Background According to the President’s budget, the federal government planned to invest more than $96 billion for IT in fiscal year 2018—the largest amount ever budgeted. Despite such large IT expenditures, we have previously reported that investments in federal IT too often resulted in failed projects that incurred cost overruns and schedule slippages, while contributing little to the desired mission-related outcomes. For example: The tri-agency National Polar-orbiting Operational Environmental Satellite System was disbanded in February 2010 at the direction of the White House’s Office of Science and Technology Policy after the program spent 16 years and almost $5 billion. The Department of Homeland Security’s (DHS) Secure Border Initiative Network program was ended in January 2011, after the department obligated more than $1 billion for the program. The Department of Veterans Affairs’ Financial and Logistics Integrated Technology Enterprise program was intended to be delivered by 2014 at a total estimated cost of $609 million, but was terminated in October 2011. The Department of Defense’s Expeditionary Combat Support System was canceled in December 2012 after spending more than a billion dollars and failing to deploy within 5 years of initially obligating funds. The United States Coast Guard (Coast Guard) decided to terminate its Integrated Health Information System project in 2015. As reported by the agency in August 2017, the Coast Guard spent approximately $60 million over 7 years on this project, which resulted in no equipment or software that could be used for future efforts. Our past work has found that these and other failed IT projects often suffered from a lack of disciplined and effective management, such as project planning, requirements definition, and program oversight and governance. In many instances, agencies had not consistently applied best practices that are critical to successfully acquiring IT. Such projects have also failed due to a lack of oversight and governance. Executive-level governance and oversight across the government has often been ineffective, specifically from CIOs. For example, we have reported that some CIOs’ roles were limited because they did not have the authority to review and approve the entire agency IT portfolio. In addition to failures when acquiring IT, security deficiencies can threaten systems. As we previously reported, in order to counter security threats, the 23 civilian Chief Financial Officers (CFO) Act agencies spent a combined total of approximately $4 billion on IT security-related activities in fiscal year 2016. Even so, our cybersecurity work at federal agencies continues to highlight information security deficiencies. The following examples describe the types of risks we have found at federal agencies. In September 2018, we reported that the Department of Education’s Office of Federal Student Aid exercises minimal oversight of lenders’ protection of student data and lacks assurance that appropriate risk- based safeguards are being effectively implemented, tested, and monitored. In August 2017, we reported that, since the 2015 data breaches, the Office of Personnel Management (OPM) had taken actions to prevent, mitigate, and respond to data breaches involving sensitive personal and background investigation information. However, we noted that the agency had not fully implemented recommendations made to OPM by DHS’s United States Computer Emergency Readiness Team to help the agency improve its overall security posture and improve its ability to protect its systems and information from security breaches. In July 2017, we reported that information security at the Internal Revenue Service had weaknesses that limited its effectiveness in protecting the confidentiality, integrity, and availability of financial and sensitive taxpayer data. An underlying reason for these weaknesses was that the Internal Revenue Service had not effectively implemented elements of its information security program. In May 2016, we reported that the National Aeronautics and Space Administration, the Nuclear Regulatory Commission, OPM, and the Department of Veteran Affairs did not always control access to selected high-impact systems, patch known software vulnerabilities, and plan for contingencies. An underlying reason for these weaknesses was that the agencies had not fully implemented key elements of their information security programs. In August 2016, we reported that the information security of the Food and Drug Administration had significant weaknesses that jeopardized the confidentiality, integrity, and availability of its information systems and industry and public health data. FITARA Increases CIO Authorities and Responsibilities for Managing IT Congress and the President have enacted various key pieces of reform legislation to address IT management issues. These include the federal IT acquisition reform legislation commonly referred to as the Federal Information Technology Acquisition Reform Act (FITARA). This legislation was intended to improve covered agencies’ acquisitions of IT and enable Congress to monitor agencies’ progress and hold them accountable for reducing duplication and achieving cost savings. The law includes specific requirements related to seven areas: Agency CIO authority enhancements. CIOs at covered agencies have the authority to, among other things, (1) approve the IT budget requests of their respective agencies and (2) review and approve IT contracts. Federal data center consolidation initiative (FDCCI). Agencies covered by FITARA are required, among other things, to provide a strategy for consolidating and optimizing their data centers and issue quarterly updates on the progress made. Enhanced transparency and improved risk management. The Office of Management and Budget (OMB) and covered agencies are to make detailed information on federal IT investments publicly available, and agency CIOs are to categorize their investments by level of risk. Portfolio review. Covered agencies are to annually review IT investment portfolios in order to, among other things, increase efficiency and effectiveness and identify potential waste and duplication. Expansion of training and use of IT acquisition cadres. Covered agencies are to update their acquisition human capital plans to support timely and effective IT acquisitions. In doing so, the law calls for agencies to consider, among other things, establishing IT acquisition cadres (i.e., multi-functional groups of professionals to acquire and manage complex programs), or developing agreements with other agencies that have such cadres. Government-wide software purchasing program. The General Services Administration is to develop a strategic sourcing initiative to enhance government-wide acquisition and management of software. In doing so, the law requires that, to the maximum extent practicable, the General Services Administration should allow for the purchase of a software license agreement that is available for use by all executive branch agencies as a single user. Maximizing the benefit of the Federal Strategic Sourcing Initiative. Federal agencies are required to compare their purchases of services and supplies to what is offered under the Federal Strategic Sourcing Initiative. In June 2015, OMB released guidance describing how agencies are to implement FITARA. This guidance is intended to, among other things: assist agencies in aligning their IT resources with statutory requirements; establish government-wide IT management controls to meet the law’s requirements, while providing agencies with flexibility to adapt to unique agency processes and requirements; strengthen the relationship between agency CIOs and bureau CIOs; and strengthen CIO accountability for IT costs, schedules, performance, and security. The guidance identifies a number of actions that agencies are to take to establish a basic set of roles and responsibilities (referred to as the common baseline) for CIOs and other senior agency officials and, thus, to implement the authorities described in the law. For example, agencies are to conduct a self-assessment and submit a plan describing the changes they intend to make to ensure that common baseline responsibilities are implemented. In addition, in August 2016, OMB released guidance intended to, among other things, define a framework for achieving the data center consolidation and optimization requirements of FITARA. The guidance directed agencies to develop a data center consolidation and optimization strategic plan that defined the agency’s data center strategy for fiscal years 2016, 2017, and 2018. This strategy was to include, among other things, a statement from the agency CIO indicating whether the agency had complied with all data center reporting requirements in FITARA. Further, the guidance states that OMB is to maintain a public dashboard to display consolidation-related costs savings and optimization performance information for the agencies. Congress Has Undertaken Efforts to Continue Selected FITARA Provisions and Modernize Federal IT Congress has recognized the importance of agencies’ continued implementation of FITARA provisions, and has taken legislative action to extend selected provisions beyond their original dates of expiration. Specifically, Congress and the President enacted laws to: remove the expiration dates for the enhanced transparency and improved risk management provisions, which were set to expire in 2019; remove the expiration date for portfolio review, which was set to expire in 2019; and extend the expiration date for FDCCI from 2018 to 2020. In addition, Congress and the President enacted a law to authorize the availability of funding mechanisms to help further agencies’ efforts to modernize IT. The law, known as the Modernizing Government Technology (MGT) Act, authorizes agencies to establish working capital funds for use in transitioning from legacy IT systems, as well as for addressing evolving threats to information security. The law also creates the Technology Modernization Fund, within the Department of the Treasury, from which agencies can “borrow” money to retire and replace legacy systems, as well as acquire or develop systems. Further, in February 2018, OMB issued guidance for agencies on implementing the MGT Act. The guidance was intended to provide agencies additional information regarding the Technology Modernization Fund, and the administration and funding of the related IT working capital funds. Specifically, the guidance encouraged agencies to begin submitting initial project proposals for modernization on February 27, 2018. In addition, in accordance with the MGT Act, the guidance provides details regarding a Technology Modernization Board, which is to consist of (1) the Federal CIO; (2) a senior IT official from the General Services Administration; (3) a member of DHS’s National Protection and Program Directorate; and (4) four federal employees with technical expertise in IT development, financial management, cybersecurity and privacy, and acquisition, appointed by the Director of OMB. FISMA Establishes Responsibilities for Agencies to Address Federal Cybersecurity Congress and the President enacted the Federal Information Security Modernization Act of 2014 (FISMA) to improve federal cybersecurity and clarify government-wide responsibilities. The act addresses the increasing sophistication of cybersecurity attacks, promotes the use of automated security tools with the ability to continuously monitor and diagnose the security posture of federal agencies, and provides for improved oversight of federal agencies’ information security programs. Toward this end, the act clarifies and assigns specific responsibilities to entities such as OMB, DHS, and the federal agencies. Table 1 describes a selection of the OMB, DHS, and agency responsibilities. The Administration Has Undertaken Efforts to Improve, Modernize, and Strengthen the Security of Federal IT Beyond the implementation of FITARA, FISMA, and related actions, the administration has also initiated other efforts intended to improve federal IT. Specifically, in March 2017, the administration established the Office of American Innovation, which has a mission to, among other things, make recommendations to the President on policies and plans aimed at improving federal government operations and services. In doing so, the office is to consult with both OMB and the Office of Science and Technology Policy on policies and plans intended to improve government operations and services, improve the quality of life for Americans, and spur job creation. In May 2017, the Administration also established the American Technology Council, which has a goal of helping to transform and modernize federal agency IT and how the federal government uses and delivers digital services. The President is the chairman of this council, and the Federal CIO and the United States Digital Service Administrator are among the members. In addition, on May 11, 2017, the President signed Executive Order 13800, Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure. This executive order outlined actions to enhance cybersecurity across federal agencies and critical infrastructure to improve the nation’s cyber posture and capabilities against cybersecurity threats. Among other things, the order tasked the Director of the American Technology Council to coordinate a report to the President from the Secretary of DHS, the Director of OMB, and the Administrator of the General Services Administration, in consultation with the Secretary of Commerce, regarding the modernization of federal IT. As a result, the Report to the President on Federal IT Modernization was issued on December 13, 2017, and outlined the current and envisioned state of federal IT. The report focused on modernization efforts to improve the security posture of federal IT and recognized that agencies have attempted to modernize systems but have been stymied by a variety of factors, including resource prioritization, ability to procure services quickly, and technical issues. The report provided multiple recommendations intended to address these issues through the modernization and consolidation of networks and the use of shared services to enable future network architectures. Further, in March 2018, the Administration issued the President’s Management Agenda, which lays out a long-term vision for modernizing the federal government. The agenda identifies three related drivers of transformation—IT modernization; data, accountability, and transparency; and the workforce of the future—that are intended to push change across the federal government. The Administration also established 14 related Cross-Agency Priority goals, many of which have elements that involve IT. In particular, the Cross-Agency Priority goal on IT modernization states that modern IT must function as the backbone of how government serves the public in the digital age. This goal establishes three priorities that are to guide the Administration’s efforts to modernize federal IT: (1) enhancing mission effectiveness by improving the quality and efficiency of critical services, including the increased utilization of cloud-based solutions; (2) reducing cybersecurity risks to the federal mission by leveraging current commercial capabilities and implementing cutting edge cybersecurity capabilities; and (3) building a modern IT workforce by recruiting, reskilling, and retaining professionals able to help drive modernization with up-to-date technology. More recently, on May 15, 2018, the President signed Executive Order 13833, Enhancing the Effectiveness of Agency Chief Information Officers. Among other things, this executive order is intended to better position agencies to modernize their IT systems, execute IT programs more efficiently, and reduce cybersecurity risks. The order pertains to 22 of the 24 CFO Act agencies: the Department of Defense and the Nuclear Regulatory Commission are exempt. For the covered agencies, the executive order strengthens the role of agency CIOs by, among other things, requiring them to report directly to their agency head; serve as their agency head’s primary IT strategic advisor; and have a significant role in all management, governance, and oversight processes related to IT. In addition, one of the cybersecurity requirements directs agencies to ensure that the CIO works closely with an integrated team of senior executives, including those with expertise in IT, security, and privacy, to implement appropriate risk management measures. Agencies Have Not Fully Addressed the IT Acquisitions and Operations High-Risk Area In the February 2017 update to our high-risk series, we reported that agencies still needed to complete significant work related to the management of IT acquisitions and operations. We stressed that OMB and federal agencies should continue to expeditiously implement FITARA and OMB’s related guidance, which includes enhancing CIO authority, consolidating data centers, and acquiring and managing software licenses. Our update to this high-risk area also stressed that OMB and agencies needed to continue to implement our prior recommendations in order to improve their ability to effectively and efficiently invest in IT. Specifically, since fiscal year 2010, we have made 1,242 recommendations to OMB and federal agencies to address shortcomings in IT acquisitions and operations. As stated in the update, OMB and agencies should demonstrate government-wide progress in the management of IT investments by, among other things, implementing at least 80 percent of our recommendations related to managing IT acquisitions and operations. As of November 2018, OMB and agencies had fully implemented 732 (or about 59 percent) of the 1,242 recommendations. Figure 1 summarizes the progress that OMB and agencies have made in addressing our recommendations compared to the 80 percent target. Overall, federal agencies would be better positioned to realize billions in cost savings and additional management improvements if they address these recommendations, including those aimed at implementing CIO responsibilities, reviewing IT acquisitions; improving data center consolidation; and managing software licenses. Agencies Need to Address Shortcomings and Challenges in Implementing CIO Responsibilities In all, the various laws, such as FITARA, and related guidance assign 35 IT management responsibilities to CIOs in six key areas. These areas are: leadership and accountability, budgeting, information security, investment management, workforce, and strategic planning. In August 2018, we reported that none of the 24 agencies we reviewed had policies that fully addressed the role of their CIO, as called for by federal laws and guidance. In this regard, a majority of the agencies had fully or substantially addressed the role of their CIOs for the area of leadership and accountability. In addition, a majority of the agencies had substantially or partially addressed the role of their CIOs for two areas: information security and IT budgeting. However, most agencies partially or minimally addressed the role of their CIOs for two areas: investment management and strategic planning. Further, the majority of the agencies minimally addressed or did not address the role of their CIOs for the remaining area: IT workforce. Figure 2 depicts the extent to which the 24 agencies addressed the role of their CIOs for the six areas. Despite the shortfalls in agencies’ policies addressing the roles of their CIOs, most agency officials stated that their CIOs are implementing the responsibilities even if the agencies do not have policies requiring implementation. Nevertheless, the CIOs of the 24 selected agencies acknowledged in responses to a survey that we administered that they were not always very effective in implementing the six IT management areas. Specifically, at least 10 of the CIOs indicated that they were less than very effective for each of the six areas of responsibility. We believe that until agencies fully address the role of CIOs in their policies, agencies will be limited in addressing longstanding IT management challenges. Figure 3 depicts the extent to which the CIOs reported their effectiveness in implementing the six areas of responsibility. Beyond the actions of the agencies, however, shortcomings in agencies’ policies also are partially attributable to two weaknesses in OMB’s guidance. First, the guidance does not comprehensively address all CIO responsibilities, such as those related to assessing the extent to which personnel meet IT management knowledge and skill requirements, and ensuring that personnel are held accountable for complying with the information security program. Correspondingly, the majority of the agencies’ policies did not fully address nearly all of the responsibilities that were not included in OMB’s guidance. Second, OMB’s guidance does not ensure that CIOs have a significant role in (1) IT planning, programming, and budgeting decisions; and (2) execution decisions and the management, governance, and oversight processes related to IT, as required by federal law and guidance. In the absence of comprehensive guidance, CIOs will not be positioned to effectively acquire, maintain, and secure their IT systems. In response to the survey conducted for our August 2018 report, the 24 agency CIOs also identified a number of factors that enabled and challenged their ability to effectively manage IT. Specifically, most agency CIOs cited five factors as being enablers to effectively carry out their responsibilities: (1) NIST guidance, (2) the CIO’s position in the agency hierarchy, (3) OMB guidance, (4) coordination with the Chief Acquisition Officer (CAO), and (5) legal authority. Further, three factors were cited by CIOs as major factors that have challenged their ability to effectively carry out responsibilities: (1) processes for hiring, recruiting, and retaining IT personnel; (2) financial resources; and (3) the availability of personnel/staff resources. As shown in figure 4, the five enabling factors were identified by at least half of the 24 CIOs and the three factors cited as major challenges were identified by at least half of the CIOs. Although OMB has issued guidance aimed at addressing the three factors that were identified by at least half of the CIOs as major challenges, the guidance does not fully address those challenges. Further, regarding the financial resources challenge, OMB recently required agencies to provide data on CIO authority over IT spending; however, its guidance does not provide a complete definition of the authority. In the absence of such guidance, agencies have created varying definitions of CIO authority. Until OMB updates its guidance to include a complete definition of the authority that CIOs are to have over IT spending, it will be difficult for OMB to identify any deficiencies in this area and to help agencies make any needed improvements. In order to address challenges in implementing CIO responsibilities, we made three recommendations to OMB and one recommendation to each of the selected 24 federal agencies to improve the effectiveness of CIOs’ implementation of their responsibilities for each of the six IT management areas. Most agencies agreed with or had no comments on the recommendations. As of November 2018, all 27 of the recommendations had not been implemented. We will continue to monitor the implementation of these recommendations. Agencies Need to Ensure That IT Acquisitions Are Reviewed and Approved by CIOs FITARA includes a provision to enhance covered agency CIOs’ authority through, among other things, requiring agency heads to ensure that CIOs review and approve IT contracts. OMB’s FITARA implementation guidance expanded upon this aspect of the legislation in a number of ways. Specifically, according to the guidance: CIOs may review and approve IT acquisition strategies and plans, rather than individual IT contracts; CIOs can designate other agency officials to act as their representatives, but the CIOs must retain accountability; CAOs are responsible for ensuring that all IT contract actions are consistent with CIO-approved acquisition strategies and plans; and CAOs are to indicate to the CIOs when planned acquisition strategies and acquisition plans include IT. In January 2018, we reported that most of the CIOs at 22 selected agencies were not adequately involved in reviewing billions of dollars of IT acquisitions. For instance, most of the 22 agencies did not identify all of their IT contracts. In this regard, the agencies identified 78,249 IT- related contracts, to which they obligated $14.7 billion in fiscal year 2016. However, we identified 31,493 additional contracts with $4.5 billion obligated, raising the total amount obligated to IT contracts by these agencies in fiscal year 2016 to at least $19.2 billion. Figure 5 reflects the obligations that the 22 selected agencies reported to us relative to the obligations we identified. The percentage of additional IT contract obligations we identified varied among the selected agencies. For example, the Department of State did not identify 1 percent of its IT contract obligations. Conversely, eight agencies did not identify over 40 percent of their IT contract obligations. Many of the selected agencies that did not identify these IT contract obligations also did not follow OMB guidance. Specifically, 14 of the 22 agencies did not involve the acquisition office in their process to identify IT acquisitions for CIO review, as required by OMB. In addition, 7 agencies did not establish guidance to aid officials in recognizing IT. We concluded that until these agencies involve the acquisitions office in their IT acquisition identification processes and establish supporting guidance, they cannot ensure that they will identify all such acquisitions. Without proper identification of IT acquisitions, these agencies and CIOs cannot effectively provide oversight of these acquisitions. In addition to not identifying all IT contracts, 14 of the 22 selected agencies did not fully satisfy OMB’s requirement that the CIO review and approve IT acquisition plans or strategies. Further, only 11 of 96 randomly selected IT contracts at 10 agencies that we evaluated were CIO- reviewed and approved as required by OMB’s guidance. The 85 contracts not reviewed had a total possible value of approximately $23.8 billion. Until agencies ensure that CIOs are able to review and approve all IT acquisitions, CIOs will continue to have limited visibility and input into their agencies’ planned IT expenditures and will not be able to effectively use the increased authority that FITARA’s contract approval provision is intended to provide. Further, agencies will likely miss an opportunity to strengthen their CIOs’ authority and the oversight of acquisitions. As a result, agencies may award IT contracts that are duplicative, wasteful, or poorly conceived. As a result of these findings, we made 39 recommendations in our January 2018 report. Among these, we recommended that agencies ensure that their acquisition offices are involved in identifying IT acquisitions and issuing related guidance, and that IT acquisitions are reviewed in accordance with OMB guidance. OMB and the majority of the agencies generally agreed with or did not comment on the recommendations. As of November 2018, 27 of the recommendations had not been implemented. Agencies Have Made Progress in Consolidating Data Centers, but Need to Take Action to Achieve Planned Cost Savings In our February 2017 high-risk update, we stressed that OMB and agencies needed to demonstrate additional progress on achieving data center consolidation savings in order to improve the management of IT acquisitions and operations. Further, data center consolidation efforts are key to implementing FITARA. Specifically, OMB established the FDCCI in February 2010 to improve the efficiency, performance, and environmental footprint of federal data center activities. The enactment of FITARA in 2014 codified and expanded the initiative. In addition, in August 2016, OMB issued a memorandum which established the Data Center Optimization Initiative (DCOI) and included guidance on how to implement the data center consolidation and optimization provisions of FITARA. Among other things, the guidance required agencies to consolidate inefficient infrastructure, optimize existing facilities, improve their security posture, and achieve cost savings. According to agencies, data center consolidation and optimization efforts have resulted in approximately $4.5 billion in cost savings through 2018. However, additional work remains to fully carry out the initiative. Specifically, in a series of reports that we issued from July 2011 through May 2018, we noted that, while data center consolidation could potentially save the federal government billions of dollars, weaknesses existed in several areas, including agencies’ data center consolidation plans, data center optimization, and OMB’s tracking and reporting on related cost savings. In these reports, we made a total of 160 recommendations to OMB and 24 agencies to improve the execution and oversight of the initiative. Most agencies and OMB agreed with our recommendations or had no comments. As of November 2018, 47 of these 160 recommendations remained unimplemented. In addition, in a draft report on data center optimization that we have provided to the agencies for comment and plan to issue in early 2019, our preliminary results indicate that agencies continued to report mixed progress toward achieving OMB’s goals for closing data centers and realizing the associated savings by September 2018. Specifically, as of August 2018, over half of the agencies reported that they had met, or planned to meet, all of their OMB-assigned closure goals for tiered data centers by the deadline. However, 6 agencies reported that they did not plan to meet their goals for tiered data centers. In addition, as of August 2018, 11 agencies reported that they had already met the goal for closing 60 percent of their non-tiered centers, 3 agencies reported that they planned to meet the goal by the end of fiscal year 2018, and 9 agencies reported that they did not plan to meet the goal by the end of fiscal year 2018. In all, the 24 agencies reported a total of 6,250 data center closures as of August 2018, which represented about half of the total reported number of federal data centers. In addition, the agencies reported 1,009 planned closures by the end of fiscal year 2018, with an additional 191 closures planned through fiscal year 2023, for a total of 1,200 further closures. Further, in August 2018, 22 agencies reported that they had achieved $1.94 billion in cost savings for fiscal years 2016 through 2018, while 2 agencies reported that they had not achieved any savings. In addition to that amount, 21 agencies identified a further $0.42 billion in planned savings through fiscal year 2018—for a total of $2.36 billion in planned cost savings from fiscal years 2016 through 2018. Nevertheless, this total is about $0.38 billion less than OMB’s goal of $2.74 billion for overall DCOI savings. Agencies Need to Better Manage Software Licenses to Achieve Savings In our 2015 high-risk report’s discussion of IT acquisitions and operations, we identified the management of software licenses as an area of concern, in part because of the potential for cost savings. Federal agencies engage in thousands of software licensing agreements annually. The objective of software license management is to manage, control, and protect an organization’s software assets. Effective management of these licenses can help avoid purchasing too many licenses, which can result in unused software, as well as too few licenses, which can result in noncompliance with license terms and cause the imposition of additional fees. As part of its PortfolioStat initiative, OMB has developed a policy that addresses software licenses. This policy requires agencies to conduct an annual, agency-wide IT portfolio review to, among other things, reduce commodity IT spending. Such areas of spending could include software licenses. In May 2014, we reported on federal agencies’ management of software licenses and determined that better management was needed to achieve significant savings government-wide. Of the 24 selected agencies we reviewed, only 2 had comprehensive policies that included the establishment of clear roles and central oversight authority for managing enterprise software license agreements, among other things. Of the remaining 22 agencies, 18 had policies that were not comprehensive, and 4 had not developed any policies. Further, we found that only 2 of the 24 selected agencies had established comprehensive software license inventories, a leading practice that would help them to adequately manage their software licenses. The inadequate implementation of this and other leading practices in software license management was partially due to weaknesses in agencies’ policies. As a result, we concluded that agencies’ oversight of software license spending was limited or lacking, thus potentially leading to missed savings. However, the potential savings could be significant considering that, in fiscal year 2012, 1 major federal agency reported saving approximately $181 million by consolidating its enterprise license agreements, even when its oversight process was ad hoc. Accordingly, we recommended that OMB issue a directive to help guide agencies in managing software licenses. We also made 135 recommendations to the 24 agencies to improve their policies and practices for managing licenses. Among other things, we recommended that the agencies regularly track and maintain a comprehensive inventory of software licenses and analyze the inventory to identify opportunities to reduce costs and better inform investment decision making. Most agencies generally agreed with the recommendations or had no comments. As of December 2018, 27 of the 135 recommendations had not been implemented. Table 2 reflects the extent to which the 24 agencies implemented the recommendations in these two areas. Agencies Need to Address Shortcomings in Information Security Area Since information security was added to the high-risk list in 1997, we have consistently identified shortcomings in the federal government’s approach to cybersecurity. In particular, in a September 2018 report, we identified four major cybersecurity challenges: (1) establishing a comprehensive cybersecurity strategy and performing effective oversight, (2) securing federal systems and information, (3) protecting cyber critical infrastructure, and (4) protecting privacy and sensitive data. To address these challenges, we identified 10 critical actions that the federal government and other entities need to take. For example, in order to address the challenge of securing federal systems and information, we identified 3 actions that the agencies should take: (1) improve implementation of government-wide cybersecurity initiatives, (2) address weaknesses in federal information security programs, and (3) enhance the federal response to cyber incidents. Figure 6 depicts the 10 critical actions to address the four major cybersecurity challenges. As we have previously noted, in order to strengthen the federal government’s cybersecurity posture, agencies should fully implement the information security programs required by FISMA. In this regard, FISMA provides a framework for ensuring the effectiveness of information security controls for federal information resources. The law requires each agency to develop, document, and implement an agency-wide information security program. Such a program should include risk assessments; the development and implementation of policies and procedures to cost- effectively reduce risks; plans for providing adequate information security for networks, facilities, and systems; security awareness and specialized training; the testing and evaluation of the effectiveness of controls; the planning, implementation, evaluation, and documentation of remedial actions to address information security deficiencies; procedures for detecting, reporting, and responding to security incidents; and plans and procedures to ensure continuity of operations. Since fiscal year 2010, we have made over 3,000 recommendations to agencies aimed at addressing the four cybersecurity challenges. These recommendations have identified actions for agencies to take to strengthen technical security controls over their computer networks and systems. They also have included recommendations for agencies to fully implement aspects of their information security programs, as mandated by FISMA. Nevertheless, many agencies continue to be challenged in safeguarding their information systems and information, in part, because many of these recommendations have not been implemented. Of the roughly 3,000 recommendations made since 2010, 73 percent had been implemented as of November 2018; leaving 688 recommendations unimplemented. Agencies’ Inspectors General Are to Identify Information Security Program Weaknesses In order to determine the effectiveness of the agencies’ information security programs and practices, FISMA requires federal agencies’ inspectors general to conduct annual independent evaluations. The agencies are to report the results of these evaluations to OMB, and OMB is to summarize the results in annual reports to Congress. In these evaluations, the inspectors general are to frame the scope of their analyses, identify key findings, and detail recommendations to address the findings. The evaluations also are to capture maturity model ratings for their respective agencies. Toward this end, in fiscal year 2017, the inspector general community, in partnership with OMB and DHS, finalized a 3-year effort to create a maturity model for FISMA metrics. The maturity model aligns with the five function areas in the NIST Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework): identify, protect, detect, respond, and recover. This alignment is intended to help promote consistent and comparable metrics and criteria and provide agencies with a meaningful independent assessment of their information security programs. The maturity model is designed to summarize the status of agencies’ information security programs on a five-level capability maturity scale. The five maturity levels are defined as follows: Level 1 Ad-hoc: Policies, procedures, and strategy are not formalized; activities are performed in an ad-hoc, reactive manner. Level 2 Defined: Policies, procedures, and strategy are formalized and documented but not consistently implemented. Level 3 Consistently Implemented: Policies, procedures, and strategy are consistently implemented, but quantitative and qualitative effectiveness measures are lacking. Level 4 Managed and Measurable: Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategy are collected across the organizations and used to assess them and make necessary changes. Level 5 Optimized: Policies, procedures, and strategy are fully institutionalized, repeatable, self-generating, consistently implemented and regularly updated based on a changing threat and technology landscape and business/mission needs. In March 2018, OMB issued its annual FISMA report to Congress, which showed the combined results of the inspectors general’s fiscal year 2017 evaluations. Based on data from 76 agency inspector general and independent auditor assessments, OMB determined that the government-wide median maturity model ratings across the five NIST Cybersecurity Framework areas did not exceed a level 3 (consistently implemented). Table 3 shows the inspectors general’s median ratings for each of the NIST Cybersecurity Framework areas. OMB Requires Agencies to Meet Targets for Cybersecurity Metrics In its efforts toward strengthening the federal government’s cybersecurity, OMB also requires agencies to submit related cybersecurity metrics as part of its Cross-Agency Priority goals. In particular, OMB developed the IT modernization goal so that federal agencies will be able to build and maintain more modern, secure, and resilient IT. A key part of this goal is to reduce cybersecurity risks to the federal mission through three strategies: manage asset security, protect networks and data, and limit personnel access. The key targets supporting each of these strategies correspond to areas within the FISMA metrics. Table 4 outlines the strategies, their associated targets, and the 23 civilian CFO Act agencies’ progress in meeting those targets, as of June 2018. In conclusion, FITARA and FISMA present opportunities for the federal government to address the high-risk areas on improving the management of IT acquisitions and operations and ensuring the security of federal IT, thereby saving billions of dollars. Most agencies have taken steps to execute key IT management and cybersecurity initiatives, including implementing CIO responsibilities, requiring CIO reviews of IT acquisitions, realizing data center consolidation cost savings, managing software assets, and complying with FISMA requirements. The agencies have also continued to address the recommendations that we have made over the past several years. However, further efforts by OMB and federal agencies to implement our previous recommendations would better position them to improve the management and security of federal IT. To help ensure that these efforts succeed, we will continue to monitor agencies’ efforts toward implementing the recommendations. Chairmen Meadows and Hurd, Ranking Members Connolly and Kelly, and Members of the Subcommittees, this completes my prepared statement. I would be pleased to respond to any questions that you may have. GAO Contacts and Staff Acknowledgments If you or your staff have any questions about this testimony, please contact Carol C. Harris, Director, Information Technology, at (202) 512- 4456 or harriscc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. GAO staff who made key contributions to this testimony are Kevin Walsh (Assistant Director), Chris Businsky, Rebecca Eyler, Meredith Raymond, and Jessica Waselkow (Analyst in Charge). This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.


Background International Safety Management (ISM) Code and Safety Management System (SMS) Requirements The ISM Code was established to provide an international standard for the safe management and operation of ships and for pollution prevention. The code establishes safety management objectives, such as preventing human injury or loss of life, and identifies a framework of key elements required to be considered for inclusion in an SMS. According to the ISM Code, each vessel operator should develop, implement, and maintain an SMS that is to include functional requirements, such as procedures to prepare for and respond to emergency situations. An SMS is typically not a single plan and can take different forms. It is up to the vessel operator to determine how best to operationalize these requirements. The SMS plan documents generally contain proprietary information and are not retained by the Coast Guard or the ROs performing services on the Coast Guard’s behalf. Key Entities Involved in Vessel SMS Activities There are three key entities involved in vessel SMS activities—vessel operators, ROs, and the U.S. Coast Guard. These entities’ SMS responsibilities are described below. Vessel Operators Vessel operators are responsible for developing an SMS in accordance with ISM Code requirements if they operate U.S-flagged vessels that are subject to the ISM Code, such as a vessel engaged in a foreign voyage that is carrying more than 12 passengers, or a tanker or freight vessel of at least 500 gross tons, among other vessel types. Vessel operators are required to perform an internal audit of their company’s SMS each year to ensure it is being implemented effectively. Vessel operators are also responsible for obtaining the requisite evidence that the company and each of its applicable vessels are in compliance with the ISM Code. In practice, this means that the vessel operators obtain certification from ROs, which are described below. According to the Coast Guard, there were approximately 1,170 U.S.-flagged vessels that maintained SMS certifications in 2019. Recognized Organizations An RO refers to an international classification society authorized by the Coast Guard to conduct applicable vessel oversight and certification services on its behalf. The Coast Guard has authorized several ROs to conduct SMS audits and issue applicable certificates, but over 95 percent of these vessel oversight and compliance activities are conducted by a single RO, the American Bureau of Shipping. ROs have to meet specific requirements for authorization, such as making information about vessel class and inspections available to the Coast Guard. In order to be authorized, the RO needs to have been an international classification society for 30 years and have a history of taking appropriate corrective actions in addressing, among other things, vessel deficiencies. ROs are to conduct the following SMS activities on the Coast Guard’s behalf: review SMS documents and conduct initial company and vessel audits to verify compliance with the ISM Code and applicable national and international requirements; issue a Document of Compliance to the vessel operator and a Safety Management Certificate for the vessel, which is valid for up to 5 years; conduct annual SMS compliance audits of the vessel operator; conduct an intermediate SMS compliance audit for the vessel at least once during the 5-year period; and conduct renewal SMS compliance audits of vessel operator and vessel(s) prior to expiration of the 5-year certificate. U.S. Coast Guard The U.S. Coast Guard is ultimately responsible for guaranteeing the effectiveness of SMS compliance activities and audits that ROs perform on its behalf. The Coast Guard’s oversight activities of ROs are conducted by the Office of Commercial Vessel Compliance. This office oversees a range of different activities to help ensure SMS compliance with the ISM Code and applicable federal regulations. Such activities include managing the commercial vessel inspection program, developing related guidance, and overseeing SMS audits and related activities performed by ROs. In addition to oversight provided by officials at Coast Guard headquarters, marine inspectors within local Coast Guard field units are also responsible for conducting vessel inspections, which routinely include assessing SMS effectiveness for applicable vessels. The Coast Guard Verifies SMS Compliance through Recurrent Vessel Inspections and Has Initiated Additional Oversight of Third Parties The Coast Guard Verifies SMS Compliance through Recurrent Inspections of Applicable U.S.-Flagged Vessels The Coast Guard verifies SMS compliance as part of its overall vessel compliance activities, such as conducting annual inspections of applicable U.S.-flagged vessels. According to the Coast Guard, recurrent vessel inspections are important opportunities for its marine inspectors to verify the effectiveness of the vessels’ SMS, even if SMS oversight is not the primary purpose of the vessel inspections. When conducting an annual vessel inspection, Coast Guard marine inspectors are to look for material deficiencies, such as poor condition of vessel structures, missing or defective equipment, or hazardous conditions that could indicate a potential SMS nonconformity. According to Coast Guard officials, marine inspectors routinely review the Coast Guard’s internal database for a record of any past deficiencies and are to inspect the vessel’s SMS documentation to determine if the Safety Management Certificate is up- to-date and the drill logs are current, among other things. The Coast Guard advises vessel operators to self-report or, in other words, proactively manage their vessels and report any deficiencies identified by the vessel’s crew and report them at the beginning of any Coast Guard inspection. When conducting an annual vessel inspection, Coast Guard marine inspectors are to follow a five-step process to identify any SMS-related deficiencies, determine if there are clear grounds for an expanded vessel inspection, and specify any applicable compliance options. The process requires distinguishing between normal wear and tear to the vessel and deficiencies that could be the result of failures to implement an effective SMS. (See appendix II for further details on this five-step process.) A more in-depth inspection, if warranted, may include a review of maintenance schedules and records, crew training records and certifications, emergency procedures, and associated interviews with the vessel master and crew. Marine inspectors are to record any identified deficiencies on a Form 835V, which specifies the time frames and procedures required to address the identified deficiencies. See figure 1 for a blank copy of the Form 835V. The Coast Guard uses a range of options for addressing SMS-related deficiencies. Some deficiencies, such as improperly secured wiring or missing documentation, can sometimes be corrected by the vessel’s crew during the course of a Coast Guard inspection. According to Coast Guard guidance, if marine inspectors identify serious deficiencies that could indicate broader SMS failures, such as an absence of required equipment or failure by the company to notify the Coast Guard of reportable marine casualties and hazards, the inspectors record an SMS-related deficiency and require an internal SMS audit. An internal SMS audit is for technical or operational deficiencies that individually or collectively do not warrant the detention of the vessel but indicate a failure or lack of effectiveness of the SMS. The internal SMS audit and any corrective actions are to be completed by the vessel operator within three months from the date of the Coast Guard vessel inspection. If during the course of a vessel inspection Coast Guard inspectors observe more serious deficiencies or failures, such as defective or missing fire-fighting or life-saving equipment, the vessel is to be detained and an external audit is to be performed by the RO prior to the vessel being released from detention. Figure 2 shows the Coast Guard’s process for ensuring SMS compliance during vessel inspections. The Coast Guard Conducts Additional SMS Oversight of Vessels Designated as Higher Risk In addition to the annual vessel inspections it conducts, the Coast Guard also maintains a list of vessels that require additional oversight, referred to as the “fleet risk index.” The Coast Guard Office of Commercial Vessel Compliance evaluates vessels enrolled in the Alternate Compliance Program and the Maritime Security Program to develop the fleet risk index using modeling that considers and weighs multiple risk factors to assign each vessel a risk score. This list is used internally by Coast Guard inspectors when prioritizing vessels for additional oversight and more frequent inspections. Assessed risk factors include vessel detentions, marine violations/enforcement actions, vessel deficiencies, vessel type, and vessel age, among others. According to Coast Guard officials, the Coast Guard uses the fleet risk index to identify approximately 50 vessels each year that are subject to inspections every 6 months rather than annually. In 2018, the Coast Guard stipulated that traveling inspectors would accompany the local inspection team to conduct all inspections aboard vessels designated for additional oversight. According to Coast Guard officials, traveling inspectors have additional training and inspection expertise, including supplemental coursework in auditing and quality management systems, and they routinely conduct additional background research on these vessels prior to participating in the inspections. Results of the Coast Guard’s Vessel SMS Compliance Activities for 2018 and 2019 Based, in part, on recommendations in the EL FARO investigative report, in 2018 the Coast Guard took steps to improve its management of the Alternate Compliance Program, including efforts to improve data reporting. For example, the Coast Guard revised its form for documenting deficiencies during annual vessel inspections. In particular, since March 2018, the Form 835V has included a checkbox to indicate if a deficiency is related to an SMS. According to the Coast Guard, this revision will allow for enhanced annual reporting of safety-related deficiencies identified during compliance activities. The Coast Guard reported it conducts approximately 1,200 inspections each year of vessels that are either required to maintain a Safety Management Certificate, or do so voluntarily. According to the Coast Guard, in calendar year 2018, the Coast Guard issued between 70 and 130 SMS-related deficiencies (reporting available for April through December only), and for calendar year 2019, the Coast Guard issued between 183 and 212 SMS-related deficiencies. Given the limited data and time frames available, we were not able to identify any trends regarding SMS deficiencies. However, we noted that the highest number of safety-related deficiencies cited in 2019 were related to maintenance of vessels and equipment—43 of the 212 annual deficiencies. The second-highest number of deficiencies addressed issues related to emergency preparedness—37 of the 212 annual deficiencies. Some specific examples in this category relate to the posting of applicable emergency instructions and providing updated records of emergency drills. According to Coast Guard headquarters officials, the Coast Guard plans to review and assess the SMS deficiency data to provide feedback to inspectors, vessel operators, and ROs. The officials also stated that SMS deficiencies will be included in future risk-based vessel inspection programs, including the fleet risk index discussed earlier. The Coast Guard Has Initiated Efforts to Enhance Its Oversight of ROs Since 2018 Following the investigative reports of the EL FARO sinking, the Coast Guard initiated several efforts in 2018 to enhance oversight of the ROs that perform SMS-related services and certifications on its behalf. These efforts were largely driven by actions identified by the Commandant of the Coast Guard in December 2017 in response to EL FARO investigative report recommendations. In particular, the Coast Guard established a new group to monitor ROs, developed new SMS-related guidance and associated work instructions, increased direct observations of ROs, developed key performance indicators, and developed guidance to request internal investigations for certain RO deficiencies. It is too early for us to assess the overall effectiveness of these Coast Guard efforts; however, we believe they are positive steps toward enhancing oversight of ROs. Further information on each of these efforts is provided in the sections that follow. Established a new group within the Office of Commercial Vessel Compliance. The Coast Guard established a new group within its Office of Commercial Vessel Compliance in 2018 to help monitor the global performance of the U.S.-flagged fleet, provide enhanced oversight of ROs performing vessel safety management functions, and implement any necessary changes to related roles and responsibilities. Developed SMS-related guidance and work instructions. The Office of Commercial Vessel Compliance developed several new work instructions to help inform mariners, the public, the Coast Guard, and other federal and state regulators in applying SMS-related statutory and regulatory requirements. The following are examples of applicable guidance issued since 2018: CVC-WI-003(1): USCG Oversight of Safety Management Systems on U.S. Flag Vessels (March 23, 2018). This document contains guidance for assessing the effectiveness of the SMS on U.S.-flagged vessels, including directions for evaluating potential deficiencies and compliance options during the course of a vessel inspection. CVC-WI-004(1): U.S. Flag Interpretations on the ISM Code (April 16, 2018). This document provides guidance regarding the Coast Guard’s interpretations on the application and implementation of the ISM Code. Increased the number of Coast Guard direct observations of ROs performing vessel and company audits. The Coast Guard reported it has increased the number of direct observations of ROs conducting vessel and company SMS audits since 2018. According to the Coast Guard, audit observations aboard vessels are routinely performed by traveling inspectors. Additionally, staff from the new Commercial Vessel Compliance group are observing an increased number of company audits. This group has eight staff available for direct observations of ROs, all of whom have received training in international auditing and safety management standards. The Coast Guard reported that the number of audit observations attended by the Commercial Vessel Compliance staff increased from three in 2018 to 21 in 2019. According to the Coast Guard, these additional observations serve as a mechanism to provide increased oversight of the ROs and the companies or vessels being audited, as well as to verify that the services provided by ROs are effectively executed in accordance with established requirements. Developed key performance indicators for assessing ROs. In mid- 2018, Coast Guard officials identified 10 key performance indicators to be used to evaluate the performance of ROs. Due, in part, to challenges with collecting and synthesizing the requested data from the different ROs, the Coast Guard reported on limited performance information in the 2018 Domestic Annual Report. According to Coast Guard officials, the Coast Guard is working with each of the ROs and the International Association of Classification Societies to standardize the key performance indicator data to better integrate the data into the Coast Guard’s data system. The Coast Guard said that it plans to include a subset of the key performance indicators in its 2019 annual report, which is scheduled for issuance in April 2020. See appendix III for more information on these key performance indicators. Developed guidance for ROs on “quality cases.” In May 2018, the Coast Guard also issued guidance that describes a new oversight mechanism, referred to as a “quality case.” If a Coast Guard marine inspector observes evidence during the course of a vessel inspection that an RO is not adequately performing its required SMS-related functions, the Coast Guard can request that the RO conduct a root-cause analysis to help identify the underlying issue(s). This analysis would generally involve the RO evaluating its quality management system and reporting findings and corrective actions to the Coast Guard. From May 2018 to November 2019, the Coast Guard reported it initiated 13 quality cases; one of which was SMS-related. Vessel SMS Plans Address Some of the Potential Shipboard Emergencies and Response Procedures Proposed by Coast Guard Guidance Each of the 12 SMS plans (or plan excerpts) for U.S.-flagged vessels that we reviewed identify potential shipboard emergencies and applicable response procedures, but they do not address the full range of emergency scenarios included in Coast Guard guidance. While the 12 SMS plans do not address all potential emergencies included in Coast Guard guidance, the plans do address the broad, functional requirement to identify potential shipboard emergencies and applicable response procedures to address them, as required by the ISM Code and applicable federal regulations. In reviewing the 12 SMS plans, we also found variation among the specific scope and formats of the emergency preparedness sections. Four of the 12 SMS plans are large documents spanning hundreds of pages that incorporate various component manuals. For example, one vessel operator provided a comprehensive SMS plan document of nearly 600 pages that includes six different procedural manuals covering the following issues: Management, Vessel, Safety, Environmental, Cargo Operations, and Emergency Response. For the other eight SMS plans we reviewed, the vessel operators provided us with either a stand-alone manual specifically addressing shipboard emergency preparedness and response procedures, or individual chapters and excerpts that included this information. According to Coast Guard and RO officials, the ISM Code does not require a specific format or level of detail for SMS plans and, rather, allows vessel operators flexibility to choose how they will implement and document SMS requirements based on their specific operations and business processes. In addition to reviewing the SMS plans for content and format, we also reviewed each of the 12 SMS plans (or excerpts) to determine the extent to which they address 21 different potential shipboard emergencies identified in 2018 Coast Guard guidance related to the application and implementation of the ISM Code (see table 1). The number of unique, potential shipboard emergency scenarios addressed in the SMS plan documents we reviewed generally range from five to 16. Ship routing procedures related to heavy weather, which is an emergency scenario highlighted in the EL FARO investigative report, is clearly identified in five of the 12 SMS plans reviewed. However, one additional SMS plan makes reference to a separate heavy weather plan that was not included in the primary SMS plan documents that we reviewed. The most frequently addressed shipboard emergency scenarios—that are addressed in at least 10 of the 12 SMS plans we reviewed—are Fire, Collision, Grounding, Abandon Ship, and Man Overboard. In addition, 10 of the 12 SMS plans we reviewed also identify additional potential emergency shipboard scenarios not included in the 2018 Coast Guard guidance, such as breakaway from dock, emergency towing, or confined space rescue. While none of the SMS plans that we reviewed specifically address all 21 potential shipboard emergencies identified in the 2018 Coast Guard guidance, the guidance states that it is not a substitute for applicable legal requirements, nor is it itself a rule. According to officials from the two ROs with whom we discussed this program, their auditors are provided the 2018 Coast Guard guidance to use as part of their SMS audit criteria. The officials noted, however, that their auditors may be limited to issuing an “observation” to the vessel operator if any potential shipboard emergency listed in Coast Guard guidance is not addressed in SMS plan documents. Under the ISM Code, an “observation” is not the same as an SMS “nonconformity,” which would require specific corrective action. Officials from one RO noted that any nonconformities identified would need to be based on specified mandatory requirements, such as ISM Code provisions, U.S. statutes, or applicable U.S. or international regulations, and not solely on the 2018 Coast Guard guidance. In addition to the fact that the emergencies listed in the guidance are not required to be included in SMS plans, there are other factors to explain why the SMS plans we reviewed may not address all 21 potential shipboard emergency scenarios identified in the 2018 Coast Guard guidance. Such factors include the following: Size and nature of vessel operations. According to RO and Coast Guard officials, not all of the 21 potential shipboard emergency scenarios contained in the 2018 Coast Guard guidance are applicable for each type of vessel or for all geographical operating areas. For example, specific emergency procedures related to piracy or terrorism, cargo-related accidents, helicopter rescue operations, or loss of key personnel may not be necessary for towing vessels, given the nature of their operations, their limited size, and the reduced number of crew required to operate that type of vessel. Similarly, icing conditions would not be expected to be included in the SMS plans for those vessels that operate solely in temperate waters. Additional time may be needed to incorporate expanded potential shipboard emergency scenarios into existing SMS plans. Although the Coast Guard guidance identifying the 21 potential shipboard emergency scenarios was issued in April 2018, vessel operators may still be in the process of revising their SMS plans to include additional potential shipboard emergency scenarios and applicable emergency response procedures. For example, we observed that six of the 21 scenarios included in the 2018 Coast Guard guidance are not listed in related guidance provided by the International Association of Classification Societies. These six scenarios are among those observed with the lowest frequency during our review of SMS plans. It is feasible that information related to these scenarios—such as loss of key personnel, or loss of communications with a vessel—may exist elsewhere in vessel operators’ SMS documents or in other vessel plans, but not incorporated as potential shipboard emergency response scenarios as proposed in the 2018 Coast Guard guidance. Along these lines, officials from the ROs with whom we spoke also noted that, in accordance with the ISM Code, they routinely use a sampling approach when conducting annual company SMS audits, and would generally not review the entire scope of an SMS plan each year. As a result of the sampling process, the annual audits occurring since April 2018 may not have addressed any potential “observations” related to the expanded scope of potential shipboard emergencies included in the Coast Guard guidance for SMS plans. As noted previously, the ISM Code and corresponding U.S. regulations and Coast Guard guidance allow vessel operators flexibility in how they address SMS functional requirements, including the documentation of potential shipboard emergencies and applicable response procedures in their SMS plans. Following the EL FARO incident, in 2018 the Coast Guard developed guidance to help inform vessel operators and ROs of potential shipboard emergency scenarios to consider. However, similar to the SMS-compliance and oversight practices used by comparable agencies in other developed countries, we found that the Coast Guard does not have a direct role in reviewing or approving vessel SMS plan documents, including response procedures for potential shipboard emergency scenarios. Rather, as described earlier, the Coast Guard relies on periodic vessel inspections and oversight of ROs that perform more rigorous ISM audits on the Coast Guard’s behalf. Although the Coast Guard has taken positive steps since 2018 to develop additional guidance and increase the number of observations of RO audits and inspections, the extent to which these efforts will result in any specific changes to the content of SMS plans by vessel operators in the future is yet to be determined. Agency Comments We requested comments on a draft of this report from DHS and the Coast Guard. Officials from the Coast Guard provided technical comments, which we incorporated into the report as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Homeland Security, the U.S. Coast Guard, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (206) 287-4804 or AndersonN@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Key contributors to this report are listed in appendix IV. Appendix I: Key Roles and Responsibilities of Recognized Organizations Related to Safety Management Systems Federal regulations allow the Commandant of the Coast Guard to delegate certain functions to authorized classification societies. In order for a classification society to be recognized by the Coast Guard and receive statutory authority to carry out delegated functions as a Recognized Organization (RO), the classification society must meet certain requirements, including having functioned as an international classification society for at least 30 years and having established a history of appropriate corrective actions in addressing vessel casualties and deficiencies, among other things. With respect to safety management systems (SMS), ROs—once authorized by the Coast Guard—are able to perform SMS-related audits and issue SMS-related certifications and documentation. The following information summarizes the key roles and responsibilities of ROs related to International Safety Management (ISM) Code certification services and the key activities that ROs perform to fulfill their delegated SMS compliance functions on behalf of the Coast Guard. Interim verification. When a new company (i.e., vessel owner/operator) is established, or an existing company wants to add a new vessel type to its current Document of Compliance, the RO is to first verify that the company has an SMS that complies with ISM Code requirements. If the RO determines that the company is in compliance, it issues the company an interim Document of Compliance (which applies to the entire company) that is valid for up to 12 months. Initial verification. After receiving an interim Document of Compliance, a company applies for ISM Code certification, and an RO conducts an SMS audit of the company’s shoreside management system that is to include a visit to the company’s physical offices. Following the satisfactory completion of the audit and verification that the company’s SMS has been in operation for at least 3 months, the RO would issue the company a Document of Compliance that is valid for 5 years. After the RO issues the Document of Compliance, the RO is to verify that the company’s SMS has been functioning effectively for at least 3 months for each of the vessels for which the company is seeking a Safety Management Certificate. A Safety Management Certificate is vessel- specific and may only be issued to a vessel if the company holds a valid Document of Compliance. To perform the initial verification, the RO is to assess each vessel to determine if the company’s SMS is being employed effectively on that vessel. Annual or intermediate verification. The RO is responsible for verifying a company’s Document of Compliance every year and for verifying the company’s Safety Management Certificates at least once during the 5- year period covered by the issued certificates. ROs generally verify Safety Management Certificates between 2 and 3 years after their issuance. Annual and intermediate verifications are opportunities for the RO to verify whether the company has taken appropriate actions to sufficiently address any deficiencies the RO may have identified during previous audits. Renewal verification. Up to 3 months before a company’s Document of Compliance or a vessel’s Safety Management Certificate expires, the RO is to conduct a renewal verification. The renewal verification is to address all elements of the SMS, including activities required under the ISM code. Additional Verification. The Coast Guard may also require additional verification to ensure that an SMS is functioning effectively—for example, to make sure that the company has sufficiently implemented appropriate corrective actions to address any identified deficiencies. Appendix II: Coast Guard’s Process for Evaluating Safety Management System Deficiencies and Corrective Action Options This appendix provides summary information on the Coast Guard’s process for evaluating safety management system (SMS) deficiencies and corrective action options if a Coast Guard marine inspector identifies any SMS-related deficiencies during a vessel inspection. Appendix III: Key Performance Indicators for Assessing Recognized Organizations In mid-2018, Coast Guard officials identified 10 key performance indicators to be used to evaluate the performance of Recognized Organizations (RO). Information on these 10 performance indicators is summarized below. 1: Number of RO-issued statutory findings divided by the number of statutory surveys conducted (e.g., 100 findings / 10 surveys = 10 Key Performance Indicators). 2: Number of RO Safety Management Certificate audit findings divided by the number of Safety Management Certificate audits conducted 3: Number of RO Document of Compliance audit findings divided by the number of Document of Compliance audits conducted (includes all types of Document of Compliance audits). 4: Number of RO associations to Port State Control Detentions under the Paris and Tokyo Memoranda of Understanding, and Coast Guard Port State Control programs. 5: Number of International Association of Classification Societies Procedural Requirement-17s (IACS PR-17) issued divided by the total number of RO applicable surveys conducted. 6: Total number of U.S. commercial vessel casualties divided by the total number of commercial vessels in the U.S. fleet of responsibility. 7: Total number of RO nonconformities issued by the Coast Guard divided by the number of statutory surveys and International Safety Management (ISM) audits conducted. 8: Total number of Coast Guard-issued deficiencies related to statutory certificates divided by the total number of Coast Guard inspections conducted. 9: Total number of RO-associated Flag State Detentions divided by the total number of statutory surveys and audits performed. 10: Number of Coast Guard-issued ISM-related deficiencies divided by the total number of Coast Guard inspections completed. Appendix IV: GAO Contact and Staff Acknowledgments GAO Contact Acknowledgments Nathan Anderson, (206) 287-4804 or AndersonN@gao.gov In addition to the contact named above, Christopher Conrad (Assistant Director), Ryan Lambert (Analyst-in-Charge), Ben Nelson, Elizabeth Dretsch, Tracey King, Kevin Reeves, and Benjamin Crossley made key contributions to this report.