Background As shown in table 1 the cost of counting the nation’s population has been escalating with each decade. The 2010 Census was the most expensive in U.S. history at about $12.3 billion, and was about 31 percent more costly than the $9.4 billion 2000 Census (in 2020 dollars). According to the Bureau, the total cost of the 2020 Census in October 2015 was estimated at $12.3 billion and in October 2017 that cost estimate grew to approximately $15.6 billion, approximately a $3 billion increase. Additionally, Bureau officials told us that while the estimated cost of the census had increased to $15.6 billion, it was nevertheless managing the 2020 Census to a lower cost of $14.1 billion. Bureau officials explained that the $14.1 billion includes all program costs and contingency funds to cover risks and general estimating uncertainty. The remaining $1.5 billion estimated cost is additional contingency for “unknown unknowns”—that is, low probability events that could cause massive disruptions—and several what-if scenarios such as an increase in the wage rate or additional supervisors needed to manage field operations. Moreover, as shown in figure 1, the average cost for counting a housing unit increased from about $16 in 1970 to around $92 in 2010 (in 2020 constant dollars). At the same time, the return of census questionnaires by mail (the primary mode of data collection) declined over this period from 78 percent in 1970 to 63 percent in 2010. Declining mail response rates has led to higher costs because the Bureau sends temporary workers to each non-responding household to obtain census data. Achieving a complete and accurate census has become an increasingly daunting task, in part, because the population is growing larger, more diverse, and more reluctant to participate in the enumeration. In many ways, the Bureau has had to invest substantially more resources each decade to conduct the enumeration. In addition to these external societal challenges that make achieving a complete count a daunting task, the Bureau also faces a number of internal management challenges that affect its capacity and readiness to conduct a cost-effective enumeration. Some of these issues—such as acquiring and developing IT systems and preparing reliable cost estimates—are long-standing in nature. At the same time, as the Bureau looks toward 2020, it also faces newly emerging and evolving uncertainties. For example, on March 26, 2018, the Secretary of Commerce announced his decision to add a question to the decennial census on citizenship status. On January 15, 2019, the U.S. District Court for the Southern District of New York ruled on one of a number of legal challenges to the Secretary’s decision. That ruling is being appealed, thus, leaving the use of the question uncertain. The U.S. Supreme Court is scheduled to begin hearing arguments in April 2019 regarding the addition of the citizenship question to the census form. In our prior work we have noted the risks associated with late changes of any nature to the design of the census if the Bureau is unable to fully test those changes under operational conditions. The Bureau also faced budgetary uncertainties that, according to the Bureau, led to the curtailment of testing in 2017 and 2018. However, the Consolidated Appropriations Act, 2018 appropriated for the Periodic Censuses and Programs account $2.544 billion, which more than doubles the Bureau’s request in the President’s Fiscal Year 2018 Budget of $1.251 billion. According to the explanatory statement accompanying the act, the appropriation, which is available through fiscal year 2020, is provided to ensure the Bureau has the necessary resources to immediately address any issues discovered during operational testing, and to provide a smoother transition between fiscal year 2018 and fiscal year 2019. The availability of those resources enabled the Bureau to continue preparations for the 2020 Census during the 35 days when appropriations lapsed for the Bureau. Moreover, the Consolidated Appropriations Act, 2019 appropriated for the Periodic Censuses and Programs account $3.551 billion. According to Bureau officials, this level of funding for fiscal year 2019 is sufficient to carry out 2020 Census activities as planned. Importantly, the census is conducted against a backdrop of immutable deadlines. In order to meet legally mandated reporting requirements, census activities need to take place at specific times and in the proper sequence. Thus, it is absolutely critical for the Bureau to stay on schedule. Figure 2 shows some dates for selected decennial events. The Bureau Has Begun Opening Offices and Hiring Temporary Staff The Bureau has begun to open its area census offices (ACO) for the 2020 Census. It has signed leases for all 248 ACOs, of which 39 of the offices will be open for the address canvassing operation set to begin in August 2019 where staff verifies the location of selected housing units. The remaining 209 offices will begin opening this fall. In 2010 the Bureau opened 494 census offices. The Bureau has been able to reduce its infrastructure because it is relying on automation to assign work and to record payroll. Therefore there is less paper—field assignments, maps, and daily payroll forms—to manually process. For the 2020 Census, the Bureau is refining its recruiting and hiring goals, but tentatively plans to recruit approximately 2.24 million applicants and hire nearly 500,000 temporary field staff from that applicant pool for two key operations: address canvassing, and nonresponse follow-up, where they visit households that do not return census forms to collect data in person. In 2010 the Bureau recruited 3.8 million applicants and hired 628,000 temporary workers to conduct the address canvassing and nonresponse follow-up field operations. According to Bureau officials, it has reduced the number of temporary staff it needs to hire because automation has made field operations more efficient and there is less paper. As of April 15, 2019, for its early operations efforts which includes hiring listers for address canvassing, the Bureau has processed approximately 264,000 applicants which represent 128.4 percent of its 205,000 recruiting goal. The Bureau is also in the process of hiring approximately 1,500 partnership specialists needed by June 2019 to help increase awareness and participation in the 2020 Census in minority communities and hard-to-reach populations. As of April 17, 2019, the Bureau has hired 467 partnership specialists, and another 329 applicants are waiting to have their background checks completed. Moreover, Bureau officials also stated that the current economic environment (i.e., the low unemployment rate compared to the economic environment of the 2010 Census) has not yet impacted their ability to recruit staff. The Bureau will continue to monitor the impact of low unemployment on its ability to recruit and hire at the local and regional levels. The Bureau Plans to Rely Heavily on IT for the 2020 Census For the 2020 Census, the Bureau is significantly changing how it intends to conduct the census, in part by re-engineering key census-taking methods and infrastructure, and making use of new IT applications and systems. For example, the Bureau plans to offer an option for households to respond to the survey via the internet and enable field-based enumerators to use applications on mobile devices to collect survey data from households. To do this, the Bureau plans to utilize 52 new and legacy IT systems, and the infrastructure supporting them, to conduct the 2020 Census. A majority of these 52 systems have been tested during operational tests in 2017 and 2018. For example, the Bureau conducted its 2018 End-to- End test, which included 44 of the 52 systems and was intended to test all key systems and operations in a census-like environment to ensure readiness for the 2020 Census. Nevertheless, additional IT development and testing work needs to take place before the 2020 Census. Specifically, officials from the Bureau’s Decennial Directorate said they expect that the systems will need to undergo further development and testing due to, among other things, the need to add functionality that was not part of the End-to-End test, scale system performance to support the number of respondents expected during the 2020 Census, and address system defects identified during the 2018 End-to-End test. To prepare the systems and technology for the 2020 Census, the Bureau is also relying on significant contractor support. For example, it is relying on contractors to develop a number of systems and components of the IT infrastructure, including the IT platform that is intended to be used to collect data from households responding via the internet and telephone, and for non-response follow-up activities. Contractors are also deploying the IT and telecommunications hardware in the field offices and providing device-as-a-service capabilities by procuring the mobile devices and cellular service to be used for non-response follow-up. In addition to the development of technology, the Bureau is relying on a technical integration contractor to integrate all of the key systems and infrastructure. The contractor’s work is expected to include, among other things, evaluating the systems and infrastructure and acquiring the infrastructure (e.g., cloud or data center) to meet the Bureau’s scalability and performance needs; integrating all of the systems; and assisting with technical, performance and scalability, and operational testing activities. 2020 Census Identified by GAO as a High-Risk Area In February 2017, we added the 2020 Decennial Census as a high-risk area needing attention from Congress and the executive branch. This was due to significant risks related to, among other things, innovations never before used in prior enumerations, the acquisition and development of IT systems, and expected escalating costs. Among other things, we reported that the commitment of top leadership was needed to ensure the Bureau’s management, culture, and business practices align with a cost-effective enumeration. We also stressed that the Bureau needed to rigorously test census-taking activities; ensure that scheduling adheres to best practices; improve its ability to manage, develop, and secure its IT systems; and have better oversight and control over its cost estimation process. Our experience has shown that the key elements needed to make progress toward being removed from the High-Risk List are top-level attention by the administration and agency leaders grounded in the five criteria for removal, as well as any needed congressional action. The five criteria for removal that we identified in November 2000 are as follows: Leadership Commitment. The agency has demonstrated strong commitment and top leadership support. Capacity. The agency has the capacity (i.e., people and resources) to resolve the risk(s). Action Plan. A corrective action plan exists that defines the root causes and solutions, and that provides for substantially completing corrective measures, including steps necessary to implement solutions we recommended. Monitoring. A program has been instituted to monitor and independently validate the effectiveness and sustainability of corrective measures. Demonstrated Progress. The agency has demonstrated progress in implementing corrective measures and in resolving the high-risk area. These five criteria form a road map for efforts to improve, and ultimately address, high-risk issues. Addressing some of the criteria leads to progress, while satisfying all of the criteria is central to removal from the list. As we reported in the March 2019 high-risk report, the Bureau’s efforts to address the risks and challenges for the 2020 Census had fully met one of the five criteria for removal from the High-Risk List—leadership commitment—and partially met the other four, as shown in figure 3. Additional details about the status of the Bureau’s efforts to address this high-risk area are discussed later in this statement. The 2020 Census Remains High Risk Due to Challenges Facing the Enumeration The 2020 Census is on our list of high-risk programs because, among other things, (1) innovations never before used in prior enumerations are not expected to be fully tested, (2) the Bureau continues to face challenges in implementing IT systems, (3) the Bureau faces significant cybersecurity risks to its systems and data, and (4) the Bureau’s cost estimate for the 2020 Census was unreliable. If not sufficiently addressed, these risks could adversely impact the cost and quality of the enumeration. Moreover, the risks are compounded by other factors that contribute to the challenge of conducting a successful census, such as the nation’s increasingly diverse population and concerns over personal privacy. Key Risk #1: The Bureau Has Redesigned the Census with the Intent to Control Costs, but Has Scaled Back Critical Tests The basic design of the enumeration—mail out and mail back of the census questionnaire with in-person follow-up for non-respondents—has been in use since 1970. However, a lesson learned from the 2010 Census and earlier enumerations is that this traditional design is no longer capable of cost-effectively counting the population. In response to its own assessments, our recommendations, and studies by other organizations, the Bureau has fundamentally re-examined its approach for conducting the 2020 Census. Specifically, its plan for 2020 includes four broad innovation areas: re-engineering field operations, using administrative records, verifying addresses in-office, and developing an internet self-response option (see table 2). If they function as planned, the Bureau initially estimated that these innovations could result in savings of over $5 billion (in 2020 constant dollars) when compared to its estimates of the cost for conducting the census with traditional methods. However, in June 2016, we reported that the Bureau’s initial life-cycle cost estimate developed in October 2015 was not reliable and did not adequately account for risk. As discussed earlier in this statement, the Bureau has updated its estimate from $12.3 billion and now estimates a life-cycle cost of $15.6 billion, which would result in a smaller potential savings from the innovative design than the Bureau originally estimated. According to the Bureau, the goal of the cost estimate increase was to ensure quality was fully addressed. While the planned innovations could help control costs, they also introduce new risks, in part, because they include new procedures and technology that have not been used extensively in earlier decennials, if at all. Our prior work has shown the importance of the Bureau conducting a robust testing program, including the 2018 End-to-End test. Rigorous testing is a critical risk mitigation strategy because it provides information on the feasibility and performance of individual census-taking activities, their potential for achieving desired results, and the extent to which they are able to function together under full operational conditions. To address some of these challenges we have made numerous recommendations aimed at improving reengineered field operations, using administrative records, verifying the accuracy of the address list, and securing census responses via the internet. The Bureau has held a series of operational tests since 2012, but according to the Bureau, it scaled back its most recent field tests because of funding uncertainties. For example, the Bureau canceled the field components of the 2017 Census Test including non-response follow-up, a key census operation. In November 2016, we reported that the cancelation of the 2017 Census Test was a lost opportunity to test, refine, and integrate operations and systems, and that it put more pressure on the 2018 End-to-End test to demonstrate that enumeration activities will function under census-like conditions as needed for 2020. However, in May 2017, the Bureau scaled back the operational scope of the 2018 End-to-End test and, of the three planned test sites, only the Rhode Island site would fully implement the 2018 End-to-End test. The Washington and West Virginia sites would test just one field operation. In addition, due to budgetary concerns, the Bureau decided to remove three coverage measurement operations (and the technology that supports them) from the scope of the test. However, removal of the coverage measurement operations did not affect testing of the delivery of apportionment or redistricting data. Without sufficient testing, operational problems can go undiscovered and the opportunity to improve operations will be lost, in part because the 2018 End-to-End test was the last opportunity to demonstrate census technology and procedures across a range of geographic locations, housing types, and demographic groups under decennial-like conditions prior to the 2020 Census. To manage risk to the census, the Bureau has developed hundreds of mitigation and contingency plans. To maximize readiness for the 2020 Census, it will also be important for the Bureau to prioritize among its mitigation and contingency strategies those that will deliver the most cost-effective outcomes for the census. We reported on the 2018 End-to-End test in December 2018 and noted that the Bureau had made progress addressing prior test implementation issues but still faced challenges. As the Bureau studies the results of its testing to inform the 2020 Census, it will be important that it addresses key program management issues that arose during implementation of the test. Namely, by not aligning the skills, responsibilities, and information flows for the first-line supervisors during field data collection, the Bureau limited its role in support of enumerators within the re-engineered field operation. The Bureau also lacked mid-operation training or guidance, which, if implemented in a targeted, localized manner, could have further helped enumerators navigate procedural modifications and any commonly encountered problems when enumerating. It will be important for the Bureau to prioritize its mitigation strategies for these implementation issues so that it can maximize readiness for the 2020 Census. Key Risk #2: The Bureau Faces Challenges in Implementing IT Systems We have previously reported that the Bureau faces challenges in managing and overseeing IT programs, systems, and contractors supporting the 2020 Census. Specifically, we have noted challenges in the Bureau’s efforts to manage, among other things, the schedules and contracts for its systems. As a result of these challenges, the Bureau is at risk of being unable to fully implement the systems necessary to support the 2020 Census and conduct a cost-effective enumeration. The Bureau Has Made Initial Progress against Its Revised Development and Testing Schedule, but Risks Missing Near-term Milestones To help improve its implementation of IT for the 2020 Census, the Bureau recently revised its systems development and testing schedule. Specifically, in October 2018, the Bureau organized the development and testing schedule for its 52 systems into 16 operational deliveries. Each of the 16 operational deliveries has milestone dates for, among other things, development, performance and scalability testing, and system deployment. According to Bureau officials in the Decennial Directorate, the schedule was revised, in part, due to schedule management challenges experienced, and lessons learned, while completing development and testing during the 2018 End-to-End test. The Bureau has made initial progress in executing work against its revised schedule. For example, the Bureau completed development for the systems in the first operational delivery—for 2020 Census early operations preparations—in July 2018, and deployed these systems into production in October 2018. However, our current work has determined that the Bureau is at risk of not meeting several near-term systems testing milestones. As of April 2019, six systems that are expected to be used in a total of two operational deliveries are at risk of not meeting milestone dates which would signal that the systems have completed development and are ready for testing. These six systems are needed for, among other things, field assignment management and worker performance tracking during address canvassing, data collection for operations, business and support automation, and customer support during self-response. According to Bureau documentation, these systems were at risk due, in part, to the lack of finalized system requirements and specifications. Figure 4 presents an overview of the status for all 16 operational deliveries, as of April 2019. The at-risk systems previously discussed add uncertainty to a highly compressed time frame over the next 4 months. Importantly, between April and August 2019, the Bureau is expected to begin integration testing for the systems in seven operational deliveries, including internet self- response and non-response follow-up. Officials from the Bureau’s integration contractor noted concern that the current schedule leaves little room for any delays in completing the remaining development and testing activities. In addition to managing the compressed testing time frames, the Bureau also has to quickly finalize plans related to its IT infrastructure. For example, in March 2019, the Bureau’s technical integration contractor stated that it needed the Bureau to obtain approval from federal partners for its Trusted Internet Connection or finalize alternative plans in order to complete performance and scalability testing in a timely manner. As of mid-April 2019, the Bureau stated that it was still awaiting final approval. Given that these plans may impact systems being tested this summer or deployed into production for the address canvassing operation in August 2019, it is important that the Bureau quickly addresses this matter. Our past reporting noted that the Bureau faced significant challenges in managing its schedule for system development and testing that occurred in 2017 and 2018. We reported that while the Bureau had continued to make progress in developing and testing IT systems for the 2020 Census, it had experienced delays in developing systems to support the 2018 End-to-End test. These delays compressed the time available for system and integration testing and for security assessments. In addition, several systems experienced problems during the test. We noted then, and reaffirm now, that continued schedule management challenges may compress the time available for the remaining system and integration testing and increase the risk that systems may not function or be as secure as intended. The Bureau has acknowledged that it faces risks to the implementation of its systems and technology. As of March 2019, the Bureau had identified about 330 active risks for the 2020 Census program, through its risk management process, including 20 high risks that may have substantial technical and schedule impacts if realized. Taken together, these risks represent a cross-section of issues, such as the effects of late changes to technical requirements, the need to ensure adequate time for system development and performance and scalability testing, contracting issues, privacy risks, and skilled staffing shortages. Going forward, it will be important that the Bureau effectively manages these risks to better ensure that it meets near-term milestones for system development and testing, and is ready for the major operations of the 2020 Census. Key Risk #3: The Bureau Faces Significant Cybersecurity Risks to Its Systems and Data The risks to IT systems supporting the federal government and its functions, including conducting the 2020 Census, are increasing as security threats continue to evolve and become more sophisticated. These risks include insider threats from witting or unwitting employees, escalating and emerging threats from around the globe, and the emergence of new and more destructive attacks. Underscoring the importance of this issue, we have designated information security as a government-wide high-risk area since 1997 and, in our most recent biennial report to Congress, ensuring the cybersecurity of the nation was one of nine high-risk areas that we reported needing especially focused executive and congressional attention. Our prior and ongoing work has identified significant challenges that the Bureau faces in securing systems and data for the 2020 Census. Specifically, the Bureau has faced challenges related to completing security assessments, addressing security weaknesses, resolving cybersecurity recommendations from DHS, and addressing numerous other cybersecurity concerns (such as phishing). The Bureau Has Made Progress in Completing Security Assessment, but Critical Work Remains Federal law specifies requirements for protecting federal information and information systems, such as those systems to be used in the 2020 Census. Specifically, the Federal Information Security Management Act of 2002 and the Federal Information Security Modernization Act of 2014 (FISMA) require executive branch agencies to develop, document, and implement an agency-wide program to provide security for the information and information systems that support operations and assets of the agency. In accordance with FISMA, National Institute of Standards and Technology (NIST) guidance, and Office of Management and Budget (OMB) guidance, the Bureau’s Office of the Chief Information Officer (CIO) established a risk management framework. This framework requires system developers to ensure that each of the Bureau’s systems undergoes a full security assessment, and that system developers remediate critical deficiencies. According to the Bureau’s risk management framework, the systems expected to be used to conduct the 2020 Census will need to have complete security documentation (such as system security plans) and an approved authorization to operate prior to their use. Currently, according to the Bureau’s Office of the CIO: Fourteen of the 52 systems have authorization to operate, and will not need to be reauthorized before they are used in the 2020 Census Thirty-two of the 52 systems have authorization to operate, and may need to be reauthorized before they are used in the 2020 Census Six of the 52 systems do not have authorization to operate, and will need to be authorized before they are used in the 2020 Census. Figure 5 summarizes the authorization to operate status for the systems being used in the 2020 Census, as reported by the Bureau in April 2019. As we have previously reported, while large-scale technological changes (such as internet self-response) increase the likelihood of efficiency and effectiveness gains, they also introduce many cybersecurity challenges. The 2020 Census also involves collecting personally identifiable information (PII) on over a hundred million households across the country, which further increases the need to properly secure these systems. Thus, it will be important that the Bureau provides adequate time to perform these security assessments, completes them in a timely manner, and ensures that risks are at an acceptable level before the systems are deployed. We have ongoing work examining how the Bureau plans to address both internal and external cyber threats, including its efforts to complete system security assessments and resolve identified weaknesses. The Bureau Has Identified a Significant Number of Corrective Actions to Address Security Weaknesses, but Has Not Always Been Timely in Completing Them FISMA requires that agency-wide information security programs include a process for planning, implementing, evaluating, and documenting remedial actions (i.e., corrective actions) to address any deficiencies in the information security policies, procedures, and practices of the agency. Agencies must establish procedures to reasonably ensure that all information security control weaknesses, regardless of how or by whom they are identified, are addressed through the agency’s remediation processes. For each identified control weakness, the agency is required to develop and implement a plan of actions and milestones (POA&M) based on findings from security control assessments, security impact analyses, continuous monitoring of activities, audit reports, and other sources. Additionally, the Bureau’s framework requires that security assessment findings that need to be remediated are to be tracked as POA&Ms. These POA&Ms are expected to provide a description of the vulnerabilities identified during the security assessment that resulted from a control weakness. As of March 2019, the Bureau had over 500 open POA&Ms to remediate for issues identified during security assessment activities, including ongoing continuous monitoring. Of these open POA&Ms, 247 (or about 48 percent) were considered “high-risk” or “very high-risk.” While the Bureau established POA&Ms for addressing these identified security control weaknesses, it did not always complete remedial actions in accordance with its established deadlines. For example, of the 247 open “high-risk” or “very high-risk” POA&Ms we reviewed through March 2019, the Bureau identified 115 as being delayed. Further, 70 of the 115 had missed their scheduled completion dates by 60 or more days. In addition, the number of open “high-risk” or “very high-risk” POA&Ms that the Bureau identified as delayed has substantially increased since June 2018, as shown in figure 6. According to the Bureau, these POA&Ms were identified as delayed due to technical challenges or resource constraints to remediate and close them. However, without resolving identified vulnerabilities in a timely manner, the Bureau faces an increased risk, as continuing opportunities exist for unauthorized individuals to exploit these weaknesses and gain access to sensitive information and systems. The Bureau Has Begun Implementing DHS’s Cybersecurity Recommendations, but Has Not Established a Formal Process to Address Them The Bureau is working with federal and industry partners, including the Department of Homeland Security, to support the 2020 Census cybersecurity efforts. Specifically, the Bureau is working with DHS to ensure a scalable and secure network connection for the 2020 Census respondents (e.g., virtual Trusted Internet Connection with the cloud), improve its cybersecurity posture (e.g., improve risk management processes and procedures), and to strengthen its response to potential cyber threats (e.g., federal cyber incident coordination). Federal law describes practices for strengthening cybersecurity by documenting or tracking corrective actions. As previously mentioned, FISMA requires executive branch agencies to establish a process for planning, implementing, evaluating, and documenting remedial actions to address any deficiencies in their information security policies, procedures, and practices. GAO’s internal control standards also state that agencies should establish effective internal control monitoring that includes a process to promptly resolve the findings of audits and other reviews. Specifically, agencies should document and complete corrective actions to remediate identified deficiencies on a timely basis. This would include correcting identified deficiencies or demonstrating that the findings and recommendations do not warrant agency action. Since January 2017, DHS has been providing cybersecurity assistance (including issuing recommendations) to the Bureau in preparation for the 2020 Census, and the Bureau has reported making progress in addressing those recommendations. Specifically, DHS has been providing cybersecurity assistance to the Bureau in five areas: management coordination and executive support, including a cybersecurity threat intelligence and information sharing enhancement through, among other things, a DHS cyber threat briefing to the Bureau’s leadership; network and infrastructure security and resilience, including National Cybersecurity Protection System (also called EINSTEIN) support; incident response and management readiness through a Federal Incident Response Evaluation assessment; and risk management and vulnerability assessments on specific targets provided by the Bureau. In the last 2 years, as a result of these activities, DHS has provided 17 recommendations for the Bureau to strengthen its cybersecurity efforts. Among other things, the recommendations pertained to strengthening incident management capabilities, penetration testing and web application assessments of select systems, and phishing assessments to gain access to sensitive PII. Due to the sensitive nature of the recommendations, we are not identifying the specific recommendations or specific findings associated with them in this statement. As of February 2019, the Bureau had fully completed actions to address three recommendations, needed to further improve on actions taken for one recommendation it indicated had been completed, and needed to complete actions in progress for the remaining 13 recommendations (as summarized in table 3). However, the Bureau had not established a formal process for documenting, tracking, and completing corrective actions for all the recommendations provided by DHS. To the Bureau’s credit, it had incorporated the corrective actions associated with the three completed recommendations into its formal process used for tracking POA&Ms, which includes identifying remediation activities, resources required, milestones, and completion dates. The Bureau did not incorporate the remaining 14 recommendations into the POA&M process. Instead, in November 2018, the Bureau created an informal document to track the 17 DHS recommendations, but this document does not consistently include details such as the resources required, expected completion date, or whether the recommendations do not warrant agency action. Until the Bureau implements a formal process for tracking and implementing appropriate corrective actions to remediate identified cybersecurity weaknesses from DHS, and addresses the identified deficiencies, it faces an increased likelihood that these weaknesses will go uncorrected and may be exploited to cause harm to agency’s 2020 Census IT systems and gain access to sensitive respondent data. Implementing a formal process would also help to ensure that DHS’s efforts result in improvements to the Bureau’s cybersecurity posture. The Bureau Faces Several Other Cybersecurity Challenges in Implementing the 2020 Census The Bureau faces other significant cybersecurity challenges in addition to those previously discussed. More specifically, we previously reported that the extensive use of IT systems to support the 2020 Census redesign may help increase efficiency, but that this redesign introduces critical cybersecurity challenges. These challenges include those related to the following: Phishing. We have previously reported that advanced persistent threats may be targeted against social media web sites used by the federal government. In addition, attackers may use social media to collect information and launch attacks against federal information systems through social engineering, such as phishing. Phishing is a digital form of social engineering that uses authentic-looking, but fake, emails, websites, or instant messages to get users to download malware, open malicious attachments, or open links that direct them to a website that requests information or executes malicious code. Phishing attacks could target respondents, as well as Bureau employees and contractors. The 2020 Census will be the first one in which respondents will be heavily encouraged to respond via the internet. This will likely increase the risk that cyber criminals will use phishing in an attempt to steal personal information. Disinformation from social media. We previously reported that one of the Bureau’s key innovations for the 2020 Census is the large-scale implementation of an internet self-response option. The Bureau is encouraging the public to use the internet self-response option through expanded use of social media. However, the public perception of the Bureau’s ability to adequately safeguard the privacy and confidentiality of the 2020 Census internet self-responses could be influenced by disinformation spread through social media. According to the Bureau, if a substantial segment of the public is not convinced that the Bureau can safeguard public response data against data breaches and unauthorized use, then response rates may be lower than projected, leading to an increase in cases for follow-up and subsequent cost increases. Ensuring that individuals gain only limited and appropriate access to 2020 Census data. The Bureau plans to enable a public- facing website and Bureau-issued mobile devices to collect PII (e.g., name, address, and date of birth) from the nation’s entire population— estimated to be over 300 million. In addition, the Bureau is planning to obtain and store administrative records containing PII from other government agencies to help augment information that enumerators did not collect. The number of reported security incidents involving PII at federal agencies has increased dramatically in recent years. Because of these challenges, we have recommended, among other things, that federal agencies improve their response to information security incidents and data breaches involving PII, and consistently develop and implement privacy policies and procedures. Accordingly, it will be important for the Bureau to ensure that only respondents and Bureau officials are able to gain access to this information, and enumerators and other employees only have access to the information needed to perform their jobs. Ensuring adequate control in a cloud environment. The Bureau has decided to use cloud solutions as a key component of the 2020 Census IT infrastructure. We have previously reported that cloud computing has both positive and negative information security implications and, thus, federal agencies should develop service-level agreements with cloud providers. These agreements should specify, among other things, the security performance requirements— including data reliability, preservation, privacy, and access rights— that the service provider is to meet. Without these safeguards, computer systems and networks, as well as the critical operations and key infrastructures they support, may be lost; information—including sensitive personal information—may be compromised; and the agency’s operations could be disrupted. Ensuring contingency and incident response plans are in place to encompass all of the IT systems to be used to support the 2020 Census. Because of the brief time frame for collecting data during the 2020 Census, it is especially important that systems are available for respondents to ensure a high response rate. Contingency planning and incident response help ensure that, if normal operations are interrupted, network managers will be able to detect, mitigate, and recover from a service disruption while preserving access to vital information. Implementing important security controls, including policies, procedures, and techniques for contingency planning and incident response, helps to ensure the confidentiality, integrity, and availability of information and systems, even during disruptions of service. Without contingency and incident response plans, system availability might be impacted and result in a lower response rate. The Bureau’s CIO has acknowledged these cybersecurity challenges and is working to address them, according to Bureau documentation. In addition, we have ongoing work looking at many of these challenges, including the Bureau’s plans to protect PII, use a cloud-based infrastructure, and recover from security incidents and other disasters. Key Risk #4: The Bureau Will Need to Control Any Further Cost Growth and Develop Cost Estimates That Reflect Best Practices Since 2015, the Bureau has made progress in improving its ability to develop a reliable cost estimate. We have reported on the reliability of the $12.3 billion life-cycle cost estimate released in October 2015 and the $15.6 billion revised cost estimate released in October 2017. In 2016 we reported that the October 2015 version of the Bureau’s life-cycle cost estimate for the 2020 Census was not reliable. Specifically, we found that the 2020 Census life-cycle cost estimate partially met two of the characteristics of a reliable cost estimate (comprehensive and accurate) and minimally met the other two (well-documented and credible). We recommended that the Bureau take specific steps to ensure its cost estimate meets the characteristics of a high-quality estimate. The Bureau agreed and has taken action to improve the reliability of the cost estimate. In August 2018 we reported that while improvements had been made, the Bureau’s October 2017 cost estimate for the 2020 Census did not fully reflect all the characteristics of a reliable estimate. (See figure 7.) In order for a cost estimate to be deemed reliable as described in GAO’s Cost Estimating and Assessment Guide and thus, to effectively inform 2020 Census annual budgetary figures, the cost estimate must meet or substantially meet the following four characteristics: Well-Documented. Cost estimates are considered valid if they are well-documented to the point they can be easily repeated or updated and can be traced to original sources through auditing, according to best practices. Accurate. Accurate estimates are unbiased and contain few mathematical mistakes. Credible. Credible cost estimates must clearly identify limitations due to uncertainty or bias surrounding the data or assumptions, according to best practices. Comprehensive. To be comprehensive an estimate should have enough detail to ensure that cost elements are neither omitted nor double-counted, and all cost-influencing assumptions are detailed in the estimate’s documentation, among other things, according to best practices. The 2017 cost estimate only partially met the characteristic of being well- documented. In general, some documentation was missing, inconsistent, or difficult to understand. Specifically, we found that source data did not always support the information described in the basis of estimate document or could not be found in the files provided for two of the Bureau’s largest field operations: Address Canvassing and Non- Response Follow-Up. We also found that some of the cost elements did not trace clearly to supporting spreadsheets and assumption documents. Failure to document an estimate in enough detail makes it more difficult to replicate calculations, or to detect possible errors in the estimate; reduces transparency of the estimation process; and can undermine the ability to use the information to improve future cost estimates or even to reconcile the estimate with another independent cost estimate. The Bureau told us it would continue to make improvements to ensure the estimate is well- documented. Increased Costs Are Driven by an Assumed Decrease in Self- Response Rates and Increases in Contingency Funds and IT Cost Categories The 2017 life-cycle cost estimate includes significantly higher costs than those included in the 2015 estimate. The largest increases occurred in the Response, Managerial Contingency, and Census/Survey Engineering categories. For example, increased costs of $1.3 billion in the response category (costs related to collecting, maintaining, and processing survey response data) were in part due to reduced assumptions for self- response rates, leading to increases in the amount of data collected in the field, which is more costly to the Bureau. Contingency allocations increased overall from $1.35 billion in 2015 to $2.6 billion in 2017, as the Bureau gained a greater understanding of risks facing the 2020 Census. Increases of $838 million in the Census/Survey Engineering category were due mainly to the cost of an IT contract for integrating decennial survey systems that was not included in the 2015 cost estimate. Bureau officials attribute a decrease of $551 million in estimated costs for Program Management to changes in the categorization of costs associated with risks. Specifically, in the 2017 version of the estimate, estimated costs related to program risks were allocated to their corresponding work breakdown structure (WBS) element. Figure 8 shows the change in cost by WBS category for 2015 and 2017. More generally, factors that contributed to cost fluctuations between the 2015 and 2017 cost estimates include: Changes in assumptions. Among other changes, a decrease in the assumed rate for self-response from 63.5 percent in 2015 to 60.5 percent in 2017 increased the cost of collecting responses from nonresponding housing units. Improved ability to anticipate and quantify risk. In general, contingency allocations designed to address the effects of potential risks increased overall from $1.3 billion in 2015 to $2.6 billion in 2017. An overall increase in IT costs. IT cost increases, totaling $1.59 billion, represented almost 50 percent of the total cost increase from 2015 to 2017. More defined contract requirements. Bureau documents described an overall improvement in the Bureau’s ability to define and specify contract requirements. This resulted in updated estimates for several contracts, including for the Census Questionnaire Assistance contract. However, while the Bureau has been able to better quantify risk; in August 2018 we also reported that the Secretary of Commerce included a contingency amount of about $1.2 billion in the 2017 cost estimate to account for what the Bureau refers to as “unknown unknowns.” According to Bureau documentation these include such risks as natural disasters or cyber attacks. The Bureau provides a description of how the risk contingency for “unknown unknowns” is calculated; however, this description does not clearly link calculated amounts to the risks themselves. Thus, only $14.4 billion of the Bureau’s $15.6 billion cost estimate has justification. According to Bureau officials, the cost estimate remains at $15.6 billion, but they are managing the 2020 Census at a lower level of funding—$14.1 billion and, at this time, do not plan to request funding for the $1.2 billion contingency fund for unknown unknowns or $369 million in funding for selected discrete program risks for what-if scenarios such as an increase in the wage rate or additional supervisors needed to manage field operations. Instead of requesting funding for these contingencies upfront the Bureau plans to work with OMB and Commerce to request additional funds, if the need arises. According to Bureau officials they anticipate that the remaining $1.1 billion in contingency funding included in the $14.1 billion will be sufficient to carry out the 2020 Census. In June 2016 we recommended the Bureau improve control over how risk and uncertainty are accounted for. This prior recommendation remains valid given the life-cycle cost estimate still includes the $1.2 billion unjustified contingency fund for “unknown unknowns”. Moreover, given the cost growth between 2015 and 2017 it will be important for the Bureau to monitor cost in real-time, as well as, document, explain and review variances between planned and actual cost. In August 2018 we reported that the Bureau had not been tracking variances between estimated life-cycle costs and actual expenses. Tools to track variance enable management to measure progress against planned outcomes and will help inform the 2030 Census cost estimate. Bureau officials stated that they already have systems in place that can be adapted for tracking estimated and actual costs. We will continue to monitor the status of the tracking system. According to Bureau officials it plans to release an updated version of the 2020 Census life-cycle estimate in the spring of 2019. To ensure that future updates to the life-cycle cost estimate reflect best practices, it will be important for the Bureau to implement our recommendation related to the cost estimate. Continued Management Attention Needed to Keep Preparations on Track and Help Ensure a Cost- Effective Enumeration 2020 Challenges Are Symptomatic of Deeper Long-Term Organizational Issues The difficulties facing the Bureau’s preparation for the decennial census in such areas as planning and testing; managing and overseeing IT programs, systems, and contractors supporting the enumeration; developing reliable cost estimates; prioritizing decisions; managing schedules; and other challenges, are symptomatic of deeper organizational issues. Following the 2010 Census, a key lesson learned for 2020 that we identified was ensuring that the Bureau’s organizational culture and structure, as well as its approach to strategic planning, human capital management, internal collaboration, knowledge sharing, capital decision- making, risk and change management, and other internal functions are aligned toward delivering more cost-effective outcomes. The Bureau has made improvements over the last decade, and continued progress will depend in part on sustaining efforts to strengthen risk management activities, enhancing systems testing, bringing in experienced personnel to key positions, implementing our recommendations, and meeting regularly with officials from its parent agency, Commerce. Going forward, we have reported that the key elements needed to make progress in high-risk areas are top-level attention by the administration and agency officials to (1) leadership commitment, (2) ensuring capacity, (3) developing a corrective action plan, (4) regular monitoring, and (5) demonstrated progress. Although important steps have been taken in at least some of these areas, overall, far more work is needed. We discuss three of five areas below. The Secretary of Commerce has successfully demonstrated leadership commitment. For example, the Bureau and Commerce have strengthened this area with executive-level oversight of the 2020 Census by holding regular meetings on the status of IT systems and other risk areas. In addition, in 2017 Commerce designated a team to assist senior Bureau management with cost estimation challenges. Moreover, on January 2, 2019, a new Director of the Census Bureau took office, a position that had been vacant since June 2017. With regard to capacity, the Bureau has improved the cost estimation process of the decennial when it established guidance including: roles and responsibilities for oversight and approval of cost estimation processes, procedures requiring a detailed description of the steps taken to produce a high-quality cost estimate, and a process for updating the cost estimate and associated documents over the life of a project. However, the Bureau continues to experience skills gaps in the government program management office overseeing the $886 million contract for integrating the IT systems needed to conduct the 2020 Census. Specifically, as of February 2019, 15 of 44 positions in this office were vacant. For the monitoring element, we found to track performance of decennial census operations, the Bureau relied on reports to track progress against pre-set goals for a test conducted in 2018. According to the Bureau, these same reports will be used in 2020 to track progress. However, the Bureau’s schedule for developing IT systems during the 2018 End-to-End test experienced delays that compressed the time available for system testing, integration testing, and security assessments. These schedule delays contributed to systems experiencing problems after deployment, as well as cybersecurity challenges. In the months ahead, we will continue to monitor the Bureau’s progress in addressing each of the five elements essential for reducing the risk to a cost-effective enumeration. Further Actions Needed on Our Recommendations Over the past several years we have issued numerous reports that underscored the fact that, if the Bureau was to successfully meet its cost savings goal for the 2020 Census, the agency needed to take significant actions to improve its research, testing, planning, scheduling, cost estimation, system development, and IT security practices. As of April 2019, we have made 97 recommendations related to the 2020 Census. The Bureau has implemented 72 of these recommendations, 24 remain open, and one recommendation was closed as not implemented. Of the 24 open recommendations, 11 were directed at improving the implementation of the innovations for the 2020 Census. Commerce generally agreed with our recommendations and is taking steps to implement them. Moreover, in April 2018 we designated 15 recommendations as “priority.” Priority recommendations are those recommendations that we believe warrant priority attention from heads of key departments and agencies. Eight of these 15 priority recommendations have been closed as implemented over the past year. On July 19, 2018, in response to our April 2018 letter calling his attention to our priority recommendations, the Commerce Secretary concurred that there was still much work to be done, and that the number of our priority recommendations concerning the 2020 Census was reflective of Commerce’s focus on ensuring a successful census in 2020. On April 23, 2019, we sent an updated priority recommendation letter to the Commerce Secretary that included five new recommendations from our recent work and also reflected the department’s progress on implementing past recommendations. We believe that attention to these recommendations is essential for a cost-effective enumeration. The recommendations included implementing reliable cost estimation and scheduling practices in order to establish better control over program costs, as well as taking steps to better position the Bureau to develop an internet response option for the 2020 Census. In addition to our recommendations, to better position the Bureau for a more cost-effective enumeration, on March 18, 2019, we met with OMB, Commerce, and Bureau officials to discuss the Bureau’s progress in reducing the risks facing the census. We also meet regularly with Bureau officials and managers to discuss the progress and status of open recommendations related to the 2020 Census, which has resulted in Bureau actions in recent months leading to closure of some recommendations. We are encouraged by this commitment by Commerce and the Bureau in addressing our recommendations. Implementing our recommendations in a complete and timely manner is important because it could improve the management of the 2020 Census and help to mitigate continued risks. Conclusions In conclusion, while the Bureau has made progress in revamping its approach to the census, it faces considerable challenges and uncertainties in implementing key cost-saving innovations and ensuring they function under operational conditions; managing the development and testing of its IT systems; ensuring the cybersecurity of its systems and data; and developing a quality cost estimate for the 2020 Census and preventing further cost increases. For these reasons, the 2020 Census is a GAO high-risk area. Regarding cybersecurity, the Bureau’s involvement of DHS to improve its cybersecurity posture, including cyber threat briefings and vulnerability assessments, is a positive step forward. However, the Bureau’s corrective actions to address its high-risk and very high-risk security weaknesses are frequently delayed—often for months—which increases the risk that these weaknesses could be exploited to cause harm to the agency’s systems. In addition, the Bureau’s process for addressing DHS’s cybersecurity recommendations has shortcomings, which increases the risk that the underlying deficiencies identified by DHS may be exploited to gain access to the Bureau’s systems and sensitive data. Going forward, continued management attention and oversight will be vital for ensuring that risks are managed, preparations stay on track, and the Bureau is held accountable for implementing the enumeration, as planned. Without timely and appropriate actions, the challenges previously discussed could adversely affect the cost, accuracy, schedule, and security of the enumeration. We will continue to assess the Bureau’s efforts and look forward to keeping Congress informed of the Bureau’s progress. Recommendations for Executive Action We are making the following two recommendations to Commerce: The Secretary of Commerce should direct the Director of the Census Bureau to direct the Census Bureau’s CIO to take steps to ensure that identified corrective actions for cybersecurity weaknesses are implemented within prescribed time frames. (Recommendation 1) The Secretary of Commerce should direct the Director of the Census Bureau to direct the Bureau’s CIO to implement a formal process for tracking and executing appropriate corrective actions to remediate cybersecurity weaknesses identified by DHS, and expeditiously address the identified deficiencies. (Recommendation 2) Chairman Serrano, Ranking Member Aderholt, and Members of the Subcommittee, this completes our prepared statement. We would be pleased to respond to any questions that you may have. GAO Contacts and Staff Acknowledgments If you have any questions about this statement, please contact Robert Goldenkoff at (202) 512-2757 or by email at goldenkoffr@gao.gov or Nick Marinos at (202) 512-9342 or by email at marinosn@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Other key contributors to this testimony include Jon Ticehurst (Assistant Director); Ty Mitchell (Assistant Director); Lisa Pearson (Assistant Director); Andrea Starosciak (Analyst in Charge); Christopher Businsky, Rebecca Eyler, Scott Pettis, Lindsey Pilver; Kate Sharkey; Kevin R. Smith; Umesh Thakkar; and Tim Wexler. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background The Defense Acquisition Regulations Council is responsible for developing fully coordinated recommendations for revisions to the DFARS, which supplements the Federal Acquisition Regulation. The Federal Acquisition Regulation provides executive agencies with uniform acquisition policies and procedures for acquiring products and services, and is prepared and issued through the coordination of the Defense Acquisition Regulations Council and Civilian Agency Acquisition Council. The DFARS contains additional requirements of law, DOD-wide policies, delegations of Federal Acquisition Regulation authorities, deviations from Federal Acquisition Regulation requirements, and policies or procedures that have a significant effect beyond the internal operating procedures of DOD, or a significant cost or administrative impact on contractors or offerors. The DFARS is designed to be read in conjunction with the primary set of rules in the Federal Acquisition Regulation. Stakeholders in the acquisition process include executive agencies’ program and contracting officials, members of Congress and congressional staff, industry and contractors, and members of the public. Specifically, the Defense Acquisition Regulations Council generally makes implementation recommendations to DOD, such as when publication of rules to amend the DFARS is appropriate. DARS staff then implements the Council’s recommendations. The Defense Acquisition Regulations Council is composed of the Chair who is also the DARS Director, Deputy Chair who is also the DARS Deputy Director, and one policy and one legal representative from each of the following DOD components: Defense Contract Management Agency, and Defense Logistics Agency. DFARS changes can originate from different sources, including legislation, recommendations from DOD’s Office of the Inspector General, our recommendations, court decisions, executive orders, or policy changes within DOD. DFARS changes that originate from legislation, including NDAAs, are given the highest priority, according to DARS officials. DARS staff has other related responsibilities, including working with civilian agencies in activities connected with promulgating the Federal Acquisition Regulation. DOD Has a Process for Implementing Acquisition-Related NDAA Provisions, but Does Not Clearly Communicate Implementation Status to Stakeholders DOD has a rulemaking process to change the DFARS that includes implementing acquisition-related NDAA provisions through regulatory changes or other methods. The DARS staff is responsible for facilitating the process of making these changes in the DFARS. The staff first reviews draft legislation that may affect acquisition regulations before Congress enacts the NDAA. After the NDAA is enacted, DARS staff then identifies which provisions require action. The DARS staff coordinates across the department and provides for public notice of implementation actions when required. However, there is no publicly-available summary reporting of the status of the regulatory changes or other implementation methods linked to specific NDAA provisions. Congress and industry representatives therefore cannot clearly see the status of pending regulatory changes pertaining to acquisition issues addressed in the NDAA. DOD Implements Acquisition-Related NDAA Provisions in DFARS and by Other Methods DOD’s acquisition rulemaking procedures are governed by statute, which generally requires agencies to issue a proposed rule for each rulemaking and provide not less than a 30-day public comment period following publication of the proposed rule in the Federal Register. These requirements only apply to those DFARS rules that are related to the expenditure of appropriated funds and have either a significant effect beyond the agency’s internal operating procedures or a significant cost or administrative impact on contractors or offerors. However, the requirements may be waived if “urgent and compelling” circumstances make compliance with the requirements impracticable. In those instances, DOD issues an interim rule rather than a proposed rule. The interim rule is effective on a temporary basis if DOD provides at least a 30-day public comment period after publishing the interim rule in the Federal Register. DOD then may issue a final rule after considering any comments received. As a part of the rulemaking process, the Office of Information and Regulatory Affairs reviews proposed and final regulations. The time period for its review is generally limited to 90 days. See figure 1 for an overview of the DARS’s process to change DFARS rules. DARS staff can implement the provisions by one or more methods, including the rulemaking process described above and other actions, such as: issuing DFARS class deviations, and changing DFARS Procedures, Guidance, and Information (PGI), a non-regulatory document that supplements the DFARS. DOD Reviews NDAAs to Identify Provisions That Might Require DFARS Revisions or Other Actions Before annual NDAAs are enacted, DARS staff told us that they review proposed legislation and committee report language to stay abreast of provisions they may have to implement after NDAAs are enacted. DARS staff solicits input on which provisions may require implementation from DOD components and offices, such as the Defense Contract Management Agency, that have a stakeholder interest in many acquisition-related provisions. DARS staff tracks each of these potential changes in case files, which are referred to in this report as cases. DARS staff also can work with other federal agency offices to implement an acquisition-related NDAA provision through a Federal Acquisition Regulation rule change, interim rule change, or class deviation. In some instances, a provision may specify that DOD take other actions, such as holding a public meeting to obtain interested parties’ opinions on an acquisition topic. Upon review of the enacted NDAA, the Defense Acquisition Regulations Council or DARS staff sometimes decides that a provision should be implemented by another DOD office or in other defense acquisition guidance. For example, the DARS staff could determine that a provision only applies to one DOD component and does not require a DFARS change. In another example, DARS staff could determine that the initially identified provision should be implemented in acquisition guidance, such as DOD Instruction 5000.02. Further, sometimes DARS staff will change implementation methods after having selected one. For example, DARS staff may initially decide to implement a provision with a DFARS change, but upon conducting research to draft the rule change, it may find that the provision would be better implemented with a Federal Acquisition Regulation change. Based on our review of NDAAs from fiscal years 2010-2018, we identified 37 explicitly directive provisions—36 that directed DOD to either make or consider making an acquisition-related regulatory change, and one that directed DOD to issue acquisition-related guidance. DARS officials told us that when a provision directs a change or consideration of an acquisition-related regulatory change, the Defense Acquisition Regulations Council and DARS staff give it the highest priority. We confirmed that, in the Defense Acquisition Regulations Management Information System, this priority is reflected by identifying the NDAA as the source of the change in the synopsis field. We confirmed that the 36 provisions we identified had NDAA as the source of the change. The Way the DARS Publicly Communicates Actions Makes It Difficult to Link to NDAA Provisions DARS staff has different ways of communicating changes to the regulations and other implementation methods to the public. “Significant revisions” to the DFARS must be published in the Federal Register. DARS staff also publishes the progress of DFARS changes in case reports that are available on its website. Case reports provide a synopsis of each case, which can include the NDAA provision or other source of the case; describe cases combined to address more than one provision; or show multiple cases for a single provision. DARS staff also posts notices of DFARS class deviations and revisions to DFARS PGI on its website. DARS staff provides input for regulatory priorities through DOD’s publicly-available Unified Agenda. This includes all expected rule changes DOD-wide and a Regulatory Plan that identifies the most significant regulatory actions DOD expects to issue within the next 12 months. It is difficult, however, for interested parties, such as Congress and industry groups, to determine if a provision has been implemented using only this publicly-available information. This is due, in part, to the fact that provisions can be implemented through one or multiple methods, and DARS actions can be reflected in more than one case. For example, if an interested party, such as a federal contractor, expects to see a change to the DFARS based on how an NDAA provision is worded, but the DARS staff implements the provision with a class deviation, the interested party may not realize that the provision has been implemented by another method. In addition, DARS staff may consider a provision as implemented with an action such as a class deviation even if a subsequent case to change the DFARS is opened later. We, too, found it difficult to determine the implementation status of acquisition-related NDAA provisions using only publicly-available reports and information. DARS staff was able to create a report for us that showed implementation status by provision. But we were able to determine and verify the implementation status of these provisions only after using a combination of the DARS internal reports, publicly-available reports and information, and data we had requested from the Defense Acquisition Regulations Management Information System database. DFARS and Federal Acquisition Regulation open and closed case reports provide general information on a case, such as the topic and case number. The reports also provide the status of the case. For example, a report may say: “Defense Acquisition Regulations Council director tasked team to draft proposed DFARS rule.” However, the case reports do not provide information on when a regulatory change may be expected. This information can help companies plan for future business opportunities and devise the means to ensure compliance with regulations. See figure 2 for an overview of NDAA provision implementation methods and the mechanisms DOD uses to report status information. Standards for Internal Control in the Federal Government states that management should externally communicate quality information to achieve the entity’s objectives. Specifically, available information should address the expectations of both internal and external users. DARS staff regularly publishes public status updates on cases, rule changes, and PGI changes. However, there is no readily available mechanism for external stakeholders, such as Congress and industry representatives, to determine the implementation status of any particular legislative provision. This is because the status updates published by the DARS staff do not provide the complete implementation status listed by specific legislative provisions. Without communicating the implementation status of legislative provisions, Congress lacks information for oversight of acquisition reforms, and federal contractors lack visibility into how and when changes will occur. For example, the House Armed Services Committee expressed its oversight interest in a provision passed in 2013 that was not implemented in the DFARS until 2018. Additional information on the status of the DFARS change may have been helpful to the committee’s oversight activities. In another example, industry expressed concern about the status of a regulation implementing a fiscal year 2017 NDAA provision related to the lowest price technically acceptable (LPTA) source selection process in order to plan for responding to solicitations following implementation of the rule. DOD Has Taken Action to Address Acquisition-Related Provisions in NDAAs from Fiscal Years 2010-2018, and Time Taken to Implement Averaged Less Than 1 Year DARS staff identified 180 NDAA provisions from fiscal years 2010-2018 that potentially required an acquisition-related regulatory change or another action. DARS staff and other DOD entities have taken some type of action to address all these provisions. Our analysis showed that 112 of the provisions had been implemented. The timeframe for implementation was, on average, just under 1 year. Some implementation efforts took longer than a year for a variety of reasons, such as reconciling multiple years of NDAA requirements or dealing with highly complex topics. The remaining legislative provisions are either in the process of being implemented or DARS staff determined that a regulatory change was not needed. DARS staff prioritized those provisions that expressly directed DOD to change or consider an acquisition-related regulatory change. DARS documentation showed that some of the implementation deadlines in statute were shorter than the time periods that DARS generally allows for the rulemaking process, including public comment and outside agency review. DARS Staff Identified and Addressed 180 Acquisition-Related NDAA Provisions Following its process, DARS staff identified 180 NDAA provisions from fiscal years 2010-2018 that potentially required an acquisition-related regulatory change or another implementation action. We found that DARS staff and, in a few instances, other DOD entities have taken action to address all of those provisions. See figure 3 for the implementation status of all 180 provisions distributed by NDAA fiscal year. DARS Staff Implemented 112 Provisions within 1 Year of NDAA Enactment, on Average We found that DARS officials opened cases within 30 days of NDAA enactment, on average, for the acquisition-related NDAA provisions from fiscal years 2010-2018. For the 112 of 180 provisions that have been implemented, DOD completed the first implementation actions on average within 1 year. DARS staff frequently used a combination of methods to implement provisions, such as using an interim DFARS rule followed by a final rule. When two or more implementation actions are taken, DARS officials generally consider the first action as the action that implements the provision. If a class deviation, interim DFARS rule, or PGI is issued to address an NDAA provision, the DARS staff considers it implemented even if additional actions—such as issuing a final DFARS rule—are still being pursued. We used the same approach for our analyses for determining the implementation status of provisions and time taken to complete implementation. See table 1 below for the average time to complete the first action to implement the 112 NDAA provisions. Figure 4 shows the distribution of time taken to implement all 112 NDAA provisions. Some implementation efforts took longer than a year for a variety of reasons. Publishing an interim DFARS rule generally took less than a year, while publishing a final DFARS rule change took closer to 2 years on average. In the selected DFARS cases studied, we found examples where DOD had to reconcile multiple years of NDAA requirements or manage complex topics, which we have similarly reported on as reasons that influence the time needed to issue regulations in past work. Reconciling Multiple Years of NDAA Requirements: Congress directed DOD to revise the DFARS to reflect updated requirements related to procuring commercial items in section 851 of the fiscal year 2016 NDAA. Congress included a deadline of 180 days from the NDAA enactment, but the DFARS update was not completed until nearly 800 days after enactment. Our review of DARS case files showed that the DARS staff prioritized implementing the provision, but decided to address a related NDAA provision from 2013 through a single DFARS rule change. In this instance, multiple NDAAs included provisions the DARS staff viewed as closely related. As a result, developing language that reconciled the requirements for all of these provisions took additional time and effort. DARS officials told us that they came close to publishing a commercial items rule earlier, but started over because subsequent NDAA provisions included requirements related to commercial items. Managing Complex Topics: Congress directed DOD to revise the DFARS regarding the use of the LPTA source selection process in section 813 of the NDAA for fiscal year 2017. Congress included a deadline of 120 days from enactment in the provision, which DARS staff was unable to meet due to the complexity of the issue and additional requirements added by a subsequent NDAA. Following enactment of the 2017 NDAA, DARS staff developed a proposed rule that would have implemented relevant NDAA sections in under a year. However, prior to publishing that rule, the NDAA for fiscal year 2018 was enacted and contained added LPTA requirements. After the 2018 NDAA was enacted, DARS staff combined all of its related LPTA cases into a new DFARS case and made adjustments to the proposed rule it had been developing. The DARS staff responsible for updating the previous proposed rule requested five extensions from DARS leadership between January and March 2018 to update documentation to address the fiscal year 2018 provisions and prepare additional analyses. After months of coordination and reviews, DARS staff published a proposed rule in December 2018 with a 60-day comment period. Sixteen formal submissions were received by the February 2019 deadline. The DARS staff is currently reviewing those comments and drafting a final rule, which must still go through multiple reviews before it can be published in the Federal Register. Congress directed DOD to consider revising the DFARS regarding an extension of contractor conflict of interest limitations in section 829 of the NDAA for fiscal year 2013. This provision has been in the process of implementation due to a determination that this rule should be informed by a pending Federal Acquisition Regulation change. In this instance, Federal Acquisition Regulation principals opened a case to implement the provision in the Federal Acquisition Regulation 7 months after NDAA enactment, and DARS officials agreed to draft the rule change that would implement the provision. DARS staff published a proposed rule in the Federal Register for public comment approximately 8 months later. However, DARS staff informed us that a few weeks after the public comment period, Federal Acquisition Regulation officials directed them to suspend its activities until a separate, related Federal Acquisition Regulation rule on “closely associated with inherently governmental functions” was finalized. However in August of 2018, section 829 of the NDAA for fiscal year 2013 was repealed by section 812(b)(4) of the NDAA for fiscal year 2019. We identified 36 provisions, a subset of the 180, that expressly directed DOD to make or consider making an acquisition-related regulatory change, as well as one provision that directed DOD to issue guidance. DARS staff implemented 22 of the 37 provisions in about 13 months on average. Of the 37 provisions, 32 had statutory deadlines, ranging from 30 to 365 days after enactment. The DARS documentation showed that the DARS staff prioritized these NDAA provisions by noting the deadlines, but generally did not implement them by the deadline. We found that: DARS staff met the deadlines in eight of 32 instances. In those eight instances, the actions completed were relatively simple, and DARS staff determined that a public comment period was not required. For example, DARS staff changed the DFARS to implement section 801 of the fiscal year 2018 NDAA—which required DOD to revise the DFARS to include three specific statements about DOD acquisitions— in 143 days, ahead of Congress’s 180-day deadline. Four provisions had deadlines for implementation of 60 days or less. For example, sections 841 and 842 in the fiscal year 2012 NDAA called for changes to be made to the DFARS within 30 days. The short deadlines allowed for fewer days than DARS staff allocate for public comment (minimum of 30 days, by law) and outside agency review (no more than 90 days, by executive order). Deadlines that did not allow for these activities as well as time to draft language were typically not met. Conclusions DARS is responsible for developing and maintaining DOD acquisition regulations, which may include implementing acquisition-related NDAA provisions. The DARS staff has internal tools to track, manage, and communicate the status of DFARS changes, including implementation of NDAA provisions. However, DOD’s DFARS change process does not have a reporting mechanism to clearly communicate to Congress, industry, and other interested parties the status of regulatory or other changes linked to specific NDAA provisions. Without a mechanism to better communicate DOD’s actions to implement NDAA provisions, stakeholders potentially affected by reforms may be unaware of what and when changes may be implemented. Given the actions and length of time that it may take to implement provisions and see a change reflected in the DFARS or elsewhere, stakeholders would benefit from knowing the status of DOD’s actions before implementation has been completed in order to, for example, prepare for compliance. Recommendation for Executive Action We are making the following recommendation to the Secretary of Defense to ensure that the Director of the Defense Acquisition Regulations System: Develop a mechanism to better communicate to all stakeholders the implementation status of acquisition-related NDAA provisions, particularly those provisions that direct a change or consideration of a change to the DFARS. (Recommendation 1) Agency Comments and Our Evaluation We provided a draft of this report to DOD for comment. DOD concurred with our recommendation to develop a mechanism to better communicate to all stakeholders the implementation status of acquisition-related NDAA provisions. The department said it will develop a matrix reflecting the implementation status of acquisition-related NDAA provisions and post the matrix on the Defense Pricing and Contracting public website. DOD’s written comments on the report are reprinted in appendix II. DOD also provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the Acting Secretary of Defense; the Under Secretary of Defense for Acquisition and Sustainment; the Secretaries of the Air Force, Army, and Navy; the Director, Defense Acquisition Regulations System; appropriate congressional committees; and other interested parties. This report will also be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions concerning this report, please contact me at (202) 512-4841 or by e-mail at woodsw@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix III. Appendix I: Objectives, Scope, and Methodology A House Armed Services Committee report related to the National Defense Authorization Act (NDAA) for Fiscal Year 2019 included a provision for us to review the Department of Defense’s (DOD) process for revising the Defense Federal Acquisition Regulation Supplement (DFARS), among other things. This report (1) determines how DOD implements acquisition-related NDAA provisions and communicates implementation status, and (2) identifies the status of DOD’s efforts to implement acquisition-related NDAA provisions from fiscal years 2010- 2018. To determine how DOD implements acquisition-related NDAA provisions, we reviewed DOD documents and supplemented our work with interviews with relevant DOD officials. Specifically, we reviewed the DFARS Operating Guide, January 2015; presentation on the Defense Acquisition Regulations System Rulemaking Process, DFARS open and closed cases reports, Federal Acquisition Regulation open and closed cases reports; decision matrices from the Defense Acquisition Regulations System (DARS), which document decisions on implementing NDAA provisions from fiscal years 2010-2018; and other applicable reports and information on provisions and cases from the DARS staff and the Defense Acquisition Regulations Council. We also referenced our past reports on DFARS rulemaking; U.S. Code on Publication of proposed regulations; the Federal Acquisition Regulation Operating Guide, July 2015; Federal Register notices related to DOD rulemaking; and the news listing on the DARS website. We adopted the DARS use of the term “implementation,” which includes both regulatory action as well as other actions, such as public meetings or a report. We interviewed DOD officials that are involved in the DFARS rulemaking process. Specifically, we interviewed members of the Defense Acquisition Regulations Council and DARS staff, including the Chair and Deputy Chair, the Regulatory Control Officer that prepares rules for submission to the Office of Information and Regulatory Affairs within the Office of Management and Budget, and DFARS case managers. We also interviewed officials from the DOD components—Air Force, Army, Navy, Defense Contract Management Agency, and Defense Logistics Agency. We interviewed industry representatives from the Aerospace Industries Association, National Defense Industrial Association, and the Professional Services Council. We compared the DARS process with the Standards for Internal Control in the Federal Government. Specifically, we reviewed DOD’s public reports of its implementation actions with internal control principle 15: “management should externally communicate the necessary quality information to achieve the entity’s objectives.” Stakeholders in the acquisition process include executive agencies’ program and contracting officials, members of Congress, congressional staff, industry, contractors, and members of the public. The DARS staff provided a complete data extract of Defense Acquisition Regulations Management Information System as of October 31, 2018, to document the acquisition-related NDAA provisions that DARS staff identified as potentially requiring implementation. The Defense Acquisition Regulations Management Information System is the DARS database to track the status of individual cases that are associated with DARS rulemaking actions. We analyzed the data extract to identify which Title VIII provisions that the DARS identified for implementation from NDAAs from fiscal years 2010-2018, and to identify the cases related to those provisions. We focused on Title VIII—Acquisition Policy, Acquisition Management, and Related Matters—of the NDAAs, which contain acquisition-related provisions. We queried the data extract to identify cases with notes indicating NDAA provisions from fiscal years 2010-2018 as the source of change in the database synopsis field. We found 180 acquisition-related provisions from Title VIII of the NDAAs from fiscal years 2010-2018 that the DARS staff had identified for implementation. For these 180 provisions, we determined the number and types of cases by year, duration of cases, and duration of select steps for cases. We verified the validity of provisions and cases that were not in both the DARS reports that DARS staff manually produced and the Defense Acquisition Regulations Management Information System data with DARS officials as of April 19, 2019. To identify the implementation status of acquisition-related NDAA provisions from fiscal years 2010-2018, we further analyzed data from the Defense Acquisition Regulations Management Information System and DARS reports. For the actions associated with the 180 provisions, we analyzed the status history of each case, associated status dates for cases, and closed status indicators. We also reviewed DARS reports, such as the internal stats charts with case duration and closure metrics that DARS officials told us they manually verify. We reviewed a report that the DARS staff manually produced for us that showed actions and cases by provision for the NDAAs from fiscal years 2010-2018. We independently analyzed the NDAAs from fiscal years 2010-2018 and determined 36 provisions in Title VIII that expressly directed DOD to make or consider making an acquisition-related regulatory change, as well as one provision that directed DOD to issue guidance. We identified these provisions using a keyword search of individual and combined terms and criteria, such as “regulation, defense, and acquisition regulation.” To better understand the Defense Acquisition Regulations Council’s recommendations and DARS implementation process, we selected 12 provisions that directed DOD to make or consider an acquisition-related regulatory change for case studies. The case study selection criteria included the year of the NDAA from which the provision originated for a mix of older and newer provisions and time duration for a mix of shorter and longer cases related to implement the provisions. We used DARS reports and our analysis of the Defense Acquisition Regulations Management Information System data to determine the year and time duration. Since the DFARS Case Standard Timeline is 52 weeks, we selected provisions with cases that were both more and less than 52 weeks. We also selected provisions with cases that were open and closed. We created a data collection instrument for the case studies that captured information, such as which provisions were associated with the case, to standardize our data collection process. For the 12 provisions, we reviewed the associated case files that are generally a record of the implementation process and the Defense Acquisition Regulations Council’s recommendations, and the decisions made by the DARS staff. We also reviewed available publication folders associated with the cases that generally document input and decisions from other agencies, such as the Office of Management Budget’s Office of Information and Regulatory Affairs. Finally, we used the information in the files to verify the information in Defense Acquisition Regulations Management Information System for those specific cases. We found the Defense Acquisition Regulations Management Information System data and information in the files that we reviewed to be sufficiently reliable for purposes of reporting on how the DARS staff implemented NDAA provisions and the time duration to do so. We conducted this performance audit from August 2018 to July 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Comments from the Department of Defense Appendix III: GAO Contacts and Staff Acknowledgments GAO Contact Staff Acknowledgments In addition to the contact named above, Penny Berrier, Assistant Director; James Kim; Holly Williams; Beth Reed Fritts; Gail-Lynn Michel; Emily Bond; Lori Fields; Matthew T. Crosby; Lorraine Ettaro; and Tim Bober made key contributions to this report.