Summary

The Department of Homeland Security (DHS) is responsible for coordinating the federal government's homeland security communications with all levels of government. In support of this mission, DHS implemented, and has been enhancing, the Homeland Security Information Network (HSIN). It also has proposed a follow-on system, called Next Generation HSIN (HSIN Next Gen). GAO was asked to determine whether (1) DHS has stopped further improvements on HSIN and if so, the department's rationale for doing so and plans for acquiring its proposed follow-on system HSIN Next Gen and (2) the department is effectively managing the HSIN Next Gen acquisition. To accomplish this, GAO analyzed documentation, interviewed officials, and compared acquisition management processes and practices defined in industry best practices with those planned and underway by DHS.

DHS halted further improvements on the existing HSIN system in September 2007. Since then, the department has continued to operate and maintain the system while a replacement--HSIN Next Gen--is being planned and acquired. DHS decided in large part to pursue this replacement due to the existing system has security and information-sharing limitations that do not meet department and other users' needs, thus impeding the department's ability to effectively perform its mission; and the new system is to be a key part of a departmentwide consolidation effort to, among other things, reduce the number of systems within DHS that share sensitive but unclassified information. DHS has developed an acquisition strategy for HSIN Next Gen, whereby the system is to be implemented in four phases, each providing for an increasing number of users to be transitioned to the system. For example, DHS plans to begin transitioning existing HSIN users beginning in May 2009. Further, in May 2008, DHS issued a task order engaging a contractor to acquire, deploy, operate, and maintain the new system. The total estimated value of the task order's initial year is $19 million; the order also includes 4 option years that if exercised, are estimated to be worth $62 million. DHS intends to continue to use the existing HSIN with the goal of terminating its use in September 2009 when HSIN Next Gen is to be fully completed. DHS estimates it will cost $3.1 million to operate and maintain HSIN between now and its planned September 2009 termination. DHS is in the process of implementing key acquisition management controls for HSIN Next Gen, but has yet to implement the full set of controls essential to effectively managing information technology system projects in a rigorous and disciplined manner. Specifically, it has not fully implemented key process controls in the areas of project and acquisition planning, requirements development and management, and risk management. DHS officials, including the Office of Operations Coordination and Planning's Chief Information Officer, who is responsible for managing the project, attribute the partial implementation of these key processes in large part to the aggressive schedule for acquiring and deploying HSIN Next Gen. The Chief Information Officer also stated the department plans to address these weaknesses by, for example, tasking its contractor to assist in the development and completion of the risk management process area, but had not yet established dates for when all of these activities will be completed. Until these weaknesses are effectively addressed and DHS implements and institutionalizes the full set of acquisition management controls, the project will be at increased risk of operating in an ad hoc and chaotic manner--potentially resulting in increased project costs, delayed schedules, and performance shortfalls.

Recommendations

Our recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Implemented" or "Not implemented" based on our follow up work.

Recommendations for Executive Action