirements design, and testing in iterative cycles.

Due to significant budget cuts and a shortage of skilled staff, the second transition state’s release plan was revised three times between 2016 and 2017. For example, in late 2017, the release plan was revised to accommodate reduced fiscal year 2018 funding levels and anticipated future reductions. According to the IRS CIO, second transition state is expected to be completed in 2024. The third transition state had not been started as of July 2020 and IRS could not provide an expected completion date.

Dashboard Risk Rating: Low

Treasury: Integrated Enterprise Portal

The other major IRS modernization effort centers on the IEP, which is comprised of four websites targeting different taxpayer users groups: the Public User Portal, also known as IRS.gov; the Registered User Portal; the Employee User Portal; and the Transaction Portal Environment. When completed, the portal will ”become the primary means for taxpayers and businesses to file tax information,” the report states.

The full lifecycle is expected to take 10 years at a cost of $698 million.

Status per GAO: As of July 2020, IEP was in the operations and maintenance phase. According to IRS’ Executive Officer of IT Enterprise Operations, IEP was deployed in 2017 and IRS continues to make enhancements to the portal through an indefinite delivery, indefinite quantity contract. The agency implemented new services through the IEP acquisition in 2018 that included web application security scanning, new service catalogs, performance analytics, enhanced monitoring, and capacity management. In 2019 and 2020, IRS completed additional enhancements including the migration of 20 Public User Portal (irs.gov) applications to the cloud, expanding network capacity and redundancy. In addition, in April 2020, IRS completed development, implementation, and support for the Get My Payment application, which is accessed through IEP.

Dashboard Risk Rating: Low

Veterans Affairs: Electronic Health Record Modernization

The sister effort to DOD’s Defense Healthcare Management System Modernization project, VA’s EHR modernization looks to implement a commercial system developed by Cerner at all veteran health care facilities over the next 10 years. GAO estimates the project will cost upwards of $16 billion.

Status per GAO: As of July 2020, VA planned to run existing systems concurrently with the deployment of EHRM while each facility is transitioned to the new solution. The department has multiple contracts in place to perform the implementation and various aspects of the EHRM are being developed concurrently over a number of stages. VA expects its EHRM delivery to be based on approximately 50 deployments to an estimated 170 medical centers, with the first go live planned for October 2020. These deployments will include initial site assessment, configuration, testing, training, change management, deployment and sustainment. Ongoing requirements documentation and development will occur over the next 12 months, including capturing initial requirements for the IT network, hardware and software modernization that need to be completed at the initial operating capability sites for a successful deployment.

Dashboard Risk Rating: Medium

Small Business Administration: Application Standard Investment

As part of its efforts to update the small business Certify program, SBA plans on spending $18.6 million over 10 years to replace several legacy systems and integrate the new applications under a single program. When finished, the final product will automate and streamline parts of the small business eligibility determination process for adjudicators and help the businesses and reviewers better follow the progress online.

Status per GAO: According to Office of the Chief Information Officer officials, as of November 2019, the acquisition was in the implementation phase, but, due to the use of an incremental development approach, other development phases were also ongoing. Activities for the Acquisition Standard Investment were to be completed in three releases for (1) workflow integration and reporting activities for historically underutilized businesses, woman owned small businesses, and a business development program for small disadvantaged businesses; (2) replacement of a small business search database; and (3) activities supporting data cleanup and change management.

Dashboard Risk Rating: Medium

Social Security Administration: Disability Case Processing System 2

The DCPS2 modernization effort looks to consolidate 52 separate systems developed to determine the eligibility of applicants seeking disability benefits. If all goes as planned, the new system will reduce the time it takes to make disability determinations, reduce or eliminate duplicate and erroneous payments, and handle every other aspect of the determination lifecycle. The project is estimated to cost $177 million over seven years.

Status per GAO: SSA’s Office of the Chief Program Officer reported that the system was re-baselined twice during its development–in August 2015 and October 2018. Specifically, rebaselining took place to transition to shorter incremental release cycles and to update the DCPS2 completion date and cost to include additional development and deployment activities. According to the Office of the Deputy Commissioner for Operations, the agency is using Agile best practices in an iterative and incremental approach to plan deliverables in two-month increments and deliver releases to the DCPS2 user community on a monthly basis. According to SSA officials, as of May 2020, DCPS2 had been deployed at 42 of 52 state Disability Determination Services sites.

The officials added that two of these sites—Maine and Wyoming—terminated their legacy contracts effective September 2019 and solely use DCPS2 to process disability claims determinations. The remaining 40 sites were still using portions of their legacy systems as well as DCPS2 to support the processing of disability claims determinations or had not yet terminated their legacy system contracts.

Dashboard Risk Rating: Low