NASA Chief Information Officer: Opportunities to Strengthen Information
Resources Management (Letter Report, 08/15/96, GAO/AIMD-96-78).
Pursuant to a congressional request, GAO reviewed the National
Aeronautics and Space Administration's (NASA) efforts to implement a
chief information officer (CIO) position, focusing on: (1) CIO
initiatives to improve information resources management (IRM); and (2)
opportunities for NASA to strengthen the CIO position and improve its
IRM program.
GAO found that: (1) NASA CIO has taken some action to address
longstanding IRM problems including the lack of strong leadership,
authority, and oversight, fragmented and overlapping responsibilities,
redundant operations, unintegrated planning and budgeting processes,
multiple communications networks, and poorly managed systems development
efforts; (2) although NASA recognizes the need to address these IRM
problems, it has been reluctant to limit the authority of its field
centers and program offices to make independent decisions on how best to
use information technology (IT) to carry out their missions; (3) despite
these limitations, NASA CIO is instituting software and hardware
standards to achieve interoperability among administrative systems,
integrating IRM planning and budgeting processes, and revising IRM
policies to reflect organizational changes; (4) strengthening the CIO
position would enable NASA to achieve efficiencies and savings among
mission-related systems; (5) agencywide investments in mission-related
systems and related contractor services constitute as much as 91 percent
of the annual NASA IRM budget; (6) funding for IT investments cannot be
accurately consolidated given the nonstandard funding categories that
various program offices use; and (7) instituting an effective IT
resource tracking system is essential to ensuring the effectiveness of
IT investments.
--------------------------- Indexing Terms -----------------------------
REPORTNUM: AIMD-96-78
TITLE: NASA Chief Information Officer: Opportunities to Strengthen
Information Resources Management
DATE: 08/15/96
SUBJECT: Information resources management
ADP procurement
Strategic information systems planning
Human resources utilization
Budget authority
Computer software
Management information systems
Systems architecture
Systems compatibility
IDENTIFIER: NASA External Tank Computer Aided Productivity System
NASA Earth Observing System Data Information System
NASA Equipment Management System
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO report. Delineations within the text indicating chapter **
** titles, headings, and bullets are preserved. Major **
** divisions and subdivisions of the text, such as Chapters, **
** Sections, and Appendixes, are identified by double and **
** single lines. The numbers on the right end of these lines **
** indicate the position of each of the subsections in the **
** document outline. These numbers do NOT correspond with the **
** page numbers of the printed product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
** A printed copy of this report may be obtained from the GAO **
** Document Distribution Center. For further details, please **
** send an e-mail message to: **
** **
** <info@www.gao.gov> **
** **
** with the message 'info' in the body. **
******************************************************************
Cover
================================================================ COVER
Report to the Chairman, Subcommittee on National Security,
International Affairs, and Criminal Justice,
House Committee on Government Reform and Oversight
August 1996
NASA CHIEF INFORMATION OFFICER -
OPPORTUNITIES TO STRENGTHEN
INFORMATION RESOURCES MANAGEMENT
GAO/AIMD-96-78
NASA Chief Information Officer
(511327)
Abbreviations
=============================================================== ABBREV
CAD/CAE - computer aided design/computer aided engineering
CFO - chief financial officer
CIO - chief information officer
IBM - International Business Machines, Inc.
IRM - information resources management
IT - information technology
ITMRA - Information Technology Management Reform Act of 1996
ITMSC - Information Technology Management Steering Council
MOU - memorandum of understanding
NACC - NASA Automated Data Processing Consolidation Center
NASA - National Aeronautics and Space Administration
OIG - Office of Inspector General
OMB - Office of Management and Budget
Letter
=============================================================== LETTER
B-271632
August 15, 1996
The Honorable William H. Zeliff, Jr.
Chairman, Subcommittee on National
Security, International Affairs,
and Criminal Justice
Committee on Government Reform
and Oversight
House of Representatives
Dear Mr. Chairman:
In August 1995, you asked us to assess the effectiveness of the
National Aeronautics and Space Administration's (NASA) initiative to
implement a chief information officer (CIO) position. NASA
established its CIO position in 1995, prior to enactment of the
Information Technology Management Reform Act which, effective August
1996, requires all federal departments and agencies to appoint CIOs.
The CIOs are to provide advice and assistance to senior agency
management and program officials regarding acquisition and management
of information resources. Further, they are to establish processes
and procedures for improving planning and control of agency
information technology (IT) investments. NASA's initiative in this
area is one part of its effort to improve the efficiency and economy
of its operations in order to accommodate significantly reduced
annual budgets. As agreed with your office, this report (1) reviews
NASA's approach to instituting its CIO position, (2) evaluates CIO
initiatives to date to improve information resources management
(IRM), and (3) identifies opportunities for NASA to strengthen its
CIO position and improve its IRM program.
We conducted our review from September 1995 through April 1996 in
accordance with generally accepted government auditing standards.
Our scope and methodology for this review is found in appendix I.
The Acting Deputy Administrator of NASA provided us with written
comments on a draft of our report. These are discussed in the
"Agency Comments and Our Evaluation" section and are reprinted in
appendix II.
RESULTS IN BRIEF
------------------------------------------------------------ Letter :1
NASA appointed its CIO in February 1995 as a senior manager within
the Office of the Administrator to strengthen agency IRM leadership.
NASA was one of the first federal agencies to appoint a CIO, doing so
prior to legislation that now requires all agencies to establish
CIOs. Since then, the NASA CIO has taken some good first steps
toward addressing past problems and improving IRM. These include
instituting a management framework for enhanced IRM cooperation and
coordination. The CIO also has a number of projects underway to
standardize or consolidate agency information resources, such as
desktop and mainframe computers, operational supercomputers, and wide
area networks. Furthermore, NASA recently created a CIO Council to
establish high-level policies and standards, approve IRM plans, and
serve as the IT capital investment advisory group to the newly
established NASA Capital Investment Council.
In chartering its CIO, NASA set specific limits on the CIO's
authority. For example, although the CIO can set agencywide policy
and standards, he must rely on the cooperation of the program offices
and field centers to carry out his direction. NASA preferred that
its program offices and field centers continue to independently
manage their information technology budgets and implement the systems
needed to support their programs.
A number of opportunities exist for a CIO with greater authority to
gain further economies and efficiencies in the information technology
area. Specifically, a strengthened CIO would be in a better position
to settle disputes among the field centers that have impeded full
implementation of the mainframe computer and wide area network
consolidation efforts. Such a CIO would also be better able to
initiate standardization and consolidation projects in
mission-related IT systems, such as project management systems,
engineering design tools, and data storage systems. As a result,
additional savings could be realized. Furthermore, strengthening the
CIO would enable NASA to meet requirements of the Paperwork Reduction
Act which, as amended by the Information Technology Management Reform
Act, will soon require that CIOs provide leadership in overseeing
investments and tracking and managing agency IT resources.
NASA is looking to IRM to play a major role in accommodating some of
the approximately $40 billion in total budget cuts it expects to
experience by the end of the decade. Enlarging the scope of the
CIO's authority and establishing stronger IRM controls would be an
effective way to capture additional savings and sustain long-term IRM
improvements.
BACKGROUND
------------------------------------------------------------ Letter :2
NASA was created by the National Aeronautics and Space Act of 1958 to
undertake civilian research, development, and flight activities in
aeronautics and space. Since its creation, the agency has achieved
significant scientific and technical accomplishments in carrying out
its mission. The agency depends heavily upon IT--hardware, software,
and telecommunications--to support its programs and administrative
operations at its headquarters in Washington, D.C., and at its 10
field centers and associated facilities across the United States. In
late 1995, the agency had a workforce of approximately 21,000 civil
servants and 190,000 contract employees.
As an IT-dependent organization, NASA is also one of the federal
government's top IT investors. NASA estimates that it spent about
$1.6 billion of its total appropriation of approximately $14 billion
in fiscal year 1995 on information technology. From 1994 to 1995,
the agency's IT program ranked as the sixth largest in the United
States government, after the Departments of Defense, Energy,
Transportation, the Treasury, and Health and Human Services. In
1993, the agency ranked third, after Defense and Health and Human
Services.
LONG-STANDING IRM PROBLEMS
AND BUDGETARY FRAMEWORK
---------------------------------------------------------- Letter :2.1
NASA has been criticized in the past for its IRM practices. Reviews
by GAO, the NASA Office of the Inspector General (OIG), and NASA
itself have identified various problems, including a lack of strong
leadership, authority, and oversight; fragmented and overlapping
responsibilities; redundant operations; unintegrated planning and
budgeting processes; poorly managed systems development efforts;
nonstandard and obsolescent systems; and multiple communications
networks.
Many of the problems cited in previous reviews derive from the lack
of IRM leadership and authority. In a study leading to establishment
of its CIO, the agency acknowledged that "the lack of focus and
leadership at NASA headquarters, the lack of a common stimulus for
vision and direction in IT, [have allowed] elements, at all levels of
NASA, to evolve independently of each other."\1 For example:
-- In 1995, NASA's OIG reported that neither NASA headquarters nor
any of its centers had complete inventories of information
systems for which they were responsible. This led to managers
spending limited resources to purchase or develop information
systems which were already available elsewhere within the
agency.\2
-- In an internal 1993 report, NASA found that its IRM
decision-making and planning were not being undertaken in a
deliberate manner. IRM responsibilities were found to be
fragmented, duplicative, and lacking adequate oversight. In
addition, offices and managers accountable for IRM
responsibilities often lacked either enforcement authority,
resources, or both.\3
-- In 1992, we reported that NASA's decentralized program
management structure, including a lack of management controls,
inadequate software standards, and the use of different software
tool sets in different locations, increased the agency's costs
and risks in developing critical space station software.\4
-- In 1990, we reported that NASA had allowed its culture of
autonomy and decentralization to dictate its approach to
managing its administrative information systems, and, as a
result, the agency could not ensure that the systems were being
operated in the most efficient and cost-effective manner. \5
In the currently constrained budget environment, and amid efforts to
increase the economy and efficiency of government operations, NASA
has increasingly been called upon to correct such management
weaknesses, streamline operations, and reduce costs. The
administration has proposed that the agency's budget, which was
estimated at $13.8 billion in fiscal year 1996, be reduced by $4
billion for fiscal years 1997 to 2000. To meet such a cut, the
agency has undertaken a series of internal assessments to determine
what support functions, parts of the "infrastructure," can be
consolidated or otherwise streamlined across NASA centers to achieve
the necessary savings. The agency has adopted a strategy of
attempting to minimize reductions to its major space and aeronautics
programs by taking the deepest cuts in support functions. As one
such support item, the approximately $1.6 billion NASA annually
spends on IT has been targeted for reduction. Specifically, NASA
plans to reduce IT budgets for fiscal years 1997 through 2000 by
about $400 million. NASA appointed its first CIO in February 1995 to
meet both the documented need for greater central leadership and
authority in the IRM area, and the increasing pressure to streamline
IT activities in order to save scarce resources.
--------------------
\1 A Discussion and Framework for Information Resources Management
Within the National Aeronautics and Space Administration, NASA IRM
Review Team, September 23, 1993.
\2 Audit Report: Survey of NASA Information Systems, Office of
Inspector General, (JP-95-003, March 29, 1995).
\3 A Discussion and Framework for Information Resources Management
Within the National Aeronautics and Space Administration.
\4 Space Station: NASA's Software Development Approach Increases
Safety and Cost Risks (GAO/IMTEC-92-39, June 19, 1992).
\5 Administrative Systems: NASA Should Reassess Its AIM Program and
Rescind Its IBM-Compatible Policy (GAO/IMTEC-90-41, May 1, 1990).
SIGNIFICANCE AND KEY ATTRIBUTES
OF AN EFFECTIVE CIO
------------------------------------------------------------ Letter :3
Recent reports, official policy guidance, and legislative acts
identify CIOs as critical to ensuring agencywide commitment to and
successful implementation of IRM improvement initiatives.
Specifically, our Executive Guide: Improving Mission Performance
Through Strategic Information Management and Technology
(GAO/AIMD-94-115, May 1994), which was based on case studies of 10
leading organizations, outlines 11 fundamental IRM "best practices,"
including establishing a CIO and ensuring agencywide commitment to
and involvement in new processes for improved IRM. Our report noted
that it is crucial to implement all of the practices as an integrated
group. Implementing only some of the practices but not others could
leave weaknesses in an organization's IRM activities and hinder the
potential for obtaining significant benefits through the application
of information resources. Further, the Office of Management and
Budget's (OMB) Evaluating Information Technology Investments: A
Practical Guide, published in November 1995, provides a systematic
approach to managing the risks and returns of IT investments.
Finally, the Information Technology Management Reform Act of 1996
(ITMRA), effective August 8, 1996, requires that each federal
department and agency appoint a CIO with responsibility for providing
information and advice to senior officials on IRM issues. ITMRA also
identifies the operative principles for establishing a supporting
management framework to improve the planning and control of
information technology investments. In April 1996, OMB issued
preliminary guidance to clarify CIO responsibilities under ITMRA.
This act amends the Paperwork Reduction Act of 1995, which requires a
number of IRM practices to improve the productivity, efficiency, and
effectiveness of government operations.
Together, the two laws, the OMB guidance, and our Executive Guide
identify a number of characteristics that are key to effective
management of agencywide information resources. For example:
(1) An agency should place its CIO at a senior management level,
making the CIO an equal partner with other senior officials in
decision-making with regard to IRM issues, and supporting the
position with an effective organizational framework for leading
agencywide IRM initiatives. Specifically, agencies should
-- appoint a CIO with expertise and practical experience in
information and technology management;
-- position the CIO as a senior management partner reporting
directly to the agency head;
-- ensure that the CIO is primarily responsible for IRM activities;
-- task the CIO to serve as a bridge between top management, line
management, and information management support professionals;
-- establish a deputy CIO at the agency level and assign other CIOs
as necessary in major organizational subcomponents to represent
their IRM interests; and
-- develop strategies and specific plans for hiring, training, and
professional development of personnel to achieve a highly
qualified IRM workforce.
(2) The CIO should be supported with effective management controls,
including
-- a sound and integrated information technology architecture to
provide a framework for evolving or maintaining existing
information technology and for acquiring new information
technology to achieve the agency's strategic and IRM goals;
-- an inventory of all agency information resources to facilitate
management of these resources and support decision-making
concerning additional investments;
-- management systems and procedures to ensure, in conjunction with
the Chief Financial Officer (CFO), a full and accurate account
of information technology resources and related expenses;
-- appropriate IRM policies, guidelines, and standards and a means
of ensuring agencywide compliance with and effective
implementation of them; and
-- a means of assessing and upgrading the skills of all agency
personnel with regard to IRM.
(3) The CIO should be responsible for working with other agency
officials to ensure the effective acquisition and management of
information resources to support agency programs and missions. This
includes
-- promoting effective agency operations by implementing
budget-linked capital planning for information technology
investments to support the agency's strategic plan;
-- actively participating with other agency managers in IT
planning, budgeting, and investment decision-making;
-- promoting improvements in agency administrative and
mission-related work processes before making significant IT
investments;\6
-- developing performance indicators to measure the extent to which
information resource investments support agency programs and
missions; and
-- monitoring the performance of agency IT programs, evaluating
them on the basis of applicable performance measures, and
advising the agency head regarding whether to continue, modify,
or terminate individual programs or projects.
While the CIO is to play an active role in managing and overseeing IT
investments, it is the agency head's responsibility under the
Paperwork Reduction Act and ITMRA to establish an agencywide process
and framework within which such IT management and oversight is
conducted. In our view, this involves the creation of a high-level
forum or board composed of the CIO, the CFO, and senior line
managers, with responsibility for selecting, controlling, and
evaluating information technology investments against established
criteria. Since it is unrealistic to expect that this agencywide
board would review all IT investments across the organization, the
agency head should establish criteria or thresholds for designating
which investments could be delegated to the subcomponent level for
approval. The agency may want to consider establishing investment
boards within the major subcomponents similar to the agencywide board
to further facilitate investment management and decision-making.
--------------------
\6 Where possible, the agency head is to ensure that agency work
process performance is quantitatively benchmarked and analyzed
against comparable processes in the public or private sector before
revisions or significant IT investments are made.
NASA LIMITED THE POWER AND
AUTHORITY OF ITS CIO
------------------------------------------------------------ Letter :4
While recognizing the need for a CIO to address long-standing IRM
problems and to promote streamlining of IRM functions, NASA has been
reluctant to limit the authority of its field centers and program
offices\7 to make independent decisions about how best to use
information technology to carry out their space and aeronautics
missions. Accordingly, NASA made compromises in setting the CIO's
power and authority. On the one hand, the CIO was given senior
status and supported by a management framework for carrying out IRM
policies and initiatives. On the other hand, the agency set specific
limitations on the CIO's authority over field center activities. CIO
responsibilities and accomplishments within the established
management framework, as well as the limitations on his power and
authority, are discussed in detail below.
--------------------
\7 NASA program offices include the Office of Space Flight, the
Office of Aeronautics, the Office of Space Science, and the Office of
Mission to Planet Earth.
THE CIO'S MANAGEMENT
FRAMEWORK
---------------------------------------------------------- Letter :4.1
In February 1995, the NASA Administrator instituted the CIO position
as an executive-level manager within his office. IRM is the primary
responsibility of the CIO, who reports directly to the Administrator
on information and technology management issues, initiatives, and
progress. Unlike the predecessor Designated Senior Official for IRM,
the CIO is a peer of the Chief Scientist and the Chief Engineer and
is positioned above the center Directors and Associate
Administrators---heads of the various NASA field and headquarters
offices---to promote leadership and authority for agencywide IRM.
(See figure 1 for a chart illustrating the CIO's organizational
placement.) By establishing the CIO at a senior level, NASA
effectively met one of the major requirements of the CIO guidance
discussed above.
(See figure in printed edition.)Figure 1: NASA Organization Chart
As of March 1996. JPL is a
contractor-operated facility.
(See figure in printed
edition.)
The CIO's specific responsibilities include
-- developing a high-level approach to planning and managing IT
investments to support mission priorities;
-- providing broad oversight of information systems and processes
across the agency;
-- leading in planning and coordinating the acquisition of
information resources to carry out cross-functional programs;
-- establishing and monitoring agencywide use of general
information technology policies, architectures, and standards to
achieve interoperability, interconnectivity, and security in
IRM; and
-- assisting program organizations in planning and implementing
their IRM activities.
To support the CIO in carrying out these responsibilities, a deputy
CIO, a staff of six, and 23 center-level CIOs were designated at the
various headquarters offices and field centers. The CIO also
chartered an Information Technology Management Steering Council
(ITMSC) to coordinate IRM activities across programs and to help
define information technology strategies, policies, and standards at
the agency level. The ITMSC, chaired by the CIO, had oversight of a
network of subboards and intercenter committees responsible for IRM
activities, such as planning, technology and data management,
communications networking, and security.
In their comments on a draft of this report, NASA officials informed
us of recent revisions to this CIO management structure.
Specifically, on July 16, 1996, NASA created a CIO Council to
establish high-level policies and standards, approve IRM plans,
address issues and initiatives, and serve as the IT capital
investment advisory group to the proposed NASA Capital Investment
Council. The NASA Capital Investment Council will be chaired by the
Associate Deputy Administrator and have responsibility for looking at
all capital investments across NASA, including those for IT.
Membership on the CIO Council includes the CFO and Associate
Administrators for headquarters operations and the various program
offices. The CIO, or in his absence, the Deputy CIO, will chair this
group. NASA also replaced the ITMSC and its four subboards with the
Information Technology Standards/Architecture Integration Council to
better coordinate and integrate institutional and programmatic IT
requirements and recommend IT policies, standards, practices, and
procedures. "Lead centers," designated to manage specific IRM
systems and projects for agencywide benefit, will assume some
responsibilities of the former subboards. The lead centers will also
oversee the intercenter committees formed to coordinate IRM
activities at the operational level.
LIMITATIONS ON CIO AUTHORITY
---------------------------------------------------------- Letter :4.2
NASA took several steps to ensure that its program offices and field
centers would retain broad flexibility in managing their own IRM
activities. For example, based on recommendations of the working
group chartered to formulate the CIO position, NASA made the
following decisions:
-- The 23 CIO representatives would continue to officially report
through their normal chains of command and remain accountable to
senior management at their own offices or centers, while working
on a collaborative basis with the CIO. This created a dual
reporting chain for the CIO representatives. The working group
devised this approach so that the CIO representatives would
remain "customer-focused," viewing CIO standards and policies in
the context of their agency programs and operations. The group
also wanted to avoid creating the CIO structure as an
independent management system and instead have the CIO and his
representatives depend on the ITMSC and its subboards as a
vehicle for coordination and cooperation with the rest of the
agency.
-- The CIO would use a memorandum of understanding (MOU) to reach
agreement with each of the designated lead centers. By not
establishing direct reporting links to the CIO, the head of the
working group told us, NASA aimed to keep the CIO "dependent
upon operational units below him for support [and] ensure
'friendly tension' and checks and balances" in their management
relationships. This was also done to keep the CIO at a high,
policy level rather than at an operational level.
-- The CIO would not control any part of the NASA budget because he
would not be responsible for funding individual systems or
programs. NASA also accepted the working group's position that
the CIO did not need budget authority as a mechanism for
enforcing policy and standards. As the head of the working
group asserted, "once the CIO issues a policy decision, the rest
of the agency is to adhere to it."
-- The CIO would not take part in individual program decisions and
would not have responsibility for setting priorities, making
trade-offs, or forming investment decisions among NASA-wide IT
systems and programs. The head of the working group believed
that the CIO would not be familiar with detailed program
requirements and, thus, should not be involved in such
decision-making.
Because of these restrictions, the CIO's responsibility was
essentially limited to formulating high-level policy and managing
cooperative initiatives to consolidate and achieve efficiencies among
administrative and cross-cutting IRM resources. In contrast, NASA's
10 field centers and related program offices retained responsibility
for (1) deciding which IT projects to pursue, (2) developing
supporting budgets, and (3) managing and overseeing implementation of
IRM initiatives. The field centers were not specifically required to
comply with CIO guidance. Consequently, the success of the CIO
position has been dependent upon their cooperation.
CIO INITIATIVES TO DATE
REPRESENT FIRST STEPS TOWARD
MORE EFFECTIVE IRM
------------------------------------------------------------ Letter :5
Despite the limitations imposed on his authority, the NASA CIO has
taken some important first steps to improve IRM at NASA. One of the
first areas the CIO targeted was administrative information resources
used in day-to-day management of NASA operations. Initiatives in
this area include instituting software and hardware standards and
developing a technical architecture to achieve interoperability among
administrative systems at the desktop and file server levels. As
part of this initiative, the CIO called for restrictions on the
acquisition of nonstandard desktop computers and related equipment.
Specifically, the CIO set a NASA policy of not buying new equipment
unless it is (1) necessary to replace obsolete equipment or (2)
critical to fulfilling mission-related requirements. The policy also
allows exceptions for renewal of existing software licenses. Other
related administrative systems initiatives include projects to
standardize electronic mail capability, consolidate management of
work station hardware and software, and collaborate with the CFO to
acquire commercial software for an integrated financial management
system.
A second major CIO effort has been to direct the consolidation of
various larger elements of NASA's IT infrastructure that are shared
by components across the agency. In one case, this effort has led to
physical consolidation of some IT equipment and facilities at a
single site, while in other cases consolidation of management
functions or support contracts is being planned or beginning
implementation. The NASA Automated Data Processing Consolidation
Center (NACC) at Marshall Space Flight Center, for example, is the
site designated by the CIO for physically collocating all NASA
administrative IBM and IBM-compatible mainframe systems and selected
mission-related applications, such as the External Tank Computer
Aided Productivity system. According to agency information, since
the consolidation began, NACC has saved over $6 million by
economizing on software licenses, labor, hardware maintenance, and
capacity management.\8 NASA estimates a total savings of $75 to $90
million from the NACC over the next 5 years.
There are also plans underway for Ames Research Center to be the
consolidated manager of supercomputers used for science and
engineering purposes beginning in October 1996. Officials in charge
of the project report that they expect to save about $228 million
from fiscal years 1994 through 2000. Further, the CIO had some early
involvement, in conjunction with the Office of Space Communications,
in directing the consolidation of the management, engineering, and
operations of NASA's wide area telecommunications networks at
Marshall. NASA expects this effort to save $236 million over the
next 6 years.
The CIO also has revised management processes to accompany these IT
systems initiatives. These revisions include:
-- integrating IRM planning and budgeting processes to coordinate
data collection and reporting requirements;
-- revising and updating IRM policy to reflect organization changes
and meet streamlining objectives; and
-- simplifying IRM self-assessment procedures, with greater
emphasis on continuous improvement and risk management.
--------------------
\8 NACC was originally chartered in January 1994 to consolidate
Office of Space Flight computer workloads, but was expanded by the
CIO in 1995 to include all NASA field centers.
OPPORTUNITIES TO STRENGTHEN THE
CIO POSITION AND IRM PROGRAM
------------------------------------------------------------ Letter :6
Standardization and consolidation efforts undertaken so far have been
to some degree successful. Nevertheless, they have been slowed in
some areas by a lack of consensus among the field centers that the
CIO has been unable to overcome. Furthermore, there are additional
opportunities for achieving efficiencies and savings among
mission-related systems that the CIO has not yet pursued, principally
because of his limited ability to influence the program offices and
field centers that have direct responsibility for NASA's space and
aeronautics missions.
CONSOLIDATION EFFORTS TO
DATE HAVE LACKED AGENCYWIDE
AUTHORITY
---------------------------------------------------------- Letter :6.1
As discussed above, the CIO has had some involvement in three major
consolidation efforts undertaken to date: the NACC project to
consolidate IBM mainframe systems at Marshall, the network
consolidation effort being managed by Marshall, and the supercomputer
consolidation project to be managed by Ames. While all three
projects are likely to realize increased efficiencies and savings, at
least two have experienced delays and other shortcomings that could
have been resolved by a CIO who had greater authority and control
over agencywide IT resources and activities.
Regarding the NACC effort, a significant dispute developed among the
field centers that prevented full implementation of the consolidation
as originally planned by the CIO. In June 1995, the CIO requested
that all IBM-type mainframes used for mission-related or
administrative purposes be moved to the NACC at Marshall. However,
Goddard Space Flight Center chose to exempt its mainframes used for
mission-related purposes, such as monitoring the flight dynamics of
unmanned space missions, from this consolidation. Goddard officials
argued that it was unnecessary to transfer these machines because
they were planning to invest in more advanced computer technology,
which they could continue to manage and operate at Goddard. NACC
officials at Marshall, as well as the CIO, however, believed the
systems should be included in the consolidation. The dispute
remained unresolved for several months. In July 1996, we were told
by an NACC official at NASA Headquarters that the matter had been
resolved. According to the official, NACC officials at Marshall
agreed not to include mission-related systems in the NACC
consolidation as originally envisioned. Thus, Goddard would be
allowed to continue to independently maintain its mission-related
systems. Lacking the necessary CIO authority to effectively organize
this agencywide consolidation, the centers reduced the scope of the
effort to include only administrative systems.
Similar problems occurred in the context of NASA's effort to
consolidate wide area networks. In this case, the Office of Space
Communications decided to begin consolidation by designating Marshall
as the lead center and adopting Marshall's approach to consolidation,
despite proposals by Goddard and Ames Research Center that suggested
that more economical approaches could be adopted. The CIO's proposal
that a competition be conducted among NASA centers to determine the
best network consolidation strategy was not adopted by the Office of
Space Communications. However, as we discussed in our recent report,
the consolidation approach chosen by NASA may not result in the
greatest possible savings.\9 The approach also did not include all
five of NASA's wide area networks. Since our report was issued, NASA
has accepted our recommendation to conduct an independent study of
how best to consolidate its networks and has said that it may amend
its approach, based on the study's findings. In our opinion, a CIO
with greater authority could have directed a more comprehensive
approach from the outset.
--------------------
\9 We recently assessed NASA's plans to consolidate these networks.
See Telecommunications Network: NASA Could Better Manage Its Planned
Consolidation (GAO/AIMD-96-33, April 9, 1996).
ADDITIONAL OPPORTUNITIES FOR
CONSOLIDATION AND
STANDARDIZATION
---------------------------------------------------------- Letter :6.2
According to the CIO and other officials, the consolidation
initiatives undertaken to date were chosen because they were
relatively easy to identify and implement, and offered quick savings
and improvements. These officials acknowledged, however, that there
are additional opportunities for streamlining, consolidating, or
standardizing mission-critical, scientific, or engineering systems.
These opportunities could result in significant savings, especially
given the fact that NASA spends as much as 91 percent of its IT
budget on mission-related activities.\10
Typical mission-related systems are used for project and data
management, mission control, computer-aided design, and flight
management. Often custom-designed or acquired to meet specific
project requirements, these systems are managed on a decentralized
basis. As such, little attention has been paid to issues of systems
duplication or inefficiency among the various program offices and
field centers. Several officials, including the former CIO,
indicated that NASA has traditionally not concerned itself with the
cost-effectiveness or return-on-investment potential of its
mission-related systems.
While no comprehensive effort has been undertaken to identify the
full range of opportunities for consolidating and standardizing
mission-related IT systems and their associated cost savings, based
on discussions with various NASA officials, the following are
examples of areas that could be streamlined:
-- Project management, configuration management, action tracking,
and other systems that are actually administrative in nature but
are managed as mission-related program components. According to
the former deputy CIO, such systems are often independently
acquired and implemented from mission to mission, even though
the need for them could be filled by shared or commercial
systems.
-- At least four types of software in use across the agency for
orbit determination--a mathematical process to track past orbits
and project future paths of NASA satellites. According to space
operations officials, there is a clear opportunity to
standardize operations in this area so that NASA does not
continue to build redundant systems to meet similar
requirements.
-- Engineering tools, such as computer aided design/computer aided
engineering (CAD/CAE) systems. According to the former deputy
CIO, the Space Shuttle and Space Station programs are using
incompatible CAD/CAE products. As a result, engineers from one
program can view documents but cannot manipulate data in the
other program's engineering system.
-- Multiple data archival and storage systems. In March 1995, the
Information Systems Cross-Cutting Team\11
recommended developing a standard approach for acquiring software
used in data storage systems to promote sharing, interoperability,
and cost reductions. NASA has more than 20 systems to archive and
store scientific, engineering, and administrative data relative to
spaceflight planning and analysis. However, improving the efficiency
of data storage has not been part of the CIO's improvement program.
--------------------
\10 NASA could not provide an accurate account of its IT expenditures
because of the fragmented manner in which its budgets are compiled.
However, according to some NASA managers and our own independent
analysis, agencywide investments in these systems and related
contractor services constitute as much as 91 percent of the agency's
annual IRM budget.
\11 The Information Systems Cross-Cutting Team was led by the former
CIO before he assumed the CIO position. This team was chartered in
1994 by the NASA Administrator as part of the Zero-Based Review and
sought to identify areas for streamlining and cost-savings.
NEW LEGISLATIVE REQUIREMENTS
CALL FOR A STRONGER CIO
POSITION AND IRM PROGRAM
---------------------------------------------------------- Letter :6.3
The recently enacted Information Technology Management Reform Act of
1996, which supplements the Paperwork Reduction Act, requires NASA to
strengthen its CIO position. The new law's requirements will take
effect in August 1996. For example, ITMRA requires agencies to
design and implement a strategic process for maximizing the value and
assessing and managing the risks of IT acquisitions. As elaborated
by our Executive Guide and OMB's investment guide, a key component of
this process is an investment review board to select, control, and
evaluate IT investments. However, we found during the course of our
audit that NASA lacked such an agencywide process and instead, as
discussed above, allowed IT investment decisions to be made by
individual field centers and program offices. NASA's proposed
Capital Investment Council may fill this need; however, the council
has not yet been formally established.
The lack of an agencywide process for overseeing investments means
that NASA has no systematic means of ensuring that particular IT
systems and projects do not duplicate other efforts underway and are
an appropriate use of diminishing funds. Accordingly, the individual
centers have developed redundant and unintegrated accounting and
reporting systems and have acquired mission-related systems and tools
on a project by project basis, often without considering
opportunities for sharing or consolidation.
ITMRA also requires that CIOs monitor the performance of existing
information technology programs on the basis of applicable
performance measurements and advise the agency head regarding whether
to continue, modify, or terminate projects or programs. However,
NASA's CIO has no program in place to measure IRM performance. As
discussed above, CIO efforts have focused on consolidating and
achieving efficiencies among administrative and cross-cutting IRM
resources. The CIO does not have the authority to conduct systems
review and oversight. Existing processes for oversight of systems
and programs are fragmented, conducted through various channels at
various levels, depending upon the dollar amounts involved.
For example, the Program Management Council chaired by the Deputy
Administrator is in some ways a corporate investment review board for
NASA. The Council is a high-level board responsible for planning,
implementation, and management of major programs costing more than
$200 million. However, the Council does not review all NASA programs
and does not specifically review IT programs. Only a few IT
projects, such as the Earth Observing System Data and Information
System, may receive review at this level. Further, while information
technology investments over $100 million may be reviewed at the
headquarters level, NASA's individual field centers and corresponding
program offices are responsible for independently managing all IT
investments below this threshold. More effective systems review and
oversight, including consistent investment management processes and
procedures agencywide, could help preclude past problems, such as
costly, poorly managed, and high-risk software development efforts,
from continuing in the future.\12 NASA's proposed Capital Investment
Council, which is intended to supplement the Program Management
Council by reviewing major capital investments, may address this
concern once it is implemented.
Further, the Paperwork Reduction Act requires agencies to develop and
maintain complete inventories of their computer equipment. Knowing
what information resources an organization has is necessary to
effectively manage them, and further, is necessary to make decisions
regarding the investment in additional resources. As we previously
indicated, NASA's Office of the Inspector General reported in its
Survey of NASA Information Systems (JP-95-003, March 29, 1995) that
the agency does not have a complete systems inventory, resulting in
the unnecessary expenditure of limited resources to purchase or
develop information systems already available elsewhere within the
agency. NASA's IRM Director said that his office keeps an inventory
of major systems for reporting purposes, but conceded that it is
incomplete. Though an automated standard tool is being put in place
to generate an inventory of systems at the desktop and file server
levels, NASA has no means of centrally identifying mission-related
information systems, except to the extent that programs include
desktop and file server equipment.
--------------------
\12 The following reports provide examples of some of the systems
development problems we identified at NASA in recent years: Space
Station: NASA's Software Development Approach Increases Safety and
Cost Risks (GAO/IMTEC-92-39, June 19, 1992); Financial Management:
Actions Needed to Ensure Effective Implementation of NASA's
Accounting System (GAO/AFMD-91-74, August 21, 1991); and Space
Shuttle: NASA Should Implement Independent Oversight of Software
Development (GAO/IMTEC-91-20, February 22, 1991).
EFFECTIVE IRM REQUIRES
BETTER VISIBILITY OF IT
RESOURCES
---------------------------------------------------------- Letter :6.4
NASA does not have a process for collecting and maintaining accurate
information on its IT resources. No comprehensive agencywide budget
for IT exists, and individual program offices compile separate IT
budgets to support the mission requirements of field centers under
their purview. Funding for administrative and institutional IT is
spread among these individual budgets and cannot be accurately
consolidated, given the nonstandard funding categories that the
various program offices use. Data on funding for mission-related
information technology must be extracted from budget subtotals for
individual programs and projects and also is not very accurate.
Existing summaries of agencywide IT investments are merely estimates
derived from gathering and analyzing budget numbers submitted by the
program offices for reporting purposes.
Given such budget processes, there is no accurate means of keeping
track of NASA IT financial resources and how they are spent. IRM
officials told us, for example, that savings resulting from IRM
improvement initiatives are not systematically tracked or visible to
senior managers on an agencywide basis. Further, the CIO has no
effective means of ensuring that agencywide IT expenditures are made
in accordance with newly instituted effectiveness and efficiency
goals. Specifically, the CIO requires that center representatives
report to his office on their efforts to implement his policies
regarding managing IT obsolescence, freezing procurements, and
standardizing administrative systems across the agency. However, as
previously discussed, the centers do not have adequate management
processes or inventory systems in place for meeting such
requirements. For example, the database of the NASA Equipment
Management System that the centers would ordinarily rely upon to meet
this need is out-of-date, and the information it contains is not
detailed enough to fulfill CIO requirements. Instituting an
effective IT resource tracking system will be an essential step
toward ensuring the effectiveness of IT investments and meeting the
requirements of ITMRA and related legislation.
The CIO has initiated some efforts to facilitate center reporting,
but it is still too soon to determine their impact. For example, the
CIO said that he has a project underway to define a set of data that
the centers will need to meet reporting requirements that are
expected to begin this summer. The centers are also in the process
of implementing a new system--Norton Administrator--to provide
standard inventories of agencywide technology and facilitate the
required reporting. However, this system only accounts for equipment
connected to local area networks and does not address the existence
of unique, standalone equipment. Further, the new CIO management
structure recently established in July 1996 is designed to address
other IT management issues, such as the need for an investment review
mechanism and performance measures for evaluating progress in
achieving agency objectives. However, it is too early at this point
to assess the effectiveness of this management structure and the
level of commitment afforded to it.
CONCLUSIONS
------------------------------------------------------------ Letter :7
NASA has gained some initial IRM improvements through its appointment
of a CIO. By establishing a CIO Council to help select, control, and
evaluate its systems investments, NASA is beginning to conform to the
Paperwork Reduction Act and ITMRA and should be in a position to
better manage its information resources in the future. However, as
currently chartered, the CIO is limited in achieving substantial
additional economies and efficiencies in IRM. Clear opportunities
exist for a CIO with more authority to pursue greater consolidation
and standardization of agency systems. Additional improvements, such
as instituting effective mechanisms for IT inventorying and
accounting, will also be critical.
RECOMMENDATIONS
------------------------------------------------------------ Letter :8
We recommend that the Administrator of the National Aeronautics and
Space Administration strengthen the agency's IT management processes
by strengthening the requirement that NASA organizations abide by IRM
policies, guidelines, standards, and architectures instituted by the
CIO and establishing clear and consistent procedures for granting
waivers and resolving conflicts.
In addition, we recommend that the NASA Administrator direct the CIO
to
-- establish and maintain a complete and accurate inventory of
agencywide IT resources for investment management and
decision-making purposes,
-- work with the CFO to develop the systems and procedures
necessary to accurately account for all IT-related expenditures,
-- define and implement IT performance measures in order to assess
the effectiveness of the agency's systems investments in meeting
program and mission requirements,
-- identify opportunities for greater efficiencies and cost
reductions among mission-related IT resources and include these
in ongoing standardization and consolidation efforts, and
-- promote improvements in agency administrative and
mission-related work processes through the increased use of IT.
AGENCY COMMENTS AND OUR
EVALUATION
------------------------------------------------------------ Letter :9
In its written comments on a draft of our report, NASA acknowledged
that there was room for improvement in its IRM activities and stated
that it generally supported the report's recommendations and had
activities underway to address all of them. Because it has these
initiatives underway, NASA criticized the report as out-of-date and
unjustifiably negative.
Based on its comments, we have updated the information in our report
as appropriate and believe that NASA's actions may ameliorate our
concerns over time. However, we do not believe that our findings are
either out-of-date or invalid. Many of the initiatives cited by NASA
were only recently implemented, and it is still too early to
determine their effectiveness. The establishment of the new CIO
Council, for example, was not made official until after NASA
submitted its comments to us. However, as discussed in our more
detailed evaluation of NASA's comments, which are reprinted in
appendix II, we deleted two proposals because of these recent
initiatives. These proposals focused on establishing an IT
investment review forum and clarifying the relationship between the
CIO and the IRM office.
As discussed in the report, we believe that NASA has taken some good
first steps towards addressing past problems and improving IRM. We
support NASA's efforts to address our recommendations. We also
believe that our findings and recommendations can provide a useful
framework for measuring continued progress.
---------------------------------------------------------- Letter :9.1
We are sending copies of this report to the Administrator of NASA;
the Director of the Office of Management and Budget; the Ranking
Minority Member of your Subcommittee; and the Chairmen and Ranking
Minority Members of the House and Senate Committees on
Appropriations; the House Committee on Science; the Senate Committee
on Commerce, Science, and Transportation; and the Senate Committee on
Governmental Affairs. We will send copies to other interested
parties upon request.
Please contact me at (202) 512-6240 if you have any questions
concerning this report. Major contributors to this report are listed
in appendix III.
Sincerely yours,
Jack L. Brock, Jr.
Director, Defense Information and
Financial Management Systems
SCOPE AND METHODOLOGY
=========================================================== Appendix I
To accomplish our review objectives, we focused on (1) assessing the
CIO's placement, leadership, and authority for agencywide IRM, (2)
evaluating the CIO's approach to instituting standards and
initiatives for more strategic and cost-effective IRM, and (3)
examining processes and controls to support the CIO in managing
information technology investments and identifying areas for
improvement. We based our review on criteria from three sources:
(1) the requirements of ITMRA, (2) guidance prepared by OMB on
implementing ITMRA and evaluating IT investments, and (3) our
Executive Guide: Improving Mission Performance Through Strategic
Information Management and Technology (GAO/AIMD-94-115, May 1994).
To obtain background information on the long-standing IRM problems at
NASA, we reviewed reports from the General Services Administration,
the NASA Office of the Inspector General, NASA, and GAO. We also
discussed these reports with OIG and NASA officials.
To assess the CIO's placement, leadership, and authority for
agencywide IRM, we met with the CIO, his successor, the Deputy CIO,
and other officials in their organization. From these officials, we
obtained documentation on their vision for more strategic management
of NASA-wide information resources. We examined organization charts,
position descriptions, steering council minutes, and committee
charters to learn about the newly instituted CIO management framework
and to identify the agencywide IRM chain of command. We interviewed
officials in the headquarters IRM office, program offices, and
selected centers to learn about accountability to the CIO for
information technology management. We also reviewed existing IRM
plans and guidance and newly-issued CIO policy directives to
determine their breadth of coverage and to identify oversight and
control mechanisms for ensuring agencywide application.
To evaluate the CIO's approach to instituting standards and
initiatives for more strategic and cost-effective IRM, we met with
officials of four IRM steering council subboards and discussed their
efforts to improve in the areas of planning, technology
standardization, data management, and information resources
consolidation. We obtained and reviewed briefing documents, plans,
and correspondence that summarized these and other standardization
efforts. Members of an evaluation team discussed with us the
criteria and analysis they used to help the CIO select and establish
lead centers to help standardize and consolidate supercomputers,
mainframes, communications networks, and workgroup technology. IRM
and financial management officials told us about efforts to upgrade
and integrate management information systems for agencywide use.
Relevant technical officials provided information on approaches to
building hardware, information, and data architectures. IRM
officials and information technology users in various program offices
and centers told us about their commitment and steps taken to
implement centrally-directed standards and initiatives.
To determine whether NASA has adequate processes and controls in
place to support the CIO in managing agencywide information
technology investments and to identify areas for improvement, we
discussed with key officials NASA's processes for selecting, funding,
and overseeing management of its information technology acquisitions
and whether there are opportunities for greater CIO involvement. For
this review, we also relied on the results of a separate GAO review
of information technology investment management at five agencies,
including NASA.
We conducted our review from September 1995 through April 1996 in
accordance with generally accepted government auditing standards. We
performed our work at NASA headquarters in Washington, D.C.; the Ames
Research Center in Moffett Field, California; the Goddard Space
Flight Center in Greenbelt, Maryland; and the Marshall Space Flight
Center in Huntsville, Alabama.
(See figure in printed edition.)Appendix II
COMMENTS FROM THE NATIONAL
AERONAUTICS AND SPACE
ADMINISTRATION
=========================================================== Appendix I
(See figure in printed edition.)
(See figure in printed edition.)
(See figure in printed edition.)
The following are GAO's comments on the National Aeronautics and
Space Administration's letter dated June 28, 1996.
GAO COMMENTS
1. NASA asserts that GAO relied on "out-of-date reports" to develop
its audit findings rather than directly investigating the current
activities of the CIO. This is not the case. Although we reviewed
previous reports in order to obtain background information on past
IRM problems at NASA, all of our audit findings were derived from a
thorough data collection activity and numerous interviews with senior
officials at NASA headquarters and key field centers from September
1995 through April 1996. The details of our methodology are
explained in appendix I.
Our background review of prior reports was used, both in our audit
and in the report, chiefly as a means to establish the context of
long-standing IRM problems that the newly-appointed CIO faced when he
began work. We note in our report that the CIO has already made
significant improvements over past NASA IRM practices, such as
instituting a management framework for enhanced IRM coordination and
initiating projects to standardize or consolidate agencywide
information resources.
NASA mentions several initiatives that it says have been underway
over the past year. However, several of these activities are very
recent and were not mentioned by IRM officials during our interviews.
For example, the reassignment of IRM policy, planning, and oversight
staff to the office of the CIO was first announced in May 1996 and
has not yet been completed. Further, the CIO Council, intended to be
responsible for overseeing investment strategies and decisions, was
just established on July 16, 1996. Given the newness of these
actions, we believe that our findings and recommendations remain
useful as a framework for measuring continued progress in improving
IRM.
2. Due to the recent organizational changes discussed above, the
chart on the CIO Management Structure has been deleted from the
report. In addition, we deleted from our draft report a proposal
that NASA clarify the linkage of the IRM organization to the CIO
office since NASA is in the process of addressing this relationship.
We have made other changes throughout the report to include updated
information where appropriate.
3. NASA states that it does not believe that the agency CIO must
have budget authority over all agency IT investments in order to be
effective. We agree with NASA on this point. In fact, we are not
making any recommendation to give the CIO such authority. Rather, we
believe that a more authoritative CIO, participating in the budget
process, would be in a better position both to advise an investment
review board on potential IT investments and to coordinate
implementation of the prioritized decisions of the board. The new
CIO Council, intended to be responsible for IT investment review and
oversight, may address this concern. Accordingly, we have not
included our earlier proposal that NASA establish such a council.
4. NASA states that GAO used previous reports on NASA's IRM
activities to substantiate its findings in the current report. This
is not true. The previous reports are referenced in order to
characterize the problems that NASA has faced in the IRM area in the
past. In order to avoid confusion, we have deleted the reference to
the 1994 General Services Administration report, which did not
contribute substantially to characterizing NASA's past IRM problems.
Further, we disagree with NASA that the OIG's 1995 report findings
were unsubstantiated and believe that the report's findings are
relevant. For example, based on our own independent audit work, we
also found that an accurate systems inventory was lacking and was
needed. The findings in our report, which address the effectiveness
of the CIO since inception in early 1995, are all based on recent
audit work conducted by GAO.
5. The data center consolidation effort is one of the CIO activities
that we cite as an example of a good first step. We believe that the
consolidation effort has been beneficial. However, its
implementation has been slowed by unresolved differences in
approaches and opinions among the field centers and headquarters.
These resulted in genuine disputes rather than merely "open, candid
dialogue" as NASA has asserted. Without anyone to take charge and
direct a solution, the consolidation effort was ultimately redefined
to not include mission-related systems. We continue to believe that
stronger leadership from the CIO could have led to a solution that
would not have resulted in such a significant reduction in the scope
of the effort.
MAJOR CONTRIBUTORS TO THIS REPORT
========================================================= Appendix III
ACCOUNTING AND INFORMATION
MANAGEMENT DIVISION, WASHINGTON,
D.C.
John A. de Ferrari, Assistant Director
Sondra F. McCauley, Evaluator-in-Charge
Cristina Chaplain, Communications Analyst
ATLANTA REGIONAL OFFICE
Reginia S. Grider, Evaluator
*** End of document. ***
|
NEWSLETTER
|
|
Join the GlobalSecurity.org mailing list
|
|
|
