Background Government-wide Reform Plan Requirements and Timeline As shown in figure 2, a number of activities led up to OMB publishing the reform plan in June 2018, and subsequently OMB has provided updates on the proposals in the reform plan. In March 2017, the President issued an executive order requiring comprehensive reorganization plans for executive branch agencies. In April 2017, OMB provided guidance to federal agencies for developing their respective reform plans. According to this guidance, the government-wide reform plan was to have been based on the agency reform plans, OMB-coordinated crosscutting proposals, and public input. In addition, OMB’s guidance indicated that OMB would track the progress of the reforms in coordination with the President’s Management Council. OMB’s guidance also stated that it would track progress of the reforms by leveraging the federal performance planning and reporting framework that was originally put into place by the Government Performance and Results Act of 1993 (GPRA), and significantly enhanced by the GPRA Modernization Act of 2010 (GPRAMA). Accordingly, OMB’s guidance explained that progress would be tracked through the use of cross- agency priority (CAP) goals, agency priority goals, and Performance.gov. The President’s Management Agenda In March 2018, OMB released the President’s Management Agenda, which identified a set of CAP goals, required under GPRAMA. The CAP goals target areas where multiple agencies must collaborate to effect change, and agencies must report CAP goal progress in a manner the public can easily track. The Government-wide Reform Plan In June 2018, the administration released its government-wide reform plan, Delivering Government Solutions in the 21st Century: Reform Plan and Reorganization Recommendations (reform plan). In July 2019, the administration reported on the first year of progress toward its reform proposals. According to the 1-year update, the President’s Fiscal Year 2020 Budget included 18 of the proposed reform proposals in whole, or in part, and also described administrative actions by agencies to implement more than 20 of its 32 proposals. Of these proposals, the administration reported progress toward four of the five reforms we selected for review: (1) moving personnel security clearance background investigations from OPM to DOD; (2) solving the cybersecurity workforce shortage; (3) establishing the GEAR Center; and (4) reorganizing OPM. OMB officials said that they are not planning to move forward with the customer experience improvement capability reform during fiscal year 2020 because they are pursuing other customer experience activities, such as those included in the CAP goal for Improving Customer Experience with Federal Services. The Extent to Which Key Practices for Effective Reforms Were Followed Has Varied, and Agencies Identified Some Legal Authorities for Implementation Moving Background Investigations from OPM to DOD: Most Selected Key Practices Addressed We added the government-wide personnel security clearance process to our High-Risk List in January 2018 because it continues to face challenges in the timely processing of clearances, measuring the quality of investigations, and ensuring the security of related information technology (IT) systems. The National Defense Authorization Act (NDAA) for Fiscal Year 2018 included provisions that resulted in the transfer of background investigations from OPM’s National Background Investigations Bureau (NBIB) to DOD for certain DOD personnel, which represented approximately 70 percent of all federal background investigations performed by NBIB. Subsequently, the selected reform proposal recommended moving the remaining 30 percent of investigations to DOD. According to the reform plan, this transfer would provide an opportunity to conduct the background investigations more efficiently and economically than having them be performed by separate agencies. In January 2019, DOD formally established the Personnel Vetting Transformation Office (PVTO) to implement and oversee activities related to the transfer of NBIB functions. In April 2019, the President issued Executive Order 13869 which generally provided for the transfer of the remaining background investigation operations from OPM to DOD. The executive order also called on the Secretary of Defense to enter into an agreement with the Director of OPM to set forth expectations and designate the appropriate support functions for the transfer. As directed, in June 2019, OPM and DOD signed an interagency memorandum that set forth expectations for activities necessary for the transfer of functions of NBIB and associated employees and resources from OPM to DOD, including measurable deliverables, key considerations for executing deliverables, and processes for coordination and governance. According to documents we received from DOD, the transfer of NBIB functions to DOD occurred by September 30, 2019, as required by the April executive order. As shown in figure 3, OMB, OPM, and DOD have generally addressed most key reform practices in implementing the transfer of background investigations from OPM to DOD. According to DOD, more than 99 percent of NBIB employees, totaling 2,979 individuals, accepted positions transferring them to DOD’s Defense Counterintelligence and Security Agency (DCSA) by September 30, 2019. According to the DOD’s PVTO Director, 17 individuals chose not to transfer, and instead retired as permitted. Going forward, we will continue to monitor the government- wide personnel security clearance process as part of our work to identify and assess high-risk issues across the government. Establishing Goals and Outcomes OMB, OPM, and DOD have generally addressed key practices related to establishing goals and outcomes. The NDAA for Fiscal Year 2018 and Executive Order 13869 established a goal and related requirements for the transfer of OPM’s NBIB personnel, resources, and functions to DOD. Specifically, the executive order established a goal to complete the transfer of all NBIB administrative and operational functions to DOD by September 30, 2019. The executive order also outlined a series of deliverables and objectives for OMB, OPM, and DOD to achieve during the transfer. For example, the executive order required DOD to execute a written agreement with OPM to establish expectations for the transition period related to detailing personnel, safeguarding information technology, contracting, and funding background investigations, among others. OPM and DOD achieved their intended goal, and as of September 30, 2019, DOD is the primary provider of national security background investigations for the federal government. As directed, OPM and DOD signed an interagency agreement in June 2019 to address expectations, including governance, information technology, contracting, and funding issues, among others. According to documents provided by DOD, the Transfer Tollgate group and the Executive Steering Committee provided interagency leadership including an executive-level decision venue for implementation, resourcing, and other decisions. According to DOD, these interagency groups also provided accountability for implementation milestones. Under the leadership of these two groups, DOD officials shared with us that they worked with OPM to resolve a host of issues such as the transfer of personnel, funding for transfer costs, transfer of information technology assets, financial management issues, and acquisition concerns, among other critical issues. To help address differences in the financial management and funding of background investigations between OPM and DOD, the agreement required DOD to establish a Working Capital Fund to fund DCSA’s background investigation mission by September 1, 2019. According to DOD officials and the agency’s Transfer Status Dashboard, the Working Capital Fund was established prior to the September 1, 2019, deadline; and, as of October 7, 2019, the fund had a balance of approximately $1 billion. Neither the NDAA for Fiscal Year 2018 nor the executive order outlined measurable outcomes related to the efficient and effective delivery of background investigations, but rather goals and deliverables related to transferring NBIB functions to DOD, among other things. According to DOD officials we spoke with, the reform’s objective was the timely transfer of background investigation functions and coordination between affected agencies and stakeholders. DOD officials explained that following completion of the transfer, on October 1, 2019, PVTO, in coordination with other DOD components and federal stakeholders, began work transforming DCSA’s processes and procedures, including the background investigation process, to improve outcomes. Involving Employees and Key Stakeholders OMB, OPM, and DOD generally addressed key practices related to involving employees and key stakeholders. OPM and DOD generally communicated with affected employees and key stakeholders and involved them in the implementation of the transfer of NBIB functions to DOD. Agencies’ communication included email correspondence to affected staff from agency leaders including OPM’s Acting Director, and the Director of NBIB. These emails provided NBIB staff regular updates on the status and details surrounding the transfer of NBIB functions to DOD. Based on documents provided by OPM, communication to affected staff began in June 2017, informing staff that Congress was considering a legislative proposal to move certain NBIB functions to DOD. According to documents we received, communication with staff has continued regularly since this time, including a July 29, 2019, message to affected staff with an official notice that NBIB employees would be offered an appointment to DOD’s DCSA effective September 29, 2019. This notice explained that OPM’s NBIB employees accepting this appointment would transfer to DOD without changes to their duty stations, grades, or benefits. In addition to email communication, in-person town hall meetings were held between agency leaders and affected staff to provide updates on the status of the transfer and answer questions. According to OPM’s then NBIB Director, a July 2017 town hall was held addressing the congressional proposal to move the majority of NBIB staff to DOD. The Director also reported that OPM and DOD had worked via meetings, information exchanges, site visits, and communication at all levels in the organization to assemble information on the implication of the transfer and its potential impacts. OPM officials testified at a number of hearings in 2018 and 2019 related to the transfer, and OPM officials told us that they joined DOD in providing quarterly briefings required by the NDAA for Fiscal Year 2018, on the status and progress of the transfer. DOD and OPM also developed a Joint Transfer Plan that described strategic communication activities with affected employees, contractors, and other stakeholders including public media outlets, ourselves, and state and local law enforcement agencies, among others. DOD officials at the PVTO explained that they developed a more detailed communication plan in March 2019 that was implemented prior to the transfer. Addressing High-Risk Areas and Longstanding Management Challenges OMB, OPM, and DOD have partially addressed key practices related to addressing high-risk areas and longstanding management challenges. As previously mentioned, we placed the government-wide personnel security clearance process on our High-Risk List because of continuing challenges in the timely processing of clearances, measuring the quality of investigations, and ensuring the security of related IT systems. While OMB and lead agencies have considered our related high-risk work, the reform proposal and implementation plans do not demonstrate how the transfer and delegation of background investigation functions from OPM to DOD will address these challenges. Moreover, in November 2019, OPM’s Inspector General identified the background investigation legacy information systems as an ongoing top management challenge that will need to be addressed by both OPM and DOD moving forward. The Director of the PVTO told us that the office’s initial goal was to ensure a smooth and timely transition of functions from OPM’s NBIB to DOD by the beginning of fiscal year 2020. The Director also told us that after the transfer occurred, the office would shift its focus to address our high-risk area by, among other things, transforming these security clearance services to optimize processes government-wide. Specifically, the PVTO charter established a goal to “identify efficiencies to be gained, areas where the organizational structure and business services may be incomplete, maximize synergy where possible, and propose mitigation strategies to address gaps and shortfalls.” We will continue to monitor the government’s progress toward addressing security clearance challenges as part of our work to track high-risk issues across the government. Leadership Focus and Attention OMB, OPM, and DOD have generally addressed key practices related to leadership focus and attention. In particular, Executive Order 13869 outlined the roles and responsibilities of OMB, OPM, and DOD, and authorized a new office (PVTO) to assist in the execution of the transfer. The executive order also clarified agencies’ roles and requirements for coordinating the transfer, delegation, and other activities. Specifically, the executive order directed the Secretary of Defense and the OPM Director, in consultation with the OMB Director and the Security Executive Agent, to provide for the transfer of the bulk of OPM’s investigative functions to the DCSA, along with any appropriate OPM-associated personnel and resources, including infrastructure and certain investigation-related support functions. With regard to a dedicated implementation team, PVTO was responsible for ensuring coordination and resource alignment during the transfer, as well as ensuring that personnel security background investigations continued without disruption during the transfer. The PVTO Director told us in July 2019 that his team reports directly to the Office of the Under Secretary of Defense for Intelligence. The Director stated that he has experience in the areas of acquisitions, mergers, and reorganizations, and has support from experts and top leadership throughout the department. In addition, the PVTO charter states that the office be composed of employees with extensive experience and expertise in personnel vetting processes and reform efforts, as well as business and technology innovation, program evaluation, acquisitions and mergers, and organization and change management. Managing and Monitoring OMB, OPM, and DOD have generally addressed key practices related to managing and monitoring. Specifically, PVTO developed a joint transfer plan outlining critical assumptions for the transfer, major activities, and time frames across nine functional areas, including personnel, training, information technology, financial management, acquisitions, strategic communications, and security, among others. For each functional area, the transfer plan provided a summary of the functional area’s objective and a set of recommended major activities. For example, the functional area for IT had an objective to provide secure, current hardware and software in compliance with DOD and federal standards, and promote the unique requirements of a highly mobile, geographically dispersed workforce managing significant volumes of personally identifiable information and other sensitive data. Major activities included: (1) the transfer of IT infrastructure, (2) the completion of a gap analysis to determine which NBIB systems and hardware are transferrable or require new acquisitions, and (3) the provision of secure devices that support mobile operations. The PVTO Director also showed us a detailed implementation plan organized around the nine functional areas identified in the broader joint transfer plan. The implementation plan tracked thousands of activities and provided a detailed timeline for completion. The Director also provided us a dashboard that his team used to track implementation progress. The Director told us that his office used the dashboard to manage and monitor the transfer daily. The dashboard allowed the implementation team to identify areas where attention was needed using red, yellow, and green stoplight indicators signaling the status of major objectives. The annual assessments of timeliness and quarterly briefings required by the NDAA for Fiscal Year 2018 also serve as mechanisms for Congress and the executive branch to monitor timeliness, costs, and continuous evaluation, among other things. OMB also publishes quarterly milestone progress and metrics on the related Security Clearance, Suitability, and Credentialing Reform cross-agency priority goal on Performance.gov. Employee Engagement OMB, OPM, and DOD have generally addressed key practices related to employee engagement. In addition to the communication and outreach activities described above, OPM and DOD have undertaken additional efforts to engage affected employees and monitor levels of employee engagement at both agencies. For example, according to DOD officials, to engage and communicate with affected employees the agency held several town hall meetings to provide information and answer questions. They also said that DOD leadership regularly emailed affected staff providing updates on the status of the transfer and held separate question-and-answer sessions to keep staff informed and engaged. According to PVTO planning documents, the office also developed a strategy to achieve stakeholder buy-in through empowering leaders and through efforts to build a coalition of stakeholders around a common vision for the future of the background investigation function at DOD. In April 2019, OPM also conducted an internal survey of agency staff to collect information on employees’ perceptions of the transition to DOD, personal work experiences, satisfaction with their job, and any intent to leave DOD and reasons for leaving. The survey asked NBIB employees the extent to which they felt informed about the upcoming transition to DOD. According to the roughly one-third of staff who responded, 35 percent felt extremely or moderately informed, 32 percent felt somewhat informed, and 33 percent felt slightly or not at all informed. Approximately 75 percent of the survey respondents reported that they had enough information to do their job well, and 74 percent reported that they were proud to tell others they worked at their organization. When asked about satisfaction with involvement with decisions that affect their work, 38 percent of respondents were positive, 34 percent were neutral, and 28 percent were negative. OPM officials told us that they continued to monitor engagement of NBIB staff throughout the transition. Strategic Workforce Planning OPM and DOD have partially addressed key practices related to strategic workforce planning. In March 2019, we reported that, to make progress on removing the Government-wide Personnel Security Clearance Process from our High-Risk List, OPM and DOD should develop and implement a comprehensive strategic workforce plan that identifies the workforce needed to meet the current and future demand for its services, as well as reduce the current backlog to a manageable level. OPM completed this action in September 2019 with the release of the NBIB Strategic Workforce Plan for the Background Investigation Mission. The strategic workforce plan includes initiatives to strengthen investigative workforce capacity and training, promote the use of different hiring authorities, and provide succession planning, among other initiatives. According to the plan, senior leadership will build upon the strategic workforce plan to create an implementation strategy. While OPM has taken action, DOD has yet to complete its workforce plan. As of October 2019, DOD’s strategic workforce plan for the new DCSA enterprise was under development. Moving Background Investigations from OPM to DOD: Agencies Identified a Number of Legal Authorities In response to our request for information, OPM, DOD, and OMB provided information regarding the authorities they are using to implement the reform proposal to move all background investigations from OPM to DOD. According to OPM and OMB, the legal authorities by which NBIB moved to DOD consisted of section 925 of the National Defense Authorization Act for Fiscal Year 2018 (NDAA 2018) and Executive Order 13869, issued in April 2019, which re-designated DOD’s DCSA as the primary investigative service provider for national security investigations. OPM also cited 5 U.S.C. § 1104, which permits OPM to delegate certain personnel management functions to other agencies. Section 925 of the NDAA 2018 authorized DOD to conduct its own background investigations and required DOD to begin carrying out an implementation plan required under the National Defense Authorization Act for Fiscal Year 2017 (NDAA 2017) by October 1, 2020. The NDAA 2018 also required the Secretary of Defense, in consultation with the OPM Director, to provide for a phased transition of DOD background investigations from OPM to DOD. According to OPM, the DOD background investigations, consisting of investigations for civil service, military, contract, and non-appropriated fund personnel, constitute approximately 70 percent of the work performed by NBIB. Executive Order 13869 provided for the transfer of the primary responsibility for conducting national security background investigations, government-wide, from OPM to DOD. The executive order designated DOD, rather than OPM, as the agency to serve as the primary entity for conducting background investigations for national security adjudications, pursuant to and consistent with the NDAA 2018 and section 3001(c) of the Intelligence Reform and Terrorism Prevention Act of 2004 (IRTPA). According to OPM, this has the effect of moving the remaining national security investigations, not already transferred by section 925 of the NDAA 2018, to DOD. The Executive Order also acknowledged that OPM will delegate, pursuant to 5 U.S.C. § 1104, other background investigation functions to DOD for non-DOD personnel, such as investigations performed to enable the adjudication of the subject’s suitability or fitness for federal employment, eligibility for logical or physical access to systems and facilities, fitness to perform work for a federal agency under a government contract, and fitness to work as a nonappropriated fund employee. In accordance with the executive order, DOD and OPM signed an agreement on June 25, 2019 that set forth the expectations for necessary activities for the transfer of functions of the NBIB from OPM to DOD. The agreement provided that the period of transition was from June 24, 2019, through September 30, 2019. The agreement covered such areas as personnel, information technology, facilities and property, contracting, administrative support, records access, claims, and funding. Solving the Cybersecurity Workforce Shortage: Most Selected Key Practices Partially Addressed This reform proposal directs OMB and DHS, in coordination with other agencies, to prioritize and accelerate efforts to recruit, evaluate, hire, pay, and distribute cybersecurity talent across the federal government. Ensuring the cybersecurity of the nation is a longstanding challenge that has been on our High-Risk List for more than two decades. Efforts to solve the cybersecurity workforce shortage will help to address a number of high-risk issues we have previously identified. To accomplish the objective of filling cybersecurity vacancies, the reform lays out a series of projects and activities intended to identify and close workforce skills gaps and develop a standardized approach to hiring, training, and retaining qualified cybersecurity professionals. Specifically, the proposal calls for: identifying and categorizing the federal cybersecurity workforce using the National Initiative for Cybersecurity Education Cybersecurity Workforce Framework (NICE framework), implementing DHS’s Cyber Talent Management System (CTMS) with options to expand the capability across the government, rationalizing and expediting the security clearance process, standardizing training for cybersecurity employees, increasing the mobility of cybersecurity positions, developing plans to establish a cybersecurity reservist program to provide needed surge capacity, reskilling federal employees to fill critical cyber positions, and rationalizing the size and scope of federal cybersecurity education programs. As shown in table 2, OMB, DHS, and other federal agencies have made progress in implementing certain projects and activities included in the reform proposal. Although OMB and DHS have several projects and activities underway related to this reform, they did not provide us with information about the government-wide goals or implementation plans for the proposal. In November 2019, OMB staff told us that they did not have additional information to share regarding their application of key reform practices because they are still developing this reform. As a result, we found that most of the key reform practices were partially met (see figure 4). We did obtain information showing that OMB and DHS addressed key practices for some of the projects and activities included in the reform proposal, but the extent to which these practices were being applied to the reform proposal as a whole, or being coordinated government-wide, was unclear. Establishing Goals and Outcomes OMB and DHS have partially addressed key practices related to establishing goals and outcomes. We found that this reform established an objective to solve the cybersecurity workforce shortage across the government, and DHS established outcome-oriented goals and performance measures for certain agency-specific projects that are part of the reform. For example, as shown in table 2, DHS established a measure to hire at least 150 cybersecurity professionals at the agency during fiscal year 2020 using its new Cyber Talent Management System. In addition, DHS provided us its 2017 Comprehensive Cybersecurity Workforce Update, which includes an array of data and analysis, including cybersecurity workforce trends, metrics on DHS components’ vacancies, attrition, capacity gaps, hiring, and other information describing the status of the agency’s cybersecurity workforce. The administration also released a National Cyber Strategy in September 2018 outlining broad activities related to the government-wide reform such as building a talent pipeline, reskilling employees, and improving the process of recruiting and retaining qualified cybersecurity professionals. These documents may provide a first step toward developing clear outcome-oriented goals and performance measures for the reform as a whole. However, OMB and DHS have not yet established measurable outcome- oriented goals for the government-wide projects and activities outlined in the reform proposal. For example, there are not government-wide measurable goals for hiring cybersecurity professional across the government, reductions to attrition, training, or other aspects of the reform. As shown in table 2, OMB and agencies have made progress on a number of areas related to the reform; however, without establishing government-wide measurable goals and outcomes, OMB and DHS will not be able to determine whether progress is being made across the federal government to solve the cybersecurity workforce shortage. Involving Employees and Key Stakeholders OMB and DHS have partially addressed key practices related to involving employees and key stakeholders. We obtained information on targeted outreach to employees and stakeholders for certain projects and activities outlined in the reform, but as of November 2019, OMB and DHS did not have information on how they were addressing these key practices for the reform as a whole. For example, DHS’s Cybersecurity and Infrastructure Security Agency (CISA) officials told us that they participate in interagency coordination activities related to the NICE framework with OMB, the Department of Commerce National Institute of Standards and Technology (NIST), the Federal Chief Information Officers Council, and outside stakeholders. CISA officials said they worked with government and industry stakeholders to develop the NICE framework, and are working with educators and certification vendors to help build a pipeline of cybersecurity talent. Additionally, in March 2019, we reported that OPM and NIST coordinated with academia and the private sector to develop a cybersecurity coding structure that aligns with the work roles identified in the NICE framework. While OMB and DHS conducted outreach for certain projects and activities included in the reform proposal, it is unclear what, if any, outreach occurred for other projects. However, without a government- wide or project-by-project plan for communicating with and involving employees and stakeholders across the government, OMB and lead agencies will not know if certain agencies or employee groups are being adequately involved and informed. We have previously reported that creating an effective, ongoing communication strategy is essential to implementing a government-wide reform. The most effective strategies involve communicating early and often, ensuring consistency of message, encouraging two-way communication, and providing information to meet the specific needs of affected employees. This reform will be more likely to achieve its intended objective if OMB and DHS establish effective lines of communication with affected federal employees and the broader cybersecurity community. Addressing High-Risk Areas and Longstanding Management Challenges OMB and DHS have partially addressed key practices related to addressing high-risk areas and longstanding management challenges. We have designated information security as a government-wide high-risk area since 1997. We expanded this high-risk area in 2003 to include protection of critical cyber infrastructure and, in 2015, to include protecting the privacy of personally identifiable information. OMB and DHS generally considered areas that we previously identified as high-risk. OMB staff and DHS officials told us that they considered our high-risk reports when developing reform proposals, and have provided some documentation of these considerations. For example, OMB’s former Deputy Director for Management stated that, when developing the Solving the Cybersecurity Workforce Shortage reform, OMB used our 2017 High-Risk Series and noted that of more than 2,500 past recommendations, about 1,000 still needed to be implemented. OMB also identified several of our reports that touch on cybersecurity workforce issues. Although OMB and DHS have considered our prior work, as of November 2019, they had not demonstrated how the projects and activities outlined in the reform proposal would address our related high-risk issues and open recommendations. Without more detailed information describing how our high-risk issues are being addressed across the reform projects and activities, it is unclear which issues and recommendations are being targeted, and which are outside of the scope of this reform. Leadership Focus and Attention OMB and DHS have partially addressed key practices related to leadership focus and attention. In May 2019, the President issued Executive Order 13870 requiring federal agencies to take a variety of actions related to cybersecurity, including efforts to enhance the mobility of cybersecurity practitioners, support the development of cybersecurity skills, and create organizational and technological tools to maximize cybersecurity talents and capabilities. Many of the actions outlined in this executive order align with the stated objectives and components outlined in the reform proposal. However, neither OMB nor DHS have created a dedicated team with necessary resources to manage and implement this reform on a government-wide scale. Moreover, DHS staff we spoke with told us that OMB was the government-wide lead for this reform, and their agency was responsible for a subset of the projects and activities outlined in the reform proposal. OMB staff did not provide us with any plans or other documents regarding the individuals or team responsible for implementation across the government. OMB staff explained that DHS’s CISA and the Federal Chief Information Security Officer Council have some responsibility for federal cybersecurity workforce issues; however, they did not clarify which organization, team, or individuals were responsible for coordinating and implementing the reform government- wide. Our prior work has shown that establishing a strong and stable team that will be responsible for the transformation’s day-to-day management is important to ensuring that it receives the resources and attention needed to be successful. A dedicated leadership team responsible for overseeing and implementing the reform can also help ensure that various change initiatives are sequenced and implemented in a coherent and integrated way. Managing and Monitoring OMB and DHS have partially addressed key practices related to managing and monitoring. DHS has developed some agency-specific implementation plans and mechanisms to monitor progress. For example, DHS provides progress updates to Congress related to its continued efforts to code cybersecurity positions and to review the readiness of the cybersecurity workforce to meet DHS mission requirements, among other agency-specific assessments. However, OMB and DHS have not yet developed a government-wide implementation plan with goals, timelines, key milestones, and deliverables for the reform proposal as a whole. As previously discussed, OMB staff told us that they did not yet have a government-wide reform plan because they are still developing this reform. Without a government-wide implementation plan to track and communicate implementation progress, OMB and DHS will be unable to determine whether the reform is achieving its intended objectives, or whether unanticipated challenges or negative workforce trends are impeding efforts to close the cybersecurity workforce gaps across the government. Employee Engagement OMB and DHS have not addressed key practices related to employee engagement. In February 2019, DHS officials told us that the agency had not yet reached the stage of implementation for its projects and activities where they were considering employee engagement in this reform. According to DHS officials, they have started collecting data on employees, but have not interacted with individual employees on specific reform initiatives. As of November 2019, OMB had not provided information on its efforts to engage affected employees across the government on this reform. We have reported that employee engagement affects attrition, absenteeism, and productivity. Moreover, we have found that failure to adequately address a wide variety of people and cultural issues, including employee engagement, can also lead to unsuccessful change. We identified six key drivers of engagement based on our analysis of selected questions in the Federal Employee Viewpoint Survey, such as communication from management. Given that the objective of this reform is to address a critical workforce skills gap, it is important that OMB and DHS remain attentive to the engagement levels of cybersecurity employees across the government to ensure that productivity and morale are not adversely affected. As previously discussed, OMB and DHS lack a government-wide or project-by-project plan for communicating with and involving employees across the government. Such a communications strategy could be used to inform and, as appropriate, involve employees on implementation of the reform. Strategic Workforce Planning OMB and DHS have partially addressed key practices related to strategic workforce planning. As set forth in the Cybersecurity Workforce Assessment Act, DHS developed and published its Cybersecurity Workforce Strategy for 2019 through 2023. DHS’s strategy contains a 5- year implementation plan and a set of goals and objectives. Goals and objectives include an analysis of DHS’s cybersecurity workforce needs, a multi-phase recruitment strategy, professional and technical development opportunities, and plans to develop a talent management system, among others. OMB and DHS have yet to develop a government-wide cybersecurity strategic workforce plan that addresses the needs of all federal agencies. However, because this reform is focused on addressing a government- wide workforce shortage, it is particularly important that OMB and DHS complete their efforts to develop a strategic workforce plan for cybersecurity professionals that takes into account existing workforce capabilities, workforce trends, and shortages across the government. Without this information, DHS and OMB will not be able to determine if they are making progress or when they have addressed the government’s cybersecurity workforce shortage. Solving the Cybersecurity Workforce Shortage: OMB and DHS Identified Legal Authorities for Certain Reform Activities, and Stated That Additional Authority Would Be Sought If Needed DHS identified some existing legal authority for implementing aspects of the reform proposal, but neither DHS nor OMB provided us with a legal analysis for full implementation of the reform. OMB’s General Counsel stated, in a November 2019 letter to us, that OMB continues to collaborate with DHS and other federal agencies on a wide range of measures to address the cybersecurity workforce shortage. OMB stated that efforts had been within the confines of various current laws and appropriations, and that new legislation had not been required for any of these efforts. OMB did not provide additional details on the existing legal authorities on which it is relying. OMB also stated that the administration would seek legislation for any efforts beyond the scope of what is permitted under current law. DHS identified activities it is currently implementing related to the reform proposal that were previously authorized or required by law. For example, the CISA Chief Counsel identified DHS’s effort in establishing the forthcoming Cyber Talent Management System (CTMS) as a reform activity authorized by statute. The Chief Counsel noted DHS was authorized to establish this new personnel system for recruitment and retention of cybersecurity workers by the Border Patrol Agent Pay Reform Act of 2014. Under the act, DHS may establish cybersecurity positions; appoint personnel; fix rates of pay; and provide additional compensation, incentives, and allowances, subject to certain restrictions. The authority to implement this new system, however, is limited to DHS, and DHS officials acknowledged that CTMS cannot be implemented government-wide without statutory authorization. Additionally, DHS officials identified work being conducted at DHS to identify and categorize cybersecurity workforce positions, another activity related to the reform proposal and required by statute. Specifically, DHS was required by the Homeland Security Cyber Workforce Assessment Act of 2014, to: identify all cybersecurity workforce positions, determine the cybersecurity work category and specialty area of such assign data element codes developed by OPM in alignment with the NICE framework for each position. Furthermore, the Federal Cybersecurity Workforce Assessment Act of 2015 required OPM, in consultation with DHS, to identify critical needs for the IT, cybersecurity, or cyber-related workforce across federal agencies and to report to Congress on the identification of IT, cybersecurity, or cyber-related work roles of critical need. DHS officials also explained that, consistent with the 2015 act, it is currently working with other agencies and with industry to catalogue the federal cybersecurity workforce. The CISA Chief Counsel also identified DHS authorities that, under subchapter II of chapter 35 of Title 44 of the United States Code, CISA could leverage when implementing reform activities having government- wide or interagency impacts. Under these authorities, CISA (in consultation with OMB) administers the implementation of agency information security policies and practices, assists OMB with carrying out its responsibilities for overseeing agency information security policies and practices, and coordinates government-wide efforts on information security policies and practices. The Chief Counsel added that CISA “continues to consider, new, more specific…statutory authority aligned to specific reform responsibilities.” Establishing the GEAR Center: OMB Generally or Partially Addressed Selected Key Practices The administration is working toward establishing the GEAR Center, which it described in the reform plan as a vehicle for applied research that would help improve government operations and decision-making. OMB staff stated that the GEAR Center would be administered as a public- private partnership, and that the administration spent about $3 million for it in fiscal years 2018 through 2020 from available appropriations (see table 3). On Performance.gov, OMB provided options for the GEAR Center’s structure; it could be housed in a physical location, composed of a network of researchers working in multiple locations, or follow a different model. The administration does not envision that the GEAR Center will require government funds to conduct all of its initiatives in the long term. Instead, OMB staff said that the private sector would help fund its work after an initial stand-up period. According to the reform plan, GEAR Center research could help inform, for example, how the government responds to technological advances, how to provide better customer service experiences, and how to better leverage government data. In March 2019, OMB staff told us that they planned to establish the GEAR Center in fiscal year 2019, but as of February 2020, the center had not been formally established. To date, OMB staff have conducted preparation activities for establishing the GEAR Center, such as gathering stakeholder input through a Request for Information and a GSA- administered GEAR Center challenge competition to learn more about the types of projects a GEAR Center could facilitate. Through the challenge, GSA requested ideas on possible research projects, as well as related materials such as a project plan and ways to measure success. The challenge competition judges, which included OMB staff, selected three winning project plans with a prize of $300,000 each (for a total of $900,000). GSA specified that the cash prizes were for high potential project plans, and not grants to execute work on behalf of the government. In September 2019, GSA announced and awarded the winners of the GEAR Center challenge. The grand prize winners submitted 1-year project plans to: (1) help solve the federal cybersecurity workforce shortage by involving neurodiverse individuals, such as those with autism; (2) integrate currently disparate datasets to measure the impact of a federally funded program; and (3) train federal employees on how to better use their data for decision-making and accountability. In addition to the challenge competition, OMB contracted with the Center for Enterprise Modernization, a Federally Funded Research and Development Center operated by the MITRE Corporation, to examine options for operating the GEAR Center, in two projects. The first project— conducted from July 2019 through September 2019—was to explore a number of options for operating the GEAR Center. Following the first project, OMB staff laid out three tasks to accomplish during calendar year 2020 that they said would help them establish the GEAR Center: (1) establish a central coordinating function for the GEAR Center, (2) build the GEAR Center’s network of research partners, and (3) develop a draft government-wide learning agenda with input from federal agencies to inform the GEAR Center’s research and piloting activities. For the second project—which began in September 2019 and is scheduled to be completed in July 2020—the contractor is to provide additional detail on options for operating the GEAR Center, including on creating a network of research partners to support the GEAR Center. Table 3 provides details on these expenditures. As shown in figure 5, OMB has generally addressed most of our relevant key reform practices, and partially addressed the others. Determining the Appropriate Role of the Federal Government OMB staff generally addressed key practices related to determining the appropriate role of the federal government for the GEAR Center. While OMB staff have not developed a detailed governance structure for the GEAR Center, they have determined, with input from the private sector, that the GEAR Center will be a public-private partnership. Specifically, OMB staff considered the private sector’s ability or likelihood to invest its own resources in the initiatives the GEAR Center undertakes and otherwise contribute to the GEAR Center’s work. OMB did this by formally seeking the private sector’s input on these topics first through a Request for Information, and subsequently through a challenge competition. Establishing Goals and Outcomes OMB has partially addressed key practices related to establishing goals and outcomes. Specifically, OMB has initiated a process for developing outcome-oriented goals and performance measures for the GEAR Center, but has not finalized them. The GEAR Center challenge competition asked respondents to provide short- and long-term outcome- focused measures of success for the proposed projects in their submissions. However, as of November 2019, OMB staff told us they have not finalized these goals and measures for the GEAR Center. They stated that this is because they have not yet analyzed the results of the progress made by the challenge competition’s grand prize winners, and because they believe the purpose, or broad goal, of the GEAR Center is sufficient for their purposes at this stage of implementation. OMB staff told us that while they acknowledge that grand prize winners are not required to complete the projects they proposed, they anticipate the winners will carry them out to some extent, and they plan to monitor their work to inform GEAR Center planning activities. As OMB moves forward with establishing the GEAR Center, OMB staff should complete their efforts to develop goals and measures, because they will be necessary to track and communicate the GEAR Center’s progress over time. In addition, OMB staff have not yet fully assessed the costs and benefits of the various options OMB is considering for operating the GEAR Center. As previously discussed, OMB has stated that the GEAR Center could be housed in a physical location, composed of a network of researchers working in multiple locations, or follow a different model. Also, as previously stated, MITRE is currently exploring details of options for operating the center, and plans to provide them to OMB in July 2020. However, OMB has not yet conducted an analysis of the costs and benefits of the options for operating the center. In July 2018, OMB’s then Deputy Director for Management said that defining costs and benefits is dependent on refining and finalizing implementation plans. As of November 2019, OMB had not developed an implementation plan for establishing the GEAR Center. As OMB moves forward with establishing the center, assessing the costs and benefits of the various options for operating it will enable OMB to communicate the value of each option to Congress and other stakeholders. This assessment can help build a business case for OMB’s ultimate choice of how to operate the GEAR Center that presents facts and supporting details among competing alternatives. Involving Employees and Key Stakeholders OMB has generally addressed key practices related to involving employees and relevant stakeholders. Specifically, OMB has coordinated with internal government stakeholders, sought input from the private sector, and publicly communicated GEAR Center progress. For example, OMB staff said that they have worked to develop the GEAR Center with the President’s Management Council, the National Science Foundation, and DOD’s National Security Technology Accelerator group. Also, OMB held a Virtual Stakeholder Forum to provide information about the GEAR Center and to gather stakeholder input. During the forum, OMB sought attendees’ input through live polls, and announced that attendees could ask questions and provide additional input by sending messages to an OMB email account. OMB also sought stakeholder input through the GEAR Center Request for Information and challenge competition. Finally, as shown in figure 6, OMB has publicly reported on the GEAR Center’s progress on Performance.gov. Leadership Focus and Attention OMB has generally addressed key practices related to leadership focus and attention. To accomplish this, OMB has designated leaders, including OMB’s former Deputy Director for Management, a member of OMB’s Performance Team, and other staff to be responsible for implementing the reform. Managing and Monitoring OMB has partially addressed key practices related to managing and monitoring the reform to establish the GEAR Center. Specifically, OMB has gathered input from stakeholders on what research it could pursue, and from both stakeholders and a contractor on how the GEAR Center could be operated. OMB has done some analysis of that input, but has neither determined how the GEAR Center will operate nor developed an implementation plan. For example, OMB’s analysis of Request for Information responses shows that OMB is considering several options for how to execute the GEAR Center’s public-private partnership—a network of researchers, a physical location, etc.—but has not decided on one. In addition, as discussed previously, OMB contracted with MITRE to further assist with determining how the GEAR Center will operate. As OMB moves forward with establishing the GEAR Center, it will be able to track the GEAR Center’s progress, and communicate these results to Congress and key stakeholders, by developing and communicating an implementation plan with key milestones and deliverables. Establishing the GEAR Center: OMB Stated That It Will Seek Additional Authority to Conduct Implementation Activities, If Needed In response to our request to identify the legal authority OMB will need to implement this reform, OMB’s General Counsel stated in a November 2019 letter to us that it and its agency partners have relied upon existing legal authorities and available appropriations to develop the Request for Information, obtain external submissions for ideas to develop the GEAR Center, and issue the prize challenge. OMB stated that in conducting any future implementation activities, it would seek new legislative authority, if necessary. Conclusions While planning and implementation progress has been made since the administration’s government-wide reform plan was released in June 2018, important details surrounding the implementation of certain reform proposals have not been developed or communicated. OMB has a central role in overseeing and prioritizing these reforms for implementation, with support from lead agencies. In our previous work on government reorganization and reforms, we have found that there are key practices that, if followed, can help manage the risk of reduced productivity and effectiveness that often occurs as a result of major change initiatives. Important practices such as engaging and communicating with Congress, employees, and key stakeholders; dedicating a senior leadership team; and developing implementation plans, can help to ensure the successful implementation of reorganizations and reforms. OMB and DHS partially addressed most of the leading practices through their efforts to implement several projects related to the cybersecurity workforce reform, including efforts to reskill employees to fill vacant cybersecurity positions, establish a cybersecurity reservist program to provide needed surge capacity, and streamline relevant hiring processes. However, OMB, in coordination with DHS, has not yet followed relevant key practices to implement its reforms government-wide. Specifically, OMB and DHS have not yet developed a communications strategy to involve Congress, employees, and other stakeholders; established a dedicated government-wide leadership team; or developed a government-wide implementation plan with outcome-oriented goals, timelines, key milestones, deliverables, and processes to monitor implementation progress. In addition, OMB and DHS have not demonstrated how the projects and activities outlined in the reform proposal would address our related high-risk issues and major management challenges, or developed workforce plans that assess the effects of the proposal on the current and future workforce. If OMB, in coordination with DHS, applied key reform practices government-wide, they would be better positioned to manage the reform, and track progress across all agencies facing cybersecurity workforce shortages. OMB has taken steps toward determining how the GEAR Center will operate, such as, by determining the appropriate role of the federal government; providing leadership focus and attention; and collecting input from the public, academia, and industry on how the center could operate and on ideas for possible research projects. However, OMB has neither assessed the costs and benefits of the options it is considering for operating the center, nor developed an implementation plan with outcome-oriented goals and performance measures for it. As OMB moves forward with establishing the GEAR Center, completing these two activities can help OMB (1) make a case for why OMB’s ultimate decisions on how to operate the center are the most optimal, and (2) provide greater transparency to the public and private partners involved in its development, help build momentum, and demonstrate the center’s value. Recommendations for Executive Action: We are making a total of seven recommendations to OMB. The Director of OMB, working with DHS, should develop a government- wide communications strategy to inform and, as appropriate, involve Congress, employees, and other stakeholders in implementation of the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 1) The Director of OMB, working with DHS, should establish a dedicated government-wide leadership team with responsibility for implementing the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 2) The Director of OMB, working with DHS, should develop a government- wide implementation plan with goals, timelines, key milestones, and deliverables to track and communicate implementation progress of the reform proposal to solve the cybersecurity workforce shortage. (Recommendation 3) The Director of OMB, working with DHS, should provide additional information to describe how the projects and activities associated with the reform proposal to solve the cybersecurity workforce shortage will address our high-risk issues related to ensuring the cybersecurity of the nation. (Recommendation 4) The Director of OMB, working with DHS, should develop a government- wide workforce plan that assesses the effects of the reform proposal to solve the cybersecurity workforce shortage on the current and future federal workforce. (Recommendation 5) The Director of OMB should assess the costs and benefits of options for operating the GEAR Center. (Recommendation 6) The Director of OMB should develop an implementation plan that includes outcome-oriented goals, timelines, key milestones, and deliverables to track and communicate implementation progress of the reform proposal to establish the GEAR Center. (Recommendation 7) Agency Comments We provided a draft of this report for review and comment to the Directors of OMB and OPM, the Secretary of DOD, the Acting Secretary of DHS, and the Administrator of GSA. OMB did not comment on the report. DHS and DOD provided technical clarifications, which we incorporated as appropriate. OPM and GSA responded that they did not have comments on the report. We are sending copies of this report to the Director of OMB and the heads of the agencies we reviewed as well as appropriate congressional committees and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6806 or Mcneilt@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. Appendix I: Key Practices and Questions to Assess Agency Reforms In a 2018 report, we developed key questions based on our prior work on key practices that can help assess agency reform efforts. The 58 questions are organized into four broad categories and 12 subcategories, as shown in table 4. For the purpose of this review, we selected those subcategories and key questions that were most relevant to the selected reforms based on the information contained in the reform proposals, agency documentation, and interviews with the Office of Management and Budget and lead agencies for each of the reforms. Appendix II: Reform Plan Effort to Reorganize the Office of Personnel Management Reorganizing OPM: Most Key Practices Partially Addressed; National Defense Authorization Act for Fiscal Year 2020 Calls for Study of OPM The administration’s proposal to reorganize the Office of Personnel Management (OPM) evolved from June 2018 through November 2019, and was effectively halted by Congress in December 2019. In the June 2018 government-wide reform plan, the administration proposed: (1) moving OPM’s policy functions to a new office in the Executive Office of the President, which would also provide a government-wide view of human capital policy issues, (2) merging a number of OPM’s responsibilities with the General Service Administration’s (GSA) or other government entities’ to be determined at a later date, and (3) renaming GSA as the Government Services Agency. The goals of this proposal were to help elevate the importance of these functions, improve efficiency of operations, and save money, according to the reform plan. Specifically, the administration suggested integrating the following duties into the Government Services Agency or other government entities: administration of healthcare and insurance programs, Human Resources Solutions (HRS), which provides products and services to other federal agencies on a reimbursable basis, and information technology services. In addition, the reform plan contained another proposal to move all of OPM’s national security background investigation functions to the Department of Defense (DOD). The President’s Fiscal Year 2020 Budget, published in March 2019, expanded and modified the original OPM reorganization proposal. It proposed that all of OPM’s functions beyond those moving to the Executive Office of the President and DOD be transferred to GSA, rather than merging a portion of them into a newly formed Government Services Agency. It also called for creating a new GSA service area to house certain functions, and for moving OPM’s Office of the Inspector General to GSA. In May 2019, the administration submitted a legislative proposal to Congress requesting new authority to implement aspects of the OPM reorganization reform proposal. As of December 2019, this proposal had not been introduced in Congress. In May 2019, we testified on issues to consider in the proposed reorganization of OPM. We found that the Office of Management and Budget (OMB) and the two lead agencies (OPM and GSA) had generally not addressed key practices for reforms, such as establishing outcome- oriented goals, assessing costs and benefits, or developing an implementation plan, and had not fully involved or communicated their efforts with Congress, employees, and other key stakeholders. We also found that OMB, OPM, and GSA had not shown how they would address management challenges that may affect their ability to successfully reorganize the government’s central human capital functions. Between May and September 2019, OPM provided us with additional information, which contributed to our assessment of the extent to which OMB, OPM, and GSA addressed key practices for this reform (see figure 7). In October and November 2019, OMB staff and OPM and GSA officials provided us with updates on the status of the OPM reorganization reform proposal. OMB staff and OPM and GSA officials told us that the transfer of major functions from OPM to GSA, such as retirement services and HRS, was on hold until Congress, through legislation, provided the necessary authority to move these functions. They also told us that they were working together on moving the following functions from OPM to GSA through their existing authorities: (1) administrative responsibilities for the Chief Human Capital Officers (CHCO) Council; (2) the Program Management Office for the Security, Suitability, and Credentialing Performance Accountability Council (PAC); and (3) management of two OPM office buildings—the Theodore Roosevelt Building, which houses OPM’s headquarters in Washington, D.C., and the Federal Executive Institute located in Charlottesville, Virginia. OMB staff and OPM and GSA officials stated that the primary purpose of these moves was to achieve greater efficiency of operations, and that these transfers were not components of the OPM reorganization reform proposal. In November 2019, OPM’s Inspector General expressed concern over ongoing efforts to merge these functions with GSA, noting that the specific details of the full merger continued to evolve, and every iteration of the proposed reorganization would fundamentally alter how agency functions and duties are performed. In the National Defense Authorization Act (NDAA) for Fiscal Year 2020, signed into law in December 2019, Congress effectively halted actions to reorganize OPM pending the completion of reports by the National Academy of Public Administration (NAPA) and OPM. The law directed OPM to enter into a contract with NAPA to conduct a study to identify challenges associated with OPM’s execution of its functions and make recommendations for addressing them, including a cost-benefit analysis of proposed changes, and the identification of statutory or regulatory changes needed to execute recommended actions, among other things. Approximately 6 months after the NAPA report, OPM must submit a report providing its views on the NAPA report and its recommendations for changes to its functions. OPM is also to include a business case analysis associated with such changes and a proposal for legislative and regulatory action required to effect the changes. Many of these requirements reflect the issues we raised in our May 2019 testimony on the extent to which the proposal to reorganize OPM was consistent with our key reform practices. According to the President’s fiscal year 2021 budget request, the administration continues to pursue implementation of OPM’s reorganization. Specifically, it proposes to transfer the functions of OPM to GSA, contingent upon enactment of authorizing legislation. Establishing Goals and Outcomes OMB, OPM, and GSA partially addressed the key practices related to establishing goals and outcomes. First, OMB, OPM, and GSA considered how the upfront costs of the reform would be funded by, for example, requesting funds through the President’s Fiscal Year 2020 Budget. However, OMB, OPM, and GSA did not fully address other aspects of the key practices. Specifically, since our May 2019 testimony, OPM provided us information on additional draft goals and measures for some portions of the reform. For example, according to a document we received from OPM in August 2019, a team leading the reform effort was developing “critical to quality” metrics in areas such as cost reduction, employee engagement, and flexible operations. However, these metrics did not have targets and had not been finalized. In November 2019, OMB staff told us that metrics were not yet final because they were still working with Congress to develop a legislative proposal authorizing the reform, and implementation of the merger was not yet underway. The NDAA for Fiscal Year 2020 requires NAPA and OPM to make recommendations for changes to OPM’s structure, functions, responsibilities and authorities, which may differ from those the administration proposed. We have also previously reported that major change initiatives should be based on either a clearly presented business case or analysis of costs and benefits grounded in accurate and reliable data, both of which can show stakeholders why a particular initiative is being considered and the range of alternatives considered. While OPM officials had some information on the costs and benefits they planned to achieve by merging functions with other agencies, they did not have an analysis or underlying data supporting their conclusions. Specifically, OPM provided us with its rationale for the reform in several documents, including: a summary of the agency’s financial and management challenges, a qualitative business case, a list of state and foreign governments’ administrative models where human resources and administrative functions are merged, and a presentation providing OPM’s estimate of the annual savings that could be realized by “fully integrating OPM’s operations into GSA.” However, the information that OPM provided did not include measurable performance or outcome metrics, or quantify benefits relative to costs, to provide a complete assessment of the costs and benefits and any alternative solutions to the reform proposal. OPM’s Office of Inspector General also found, in its fiscal year 2020 top management challenges report, that OPM had not developed a thorough analysis of costs and benefits. Shortly after OMB published the reform plan, OMB’s then Deputy Director for Management, who also served as OPM’s Acting Director, said that defining costs and benefits was dependent on refining and finalizing implementation plans. Since then, in the NDAA for Fiscal Year 2020, Congress required that NAPA’s study include an analysis of the benefits, costs, and feasibility of each recommendation, and a timetable for implementing these options. In addition, the law requires that OPM’s report include a business case analysis that describes the operational efficiencies and cost savings (both short- and long-term) associated with its recommendations. Involving Employees and Key Stakeholders OMB, OPM, and GSA partially addressed the key practices related to involving employees and key stakeholders. Specifically, since our May 2019 testimony, OPM officials provided us with documents to demonstrate that the agency took additional actions in this area, as discussed in more detail below. However, we found that OPM’s early outreach efforts to employees and stakeholders were insufficient, the agency did not have a plan for incorporating employee and stakeholder feedback, and it did not share relevant implementation details that may have affected employees and stakeholders. For example, OPM provided us with a communications tracker that listed meetings and correspondence with Congress, staff, and employee groups from OPM’s Acting Director, Deputy Director, and Deputy Chief of Staff. While this document listed a number of meetings and calls, it showed that most of OPM’s efforts to involve Congress, employees, and employee groups began in April 2019, more than 9 months after OMB published the reform plan, and more than 8 months after OPM’s Director and GSA’s Administrator testified before Congress about their plans for carrying out the reform proposal. In addition, both members of Congress and employee groups expressed dissatisfaction with initial outreach from OMB, OPM, and GSA, including lack of transparency. For example, during a House Committee on Oversight and Reform Subcommittee on Government Operations hearing on May 21, 2019, members of Congress and employee groups testified that they felt insufficiently involved in the reform. Both groups stated that OPM officials communicated with them on few occasions, and members of Congress said that they had not received key documents they requested from OPM, including an implementation plan. In August 2019, OPM provided us with a strategic communications plan that included high level messages and strategies for reaching out to Congress, employees, and the public. This and other OPM documents demonstrated that OPM communicated with employees and key stakeholders, and provided opportunities for its employees to ask questions and provide comments about the reform, activities consistent with our key practices. However, the documents did not indicate how senior OPM officials planned to use the feedback they received from their employees. Similarly, neither OMB nor GSA described how they planned to use employee feedback to inform their reform efforts. The NAPA study required by the NDAA for Fiscal Year 2020 must include methods for involving, engaging with, and receiving input from other federal agencies, departments, and entities potentially affected by any change in OPM that NAPA recommends. The study must also incorporate the views of stakeholders. Addressing High-Risk Areas and Longstanding Management Challenges OMB, OPM, and GSA partially addressed the key practices related to addressing high-risk areas and longstanding management challenges, consistent with our assessment in May 2019. Since then, OPM provided additional documents related to (1) our relevant high-risk area of strategic human capital management, as well as (2) longstanding challenges at OPM we and OPM’s Inspector General have reported. However, OMB, OPM, and GSA did not explain how the OPM reorganization reform proposal would address our high-risk issue or mitigate major management challenges, and did not have plans to monitor the potential effects of the reform on these issues. As a result, OMB, OPM, and GSA did not fully consider the potential risks of transferring OPM systems with longstanding weaknesses to GSA, and of GSA taking on duties in areas such as information technology, where it faces major management challenges. They also lacked a means of monitoring the reform’s potential effects on our strategic human capital management high-risk area and on major management challenges. Moreover, in November 2019, OPM’s Office of the Inspector General continued to identify the proposed merger of OPM with GSA as a top management challenge because the proposal did not include an implementation plan, and created a burden for the agency to fully study, plan, and execute reorganization activities. In November 2019, OMB staff told us that, because the proposed merger was a long-term effort and plans were still under development, they had not yet determined how our high-risk and other management challenges would be addressed. The NDAA for Fiscal Year 2020 requires the NAPA study to include analyses of OPM’s challenges and a recommended course of action for resolving them. Leadership Focus and Attention OMB, OPM, and GSA generally addressed the key practices related to leadership focus and attention. Specifically, since our May 2019 testimony, OPM officials provided us with documents demonstrating that OMB, OPM, and GSA made progress in this area. For example, OPM documents showed that OPM, OMB, and GSA leaders approved a governance structure for leading reform efforts that included: an executive steering committee that provided guidance and made decisions. Its members included the OMB Deputy Director for Management (serves as executive sponsor and chair), the OPM Director (serves as a vice-chair), and the GSA Administrator (serves as a vice-chair). The group used the Lean Six Sigma management approach to make decisions related to planning and implementing the reform during Tollgate meetings. an interagency task force that led activities to implement the reform, and that raised issues to the Executive Steering Committee as needed. Its members included leaders from OMB, OPM, and GSA. interagency teams, which provided subject matter expertise and performed tasks and activities to implement the reform. Their members were OPM and GSA officials. From August 2018 through April 2019, our analysis of OPM documents showed that these groups met and communicated frequently—from every few days to every few weeks, depending on the group. From May 2019— when the administration transmitted their legislative proposal to Congress to reorganize OPM—to November 2019, these groups met less frequently, according to OMB staff and GSA officials. Managing and Monitoring OMB, OPM, and GSA partially addressed the key practices related to managing and monitoring. Since our May 2019 testimony, OPM provided us with documents that demonstrated improvements in this area, but as of November 2019, had yet to finalize an implementation plan. Specifically, the documents showed that OMB, OPM, and GSA held leadership meetings and systematically tracked various aspects of the reform. For example, OPM officials tracked the status of certain activities associated with the reform, such as progress on developing a plan for communicating with employees and stakeholders, through leadership meetings. Also, OPM had a document identifying risks associated with the reform, such as ensuring continuity of services, as well as mitigation strategies, such as including provisions in OPM-GSA interagency agreements. The document also specified individual agency officials responsible for each risk. OMB, OPM, and GSA did not develop an implementation plan for the OPM reorganization reform that included key milestones and deliverables. In November 2019, OMB staff told us that their plans were still being developed because they were waiting for Congress to pass the administration’s legislative proposal authorizing the reform. The NDAA for Fiscal Year 2020 requires NAPA and OPM to make recommendations for changes to OPM’s structure, functions, responsibilities, and authorities, which may differ from those the administration proposed. Employee Engagement OMB, OPM, and GSA partially addressed the key practices related to employee engagement. Specifically, while OMB and agencies undertook activities to measure employee engagement, such as surveying and communicating with employees, they did not develop a comprehensive strategy for sustaining and strengthening employee engagement during and after the reform. For example, GSA officials told us that they established a GSA-OPM change management and communications workgroup, which developed a change management and communications plan that included employee engagement activities. Also, in April 2019, OPM conducted an internal survey of agency staff to measure employee engagement, among other factors. OPM officials also identified employee morale issues as a risk in a document identifying risks associated with the reform and risk mitigation strategies. To address employee dissatisfaction and low morale, OPM officials, including OPM’s then-Acting Director, shared the survey results with employees, held listening sessions to determine employees’ preferences for communications about the OPM reorganization reform proposal, and developed a communications strategy. However, OPM officials did not determine how they planned to use these communications to sustain and strengthen employee engagement. In November 2019, OMB staff told us that because they were still in the planning stages of the reorganization, the proposed reform had not yet involved major changes for employees, so they put employee engagement efforts on hold. The NAPA study required by the NDAA for Fiscal Year 2020 is to include methods for involving, engaging with, and receiving input from other federal agencies, departments, and entities potentially affected by any change in OPM that NAPA recommends. The study is to also incorporate the views of stakeholders. Strategic Workforce Planning OMB, OPM, and GSA did not address the key practices related to strategic workforce planning. OPM and GSA officials told us that they were conducting workforce planning activities associated with the OPM reorganization reform. Also, the President’s Fiscal Year 2020 Budget provided some information about staff levels at OPM and GSA. However, OMB, OPM, and GSA did not produce strategic workforce plans for OPM and GSA employees. OPM and GSA officials stated that they had not provided us with these plans because they were under development. In November 2019, GSA officials added that they were waiting for congressional authorization to carry out the reform proposal, so they had put their efforts to develop a workforce plan on hold. The NDAA for Fiscal Year 2020 requires that NAPA and OPM make recommendations on changes to OPM, which may differ from the administration’s proposed reorganization of OPM. Reorganizing OPM: NDAA for Fiscal Year 2020 Provides for the Identification of Legal Authorities As part of our review, our Office of General Counsel sent letters to the Offices of General Counsel at OPM, GSA, and OMB requesting they provide us with a description of the legal authorities they were using to support the proposed OPM reorganization. OMB, OPM, and GSA provided responses to our letter, but did not identify which aspects of the OPM reorganization could be carried out under existing law and which would require legislative authority. GSA, OPM, and OMB officials stated that they had not yet finalized their legal analysis, and that they were still determining which legal authorities they could use to implement elements of the reform. OMB General Counsel stated that to implement the administration’s proposed reorganization, both legislative and administrative actions would be necessary and dependent on each other “in the long run.” In May 2019, the administration submitted a legislative proposal requesting authority to transfer OPM functions—such as Human Resources Solutions, Information Technology, Retirement, and Health and Insurance Services—to GSA. As of December 2019, the proposal had not been introduced in Congress. OMB staff told us that the legislative proposal was an effort to communicate transparently about the extent to which new authorities would be required. As discussed earlier, in December 2019, Congress passed the NDAA for Fiscal Year 2020. In the NAPA study required under the NDAA, NAPA is to provide a comprehensive assessment and analysis of the statutory or regulatory changes needed to implement any recommended course of action, and to submit this report to Congress and the Director of OPM. The Director of OPM is then to submit a report to Congress that lays out OPM’s views on the findings and recommendations of the NAPA study, along with OPM’s recommendations for change. Any recommendation submitted by OPM for change is to include a business case analysis that sets forward the efficiencies and cost savings (both short- and long-term) associated with the change, and a proposal for legislative or administrative action required to effect the change. The statutory provisions in the act generally provide that no aspect of the agency that is assigned in law to OPM may be moved to GSA, OMB, or the Executive Office of the President until 180 days after OPM’s report is submitted to congressional committees, and subject to the enactment of any required legislation. Appendix III: Reform Plan Effort to Develop a Capability to Improve the Customer Experience This reform proposal aims to modernize and streamline the way citizens interact with the federal government, and to raise customer experience to a level comparable with leading private sector organizations. With support from the United States Digital Service (USDS) and GSA’s Technology Transformation Service, OMB has stated that it will lead an effort to establish a government-wide capability that will enable agencies to identify their customers, map their interactions (or journeys) with federal programs or services, and leverage digital tools and services to improve their experiences and overall satisfaction. For example, as reported in the reform plan, the U.S. Department of Agriculture created a “digital front door,” accessible at Farmers.gov, that is organized around the user experience rather than the government’s structure. The reform plan further explains that the improved capability provided by USDS and GSA would also provide for a government-wide resource to manage organizational change, including improved project planning, facilitating interagency collaboration, and sharing best practices on change management. OMB staff told us in early 2019 that they have delayed implementation of this reform, and instead will focus on other customer experience activities, such as those outlined in the related Cross-Agency Priority (CAP) goal. Upon release of the President’s Fiscal Year 2020 budget in March 2019, we confirmed that this reform was not included in the administration’s reorganization priorities, and OMB confirmed that no funding was requested for its implementation. OMB and agencies are also pursuing a related but distinct CAP goal under the President’s Management Agenda–Improving Customer Experience with Federal Services–with the aim of providing a modern, streamlined, and responsive customer experience across government, comparable to leading private-sector organizations. According to OMB, the reform proposal is meant to stand up a central capacity, or office, within GSA to manage customer experience government-wide; whereas, the CAP goal is intended to support capacity growth and accountability within agencies to develop and manage their own customers’ experience and satisfaction. Because OMB has not yet begun to implement this reform, and no actions are planned for fiscal year 2020, we are not able to assess the extent to which the reform is adhering to key reform practices. When the administration moves forward with implementing this reform, it will be better positioned for its successful implementation if the key reform practices are followed. In response to our request to identify the legal authority OMB will need to implement this reform, OMB’s General Counsel responded in a November 2019 letter that the initiative will not require new legislation. OMB stated the reform can be implemented within current law and available appropriations. Appendix IV: GAO Contacts and Staff Acknowledgments GAO Contact Staff Acknowledgments Triana McNeil at (202) 512-6806 or Mcneilt@gao.gov. In addition to the contact named above, Sarah E. Veale (Assistant Director, Strategic Issues), Peter Beck (Analyst-in-Charge, Strategic Issues), Colenn Berracasa, Karin Fangman, Steven Putansu, Janet Temko-Blinder, Peter Verchinski, and Kellen Wartnow made key contributions to this report. Timothy Carr, Jacqueline Chapin, Tom Costa, Sara Cradic, Brenda Farrell, Patrick Hickey, Shirley Jones, Tammi Kalugdan, Brian Mazanec, Kimberly Seay, Gregory Wilshusen, and Alicia White also contributed to this report.