Congressional Hearings
FITARA 8.0
Congressional Hearings
SuDoc ClassNumber: Y 4.G 74/7
Congress: House of Representatives
CHRG-116hhrg37281
| AUTHORITYID | CHAMBER | TYPE | COMMITTEENAME |
|---|---|---|---|
| hsgo00 | H | S | Committee on Oversight and Reform |
[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]
FITARA 8.0
=======================================================================
HEARING
BEFORE THE
SUBCOMMITTEE ON GOVERNMENT OPERATIONS
OF THE
COMMITTEE ON OVERSIGHT
AND REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTEENTH CONGRESS
FIRST SESSION
__________
JUNE 26, 2019
__________
Serial No. 116-40
__________
Printed for the use of the Committee on Oversight and Reform
[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]
Available on: http://www.govinfo.gov
http://www.oversight.house.gov or
http://www.docs.house.gov
___________
U.S. GOVERNMENT PUBLISHING OFFICE
37-281 PDF WASHINGTON : 2019
COMMITTEE ON OVERSIGHT AND REFORM
ELIJAH E. CUMMINGS, Maryland, Chairman
Carolyn B. Maloney, New York Jim Jordan, Ohio, Ranking Minority
Eleanor Holmes Norton, District of Member
Columbia Justin Amash, Michigan
Wm. Lacy Clay, Missouri Paul A. Gosar, Arizona
Stephen F. Lynch, Massachusetts Virginia Foxx, North Carolina
Jim Cooper, Tennessee Thomas Massie, Kentucky
Gerald E. Connolly, Virginia Mark Meadows, North Carolina
Raja Krishnamoorthi, Illinois Jody B. Hice, Georgia
Jamie Raskin, Maryland Glenn Grothman, Wisconsin
Harley Rouda, California James Comer, Kentucky
Katie Hill, California Michael Cloud, Texas
Debbie Wasserman Schultz, Florida Bob Gibbs, Ohio
John P. Sarbanes, Maryland Ralph Norman, South Carolina
Peter Welch, Vermont Clay Higgins, Louisiana
Jackie Speier, California Chip Roy, Texas
Robin L. Kelly, Illinois Carol D. Miller, West Virginia
Mark DeSaulnier, California Mark E. Green, Tennessee
Brenda L. Lawrence, Michigan Kelly Armstrong, North Dakota
Stacey E. Plaskett, Virgin Islands W. Gregory Steube, Florida
Ro Khanna, California
Jimmy Gomez, California
Alexandria Ocasio-Cortez, New York
Ayanna Pressley, Massachusetts
Rashida Tlaib, Michigan
David Rapallo, Staff Director
Wendy Ginsberg, Subcommittee Staff Director
Yvette Badu-Nimako, Director of Policy and Counsel
Joshua Zucker, Assistant Clerk
Christopher Hixon, Minority Staff Director
Contact Number: 202-225-5051
------
Subcommittee on Government Operations
Gerald E. Connolly, Virginia, Chairman
Eleanor Holmes Norton, District of Mark Meadows, North Carolina,
Columbia, Ranking Minority Member
John Sarbanes, Maryland Thomas Massie, Kentucky
Jackie Speier, California Jody Hice, Georgia
Brenda Lawrence, Michigan Glenn Grothman, Wisconsin
Stacey Plaskett, Virgin Islands James Comer, Kentucky
Ro Khanna, California Ralph Norman, South Carolina
Stephen Lynch, Massachsetts W. Steube, Florida
Jamie Raskin, Maryland
C O N T E N T S
----------
Page
Hearing held on June 26, 2019.................................... 1
Witnesses
Ms. Suzette Kent, Federal Chief Information Officer, Office of
Management and Budget
Oral Statement................................................... 3
Ms. Carol Harris, Director, IT Management Issues, Government
Accountability Office
Oral Statement................................................... 4
Mr. Gary Washington, Chief Information Officer, U.S. Department
of Agriculture
Oral Statement................................................... 18
Mr. Jason Gray, Chief Information Officer, U.S. Department of
Education
Oral Statement................................................... 20
Mr. Eric Olson, Chief Information Officer, U.S. Department of the
Treasury
Oral Statement................................................... 21
Written opening statements and statements for the witnesses are
available on the U.S. House of Representatives Document
Repository at: https://docs.house.gov.
No additional documents were entered into the record during this
hearing.
FITARA 8.0
----------
Wednesday, June 26, 2019
House of Representatives
Subcommittee on Government Operations
Committee on Oversight and Reform
Washington, D.C.
The subcommittee met, pursuant to notice, at 4:07 p.m., in
room 2154, Rayburn House Office Building, Hon. Gerald E.
Connolly (chairman of the subcommittee) presiding.
Present: Representatives Connolly, Norton, Khanna, Meadows,
Massie, Grothman, and Jordan.
Mr. Connolly. The subcommittee will come to order. And
without objection, the chair is authorized to declare a recess
of the committee at any time.
This subcommittee is convening our eighth biannual hearing
to assess FITARA, the Federal Information Technology
Acquisition Reform Act, and other information technology laws.
I want to recognize our two witnesses on the first panel.
Very brief--I'm going to recognize myself very briefly for an
opening statement.
FITARA, from our point of view, is a tool that can be used
for change agents within Federal agencies to come into the 21st
century to make ourselves more efficient, to achieve economies,
to improve productivity and morale while also better serving
the American people. Not doing that has huge costs including
compromising data, big data bases that we are charged as the
Federal Government with protecting. And so after we passed
FITARA, we wanted to make sure that what happened to FITARA was
not what happened with Clinger-Cohen, its predecessor law,
where both authors of the legislation left Congress, and there
was really nobody who felt they were vested in making sure that
law did what it was intended to do. We wanted to make sure that
did not happen.
And so I think by now it's pretty clear that our committee
is as committed as ever to insisting on implementation of the
law. We create a scorecard working with GAO that's designed to
incentivize that cooperation and that reform so that we can
achieve all of the valued goal, as I just enunciated. It's not
designed to burn a scarlet letter on an agency's back or a
CIO's back. It is designed to be a tool to incentivize change
for the good. And that's the spirit in which we are going to
have today's hearing.
We are glad that there are agencies that are showing steady
progress. And we believe that there are some agencies that
would show even more progress had they not fallen back on the
CIO reporting sequence in the organization chart or if they
had, in fact, adopted that as a reform. We want to see a
reporting sequence that makes sure that the chief CIO is
reporting to the boss. And that's our goal. And you get scored
on that if you're not doing it.
So anyway, we're going to get on with the hearing. I want
to thank everyone for their patience with the House schedule,
both this subcommittee and the floor votes. Sorry to keep
everybody waiting, but that was beyond my control or Mr.
Meadows' control.
And it now gives me great pleasure to recognize my friend,
the distinguished ranking member and the former chairman of
this subcommittee, and my partner in crime, Mr. Meadows.
Mr. Meadows. Thank you, Mr. Chairman. Thank you for your
leadership. I'm going to be extremely brief because of the
lateness of the hour.
Thank you both for being here. Some of you have made
recommendations in terms of direct reports on CIOs. I can tell
you that, having a conversation with NASA, I think they're
going to address that. And so the bottom line, we're paying
very close attention to it. We're working in a bipartisan
fashion. We want everybody to understand the score cards are
meaningful to us, and eventually they're going to be meaningful
to the agencies because we're working to attach dollars both as
penalties and rewards to that, because I believe that if you're
getting good responses, you ought to be rewarded.
I can tell you that I took a visit over to OPM the other
day. And the way that we're doing Federal benefits is archaic.
We have got to change that. And I am willing--you know, this
fiscally conservative Republican is willing to spend money to
get it done. So this is a critical piece.
And with that, thank you both for coming to testify. Thank
all the staff. Listen, I know the work gets done, many times
without a lot of applause. But I want to applaud everybody
who's trying to make this work. And I thank the gentleman for
his leadership on the Connolly Issa bill.
Mr. Connolly. My friend is too kind, and I thank him.
So for our first two witnesses, we have Suzette Kent, who
is the Federal chief information officer from the Office of
Management and Budget. I think this is your first time before
us, Ms. Kent; is that correct.
Ms. Kent. This is my second.
Mr. Connolly. Second. Okay. Well, welcome back.
And Carol Harris, who, of course, is the director of IT
management issues at the Government Accountability Office.
If you would both rise, please. We swear all of our
witnesses in here at the committee.
And if you'd raise your right hands, do you swear or affirm
that the testimony you're about to give is the truth, the whole
truth, and nothing but the truth, so help you God.
Let the record show that both of our witnesses answered in
the affirmative. Thank you.
Mr. Connolly. The microphones are sensitive, so please
speak directly into them. Without objection, your full written
testimony will be made part of the record, so I would ask you
to verbally summarize your testimony as best you can within the
five-minute window. With that, Ms. Kent, over to you.
STATEMENT OF SUZETTE KENT, FEDERAL CHIEF INFORMATION OFFICER,
OFFICE OF MANAGEMENT AND BUDGET
Ms. Kent. Thank you, Chairman Connolly, Ranking Member
Meadows, and members of the committee, thank you for having me
here today. I'm honored to be here to discuss FITARA and
technology topics that are of vital importance to empowering
agencies to achieve their missions. As you open, FITARA is more
than just a law and a scorecard; it serves as a vehicle for how
we communicate involving priorities and a measure to
demonstrate progress.
This administration continues to emphasize the FITARA goals
through the IT modernization goal in the President's management
agenda and in the executive order on CIO authorities. Our
government's ID policies must be as nimble and iterative as the
global technology industry and the changing nature of the
threat landscape we're addressing. This intent drove our policy
updates in 2018 and 2019.
Some of those policies had not been updated in almost a
decade. We also sought to update how we measure success, so the
council provided recommendations to GAO and to this Oversight
Committee around how we continue to enhance the FITARA
scorecard and continue to make it meaningful in driving
progress.
Additionally, we are focused on making metrics and measures
data driven, publicly available, and continuous through the
websites. We made great strides in IT modernization in the last
two years. I'll highlight a couple of quick examples.
Increasing adoption of commercial cloud email from 45 percent
to 72 percent. That's 1.8 million mailboxes now. We closed 150
enterprise datacenters.
All 23 civilian CFO act agencies have hit defined targets
for data ex-filtration detection and 21 have met targets on
mobile device security, and our technology modernization fund
projects have yielded playbooks and working strategies that can
be easy--easily replicated to accelerate agency systems
migrations.
We've updated policy on high value assets, identity and
credential and access management, cloud smart, datacenter, and
delivered for the first time a Federal data strategy with a
one-year action plan. And in May, various agency CIOs, OMB
policy leaders, and I met with congressional staff members of
this and other committees to walk through all of those policy
updates and how those actually drive progress forward for
enhancements. The recently released cloud smart strategy is a
great example of how we remove barriers.
Three key areas prevented adoption of cloud and
technologies that were addressed in the update. Security. How
we move from a perimeter-based model to a data-centric model.
Procurement. Agencies had to adjust to these new consumption-
based models, and most important, how we address and develop
the Federal work force to operate effectively in these new
paradigms.
It also includes a directive for agencies to develop an
application rationalization road map. This road map is critical
and it defines what can move to the cloud and helps inform the
datacenter needs and helps us define those targets for what
will be closed.
The CIO Council has recently released the application
rationalization playbook to help agencies achieve this task.
Since datacenter optimization is also important to this
committee, I'll briefly comment on a couple of pieces of
division in the new policy. We closely studied the data
collected under the original memo and working with agencies, we
identified ways to streamline the closure process and clearly
identify facility types that will continue to be needed for
agency mission specific reasons. We included these learnings in
the updated policy, which does focus on enabling aggressive
closure with specific targets by agency and ensuring efficient
operations where datacenters deemed to be a key mission
facility that's part of that agency's mission.
Last year when I testified to this committee, I highlighted
work force challenges and any technology transformation the
people that are charged with acquiring, deploying, and
operating in that new environment are ultimately the key to the
transformation success and we must invest in providing the
experiences that our work force needs to keep their skills
relevant.
Next month we will be celebrating the graduation of our
first Federal cyber rescaling academy and we will have kicked
off our second cohort. These initiatives are a way that we're
investing in our current, dedicated, and qualified Federal
employees to both enhance their careers, but simultaneously
address our work force gaps in the technology area.
As the reskilling model proves itself, we hope to replicate
it for other skill areas and we endeavor to make this approach
a standard operating procedure, not just a onetime special
project.
So in closing, our continued coordination with Congress is
key to making government modern, secure, and mission ready. We
know that the American people expect our Nation to be a world
leader on every front including technology and cybersecurity.
In this discussion today, we know that agencies are making
progress, but modernization and battling cybersecurity threats
are a continuous journey and there's much more to do. With the
support of Congress, we will continue to raise the bar in
agency performance, and overall empower agencies to leverage
technology to enable their mission, to improve the citizen
services and be effective stewards of taxpayer money.
Thank you for the opportunity today, and I look forward to
answering your questions.
Mr. Connolly. Thank you, Ms. Kent. And when you go back to
OMB, you're going to be able to say, I'm the one person in this
White House who went to a hearing on impeachment and subpoenas
and nothing like that was discussed at all.
Ms. Kent. Yes, sir.
Mr. Connolly. Ms. Harris?
STATEMENT OF CAROL HARRIS, IT MANAGEMENT ISSUES, GOVERNMENT
ACCOUNTABILITY OFFICE
Ms. Harris. Chairman Connolly, Ranking Member Meadows, and
members of the subcommittee. I'd like to thank you and your
staff for your continued oversight on IT management and
cybersecurity with this eighth set of grades.
Overall, five agencies' grades went up, four went down, and
11 remained the same. HHS and NASA's overall grades were
lowered because their CIOs no longer report to the head or
deputy of the agency. This is also the first time in which four
agencies received two grades, which we prepared at your request
in response to changes to OMB's datacenter initiative.
I'd like to briefly comment on this and other selected
areas of your scorecard. I'll first start with the dashboard
portfolio stat areas. Thirteen agencies' grades were increased
by this committee as a way to recognize a significant progress
made in these areas governmentwide since scorecard 1.0 4 years
ago. This progress would not have happened to this extent
without your scorecard in oversight.
I'll turn to FISMA next, which is now included in the
scorecard methodology. It's inclusion had a generally negative
effect as there were 12 agencies with either a D or an F. Only
one agency, NSF, received an A and four received a B.
Next, Incremental Development. This area now captures
projects that are not primarily software development in nature
such as a non-IT acquisition with the tech component. This
change, which was previewed in scorecard 7.0 was suggested by
the CIO Council and makes this area more comprehensive. As a
result, we saw ten agencies grades in this area decrease while
three agencies went up.
And last, with respect to datacenters, you asked us to show
a set of overall grades that use the datacenter grades from 7.0
as well as another set that excluded these grades entirely. If
datacenter grades were included, HUD and EPA's overall grades
would increase and VA and SSA's grades would decrease. The
reason for the two sets of grades relates to OMB's changes to
its datacenter optimization initiative.
Among other things, OMB's guidance revises the
classification of datacenters and datacenter optimization
metrics. For example, OMB will no longer require agencies to
maintain inventories of their smaller nontiered datacenters
which make up about 80 percent of the government's facilities.
If these changes are implemented as is, the committee will lose
the ability to track and measure progress in this area since
the initial scorecard because the baseline for comparison will
have changed.
Moreover, the changes will likely slow down or even halt
important progress agencies should be making to consolidate,
optimize, and secure their datacenters.
Mr. Chairman, this concludes my comments on the overall
scorecard. I look forward to your questions.
Mr. Connolly. Thank you so much. Let me begin. Ms. Harris,
we're here to talk about the implementation of a law, correct?
Ms. Harris. Correct.
Mr. Connolly. When it comes to datacenters, what is the
language of the law?
Ms. Harris. The language says that agencies should have a
comprehensive datacenter inventory.
Mr. Connolly. And what's the goal besides an inventory?
Ms. Harris. The goal is to consolidate.
Mr. Connolly. Correct. That's the verb. We say I believe in
the law, consolidation, and optimization, but consolidation
goes first and it means something presumably other than
optimization, would you agree----
Ms. Harris. Yes.
Mr. Connolly [continuing]. since we use both words?
Ms. Harris. Yes.
Mr. Connolly. Ms. Kent, one of the concerns we have,
although your memo delivered to us on June 25 adds some clarity
that may be reassuring, but since we got a hearing, our concern
is that when OMB gives guidance on optimization and exempts 80
percent of the datacenters from specific inventory plans, you
are--you're skirting the intent of the law.
The intent of the law was always to identify how many
datacenters we had, which was a struggle, and then cut them in
half and then cut them in half again. That was the goal. It was
set by your predecessor in the early years of the Obama
Administration, actually. In those days I think we thought we
had 1600, and so the goal was initially by the administration
cut it to 800 and my bill said, no, we're going to do that
again, cut it to 400. And that's what we put--we didn't put
that number, but that's--that was what we incorporated into
FITARA.
What we discovered was that, of course, what we got really
good at was identifying more. And so we didn't have 1600, we
had whatever it was, Ms. Harris, 12,000, 14,000, and so at some
point we thought, well, good that you're getting better at
counting, but the goal here is to be more efficient, move to
the cloud, don't have all these little stovepipes all over the
place, and I know you share that goal.
So I want to give you the opportunity to talk about, well,
what is it that OMB is doing in emphasizing optimization and
exempting from, sort of, our audit here 80 percent of the
datacenters that exist because we're afraid that whatever your
intent, the consequence is we won't capture that and we will
not effectuate the savings the law was intended to encourage.
Ms. Kent. Thank you for your question, sir, and the
opportunity to talk about it. And first statement of intent is
to comply with the law.
Mr. Connolly. We are relieved.
Ms. Kent. You referenced changing various numbers over
points and time, and that was one of the components of the
analysis was that there were things that had been included that
included rate things for printers and weather stations and
things that weren't necessary--MRI machines weren't actually
classified as a datacenter, so some of the things are trying to
address what actually operates as a datacenter and we intend to
close. And that is very specific in the new guidance.
But we also understand and very clearly from talking with
agencies, there are some reasons where we will continue to
operate a datacenter, a super computer site, something that is
needed for resiliency, special needs of agencies that we
believe are very important and we want to ensure those are
being operated efficiently and securely with the intent of this
committee.
But we also found out something else that's included in the
cloud strategy. One of the barriers to making progress from
closing those remaining datacenters and the IT dashboard has
the target, by Fiscal Year for each of the agencies that was
developed at the agency level, but in some cases, the
application rationalization work is not complete. So they don't
have an identified target for whether it's moving to the cloud
or what we're going to do with it, so that's the part of the
application rationalization playbook that's included in cloud
and you will hear some agencies, they've met their target,
they've done a fantastic job, but other agencies have more work
to do.
Mr. Connolly. How long have you worked in government?
Ms. Kent. Sixteen months today.
Mr. Connolly. All right. So sometimes with the best of
intentions and trying to be flexible, we send signals we did
not intend to send and that's our concern. We don't want a
rigid, mindless mentality, and you've--everything you said I
can agree with and I know Mr. Meadows could too, but both of us
come from private sector backgrounds and I also come from a
public sector management background and I'm a big believer and
I think--I know Mr. Meadows is too, in setting metrics because
that's goal setting.
So at the end of the day, yes, we want to be flexible, but
what we felt--and I still do feel, we've got to set metrics. So
Agency X, we all agree you've got 340 and after some
consultation and all that, the goal is to reduce a hundred of
them because the others you need or cut it in half.
Once we do that, let's set that and hold people to that
metric and we're willing to work with you on that. What we
obviously don't want is a circumvention and a dilution of the
goal and we're nervous optimization gives a lot of wiggle room.
And it's easy for somebody to say I have 3,420 of them and
I need every one of them. Every one is precious, and we're not
going to change a thing. Or wait you out because, after-all,
you've used this weaker word optimization, which doesn't really
require me to do something specific and so I know that's not
your intent, but you hear my concern and my experience is,
sometimes you've got to give very clear direction and set very
explicit metrics in order to accomplish something.
Ms. Kent. I hear your concern. I look forward to continuing
to talk with the committee because I think we are being
extremely explicit and actually in the opening of the guidance,
it specifically says, any plans to open new or expand have to
be approved by OMB as well as the closure intent is part of
their strategic planning and reporting in the capital planning
process.
Mr. Connolly. And as I said at the beginning, I'd be more
worried but I think your memo of June 25 does, I agree, it's
reassuring in some ways.
Ms. Kent. Thank you, sir.
Mr. Connolly. Not 100 percent, but maybe we're all on the
same page. So all right. I saw you shake your head in agreement
about the CIO reporting to the boss and I want to give you an
opportunity given your title and your position to maybe talk
about that. I think, again, both Mr. Meadows and I know Mr.
Hurd if he were here and Ms. Kelly if she were here, our
experiences, especially in bureaucracies--and I don't mean that
in a pejorative way, but big, large organizations who you
report to matters a lot.
Ms. Kent. Yes, sir.
Mr. Connolly. If you report to the deputy assistant under
widget manager in the bowels of the basement, everyone can
figure that out and it's how fascinating you've got an opinion
about what I should do with my IT, but I'm going to listen to
him because he's the assistant secretary or the secretary or
whatever he is.
When you report to the boss and everyone knows you report
to the boss, that carries weight and we want to empower a CIO
to have that relationship and to carry that kind of weight and
make those kinds of decisions. I think Ms. Harris indicated
that in the case of two agencies had they done that, they would
have had A scores. Is that correct?
Ms. Harris. Yep. That's correct.
Mr. Connolly. Yes. So we're missing an opportunity here.
How can we better encourage that org chart and that hierarchy
of efficient responsibility so that we're all doing better?
Ms. Kent. Thank you for the opportunity to comment on that.
We do share that concern and are very focused on not just the
reporting relationship from the perspective of reporting to the
boss, but ensuring that we have technology as a mission enabler
and they are absolutely clear with the direction from the top
about what the priorities are and what set out to be
accomplished by that agency.
We shared your concerns with the agencies that moved
backward, we had direct conversations with them as well, and
appreciate your continued support in emphasizing that both
through law, through guidance, and through an executive order,
directives have been issued. We're going to continue those
conversations and I do believe, though, that in--it's a
conversation with GAO and some of the scorecard reporting
relationships, there are agencies who have made recent changes.
They recognize the intent. I've had opportunity to be with at
least three of those agencies in conversations with the
Secretary and the CIO with clarity around priorities, budget,
and resource needs. So we will continue to focus on it, your
support in those that moved backward is much appreciated.
Mr. Connolly. Thank you, and I have overstayed my welcome.
So I know my friend, Mr. Meadows, has, in fact, directly
engaged in one of these questions to good effect. Mr. Meadows?
Mr. Meadows. Mr. Chairman, thank you for continuing to make
this a priority. I know this is not our first, second, or third
FITARA hearing. It won't be our last and for both of you, thank
you for your testimony.
Obviously Ms. Harris, thank you for continuing with your
fine folks at GAO to guide us through on what we believe is--
will ultimately be a good tool. I don't know that we're there
yet. I think my perspective is that it's a work in progress and
even with the way that we changed the grading just recently to
make sure that some of the unintended consequences are not
there.
So Ms. Kent, one of the areas that we've got to be aware of
is, as we start to see how agencies game the system, and I say
game the system in that, you know, it's basically figuring out
how the scorecard works and how you can either underreport or
overreport to create a better grade and so we're trying to
address that.
Getting back to the point that the chairman made just a few
minutes ago as it relates to datacenters, so I'll give you the
cheat sheet. There is nothing more important to him than
getting rid of datacenters and he can look at all the scores on
this FITARA scorecard and if you're messing up on datacenters,
you're going to have a problem. All right? So I just--Ms.
Harris, would you agree with that?
Ms. Harris. I would absolutely agree with that.
Mr. Meadows. And so in doing that, here's what I would ask
for greater clarification than what we have. The word
``optimization'' when we look at that, you know, you can
optimize this and it doesn't necessarily mean that we're
changing anything and so here's what I would ask is, if you
could provide this committee with some--and GAO with guidance
on what optimization actually means. I mean, are we looking at
70 percent capacity on servers? Are we looking at redundancy of
X percentage? What does it mean because what it means to one
agency will be very different than--and, actually, probably,
should be different for some agencies.
You certainly want redundancy in some areas of the
government with greater--with the need for greater reliability
than others. That being said, we need to define that and make
sure that Ms. Harris and her team has the proper input.
One of the concerns is that the quality of the data that we
continue to get is a hodge podge, and so I need to make sure
that that gets prioritized, if you can, and if you're running
into a problem, here's, I think, the chairman and I would
agree, you just call us, we'll be glad to raise it to the very
highest levels within those agencies.
I know when Ms. Harris the other day mentioned the direct
report for the NASA administrator, I'm one of the few that have
had the privilege of knowing the previous NASA administrator
under the previous administration and thinking incredibly
highly of him and what he was able to accomplish.
I also have a personal relationship with the new NASA
administrator and so I sent him a text and just said, listen,
this is not good. You're getting dinged on the scorecard. He
responded back promptly, we're going to take care of it and
those are the kind of things that I think all of us just want
to see, is just that willingness to say, golly, we didn't know
it was a problem, especially when you have a transition from
administration to administration, but that's the other key
point, I guess.
And what I would love to see from you, Ms. Kent, is the
processes in place that when we change an administration, we
don't go backward. I think there's a real--and it's not a ding
on this administration or the prior administration that have,
you know, been able to deal with FITARA, but it's a real
problem that we are going to have going forward is the minute
you get a new political appointee in there, if they don't
realize that it's a big deal, then we're going to have the same
thing with somebody that's here for 16 months saying, golly
gee, I didn't know it was a problem.
So is that something that you can work with the committee
in terms of establishing those for us?
Ms. Kent. Yes, it certainly is. And I appreciate our
ongoing discussions. The phone call from Members of Congress
certainly seems to assist in getting action and we would very
much like to talk through the details on the guidance on what
we are holding agencies accountable when we say optimization.
It's some of the things that have been part of the baseline and
been defined, and I would add one more point on the CIOs. We're
at a point today as reflected in the scorecard for the first
time where we have 22 of 24 that are actually permanent and not
acting, and that is--as you look over the history of the
scorecard, that's an important accomplishment.
Mr. Meadows. And that's to be applauded. It truly is.
Ms. Kent. And it let's us move forward as you have said and
have some consistency as we go forward, so I do look forward to
taking those followups back to this committee.
Mr. Meadows. I yield back.
Mr. Connolly. I thank my friend and I reiterate his offer.
Another way of putting it as, he and I are Alphonse Gaston and
I'm not going to say which is which, but it's all good.
The gentlelady from the District of Columbia, our friend,
Eleanor Holmes-Norton.
Ms. Norton. Thank you very much, Mr. Chairman. I think this
is a timely hearing given what we learn was the state of IT, of
technology in the Federal Government, how behind the Government
of the United States was, so I'm interested in how we're doing
in catching up.
Now it looks like we made a decent start, 90 million in
funds allocated during that first year, so the first thing I'd
want to know since this is so new is, examples of modernization
projects that have been done. What have you done with the money
particularly given reductions in appropriations which perhaps
we could help get if we could have some examples, good examples
that speak to the public and speak to the Congress about what
you've done with the pretty good start. You had $90 million in
the fund I'm interested in is the technology modernization
fund.
Ms. Kent. I'd be very excited to share some of those
successes with you and I'll frame a couple of things. Just in
the time since the board has started, so a little over a year,
we looked at over 50--or approximately 50 proposals that would
have totaled almost $600 million. Now, as you pointed out, we
only funded a very small set of approximately--that represented
$90 million and those were projects that had not only agency
benefit, but all of government benefit and I'd like to tell you
the--share the success stories of a couple.
You will hear later from USDA, one of the initiatives that
they undertook was consolidation of multiple portals for
farmers.gov to provide an enhanced services for things that had
been spread out and created an environment that was not only
the most effective from customer service, but from--or farmer
facing, but from a maintenance perspective, more costly and
less efficient.
In the case of HUD, they have eight applications that are
cobalt applications that are core applications to their mission
and they brought forward two of those as a pilot to learn both
the tools, the process, and the playbooks to convert that from
cobalt to java and not disrupt the business. And that's a
really exciting part of what they are achieving is, they've
been able to take 1.2 million lines of code and convert it and
not disrupt the business.
Ms. Norton. Is this a competitive process? Is this based on
who will cost you less while saving you some money in this
fund? How do you judge?
Ms. Kent. That's a great question.
Ms. Norton. They compete against one another, or how?
Ms. Kent. So in what was actually laid out in the law,
there were specific intents--modernization, implementation of
shared services, work force transformation, large broad scale
transformation. There was also a very important component that
the benefits from the initiative could pay back the funds that
they received, so not every project actually has--and they have
to pay it back in a very specified timeframe under a definition
of----
Ms. Norton. Are they doing that, by the way?
Ms. Kent. They are doing that. They are doing that. As I
said, we started a year ago and this is the first time we will
have money coming back on schedule as planned----
Ms. Norton. Your appropriations----
Ms. Kent. I'm sorry?
Ms. Norton [continuing]. fail, though, tremendously from
that healthy $100 million in that first year to only $25
million in 2019, so giving--excuse me?
Ms. Kent. Yes, ma'am. It certainly has moved.
Ms. Norton. That's a huge reduction. I'm not sure why, but
I'd like, since this was supposed to be a full cost recovery
fund, how does that work and are you concerned about the funds'
ability to remain solvent?
Ms. Kent. It is full cost recovery and I appreciate
Congressman--Chairman Connolly's support for the technology
modernization fund. We did request additional funds because we
saw the worthiness of all these projects coming forward and in
many cases with the agencies and I would invite you to speak
with our team at USDA in the next panel. The agencies were able
to accelerate things that they would not be able to do in
normal course of business and they have a payback plan.
And one of the other very large benefits that we saw and I
know that Department of Energy, USDA, HUD, and GSA have shared
is that it brought the CIO and CFO communities very close
together because they had to reconcile the spend and the
payback plan and what the benefits look like in a way that they
have never been tasked to do before to ensure that it is cost
recoverable, so we've very much appreciate----
Ms. Norton. Do you think you can remain solvent?
Ms. Kent. Yes, we can remain solvent with that amount. It
limits what we can do----
Ms. Norton. I see.
Ms. Kent [continuing]. and the projects we can--we
absolutely have the plan for solvency, but it limits the number
of projects and the acceleration of modernization that we can
do going forward.
Ms. Norton. That's my concern, Mr. Chairman. Thank you very
much.
Mr. Connolly. Thank you.
And if I could, just before I call on you, Mr. Grothman, if
I may, just quick, Ms. Harris, the fund that Ms. Kent and Ms.
Norton were just talking about Congress created. Originally we
had pretty large amounts of money in mind. That got whittled
down and whittled down and whittled down in order to be able to
sell the idea of the authorization.
Do you believe that we have critical mass that this fund as
currently funded is viable or, put differently, can actually
make a difference, be the catalyst we intended it to be for
people to retire legacy systems?
Ms. Harris. I don't believe so, Mr. Chairman. With fewer
funds to award, the TMF cannot recover as much in their
administrative fees. So when Ms. Norton is asking about
solvency, we have preliminary analysis that shows that the
office's operating cost through Fiscal Year 2020 will exceed
the administrative fees to be collected from these awarded
projects. So our suggestion and--is for the TMF fund to be
fully funded at that $438 million level to continue the good
work that Ms. Kent is elaborating on.
Mr. Connolly. I think that this is something we can find
some common ground on, and we need to work in the next budget
cycle hopefully together so we have a number we can all agree
on that is meaningful, gives us the criticality we need, and
that can incentivize agencies to do the very thing you were
describing, Ms. Kent.
And finally, just both of you, on--I know this is on behalf
of Mr. Hurd as well as all of us, but one of the things we
encountered was agencies saying, well, we're creating a fund
within our agency to be able to capture the savings effectuated
in FITARA, but our lawyers are telling us we can't use them, we
can't put money in them because that's an appropriations
function.
Now, some agencies I don't think seem to have that problem
but others do. Just real quickly, do you both believe that we
need to fix that legislatively, or can that be done
administratively with guidance from OMB?
Ms. Kent. We believe in some of the cases it has to be
fixed legislatively and there is wording proposed at the
committee level. We had proposed some blanket language that
would apply to all agencies. That has been turned down multiple
times. So we have gone very specifically to individual
agencies, and in some cases, through those committees, that has
been approved.
We have some requests and education is one of those
directly at the committee level for various technical
enablement of those funds for agencies who don't have a similar
vehicle or need to fund or operate out of that working capital
account.
Mr. Connolly. Ms. Harris.
Ms. Harris. Mr. Chairman, I think----
Mr. Connolly. Could you speak up?
Ms. Harris. Yes. Mr. Chairman, when MGT was passed, I mean,
the intent was that that transfer authority would be there. So
while I'm not a lawyer, it kind of boggles the mind that you
would need additional legislation in order to offer that
transfer authority so that MGT could be----
Mr. Connolly. I know Mr. Hurd would share your view and so
do I. And I don't speak for Mr. Meadows, but he's here. He can
speak for himself. But our view is the law is the law. We
passed the law. It's quite clear what the intent is. And to
have a sudden hurdle from inside agency attorneys saying, well,
no, you can't do that, certainly thwarts the intent of the law,
that that may not be their purpose but that's the effect. And
so we will do what we have to do, but we would share, I think,
your initial reaction, Ms. Harris.
Mr. Meadows, did you want to comment on that?
Mr. Meadows. Well, I just agree. And What I'd like to do--
--
Mr. Connolly. You do agree?
Mr. Meadows. I do agree.
Mr. Connolly. Yes.
Mr. Meadows. And, Ms. Kent, what I would like to do--I
think congressional intent was clear. I think general counsels
in different agencies maybe are a little unclear in what we
believe we were clear about. And so in doing that some guidance
I think would go a long way, and if we need to do a little
research and a little push on our end to support that, I'm
willing to do that.
Ms. Kent. I'd be happy to share the specific examples with
you and appreciate your support.
Mr. Connolly. Yep. That would be very helpful. I thank my
friend.
Mr. Khanna, the gentleman from California.
Mr. Khanna. Thank you. Well, first, Chairman Connolly, I
want to recognize your leadership for having the FITARA
guidelines become law and really bring some accountability to
technology in government. And I want to recognize our ranking
member, Representative Meadows, for also his understanding on
technology.
You know, I represent Silicon Valley, and probably the
biggest thing that surprised me when I got to Congress is some
of the technological illiteracy in this place. There was one
hearing, I'm not going to mention the Member, who held his up
his iPhone and started berating the Google CEO telling him how
he couldn't track the iPhone. And the Google CEO was patiently
explaining that Apple made the iPhone.
I appreciate, Ms. Kent, your leadership coming from a
technology background. When I'm pressed to say what part of the
administration I liked, I often cite you and Matt Lira. And I
appreciated your work on the IDEA Act, which coincides with
FITARA and was bipartisan legislation that we all passed. And I
would like to know what is the status of the implementation
guidelines for that legislation?
Ms. Kent. Thank you for your question, sir, and thank you
for your kind comments. I'd very much like to tell you about
where we are with the IDEA Act, and I was honored to be there
with you when that was signed at the end of the year.
Our immediate action with all of the agencies was to take
the specific items that were laid out in the IDEA Act and
determine both the timeline and what things needed to be done
centrally and what things needed to be done by the agency
specifically.
We met with the agencies and outlined those pieces. Some
components were actually part of work that was already
underway, things like the inventory that you required and the
definition or the intent for a plan for how those would be
handled. I know that the report for digital signature
acceptance has just come in.
So we aligned those things with what was already in place.
We also had some items that you will see in some of the budget
requests that are coming forward that has to do with those
forward implementation plans. And we look to do those in the
future.
I would share one really interesting outcome of the IDEA
Act. In inventorying the websites and determining a plan
forward, it was very enlightening because many of the agencies
said we need to consolidate this set of websites. So we
actually looked at them from priority and a user-centered
approach of what was highly used, what was highly valued. And
then those things that didn't have the user traffic, wasn't
delivering specific services, other reasons, we're actually
pursuing a plan to consolidate and close those.
So we are moving forward with many aspects of the
implementation, they are included in the activities going on
now. And there are some pieces for which agencies needed
additional resources, and you'll see those reflected in their
2020 budgets.
Mr. Khanna. Great. Let me ask you one final open-ended
question. I don't think anyone on the committee would disagree
that the U.S. Government is the most powerful institution
created in human history. And it was the U.S. Government
actually that helped fund a lot of Silicon Valley. And so it's
mind boggling me that this incredibly powerful institution has
technology platforms or acquisition platforms that aren't up to
now what many companies do in Silicon Valley.
What do you think Congress can do in supporting FITARA and
the IDEA Act to help continue to get us to a place where the
U.S. Government should be the model for innovation?
Ms. Kent. Your question actually aligns with part of the
reason that I'm here and actually believing that same thing,
that we should have the capabilities in the Federal Government
that are available across many other industries and set the
basis of expectations for our citizens.
So when we talk about particularly modernization and
cybersecurity as part of the FITARA Act those are the key
components of how we actually make this transformation.
Elements of the IDEA Act give us a prioritization to be able to
actually take action and shut down and close the websites and
rethink how we deliver services.
The connected government and delivering mobile and digital
services help make those things a priority. Those signals both
through the FITARA scorecard and specific legislation are
helpful. I would also say though when you look across at the
agency activity for IT budgets we do--and it's--this committee
has talked about it frequently--we spend quite a bit on
maintenance of those legacy systems.
So tools like the Technology Modernization Fund and
modernization initiatives that are outside of that basic
maintenance helps us drive faster and gives us a way--otherwise
agencies are moving in small increments for what they can
divert out of that maintenance path, and that's not a good
solution either.
Mr. Khanna. Thank you.
Mr. Connolly. I thank the gentleman.
And now the gentleman from Wisconsin, Mr. Grothman.
Mr. Grothman. Thank you.
And I'd like to thank both of you for coming over here. I
know you have such a busy day, but I know it's something
Congress has been waiting for, so thanks for coming over.
Health and Human Services and NASA changed their reporting
structures, right, so that the CIOs no longer report directly
to the head or even the deputy head of the agency. Can you
comment as to why that was done and what your general opinion
of it is?
Ms. Kent. I can comment from my conversations regarding
that. I would direct you specifically to the agency heads as to
why they made that decision. You know, what NASA shared had
decisions that were not necessarily related to the activities
of the CIO. I think that's in conflict with what we expected.
And as you may have seen in the HHS side they had lots of
different moves going on at the time. I am continuing my
conversation with them regarding that approach.
Mr. Grothman. It just seems odd.
Ms. Kent. And we agree, and that is not the intent. So we
will continue the conversations until we are back in a place
that is reflective of what is expected.
Mr. Grothman. Okay. Ms. Harris?
Ms. Harris. I mean, the only thing I would add, sir, is in
the case of HHS that reporting relationship was not codified in
their policy. So at the time the acting CIO also was dual
hatted as the acting chief or the chief technology officer, and
so in that role as a chief technology officer he had that
direct reporting relationship to the Secretary. And so when he
put on the hat of CIO he also had that relationship to the
Secretary.
But since he has now vacated that CIO position because that
relationship wasn't codified in policy it went away, and so
that really drives the important point that this relationship
needs to be set in stone in policy so that we can maintain that
continuity regardless of who is in the office.
Mr. Grothman. Okay. Let me give you kind of a broad-based
question here. From your perspective--first of all, how long
have you both had your positions? I should know that and I
don't.
Ms. Kent. Sorry. Could you repeat the question?
Mr. Grothman. How long have you had your position?
Ms. Kent. Sixteen months.
Ms. Harris. Since 2012.
Mr. Grothman. Okay. From your perspective what worries you
the most about IT management, say the last six months?
Anything?
Maybe nothing. It runs like a clock.
Ms. Harris. I think from my perspective when you take a
look at the spend of the $90 billion each year on IT, 80
percent of that spend is on legacy IT. We need to focus on
decreasing that number and reinvesting that money into
modernizing our aging systems.
Mr. Grothman. It's kind of a shocking number, isn't it?
Ms. Harris. Yes.
Mr. Grothman. If it was done right, how much do you think
you could save?
Ms. Kent. It is. And I think I just commented on
modernization that reflects a similar view. I would also state
that when you look at our entire set of modernization goals,
both transformation of the legacy systems and the ability to
sustain current environment while you're making that
transformation and then continued focus, you said, you know,
what are the priorities, it is always cyber, and ensuring that
we are prioritizing our activities there based on the changing
nature of the threat environment and where we see that volume
and where we see those types of threats and ensuring that we
are prioritizing that.
So when the majority of an agency budget goes to
maintaining status quo that means that agency CIOs have to be
incredibly crystal clear on the priority for those funds and
their internal resources that are focused on the transformation
in cybersecurity.
Mr. Grothman. When we talk about legacy systems what
percent of the systems that you're familiar with--I mean, you
said how much more money we're spending on the legacy systems,
but what percent of this--even compared to the private sector,
and you must deal with that somewhat, what percent do you think
we have in the government you'd call up to date or the same
type of systems you'd find in a modern American corporation?
Ms. Harris. Sir, we don't have that information. We have
not done work to look at the percentage of what's legacy and
what's development in the private sector. So I wish I could
answer it, but I don't have that information.
Mr. Grothman. You guys, can I ask one more question?
Mr. Connolly. Of course.
Mr. Grothman. That's a surprising answer. I feel I've got
to ask another question. Do you ever look into and see, you
know, compare like where you are compared to major American
corporations, you'd have people begin to work with you and say,
holy cow, I can't believe you still have this stuff sitting
around here? Does that thing ever go on? Or do you have people
leave your organization to the private sector and say, hey,
wow, you want--you can't believe what I found out here? There's
no comparison or no looking around or no comparing? You don't
do that?
Ms. Kent. I would comment, I don't know that there's an
exact number, a comparison per se to a single sector, but I
would mention two things that we are looking at. One of the
policies that we've used as a driver and a filter for how we
prioritize legacy system transformation as well as website
transformation has been high-value assets and looking at those
things that are of critical importance to agencies and insider
infrastructure and ensuring that we put resources there first.
The other thing that we've done is from a customer
experience perspective actually looked at the citizens that
we're serving and had dialogs around what they expect. And that
actually does give a comparison in many cases across industry
because their expectations are set on what they experience in
their normal lives, whether it's from their financial
institution or a retail business that they're shopping with.
So we have used that user-centered design and customer
expectations to drive back into the way that we are looking at
delivering services, both from a digital and mobile capability
standpoint.
Mr. Grothman. Okay. Well, again, thanks. Thanks for coming
over here. I appreciate the chair letting me take so much of
other people's time.
Mr. Connolly. Not at all. Thank you, Mr. Grothman.
And, Mr. Grothman, if I may followup on your question, I
think we could afford, Ms. Harris, to be a little more
forthright. I think you're letting yourself off the hook a
little bit by saying, I don't know, I mean, I'm not in the
private sector. I mean, there are things we do know.
For example, I always ask--and you probably do too, Mr.
Meadows--when I speak to a private sector group, it's a trick
question. I go, well, how many CIOs do you have? And they
always look at you no matter how big they are like what a
trick--well, what do you mean? We have one. Well, how many does
the Federal Government have?
When we began FITARA with 24 agencies we had 250 people
with the title CIO, and that means no one is in charge, no one
can be held accountable, nobody is exactly responsible. And
that's a big difference, I would say, Mr. Grothman, between the
private sector and the public sector where we can learn from
the private sector.
Likewise, we were celebrating a little while ago the
transition from COBOL. I can't think of a private sector
company that still has COBOL, let alone would be celebrating in
2019 the transition from it to something else. So I think there
are some things that we clearly can observe and learn from and
benefit from in the private sector. Moving to the cloud is
another one.
So it is instructive, and hopefully we cannot necessarily
entirely mimic the private sector, but there's a lot of
management practices we could learn from. And having the CIO
report directly to the Secretary of the agency is also
something quite common in the private sector. The CIO is not
buried in the bowels of the organization, somebody who is a key
part of the management team, because everyone understands the
key role of IT in the enterprise.
Ms. Harris. Yes.
Mr. Connolly. Well, I want to thank you both so much for
coming. We're going to continue this dialog. I am pleased, Ms.
Harris, that MeriTalk did a study--a survey rather of 200 CIOs
mostly in the public sector, and they found that 70 percent
said that FITARA was, in fact, from their point of view, a
useful kind of nudge for change within the agencies, and that's
kind of good to hear. And I see you shaking your head. Would
you confirm that yourself or----
Ms. Harris. Well, I think that's very encouraging because I
will say that the progress that has been made since the
inception of the score--well, the FITARA but then also with
your continued oversight with the scorecard 1.0 now to 8.0 how
it has evolved and how it has kind of raised the level of
improvements across the board has been tremendous from
transparency in the dashboard to portfolio stats in the
savings. It's all, you know, because of the tremendous
oversight from your committee.
Mr. Connolly. Well, we want to thank GAO also for always
being innovative in looking at how best we can make that
scorecard a useful tool. So thank you and to your colleagues.
Mr. Meadows.
Mr. Meadows. I just want to make one point. The staff just
let me know when we look at the transition fund, you know, it
passed the House today with only 35 million. And when we look
at this it's--you know, we may represent two different District
11s, but we are together on this particular issue, and so what
we need to do is work in a bipartisan way to get that up to a
number that actually is meaningful. Thirty-five million sadly
is a rounding error when it comes to addressing this problem.
Mr. Connolly. I'm so glad you brought that up, Mr. Meadows,
because I had an amendment to add $15 million to that $35
million to just get a respectable number. And unfortunately
that was not ruled in order. It was subject to a point of order
up in Rules, so we were not able to do it.
Mr. Meadows. You have better connections with the Speaker
than I do.
Mr. Connolly. But we will work on it together.
Thank you both so much for being here today. And, Ms.
Harris, I promised you'd make your plane. You're going to make
your plane.
Thank you.
Ms. Harris. Thank you.
Ms. Kent. Thank you.
Mr. Connolly. And now we're ready for our second panel:
Gary Washington, Chief Information Officer of the United States
Department of Agriculture; Jason Gray, Chief Information
Officer of the United States Department of Education; and Eric
Olson, Chief Information Officer from the Department of
Treasury.
If you would stand and raise your right hand, we'll be
sworn in. Thank you. Do you swear or affirm that the testimony
you're about to give is the truth, the whole truth, and nothing
but the truth, so help you God?
I thank you. And let the record show that our witnesses
answered in the affirmative.
The microphones, as I said, are sensitive, so if you can
speak directly into them like I'm doing, you can be heard.
Everybody has five minutes to summarize their testimony. Your
full statement will be entered the into the record as
submitted.
And, Mr. Washington, why don't we begin with you and your
five-minute statement. Welcome.
STATEMENT OF GARY WASHINGTON, CHIEF INFORMATION OFFICER, U.S.
DEPARTMENT OF AGRICULTURE
Mr. Washington. Thank you, Chairman Connolly, Ranking
Member Meadows, and the members of the subcommittee for the
opportunity to update you today on the United States Department
of Agriculture's progress on implementation of FITARA. I am
Gary Washington, the Chief Information Officer of USDA. I would
also like to thank you for your ongoing support and commitment
to improve information technology management across the Federal
Government.
Secretary Perdue's vision is to make USDA the most
efficient, effective, customer focused, and best managed
department in the Federal Government. Central to that goal is
focusing on enterprise-based approaches to management and
decision-making. We have taken many steps to achieve that goal
including the implementation of the FITARA Information
Technology Management Maturity Model, and we continue to make
progress.
As evidenced by the latest FITARA scorecard and the
progress we have made over the past year, I am pleased that
USDA have moved up an entire letter grade on the scorecard, and
I hope that we will be doing as well or better than our friends
here at Department of Education next year.
I know we have a lot further to go, but every day I am
seeing the positive impact that FITARA has on our Department,
and I would like to discuss some of that progress today. Since
my last appearance before the subcommittee, USDA partnered with
the White House Office of American Innovation and the General
Services Administration Center of Excellence to improve the
management of information technology at USDA.
This effort accelerated IT modernization across the
Department, improving leadership alignment, quality, and
efficiency of IT, including decreasing the number of chief
information officers, CIOs, from 22 to one, closing 28 to 39
data centers resulting in a cost savings and avoidance of $42.1
million and closing 2,255 data centers overall.
We have enrolled 13 agencies into USDA cloud program
resulting in a net cost avoidance of $12.1 million, improving
our megabytes score from an F to an A on the 7.0 scorecard by
implementing a number of effective processes and procedures to
improve software management.
We've also petitioned our existing working capital fund to
receive technology modernization funding and making significant
improvements in cybersecurity with 96 percent of USDA systems
having authorities to operate as opposed to 74 percent in
Fiscal Year 2017.
Additionally, end-user equipment and hardware will be
centrally managed by the Office of Chief Information Officer
using an IT service management system with asset management as
a core function. We will onboard the inventory for all the USDA
mission areas and offices as part of an enterprise end-user
consolidation initiative scheduled to be completed by the end
of Fiscal Year 2020.
And our Digital Infrastructure Services Center will be
responsible for the central inventory and management of all
infrastructure components of USDA, which includes network and
system hosting. The system hosting would be accomplished by the
end of Fiscal Year 2020 through the data Center Optimization
Initiative and Cloud Adoption Centers of Excellence.
The network transition to the new General Services
Administration enterprise infrastructure solutions contract
will ensure accurate inventory of our network infrastructure. I
would like to emphasize the strong engagement and support for
those efforts from our USDA leadership, namely the secretary
and deputy secretary who I report directly to on IT matters. I
believe we have an effective reporting structure and
involvement in IT management and modernization issues at the
highest level.
In closing, USDA has consistently proven itself as a leader
in embracing FITARA. We want to continue to implement FITARA
across USDA and integrate it into our daily processes and IT
modernization activities even further than we have today. We
recognize there is more work to be done, and we continue to
tackle those challenges.
I truly appreciate the attention the committee has brought
to this issue and your ongoing support of our efforts to change
the way the Federal Government thinks about and manages IT.
I look forward to answering any questions you may have.
Thank you.
Mr. Connolly. Thank you, Mr. Washington.
Mr. Gray.
STATEMENT OF JASON GRAY
Mr. Gray. Thank you, Chairman Connolly, Ranking Member
Meadows, and members of the subcommittee for this opportunity
to talk about the progress the U.S. Department of Education has
made in implementing the Federal Information Technology
Acquisition Reform Act.
I recognize the great privilege and honor of being invited
to appear here today. Never in my life could I have imagined
having opportunities I've had to speak before the U.S.
Congress. Thank you.
I'd also like to thank you for your continued commitment to
improving information technology management. My responsibility
is to ensure the availability of IT with appropriate controls
and to ensure the integrity in how we use it under the
leadership of Secretary DeVos and in collaboration with the
Office of Federal Student Aid and my office we have achieved a
number of improvements in recent years.
Mr. Gray. There are two areas that I would like to
highlight today, cybersecurity is one focus area of FITARA,
which encourages agencies to proactively address cybersecurity
risk and compliance with Federal Information Security
Modernization Act.
To address the cybersecurity challenge, OCIO developed our
own cybersecurity risk scorecard based on the National
Institute's of Standards and Technical cybersecurity framework.
The implementation of a scorecard improved our focus and
alignment with OMB requirements for sound risk management
practices for protecting our systems and networks.
The scorecard also provided a specific path for the
Department system owners and security officers to identify,
prioritize, and mitigate risks. From September 2018 to June
2019, the Department has mitigated and closed over 2,300 plans
of actions and milestones representing a 72 percent reduction
in vulnerabilities than the Department systems.
We use the scorecard to provide monthly briefings to the
secretary, deputy secretary, and senior leaders. With their
support and with the hard work off our system and security
personnel, we were able to raise our FITARA security score two
letter grades to a C in December 2018. The Department, along
with the majority of its peers, started with a FITARA
cybersecurity score of F in 2018.
Another area of focus is IT modernization, which is in line
with the Department's focus on creating and managing a more
modern and secure IT environment and is consistent with the
themes and principles outlined in the cross-agency priority
goal on IT modernization found in the President's management
agenda.
In 2017, we began an exhaustive review of our IT portfolio
to ensure that IT systems, applications, and services are
secure, appropriately governed, and modernized to meet the
needs of today's economy with an eye toward tomorrow
opportunities.
To this end, OCIO worked with key stakeholders across the
agency and industry experts to complete a comprehensive
analysis of our business missions and the IT assets supporting
them. As a result of those efforts, we developed a detailed
visualization or map of the Department's IT inventory, which we
analyzed to determine the Department's needs and to build our
five-year IT modernization plan and strategic road map.
The effort provides greater transparency across the
Department enabling us to work with business owners, to
identify opportunities, to leverage shared and cloud services,
automate manual business processes, reduce cybersecurity risk,
and consolidated cloud service providers. We are working with
the Office of Management and Budget and Congress to obtain
appropriations language that would allow us to transfer funds
to a working capital fund, which would support the Department's
future modernization initiatives and accomplish the goals and
objectives of the Modernizing Government Technology Act.
We requested this transfer authority in the Fiscal Year
2020 budget, and the Treasury Department has committed to
activating an account for the Department once the transfer
authority has been granted by Congress.
I recognize our areas for improvement, we must continually
monitor and assess our IT management and service delivery
practices and policies. We are taking actions in areas where we
are not fully meeting our milestones.
One such area is CIO and CAO collaboration on the review
and approval acquisition strategies and plans. OCIO is
partnering with contracts and acquisition management to
establish touch points between the IT life cycle management
process and the acquisitions process to ensure the CIO has the
opportunity to review all approve all acquisition strategies
and plans that contain IT.
Secretary DeVos and the Department take FITARA
implementation seriously, we believe our progress demonstrates
that. Thank you for your time today, and I look forward to
responding to your questions.
Mr. Connolly. Thank you so much, Mr. Gray.
Mr. Olson.
STATEMENT OF ERIC OLSON, CHIEF INFORMATION OFFICER, U.S.
DEPARTMENT OF THE TREASURY
Mr. Olson. Thank you, Chairman Connolly, Ranking Member
Meadows, and members of the subcommittee for the opportunity to
testify on Treasury's implementation of FITARA. My name is Eric
Olson and it is my honor and privilege to serve as the chief
information officer for the U.S. Department of the Treasury.
Information technology is at the core of what Treasury
does. We represent the third largest civilian agency in terms
of overall IT budget, and plan to spend approximately 4.8
billion on IT in Fiscal Year 2019.
Managing a large IT portfolio with the scale in complexity
of Treasury is a very challenging endeavor, and we are grateful
for the financial and human resources we have been provided to
accomplish our mission. We recognize our responsibility for the
stewardship of these resources, and we take this responsibility
very seriously. We appreciate that FITARA was enacted to assist
us to perform this responsibility.
Our key guiding principle for modernization is to drive the
greatest amount of resources toward mission enablement and
digital transformation. This requires pursuing enterprise
initiatives and shared services so that we can reduce
duplication and leverage economies of scale. At the same time,
we encourage our bureaus to focus on transforming mission
outcomes by adopting practices from the private sector that
have proven successful in delivering digital transformation,
such as cloud-based services, agile development, and low code
platforms.
I would like to briefly summarize some of our recent
accomplishments and how they fit into the larger approach for
Treasury IT modernization. On the heels of Congress' enactment
of the Tax Cut and Jobs Act, the IRS recently completed a
successful tax filing season that was annealed in large part by
the successful delivery of one of the largest and most complex
IT implementations every undertaken by the Treasury Department.
Implementation of tax form required the modification of
hundreds of applications across the IRS and the Bureau of
Fiscal Service. This recent accomplishment demonstrates
Treasury's ability to deliver change at scale on an accelerated
timeframe. Treasury continues its pursuit of enterprise-wide
services. Recently Treasury delivered an expansive upgrade to
its enterprise H.R. system, an enterprise-wide service that
supports the nearly 100,000 Treasury employees.
Treasury is also in the process of implementing a cloud-
based talent management system that will deliver a common
platform for employee training, performance management, and
succession planning. These initiatives demonstrate Treasury's
ability to use its franchise fund to achieve some of the
benefits of what an IT working capital fund might achieve.
In addition to the successes I mentioned earlier, I would
like to report on how Treasury is implementing FITARA. In some
areas of the FITARA scorecard Treasury has scored well, for
example, data center consolation and portfolio review. We have
worked hard in these areas and we are proud of our results. In
other areas, although we have worked hard, we recognized there
is room for improvement.
FITARA recognizes the importance of agency CIOs having a
substantial role in agency IT decisions. I meet regularly with
Secretary Mnuchin on major IT investments, cybersecurity risk,
and opportunities to pursue Treasury-wide initiatives. I
believe this increased engagement with Treasury senior
leadership has produced notable results in the delivery of the
IRS modernization plan and the delivery of technology to
support tax reform, among other things.
On cybersecurity, we fully appreciate the threat posed by
well-resourced and highly motivated adversaries and are
committed to mitigating risk posed by such actors. While we
cannot completely eliminate risk, we acknowledge our supreme
responsibility to proactively address cybersecurity risk to the
greatest degree possible. Toward that end, we operate a
comprehensive cybersecurity program focused on risk mitigation.
Our strategy is to make investments and capabilities that
materially reduce our risk and reduce the cost of our
compliance.
We are grateful to Congress for the support of our
cybersecurity enhancement account, which is focused on
identifying and funding projects that have the greatest
Treasury-Wide impact in these and other important areas.
In closing, we recognize and embrace our responsibility to
be a good steward of IT resources. We understand and embrace
the language intended in FITARA. We share the common goal of
Treasury IT modernization. And we value the collaboration with
Congress to jointly achieve these goals.
Thank you, once again, for the opportunity to testify
today.
Mr. Connolly. Thank you, Mr. Olson.
Ms. Harris, did you want to comment? And I'm sorry if I led
you astray, I was simply reassuring you, you're going to make
your flight at 10 o'clock.
Ms. Harris. I see. I apologize for----
Mr. Connolly. No, forgive me if I misled.
Ms. Harris. Mr. Chairman, Ranking Member Meadows, I'll now
turn my comments to the Departments of Agriculture, Education,
and Treasury. These agencies collectively plan to spend $7.5
billion on IT this year, for each of them, roughly 80 percent
of their IT spend is on operational systems. Both USDA and
Treasury have an overall C-grade on this scorecard, while
Education is at a B+. Education has also sustained this overall
B+ grade over the last four scorecards.
Some positive areas to highlight for all three, the vast
majority of their IT projects use an incremental approach. They
also have comprehensive software license inventories and use
them to make decisions and save money. USDA and Treasury have
also closed more than 50 percent of their total data centers
and exceeded their savings goals. Education closed all of their
data centers and moved to the cloud years ago.
For all three agencies, the progress to improve their IG
assessments of cybersecurity is rather low. In the case of USDA
and Treasury, they also self-reported low numbers in meeting
OMB's 10 cyber metrics. The combination of the two is a reason
for their low grades in this area. Education, on the other
hand, self-reported meeting all 10 of OMB's cyber metrics, and
as a result, raised their grade in this area to a C. I'd also
like to note that if USDA and Treasury CIOs reported to the
head of their agencies, their overall grade would increase to a
B.
Mr. Chairman, this concludes my comments on the results of
these three agencies.
Mr. Connolly. I thank you. Thank you so much. And it is
heartening to hear the progress. I would just say, and you can
confirm this, Mr. Gray. As I understand it, you now have zero
data centers?
Mr. Gray. That is correct.
Mr. Connolly. And that you went from paying $12 per
gigabyte of storage to a few cents?
Mr. Gray. Actually, sir, we are currently focused on
transition--or doing cloud consolidation, and we recently
within the last three months transitioned from $1.43 per
gigabyte to $0.12 a gigabyte.
Mr. Connolly. So there are savings to be had in data center
consolation and moving to the cloud?
Mr. Gray. Yes. Yes, Mr. Chairman. I think you're a poster
child for doing that, and I thank you.
Mr. Connolly. Let me ask, Ms. Harris, GAO looked at best
practices, and you identified FITARA requirements, one of which
was--in order to get to best practices, obtains support from
senior leadership.
Would it be fair to say that all three of the agencies in
front of us have achieved that?
Ms. Harris. Well sir, I think in the case of Education
that's clearly the case because of Mr. Gray's direct reporting
to the Secretary. In the case of USDA and Treasury, that direct
reporting is not as clear-cut. So I would say that in those two
cases that senior leadership support may not be as clear as
Education's.
Mr. Connolly. And I think that's really particularly
important in your case, Mr. Washington, because Secretary
Purdue has offered himself up as the pilot for the innovation
agenda that Mr. Kushner and Chris Little are organizing at the
White House. And if you're going to do that, the model here is
the CIO has got to report to the boss. There's kind of no
getting around that, and it is the desiring goal and objective
of FITARA, it's in our scorecard, and it is part of best
practices GAO established.
The second is--and you can comment on that if you wish. I'm
sorry, I didn't mean to not let you comment.
Mr. Washington. Thank you, Mr. Chairman. I have all the
access--I have extreme amount of access to the Secretary and
the deputy secretary, and I frequently meet with the deputy
secretary and speak with him about matters----
Mr. Connolly. But if I may, Mr. Washington. That's good,
but that could be personal.
Mr. Washington. Yes, sir.
Mr. Connolly. We're talking about an organizational chart
where you have the right to go in that office because you
report to him or her. And if the bureaucracy doesn't see that,
it diminishes your power or your successor's power. Power,
influence, the ability to make change get enforced because
everyone understands you've got the ear's boss--I mean, the
boss's ear. You know, that works in the private sector.
If I know, in the private sector, somebody has the ear of
the CEO, so when he or she calls me, I know who that is,
believe me, I'm paying attention and following up on that as a
priority. And so I think that's really what we're getting at.
It has to show on the organizational chart. It's great you have
access, but your successor may not. And we want to
institutionalize this in the formal structure of the
organization.
And, Mr. Olson, you indicated that you have access to Mr.
Mnuchin, but again, the same thing, is it not that we haven't
institutionalized this, though, so that your successors and his
successors will have the same kind of relationship?
Mr. Olson. Sir if I could elaborate a little bit on the
arrangement. So by Treasury policy, I do have a direct
reporting relationship to Secretary Mnuchin on all CIO matters.
I do also have an operational relationship to the secretary for
management, and I think that is sort of the element that is
causing some confusion or some concern here.
This is what I would offer up. I think Treasury has a very
robust, I'll say performance management structure. That
structure, which has existed for many years, is the purview and
the responsibility of the assistant secretary for management.
It has served actually as enhancer to my authorities as a CIO
to be plugged into that and not try to recreate, for example,
my own sort of set of oversight, if you will, with all the
Treasury bureau heads and Treasury IT leaders.
So it enables me actually to have very good interaction and
influence with bureau heads routinely. I have the opportunity
to meet with them and talk with them on technology matters.
It also brings me to the table when, for example, we're
talking about a particular bureau's budget or work force issues
with the bureau head, because IT doesn't live in a vacuum,
there are work force issues, there are budget issues, there are
procurement issues, and all those folks need to be at the
table. So, you know, I do feel like I have that.
The other thing I'll say, and I mentioned this in my
opening comments, is that we successfully delivered a tax
filing season, it was a very complicated heavy lift. Back a
year or so ago when we were sort of still interpreting the law
and creating specific requirements, I started to have some
concerns about our ability to deliver that on time, and I
expressed those to the Secretary.
The engagement with the Secretary led to the ability, for,
me to meet with IRS leadership weekly for the following year,
and I'm talking about the commissioner, the deputy
commissioners, the CIO, and we sat down and we reviewed the
progress of tax reform implementation weekly so that we would
get there. I don't believe that would have happened if the rest
of the organization didn't understand my reporting relationship
to the Secretary.
Mr. Connolly. Good feedback. And it's also heartening that
finally IRS is getting the attention it has long deserved. It
has been on a starvation diet for all too long, and especially
when it comes to technology, some of those legacy systems are
particularly characteristic of IRS. I mean, as a Democrat, I'm
sorry it took the tax bill to be the incentive to do it, but
I'll take it.
In any event, thank you.
Mr. Meadows.
Mr. Meadows. I'm going to be real brief. Obviously we're
looking at this. We're looking at detail. We're looking at what
is being said and then what is actually being done, and I think
there's a big difference between what is said and what is done,
and sometimes what is said here as witnesses is not what we're
hearing is being actually done at the agencies. So I guess what
I would encourage all of you to do is look at your FITARA
scorecard.
And, Mr. Gray, I want to say thank you. Obviously,
recognizing success is one of the things that we don't do a
good job of doing sometimes. And I know I've been to--I haven't
been to your agency, I've been to the other two agencies, and
many times it's the first time Members of Congress ever come to
say thank you, and shame on us. And so I just want to say thank
you for your work.
Thank you for truly the impact that you're making. And yet,
we will not spend any more money on any one item than we do IT.
I mean, Ms. Harris was talking about $90 billion, you know,
when you add all the factors in there, it's probably up to 110,
120 billion when you count in some of the agencies we can't
talk about. When you look at what all of those components--I'm
amazed at how archaic our IT system is. I mean, we're spending
more than any Fortune 500 company would spend on IT, and yet,
obviously--and, listen, I'm preaching to the choir, all of you
get this.
And I guess what I'm saying, the big thing for me--the big
thing for the chairman is data centers and making sure those
are consolidated. The big thing for me is if we continue to
spend operational money for COBOL and FORTRAN programmers and
legacy systems that--it's just mind-boggling that we would do
it and we continue to do it, not just in some of your agencies,
but in other agencies across this.
And so, for me, it is, you know, really critical, Mr.
Olson. I think about the IRS and the amount of data that you
have, and what I would call the big mainframe IBM systems that
are really programmed in such archaic language that we're
having to pay a premium for the programmers because nobody
programs in that language anymore.
So in terms of action items, for me, if you would get back
to this committee on what is your plan to get rid of legacy
systems, and what is the cost of doing it? And for some of you,
you know, you've got to make sure that you're up and running,
and you may even have to have a parallel system that gets built
so that you can do the transfer.
I realize there are logistical problems, Ms. Harris has
said sometimes it's like trying to change a tire while you're
driving 55 miles an hour. For some of you it's like your
driving 100 miles an hour trying to fix that flat tire, but I
need a plan.
And I guess the only frustration you will find is that at
the next FITARA hearing, if there is not a plan, not just from
the three of you, but anybody that is listening, on how we're
going to get rid of that, there's going to be a problem. I'm
tired of talking about it. And I'm saying that in the nicest
way that I can.
But thank you all for your work. We are making great
progress. Even the Cs and the C+s and D+s and all of that, do
not take the generosity of a modified scoring as oly oly oxen
free. It's time that we get serious about trying to get those
to at least the next level up. And I'll yield back.
Mr. Connolly. I thank the gentleman. The gentlelady from
the District of Columbia, Ms. Eleanor Holmes Norton.
Ms. Norton. Thank you very much, Mr. Chairman, I appreciate
your calling specific agencies so that we could look beneath
the surface and see how this is doing. So I'm interested in the
scorecard that evaluates agencies for implementation of what is
called the Federal Information Security Modernization Act,
that's what we mean when we say FISMA.
And I think that this metric is particularly important to
the Congress because it will enable us to evaluate agencies who
have a metric of their own and then to ask the agencies to
explain themselves, and that's what I'd like to begin with now.
I'm going to ask the Department of Education who received a
C, the Department of Treasury who received a D, and the USDA
who received an F, to explain why and what actions you can take
or have taken to improve these scores?
Mr. Gray. Thank you for the question. Specifically, as was
mentioned earlier, the Risk and Management Assessment, the RMA
piece, is where agencies are assessing against metrics. We meet
regularly to discuss cybersecurity as a whole. As I alluded to
in my opening remarks and my written testimony, we use a
cybersecurity risk scorecard that was developed that is aligned
with the new cybersecurity framework, and what that does is it
enables me to have near real time visibility into the
cybersecurity posture of each of our systems. It reaches back
to the Department of Justice in this case to pull information
about my systems and I use that as----
Ms. Norton. So did you know that--this is Mr. Gray from the
Department of Education--did you know that at the time that
your Department received a C? Is that what it would get today--
will continue to get?
Mr. Gray. We are striving to improve our cybersecurity
scorecard and have made significant improvements. To your
question about what have we done or what are we going to do?
Ms. Norton. Yes.
Mr. Gray. Within the last three months we have made a
massive IT transition to everything entirely new. When I got to
the Department about three years ago, a little over three years
ago now, we inherited a 10-year-old IT service contract. There
was a lot of legacy and old things. We have re-competed and
awarded, and within the last three months have transitioned to
entirely new--new equipment, new hardware, new software, new
systems, everything.
Ms. Norton. So if you were evaluated today, you think you
would do better than a C? If you were evaluated today, given
the improvements you just indicated?
Mr. Gray. We are currently stabilizing within the next two
months, but absolutely. Once the stabilization is done, I
absolutely expect for our scores to improve.
Ms. Norton. The Department of Treasury, that would be Mr.
Olson.
Mr. Olson. That's correct.
Ms. Norton. The Department of Treasury got a D. How do you
explain that, and what actions have you taken to improve that
score metric?
Mr. Olson. Sure. So let's talk about the metric itself.
Part of it is based on an IG audit----
Ms. Norton. Based on what?
Mr. Olson. IG audit that's done of our FISMA system, so we
scored three out of five.
Ms. Norton. Is that why you got a D?
Mr. Olson. So three out of five equates to a D, and that's
50 percent of our grade. And I would the first to tell you that
that's not where we need to be. It's a maturity model and, you
know, part of what we've been trying to do and part of what
we've been using, the cyber enhancement account, has been to
make investments where we get the biggest bang for the buck to
improve these kinds of things.
I actually sat down with Secretary Mnuchin to talk about
our scores in this area, and he said, Eric, what's it going to
take to get to four? So, four, we have 430 systems, it's a
random selection of systems in any given year. So it's like,
gosh, it's an extremely heavy lift, but how can we get to four
on the highest value assets. So he's asked me to put together a
plan, how can we get to four if we were to be audited on our
highest value assets.
The other half of the grade, which is the risk management
score, as you know, this is sort of like 10 individual items,
it's passed down. And some of these scores, if you don't get
100 percent, you fail. So I'm not at all quibbling with the
scorecard, but I mean to say that 9 out of 10 of them are well
into the high 90's, and we have a one or two percent delta,
which--you know, we have got to put it over the line and we
would get, you know, a much better grade.
The one area where we're doing the worst and is actually a
new element that was added to the scorecard in Q-3 of 2018, and
we have a lot of work to do. That has to do with bringing
strong encryption to legacy--well, to high value assets, many
of which in the Department of the Treasury, are legacy systems
which don't lend themselves sort of architecturally elegant
ways of doing that. But nonetheless, we understand the ask,
we'll figure it out. But that's how I look at raising my
scores.
Ms. Norton. So it seems that you are aware.
Mr. Olson. Very aware.
Ms. Norton. And are taking action. And, finally, to round
this out, Mr. Chairman, could I ask the Representative of USDA,
Mr. Washington, about what was the lowest score among the three
of you here, the F score. How do you explain that? Why that
score? And what actions have you taken to improve that score
since you got that score--that low score?
Mr. Washington. Well, ma'am, we were in an environment
where we had many different tools that weren't speaking the
same language in terms of configuration management and
patching. That's where we fell short on the----
Ms. Norton. Do you have a variety of tools, did you say?
Mr. Washington. Yes, we had a variety of tools that weren't
feeding the same information, that's where we fell short on a
FISMA metric because it wasn't feeding the metric data
properly. So what we've done since last year, we've organized
the end user consolidation that's very important to us across
USDA, and we're going to get down to one common tool. And all
of the end user support activities will be managed by the
Department. So they will have common images and patching will
be done the same way and standardized across the Department of
Agriculture. And we intend to have that completed before the
end of Fiscal Year 2020.
Ms. Norton. Thank you very much.
Thank you, Mr. Chairman. That's all.
Mr. Connolly. Thank you. And thank you for that line of
questioning because I think that really is something we got to
work on.
Mr. Olson, I just want to add, with respect to your answer.
Surely--I know you do--understand the part of our intention
was, if it can't be encrypted, it needs to be replaced and
we're trying to incentivize the replacement of legacy systems.
Mr. Olson. Yes.
Mr. Connolly. And that's another nudge.
Mr. Olson. Absolutely. And I think you're aware of a large
modernization plan we have put in for most of that portfolio.
Mr. Connolly. I would just say to all three of you, you
represent agencies that maintain very large data bases. And I
can recall, Mr. Gray, not to cite Education, but we had a
hearing on this subcommittee a number of years ago focusing on
different Federal agencies, and one of them was on yours. And
what really was striking was, you wouldn't think of Department
of Education being a particular target for bad guys in the
cyber world, but you have a data base of over 40 million
Americans. Because if I applied for a student loan, you got my
data. You got my financial data, my banking information, my
credit cards, my credit history, my mortgage, on and on. And
what could go wrong with that if that got breached?
So your being up to snuff in terms of cybersecurity is
actually pretty important to the American people, and that
would certainly be true--IRS has data on everybody. And USDA
has all kinds of data base, of course, as well. So, you know,
this cyber question is not an academic one, I know not for you,
but it isn't for us either. We're very cognizant of what can go
wrong if we don't accelerate this move toward updated systems.
Oh, I'm sorry, Mr. Grothman, the gentleman from Wisconsin.
Mr. Grothman. Thank you very much. I'd like to thank the
other three of you for coming over here, I know it's very busy
for you and we're keeping you here a little late. So appreciate
the extra effort.
We talked before about the huge amount of cost that goes
into what--I think it was Ms. Harris described as legacy
systems. And I wondered for each of your three agencies, if we
can start with Mr. Washington, could you let us know how many
of the systems in your agencies you would describe as legacy
systems?
Mr. Washington. Sir, in terms of legacy systems, is it
classified and is obsolete using outdate technology?
Mr. Grothman. Correct.
Mr. Washington. We have less than five systems that are
actually classified as old legacy systems. But we do spend
about 77 percent of our portfolio in terms of O&M.
Mr. Grothman. Seventy-seven percent of your money you spend
on the legacy systems? You said you have five legacy systems
left, of that, five of how many?
Mr. Washington. Oh, how many systems? We have--I'd have to
get back to you on the exact number of systems, sir.
Mr. Grothman. About.
Mr. Washington. We have about 129 systems in USDA.
Mr. Grothman. So you spend 77 percent of the money on five
out of like 150 systems?
Mr. Washington. On operation and maintenance. Of what we
spend on our IT portfolio.
Mr. Grothman. That's almost unbelievable. Could you give me
the dollar numbers that go with those fantastic figures?
Mr. Washington. Say again, sir.
Mr. Grothman. Like how many dollars are we talking about
here.
Mr. Washington. We have approximately a $2.3 billion IT
portfolio at USDA.
Mr. Grothman. Two point three billion.
Mr. Washington. Yes sir.
Mr. Grothman. And you spend like 72 percent of that on five
out of a 150 systems.
Mr. Washington. No not on five--that's on O&M. On the five
systems we don't spend that much money, sir.
Mr. Grothman. Okay. But you said you spent over 70 percent
on five legacy systems. Is that right.
Mr. Washington. I said for operations and maintenance. On
the five legacy systems, we plan to retire those this year--
those this year. And I don't have the exact numbers right now,
but it's not--it's a small amount of money.
Mr. Grothman. Okay. Well, it sounds kind of amazing
numbers. Mr. Gray, I'll give you the same question.
Mr. Gray. We have one legacy system at the Department,
which is currently planned to be modernized through the next
gen initiative that Federal Student Aid is leading.
Mr. Grothman. And when will that be done?
Mr. Gray. Excuse me.
Mr. Grothman. When will that be done? When will it be
modernized?
Mr. Gray. That is a wonderful question. We currently have
contracts that are under a protest, and as soon as those
contract protests are resolved, we will be proceeding forward.
Mr. Grothman. What's the nature of the protests?
Mr. Gray. There's quite a number of that. I'd be happy to
followup after.
Mr. Grothman. Okay. We'll give Mr. Olson the same question.
Mr. Olson. Sure. So I'm happy to sort of comment. Within
Treasury we have eight or so major bureaus, and I would
probably answer that question a little bit for each one. But at
the end of the day, the biggest rock in the Treasury Department
is the IRS. So let's sort of talk about that one, because I
think that one. It's roughly sort of an 80/20 split, maybe 85/
15, depending on the year.
Mr. Grothman. What is the 85?
Mr. Olson. Eighty-five is O&M versus what we call
development, maintenance, and enhancement DM&E, which is the
build piece. I would offer this--there's been a lot of
discussion earlier in--in the early panel about private sector
companies.
I spent a lot of time talking to private sector companies,
and in particular, financial services companies, and asked them
this question a lot about how much do they spend on O&M, which
is in the private sector they call run, and DM&E, which in the
private sector they call grow. And they have another--sort of
another category of spend that they call transform.
It's not necessarily bad in and of itself to have a big
number in run. But you have to have strategy for making the
business case to invest as much as you can in grow and
transform. And I will just say, as far as the IRS goes, and the
big banks that I've talked to, this particular fraction, if you
will, percentage, if you will, is not unlike what the biggest
banks in the countries see as far as the split between run and
build.
We have a big proposal and request for funding, you know,
that will be coming forward----
Mr. Grothman. When you talk to other people--and I'm
already past my time limit here. Do they feel you're up-to-date
or do they say this is where we were 15 years ago, or what do
they say?
Mr. Olson. They, like us, have an enormously complex set of
systems. So a GAO report just came out, we had, you know, the
honorary of a 51-year old system. A 51-year-old system, that is
the year it was put into production. It gets down to I think
what's the definition of legacy. I mean, we joke sometimes in
the IT business that legacy begins the day after you implement
the system for the first day. You know, so the definition of
legacy is something that there's a fair amount of debate on.
You know, if I were to take that 51-year-old system and
tell you it's running on a mainframe that's four years old, is
it a legacy system. There is a variety of----
Mr. Grothman. In general, though, when you talk to people,
because I'm way over, my subcommittee chair is being very
gracious. When you talk to people, where do they feel about
where you are?
Mr. Olson. Oh, absolutely, they say we need to make
significant changes, and we're committed to that.
Mr. Grothman. Do they say, like, we are where we were 15
years ago or something. I mean, you hear some of these stories
that the government is so far behind where everybody else is.
Mr. Olson. I'm not going to debate that, but I will tell
you that I met with a group of financial service CIOs from some
of the country's biggest banks, and it was amazing how similar
of the challenges that we have in terms of our portfolio of
applications.
Mr. Grothman. Okay. Thank you.
Mr. Connolly. I thank the gentleman. Mr. Olson, let me
followup on your answers to Mr. Grothman, however. I think it's
a little misleading to compare yourself to the private sector,
we're kind of roughly the same----
Mr. Olson. Absolutely.
Mr. Connolly. Same ratio. There is no private sector
company I know of----
Mr. Olson. There is not.
Mr. Connolly. [continuing]. that has a 51-year-old
operating system still operating and you're dependent on.
Mr. Olson. Well, yes. I'm not trying to defend that.
Mr. Connolly. I understand. But it goes deeper, doesn't it?
So I remember during the Obama years, the IRS was so starved
that the average computer, the average PC. For example, was in
the eight to nine year range. In the private sector any modern
company is replacing computers every two or three years.
Mr. Olson. Right.
Mr. Connolly. So already we're at a huge disadvantage, and
little wonder that we had a lot of hard drive crashes, because
it just was out living its life span, and we were really taxing
that hardware really behind its useful life.
We also had for IRS, if you wanted to archive material and
be able to retrieve it, the instruction was, print and save.
Now there is no private sector company that would accept that
as a standard. IRS has to because we weren't allowing them to
invest in their technology.
So I just wanted to clarify that in the case certainly of
at least your big constituent agency, IRS, it is a victim
directly of investment starvation.
Mr. Olson. Absolutely. And I don't mean to--I think I just
wanted to paint that it was a more nuanced picture, and we are
trying to look at what is a very large portfolio to identify
the places where we really need to make that investment and
move quickly, as opposed to just painting a broad brush to what
is almost a $300 billion dollars spend.
Mr. Connolly. As I said earlier, I've been on this case for
quite some time. And the IRS--I regret that my colleagues on
the other side finally got around to wanting to do something
only because they realized their tax bill was at jeopardy if
they didn't because you couldn't implement it. I wish we had
made those investments earlier for the sake of serving the
American public with or without a tax bill.
Mr. Olson. Agreed.
Mr. Connolly. And hopefully that will be the ethos going
forward. Ms. Harris, anything else for the good of the order?
Anything we haven't covered that we ought to at least mention?
Ms. Harris. I think we've covered everything.
Mr. Connolly. We've covered everything.
Ms. Harris. We have, sir.
Mr. Connolly. Let the record show, GAO believes we have
covered everything. But, again, I want to thank you for your
leadership and your incredible staff work from the very top. I
mean, you know, this item has been on the high risk list for a
long time.
GAO unequivocally got behind FITARA and supported the
legislation and exhorted Congress to pass it, and has been with
us every step of the way as we insist on its implementation.
And we couldn't have done it without you, and I think
you're really one of the great heros of--if this legislation is
transformative over time, GAO shares in the credit, and we
thank you.
Let me see, what am I doing here? I am adjourning. Okay. I
want to thank our witnesses. And without objection, all members
will have five legislative days within which to submit
additional written questions for the witnesses, and those
questions will come from us.
And if you can get back to us in a timely fashion, through
the chair, we'll distribute them to the members, should they
appear.
I want to wish you all a good day. Thank you again for your
patience with the House schedule. Good luck on your trip, Ms.
Harris. This hearing is adjourned.
[Whereupon, at 5:55 p.m., the subcommittee was adjourned.]
[all]
| MEMBERNAME | BIOGUIDEID | GPOID | CHAMBER | PARTY | ROLE | STATE | CONGRESS | AUTHORITYID |
|---|---|---|---|---|---|---|---|---|
| Clay, Wm. Lacy | C001049 | 8009 | H | D | COMMMEMBER | MO | 116 | 1654 |
| Lynch, Stephen F. | L000562 | 7974 | H | D | COMMMEMBER | MA | 116 | 1686 |
| Wasserman Schultz, Debbie | W000797 | 7892 | H | D | COMMMEMBER | FL | 116 | 1777 |
| Foxx, Virginia | F000450 | 8028 | H | R | COMMMEMBER | NC | 116 | 1791 |
| Sarbanes, John P. | S001168 | 7978 | H | D | COMMMEMBER | MD | 116 | 1854 |
| Sarbanes, John P. | S001168 | 7978 | H | D | COMMMEMBER | MD | 116 | 1854 |
| Jordan, Jim | J000289 | 8094 | H | R | COMMMEMBER | OH | 116 | 1868 |
| Welch, Peter | W000800 | 8204 | H | D | COMMMEMBER | VT | 116 | 1879 |
| Speier, Jackie | S001175 | 7817 | H | D | COMMMEMBER | CA | 116 | 1890 |
| Connolly, Gerald E. | C001078 | 8202 | H | D | COMMMEMBER | VA | 116 | 1959 |
| Gosar, Paul A. | G000565 | 7798 | H | R | COMMMEMBER | AZ | 116 | 1992 |
| Amash, Justin | A000367 | 7988 | H | I | COMMMEMBER | MI | 116 | 2029 |
| Gibbs, Bob | G000563 | 8108 | H | R | COMMMEMBER | OH | 116 | 2049 |
| Massie, Thomas | M001184 | 8371 | H | R | COMMMEMBER | KY | 116 | 2094 |
| Meadows, Mark | M001187 | H | R | COMMMEMBER | NC | 116 | 2142 | |
| Kelly, Robin L. | K000385 | H | D | COMMMEMBER | IL | 116 | 2190 | |
| DeSaulnier, Mark | D000623 | H | D | COMMMEMBER | CA | 116 | 2227 | |
| Hice, Jody B. | H001071 | H | R | COMMMEMBER | GA | 116 | 2237 | |
| Hice, Jody B. | H001071 | H | R | COMMMEMBER | GA | 116 | 2237 | |
| Lawrence, Brenda L. | L000581 | H | D | COMMMEMBER | MI | 116 | 2252 | |
| Lawrence, Brenda L. | L000581 | H | D | COMMMEMBER | MI | 116 | 2252 | |
| Grothman, Glenn | G000576 | H | R | COMMMEMBER | WI | 116 | 2276 | |
| Comer, James | C001108 | H | R | COMMMEMBER | KY | 116 | 2297 | |
| Khanna, Ro | K000389 | H | D | COMMMEMBER | CA | 116 | 2308 | |
| Cooper, Jim | C000754 | 8152 | H | D | COMMMEMBER | TN | 116 | 231 |
| Krishnamoorthi, Raja | K000391 | H | D | COMMMEMBER | IL | 116 | 2325 | |
| Higgins, Clay | H001077 | H | R | COMMMEMBER | LA | 116 | 2329 | |
| Raskin, Jamie | R000606 | H | D | COMMMEMBER | MD | 116 | 2332 | |
| Norman, Ralph | N000190 | H | R | COMMMEMBER | SC | 116 | 2361 | |
| Gomez, Jimmy | G000585 | H | D | COMMMEMBER | CA | 116 | 2362 | |
| Cloud, Michael | C001115 | H | R | COMMMEMBER | TX | 116 | 2369 | |
| Hill, Katie | H001087 | H | D | COMMMEMBER | CA | 116 | 2379 | |
| Rouda, Harley | R000616 | H | D | COMMMEMBER | CA | 116 | 2382 | |
| Pressley, Ayanna | P000617 | H | D | COMMMEMBER | MA | 116 | 2405 | |
| Tlaib, Rashida | T000481 | H | D | COMMMEMBER | MI | 116 | 2410 | |
| Armstrong, Kelly | A000377 | H | R | COMMMEMBER | ND | 116 | 2417 | |
| Ocasio-Cortez, Alexandria | O000172 | H | D | COMMMEMBER | NY | 116 | 2427 | |
| Green, Mark E. | G000590 | H | R | COMMMEMBER | TN | 116 | 2442 | |
| Roy, Chip | R000614 | H | R | COMMMEMBER | TX | 116 | 2449 | |
| Miller, Carol D. | M001205 | H | R | COMMMEMBER | WV | 116 | 2460 | |
| Cummings, Elijah E. | C000984 | 7982 | H | D | COMMMEMBER | MD | 116 | 256 |
| Maloney, Carolyn B. | M000087 | 8075 | H | D | COMMMEMBER | NY | 116 | 729 |
Disclaimer:
Please refer to the About page for more information.