NASA Information Technology: Urgent Action Needed to Address Significant Management and Cybersecurity Weaknesses

NASA depends heavily upon IT to conduct its work. The agency spends at least $1.5 billion annually on IT investments that support its missions, including ground control systems for the International Space Station and space exploration programs.

The National Aeronautics and Space Administration Transition Authorization Act of 2017 included a provision for GAO to review the effectiveness of NASA's approach to overseeing and managing IT, including its ability to ensure that resources are aligned with agency missions and are cost effective and secure. Accordingly, GAO's specific objective for this review was to determine the extent to which NASA has established and implemented leading IT management practices in strategic planning, workforce planning, governance, and cybersecurity. To address this objective, GAO compared NASA IT policies, strategic plans, workforce gap assessments, and governance board documentation to federal law and leading practices. GAO also assessed NASA IT security plans, policies, and procedures against leading cybersecurity risk management practices.

The National Aeronautics and Space Administration (NASA) has not yet effectively implemented leading practices for information technology (IT) management. Specifically, GAO identified weaknesses in NASA's IT management practices for strategic planning, workforce planning, governance, and cybersecurity.

NASA has not documented its IT strategic planning processes in accordance with leading practices. While NASA's updated IT strategic plan represents improvement over its prior plan, the updated plan is not comprehensive because it does not fully describe strategies for achieving desired results or describe interdependencies within and across programs. Until NASA establishes a comprehensive IT strategic plan, it will lack critical information needed to align resources with business strategies and investment decisions.

Of the eight key IT workforce planning activities, the agency partially implemented five and did not implement three. For example, NASA does not assess competency and staffing needs regularly or report progress to agency leadership. Until NASA implements the key IT workforce planning activities, it will have difficulty anticipating and responding to changing staffing needs.

NASA's IT governance does not fully address leading practices. While the agency revised its governance boards, updated their charters, and acted to improve governance, it has not fully established the governance structure, documented improvements to its investment selection process, fully implemented investment oversight practices and ensured the Chief Information Officer's visibility into all IT investments, or fully defined policies and procedures for IT portfolio management. Until NASA addresses these weaknesses, it will face increased risk of investing in duplicative investments or may miss opportunities to ensure investments perform as intended.

NASA has not fully established an effective approach to managing agency-wide cybersecurity risk. An effective approach includes establishing executive oversight of risk, a cybersecurity risk management strategy, an information security program plan, and related policies and procedures.

As NASA continues to collaborate with other agencies and nations and increasingly relies on agreements with private companies to carry out its missions, the agency's cybersecurity weaknesses make its systems more vulnerable to compromise. Until NASA leadership fully addresses these leading practices, its ability to ensure effective management of IT across the agency and manage cybersecurity risks will remain limited.

GAO is making 10 recommendations to NASA to address the deficiencies identified in NASA IT strategic planning, workforce planning, governance, and cybersecurity. NASA concurred with seven recommendations, partially concurred with two, and did not concur with one. GAO maintains that all of the recommendations discussed in this report remain valid.

The National Aeronautics and Space Administration (NASA) exercises  control over aeronautical and space activities sponsored by the United  States and also seeks to encourage the fullest commercial use of space.  NASA’s current and planned activities span a broad range of complex  and technical endeavors, including developing new capabilities to send  future missions to Mars, improving the air transportation experience, and  developing new space transportation systems. These activities may rely  on partnerships with academic, private sector, and international  organizations, including foreign space agencies. In recent years, NASA  also has increasingly relied on other countries and agreements with  private companies to support its missions.

NASA depends heavily upon information technology (IT) to conduct its  work. Since fiscal year 2016, the agency has planned to spend about  $1.5 billion annually on IT investments that support its missions, including  ground control systems for the International Space Station and other  space exploration programs. In addition, the agency has invested in cloud  computing, data center optimization, and IT security capabilities to  support its business operations.

However, we and the NASA Office of Inspector General have reported  that the agency has struggled for more than two decades to overcome its  decentralized operations and culture of autonomy at its major  organizational units, in an attempt to provide effective oversight and  management of its IT environment. Moreover, we and others have  reported on information security concerns. NASA systems are highly  interconnected. The agency is also affected by geopolitics and is  targeted by cybercriminals, including those that may be sponsored by  foreign intelligence services. In addition, entities with whom NASA  collaborates may also be targets of cybercriminals.

The National Aeronautics and Space Administration Transition  Authorization Act of 2017 included a provision for us to review the  effectiveness of NASA’s approach to overseeing and managing IT,  including its ability to ensure that resources are aligned with agency  missions and are cost effective and secure. Our objective for this review  was to address the extent to which NASA has established and  implemented leading IT management practices in strategic planning,  workforce planning, governance, and cybersecurity.

To address this objective, we compared NASA’s IT management policies,  procedures, and documentation to criteria established by federal law and  leading practices.

For our work regarding IT strategic planning, we obtained and  evaluated NASA’s documentation on IT strategic planning, including  its related planning guidance, agency-wide strategic plan, and IT- specific strategic plans. We analyzed its strategic planning guidance  and assessed the contents of the previous and current IT strategic  plans by comparing them to leading practices that we and the Office  of Management and Budget (OMB) have previously identified. These  practices include documenting the IT strategic planning process and  developing a strategic plan that defines the agency’s vision and  provides a road map to help align information resources with business  strategies and investment decisions.

For IT workforce planning, we reviewed documentation, including  NASA’s 2015 draft IT workforce plan, competencies, reported staffing  data, and a workforce gap assessment. We compared this  documentation to eight key IT workforce planning activities that we  previously identified and that were derived from federal law and  guidance, including OMB memorandums, GAO reports, and the Office  of Personnel Management’s (OPM) Human Capital Framework.

Our review of IT governance involved analyzing NASA’s governance  board meeting minutes and briefings, charters, and policies and  procedures, and comparing them to criteria as identified by GAO in  the IT investment management framework. Specifically, we focused  on policies and procedures related to instituting investment boards,  selecting investments, overseeing investments, and developing  investment portfolios.

Regarding cybersecurity, we obtained and analyzed available NASA  documentation to determine the extent to which the agency had  established an effective approach for managing cybersecurity risk.  This documentation included information security policies and  procedures, management briefings and reports, and a draft  information security program plan. We then assessed whether  NASA’s approach addressed foundational cybersecurity risk  management components identified in the National Institute for  Standards and Technology’s (NIST) guidance. These components  included the establishment of a risk executive function, a  cybersecurity risk management strategy, an information security  program plan, and current policies and procedures for relevant  security controls.

In addition to assessing IT management at NASA headquarters, we  reviewed such management practices at two of the agency’s centers and  one mission directorate, focusing on those with the largest fiscal year  2017 IT budgets. In addition, we visited and reviewed IT management  practices for the Goddard Space Flight Center because of the center’s  proximity to GAO. We also interviewed cognizant officials with  responsibilities for IT management at NASA. The results of our work at  the selected NASA centers and mission directorate are not generalizable  to other NASA centers and mission directorates. Additional details on our  objective, scope, and methodology can be found in appendix I.

We conducted this performance audit from May 2017 to May 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective.

NASA’s mission is to drive advances in science, technology, aeronautics,  and space exploration to enhance knowledge, education, innovation,  economic vitality, and stewardship of Earth. The NASA Administrator is  responsible for leading the agency and is accountable for all aspects of its  mission, including establishing and articulating its vision and strategic  priorities and ensuring successful implementation of supporting policies,  programs, and performance assessments.

Within NASA headquarters, the agency has four mission directorates that  define its major core mission work: (1) Aeronautics Research conducts  cutting-edge research to enable revolutionary advances in future aircraft,  as well as in the airspace in which they will fly; (2) Human Exploration and  Operations is responsible for NASA space operations, developing new  exploration and transportation systems, and performing scientific  research; (3) Science carries out the scientific exploration of Earth and  space to expand the frontiers of Earth science, planetary science, and  astrophysics, and (4) Space Technology develops revolutionary  technologies through transparent, collaborative partnerships that expand  the boundaries of aerospace. The agency also has a mission support  directorate to manage its business needs and administrative functions,  such as human capital management.

In addition to NASA headquarters in Washington, D.C., the agency is  composed of nine field centers managed by NASA employees, and one  federally funded research and development center that are responsible  for executing programs and projects. NASA centers are located  throughout the country and manage projects or programs for multiple  mission directorates. For example, the Goddard Space Flight Center  supports various IT programs within the Science mission directorate,  while the Johnson Space Center supports multiple programs in the  Human Exploration and Operations mission directorate.

According to NASA documents, the agency planned to spend $1.6 billion  of its fiscal year 2018 budget authority on IT. Of this total, $888 million  was to be used for business IT and $672.8 million was to be used for  mission IT. Business IT includes the infrastructure and systems needed to  support internal agency operations, such as commodity IT (e.g., e-mail  and communications systems), infrastructure, IT management,  administrative services, and support systems, whereas mission IT  includes the technology needed to support space programs and research  for the agency’s mission programs. The technology that the agency uses  to support its mission programs includes highly-specialized IT, defined by  NASA as any equipment, system, and/or software that is used to acquire,  store, retrieve, manipulate, and/or transmit data or information when the  IT is embedded in a mission platform or provides a platform required for  simulating, executing, or operating a mission.

Historically, NASA and its Inspector General have reported that funding  for and oversight of highly-specialized IT has been decentralized among  mission directorates and embedded within launch programs and other  mission activities instead of being identified as IT to be managed as part  of the agency’s IT portfolio. According to the Inspector General, the  agency’s decentralized funding for and oversight of IT has minimized  agency-wide visibility into and oversight of NASA’s spending on these  systems.

NASA’s IT Management and Governance Structure

The agency’s Chief Information Officer (CIO) reports directly to the NASA  Administrator and serves as the principal advisor to the NASA  Administrator and senior officials on all matters pertaining to IT. The CIO  is to provide leadership, planning, policy direction, and oversight for the  management of NASA’s information and systems. Toward this end, the  CIO’s responsibilities include developing and implementing approaches  for executing the goals and outcomes in the NASA strategic plan;  ensuring that the agency’s human resources possess the requisite  knowledge and skills in IT and information resources management;  maximizing the value of NASA IT investments through an investment  management process; and leading and implementing the agency’s IT  security program. The CIO also is responsible for developing and  implementing agency-wide IT policies and processes.

NASA’s CIO also is to direct, manage, and provide policy guidance and  oversight of the agency’s center CIOs. Each center has a CIO  responsible for supporting center leadership and managing IT staff.

Similarly, each mission directorate has a representative who coordinates  with programs on IT-specific issues and, as needed, obtains support from  the Office of the CIO. Both center CIOs and mission directorate IT  representatives report to the NASA CIO and to the leadership of their  respective centers and mission directorates.

The CIO is supported by staff in the Office of the CIO. This office is  organized into four divisions responsible for (1) IT security, (2) capital  planning and governance, (3) technology and innovation, and (4)  enterprise services and integration. Collectively, these divisions support  NASA’s approach to IT strategic and workforce planning, governance  boards and practices, and cybersecurity.

In March 2017, the Office of the CIO submitted plans to establish a fifth  division focused on new applications, and also to rename existing  divisions to better represent the services they provide. For example, the  Office of the CIO proposed that the Capital Planning and Governance  Division be renamed the IT Business Management Division. As of March  2018, NASA had not yet approved or implemented the planned  reorganization.

Figure 1 depicts the organization of the Office of the CIO, including  relevant reporting relationships for center CIOs and mission directorate IT  representatives, as of March 2018.

GAO and NASA’s Office of Inspector General Have Reported on Longstanding Weaknesses in IT Management

We and NASA’s Office of Inspector General have reported on  longstanding IT management weaknesses within the agency. For  example, in October 2009, we reported that NASA had made progress in  implementing IT security controls and aspects of its information security  program, but that it had not always implemented appropriate controls to  sufficiently protect the confidentiality, integrity, and availability of  information and systems. We also identified control vulnerabilities and  program shortfalls, which, collectively, increased the risk of unauthorized  access to NASA’s sensitive information, as well as inadvertent or  deliberate disruption of its system operations and services. We  recommended that the NASA Administrator take steps to mitigate control  vulnerabilities and fully implement a comprehensive information security  program. The agency concurred with our eight recommendations and  stated that it was taking actions to mitigate the information security  weaknesses identified.

In addition, NASA’s Office of Inspector General has issued 24 reports  over the last 7 years on IT governance and security weaknesses at the  agency. For example, in June 2013, the office reported that the  decentralized nature of NASA’s operations and its longstanding culture of  autonomy had hindered the agency’s ability to implement effective IT  governance. Specifically, the report stated that the CIO had limited  visibility and control over a majority of IT investments, operated in an  organizational structure that marginalized the authority of the position,  and could not enforce security measures across NASA’s computer  networks. Moreover, the IT governance structure in place at the time was  overly complex, did not function effectively, and operated under a  decentralized model that relegated decision making about critical IT  issues to numerous individuals across NASA, leaving such decisions  outside the purview of the CIO.

The Office of Inspector General made eight recommendations to the  NASA Administrator for improving IT governance, including calling for all  governance to be consolidated within the Office of the CIO to ensure  adequate visibility, accountability, and integration into all mission-related  IT assets and activities. The Administrator concurred with six and partially  concurred with two of the recommendations and planned actions  sufficient for the Office of Inspector General to close all eight  recommendations as implemented. However, the Office of Inspector  General later reported that the extent to which NASA had implemented  the agreed-upon changes was in doubt based on subsequent audit  findings that NASA was still struggling with limited agency CIO authority,  decentralized IT operations, and ineffective IT governance.

A follow-on report issued in October 2017 described a continued lack of  progress in improving IT governance, determined that the CIO’s visibility  into investments across the agency continued to be limited, and identified  flaws in the process developed to improve governance. Specifically, the  Office of Inspector General noted that the Office of the CIO had made  changes to its IT governance boards over the past few years, but the  boards had not made strategic decisions to substantively impact how  NASA IT would be managed. According to the Office of Inspector  General, slow implementation of the revised governance structure had left  many IT officials operating under the previous inefficient and ineffective  framework.

The report also noted that, as of August 2017, the Office of the CIO had  not finalized the roles and responsibilities for IT management and  lingering confusion regarding security roles, coupled with poor IT  inventory practices, had negatively impacted NASA’s security posture.  Importantly, the report explained that the Office of the CIO continued to  have limited influence over IT management within the mission  directorates and at centers.

The Office of Inspector General made five recommendations to the CIO  that were intended to improve, among other things, governance and  security. As of October 2017, NASA had concurred with three  recommendations, partially concurred with two recommendations, and  described corrective actions taken or planned. However, the Office of  Inspector General found that NASA’s original proposed action to address  the fourth recommendation was insufficient; thus, in December 2017, the  agency established additional proposed actions to address that  recommendation.

We have identified a set of essential and complementary management  disciplines that provide a sound foundation for IT management. These  include the following:

Strategic planning: Strategic planning defines what an organization  seeks to accomplish and identifies the strategies it will use to achieve  desired results. We have previously reported that a defined strategic  planning process allows an agency to clearly articulate its strategic  direction and establish linkages among planning practices, such as  goals, objectives, and strategies and identified leading practices for  agency planning.

Workforce planning: We have previously reported that it is important  for an agency to have a strong IT workforce to help ensure the timely  and effective acquisition of IT. In November 2016, we identified eight  key workforce planning activities derived from the Clinger-Cohen Act  of 1996 and relevant guidance, including memorandums and  guidance from OPM and OMB, and prior GAO reports. These laws  and guidance focus on the importance of setting the strategic direction  for workforce planning, analyzing the workforce to identify skill gaps,  developing strategies to address skill gaps, and monitoring and  reporting on progress in addressing skill gaps.

IT governance: IT projects can significantly improve an organization’s  performance, but they can also become costly, risky, and  unproductive. In 1996, Congress passed the Clinger-Cohen Act,  which requires executive branch agencies to establish a process for  selecting, managing, and evaluating investments in order to maximize  the value and assess and manage the risks of IT acquisitions.  Agencies can maximize the value of their investments and minimize  the risks of their acquisitions by having an effective and efficient  governance process, as described in GAO’s guide to effective IT  investment management.

Cybersecurity: Federal systems and networks are often  interconnected with other internal and external systems and networks,  including the Internet. When systems are interconnected, the number  of avenues of attack increases and the attack surface expands.  Effective security for agency systems and data is essential to prevent  data tampering, disruptions in critical operations, fraud, and  inappropriate disclosure of sensitive information, including personal  information entrusted to the government by members of the American  public. Taking action to assure that an agency’s contractors and  partners are adequately protecting the agency’s information and  systems is one way an agency can address cybersecurity risks.

NIST has issued a suite of information security standards and  guidelines that, collectively, provide comprehensive guidance on  managing cybersecurity risk to agencies and any entities performing  work on the agencies’ behalf. NIST’s cybersecurity framework was  issued in February 2014 in response to Executive Order 13636. The  framework outlines a risk-based approach to managing cybersecurity  risk and protecting an organization’s critical information assets.  Subsequent to the issuance of the cybersecurity framework, a May  2017 executive order required agencies to use the framework to  manage cybersecurity risks. The order outlined actions to enhance  cybersecurity across federal agencies and critical infrastructure to  improve the nation’s cyber posture and capabilities against  cybersecurity threats to digital and physical security.

NASA Has Not Yet Effectively Established and Implemented Leading IT Management Practices

NASA has not yet effectively established and implemented leading IT  management practices for strategic planning, workforce planning,  governance, and cybersecurity. Specifically,

The agency’s IT strategic planning process is not yet fully  documented and its IT strategic plan lacks key elements called for by  leading practices.

NASA has not yet established an IT workforce planning process  consistent with leading practices.

The agency has taken recent action to improve its IT governance  structure; however, it has not yet fully established that structure,  documented improvements to its investment selection process, fully  implemented investment oversight leading practices, or fully defined  its policies and procedures for IT portfolio management.

NASA has not fully established an effective approach to managing  agency-wide cybersecurity risk. While it has designated a risk  executive, the agency lacks a dedicated office to provide  comprehensive executive oversight of risks. In addition, the agency- wide cybersecurity risk management strategy is currently in  development, and the agency’s information security program plan  does not address all leading practices and has not been finalized.  Further, policies and procedures for protecting NASA’s information  systems are in place, but the agency has not ensured that they are  always current or integrated.

NASA Has Not Fully Documented Its IT Strategic Planning Process

Leading practices of IT strategic planning established in OMB guidance  call for an agency to document its IT strategic planning process,  including, at a minimum, documenting the responsibilities and  accountability for IT resources across the agency. It also calls for  documenting the method by which the agency defines its IT needs and  develops strategies, systems, and capabilities to meet those needs.

NASA’s documented IT strategic planning process describes the  responsibilities and accountability for IT resources across the agency. For  example, NASA has assigned specific governance bodies with  responsibility for developing and overseeing the implementation of the IT  strategy. Also, in its IT strategic plan, NASA described key stakeholders  across the agency that are responsible for the development of the plan.  These stakeholders include the Associate CIOs, representatives from  mission directorates, mission support organizations, and the centers.

On the other hand, the methods by which the agency defines its IT needs  and develops strategies, systems, and capabilities to meet those needs  are not documented. For example, according to the IT strategic plan, the  Office of the CIO is to perform a gap analysis to inform the development  of NASA’s roadmap that translates its IT needs and the strategies  identified for meeting those needs into tactical plans. The tactical plans  are to define how the strategic plan will be incrementally executed to  achieve the longer term goals.

However, the Office of the CIO has not documented in its strategic  planning policies and procedures how the CIO will perform the gap  analysis or the methods for developing these tactical plans and  roadmaps. This is particularly important since, according to officials in  NASA’s Office of the CIO, the centers vary as to whether they have  developed their own IT strategic plans or tactical plans, and the office  does not oversee or review any center-level plans to ensure they align  with the NASA IT strategic plan.

According to officials in the Office of the CIO, NASA used a new model in  formulating its IT strategy for fiscal years 2018 to 2021, such as including  a broader set of stakeholders in the strategic planning cycle before  documenting the strategic planning process. The officials stated that they  intend to identify lessons learned from using this new model and formally  document a complete and repeatable IT strategic planning process in the  future. However, the agency has not established time frames for when the  Office of the CIO will fully document its strategic planning process.  Without a fully documented strategic planning process, NASA risks not  being able to clearly articulate what it seeks to accomplish and identify  the IT resources needed to achieve desired results in a way that is  consistent and complete.

NASA Has Improved Its IT Strategic Plan, but Has Not Yet Established a Comprehensive Plan

In addition to calling for agencies to fully document the strategic planning  process, leading practices from OMB guidance and our prior research  and experience at federal agencies have shown that an agency should  develop a comprehensive and effective IT strategic plan that (1) is aligned  with the agency’s overall strategy; (2) identifies the mission of the agency,  results-oriented goals, and performance measures that permit the agency  to determine whether implementation of the plan is succeeding; (3)  includes strategies, with resources and time frames, that the governing IT  organization intends to use to achieve desired results; and (4) provides  descriptions of interdependencies within and across projects so that they  can be understood and managed. The resulting plan is to serve as an  agency’s vision, or road map, and help align information resources with  business strategies and investment decisions.

NASA has taken steps to improve its IT strategic plan, but the updated  plan is not comprehensive in that it does not fully address all four  elements of a comprehensive and effective plan outlined above. In this  regard, the agency had a prior strategic plan covering the time frame of  March 2014 to November 2017. More recently, in December 2017, the  CIO and Associate Administrator approved an updated plan for  implementation. The updated plan is intended for use from the date it was  approved through fiscal year 2021.

Regarding the four elements of a comprehensive IT strategic plan,  NASA’s prior plan addressed one element, partially addressed two  elements, and did not address one element. The updated plan was  slightly improved in that it addressed two elements, partially met one  element, and did not meet one element of a comprehensive strategic  plan. Table 1 provides a summary of the extent to which NASA’s prior IT  strategic plan (covering the time frame of March 2014 to November 2017)  and recently updated IT strategic plan (covering the time frame of  December 2017 to fiscal year 2021) addressed key elements of a  comprehensive strategic plan.

NASA’s prior IT strategic plan was aligned with the agency’s overall  strategic plan and identified the mission of the agency and results- oriented goals. However, these goals were not linked to specific  performance measures that were needed to track progress and did not  always describe strategies to achieve desired results. Additionally, this  plan lacked descriptions of interdependencies within and across projects.

NASA’s updated IT strategic plan is aligned with the agency’s overall  strategic plan and identifies the mission of the agency and results- oriented goals. For example, the plan describes the agency’s IT vision,  mission, principles, and objectives of five strategic goals—excellence,  data, cybersecurity, value, and people. To support these goals, the plan  defines 14 objectives to be accomplished over 4 years. For example, the  plan defines objectives for increasing the effectiveness of NASA’s IT  strategy execution through disciplined program and project management.

In addition, NASA has improved upon the prior plan by identifying  performance measures that allow the agency to determine whether it is  succeeding in the implementation of its goals. For example, in order to  increase the effectiveness of its IT strategy execution, the Office of the  CIO expects 85 percent of projects to be in conformance with approved  project plans by the end of fiscal year 2018. As another example, to  prepare its employees to achieve NASA’s IT vision, the Office of the CIO  plans to, by the end of fiscal year 2020, identify skills gaps and ways to  close the gaps based on the workforce strategy.

However, similar to the prior plan, the updated plan does not fully  describe strategies NASA intends to use to achieve the desired results or  descriptions of interdependencies within and across projects. Specifically,  the plan discusses how the agency intends to achieve its strategic goals  and objectives through various activities. For example, according to the  plan, to increase the effectiveness of investment analysis and  prioritization, NASA intends to implement a financial management  process that integrates Office of the CIO, center, and mission directorate  IT spending. The plan states that this process will map IT investments to  NASA’s vision and strategy, as well as enable high-quality internal and  external investment insight and reporting.

However, the updated plan does not further describe the strategies NASA  intends to use to accomplish these activities, including a schedule for  significant actions and the resources needed to achieve this objective.  For instance, the plan states that the Office of the CIO will define clear  lines of authority and accountability for IT between the agency and  NASA’s centers, but does not describe a strategy, including time frames  and resources, for accomplishing this. Additionally, the plan does not  describe interdependencies between projects, which is essential to help  define the relationships within and across projects and major initiatives.

According to NASA’s CIO, the updated strategic plan was kept at a higher  level with the expectation that more detailed implementation plans (e.g.,  tactical plans and roadmaps) would define the necessary projects and  interdependencies. However, NASA has not defined guidance for  developing the implementation plans to ensure that any plans developed  will fully describe strategies and interdependencies, or time frames for  when these plans will be completed. Until NASA incorporates the key  elements of a comprehensive IT strategic plan, it will lack critical  information needed to align information resources with business  strategies and investment decisions.

NASA Has Gaps in Its IT Workforce Planning Efforts

Key to an agency’s success in managing its IT investments is sustaining  a workforce with the necessary knowledge, skills, and abilities to execute  a range of management functions that support the agency’s mission and  goals. Achieving such a workforce depends on having effective human  capital management consistent with workforce planning activities  pursuant to federal laws and guidance.

Specifically, OMB requires agencies to develop and maintain a current  workforce planning process. In addition, we reported in 2016 on the  importance of setting a strategic direction for IT workforce planning,  identifying skills gaps and implementing strategies to address them, and  monitoring and reporting on progress in addressing the identified skills  gaps. We identified eight key IT workforce planning activities that are  essential to agency efforts to establish an effective IT workforce:  1.  establish and maintain a workforce planning process;  2.  develop competency and staffing requirements;  3.  assess competency and staffing needs regularly;  4.  assess gaps in competencies and staffing;  5.  develop strategies and plans to address gaps in competencies and  6.  implement activities that address gaps (including IT acquisition  cadres, cross-functional training of acquisition and program  personnel, career paths for program managers, plans to strengthen  program management, and use of special hiring authorities);  7.  monitor the agency’s progress in addressing competency and staffing  8.  report to agency leadership on progress in addressing competency  and staffing gaps.

The Office of the CIO has had IT workforce planning efforts underway  since 2015 that are intended to address the workforce planning activities  listed above; however, the office has not finalized or implemented any of  the planned actions. The office recently began working to establish a  more comprehensive workforce strategy for fiscal year 2019 to align with  the agency’s increased emphasis on improving the overall workforce.  Specifically, in the draft NASA Strategic Plan, the agency established a  workforce development goal and two strategic objectives that relate to its  IT workforce and call for, among other things, workforce training and  efforts to increase cybersecurity awareness to reduce cybersecurity risks.

Nevertheless, NASA has gaps in its IT workforce planning efforts. Of the  eight key IT workforce planning activities that we previously outlined,  NASA partially implemented five and did not implement three. Table 2  shows the extent to which NASA has implemented each IT workforce  planning activity and provides examples of workforce practices planned or  implemented, as well as those not yet undertaken.

According to NASA’s CIO, the Office of the CIO put IT workforce planning  activities on hold in 2015 pending the outcome of more comprehensive,  agency-wide efforts. Specifically, the agency began planning and  developing a new phased program—the Mission Support Future  Architecture Program—designed to deliver workforce and other mission  support services, including a talent management program. Phase 1 of  the new phased Mission Support Future Architecture Program began in  May 2017.

According to the NASA CIO, the Office of the CIO is expected to be part  of a future phase and to renew its IT workforce planning as part of that  effort. However, the CIO did not have an estimate for when the Office of  the CIO would join the program. Until NASA implements all of the key IT  workforce planning activities discussed in this report, the agency will have  difficulty anticipating and responding to changing staffing needs. Further,  NASA will face challenges in controlling human capital risks when  developing, implementing, and operating IT systems.

NASA’s IT Governance Approach Does Not Fully Address Leading Practices

Leading practices for governing IT, such as those identified by GAO in its  IT investment management framework, call for agencies to establish and  follow a systematic and organized approach to investment management  to help lay a foundation for successful, predictable, and repeatable  decisions. Critical elements of such an approach include instituting an IT  investment board (or boards), developing and documenting a governance  process for investment selection and for investment oversight, and  establishing governance policies and procedures for managing the  agency’s overall IT investment portfolio.

NASA Has Not Fully Instituted an Effective Governance Structure

Instituting an effective IT governance structure involves establishing one  or more governance boards, clearly defining the boards’ roles and  responsibilities, and ensuring that they operate as intended. Moreover,  Section 811(a) of the National Aeronautics and Space Administration  Transition Authorization Act of 2017 directs the agency to ensure that the  NASA CIO, mission directorates, and centers have appropriate roles in  governance processes. The act also calls on the Administrator to provide,  among other things, an IT program management framework to increase  the efficiency and effectiveness of IT investments, including relying on  metrics for identifying and reducing potential duplication, waste, and cost.

NASA has established three boards focused specifically on IT  governance—an IT Council which is its executive-level IT board, a CIO  Leadership Team, and an IT Program Management Board which provides  oversight of programs and projects. Meeting minutes for the three IT- specific governance bodies identified above revealed that these groups  are meeting as required by their charters.

Further, two of NASA’s agency-wide councils (whose governance  responsibilities extend beyond IT) also play a role in IT governance.  Specifically, the Mission Support Council is the governance body to which  the IT Council escalates unresolved decisions, and the Agency Program  Management Council is responsible for reviewing and approving highly- specialized IT. In addition, NASA centers have the option to create  center-specific IT governance boards to make decisions about center- level IT investments under the authority of center CIOs.

Table 3 describes the roles of the IT-specific governance boards, the  agency-wide councils with roles in IT governance, and the center-level IT  governance boards. The table also includes additional details on how  frequently the councils and boards meet, the dollar thresholds NASA has  established to determine which investments each council or board  reviews, and which officials serve as members of the boards.

Although it has established and assigned responsibilities for the  aforementioned governance councils and boards, NASA has not yet fully  instituted an effective investment board governance structure for several  reasons.

Planned improvements to the IT governance structure are not yet  complete. NASA has established new governance boards in addition  to the boards listed above, but has not yet approved charters to guide  their operations. Specifically, the Office of the CIO has revised its  governance structure to establish six new boards, one for each of its  IT programs. Agency officials, including the IT governance lead,  reported that the boards had been established; however, as of  December 2017, NASA had not yet approved charters defining the  new governance bodies’ membership, functions, and interactions with  other governance boards.

Roles and responsibilities of the IT governance boards and  agency-wide governance councils are not clearly defined. NASA  continues to operate a federated governance model with  decentralized roles and responsibilities for governance of mission and  business IT investments. Business IT is selected and approved by the  IT-specific governance boards, but mission IT follows a different path  for investment selection in that it is not reviewed and approved by the  CIO along with other IT investments proposed for selection. Instead,  the Agency Program Management Council’s reviews focus on the  selection of overall mission programs, and not on selecting IT. As a  result, mission IT has historically been reported to the Office of the  CIO only if the program has been designated as a major agency IT  investment to be reported to OMB.

NASA has begun making changes to its decentralized governance  approach in response to provisions in legislation commonly referred to  as the Federal Information Technology Acquisition Reform Act that  are intended to ensure that the CIO has visibility into both mission and  business IT investments. However, the agency has not yet developed  policies and procedures to clarify how these changes will affect the  CIO’s and governance boards’ roles and responsibilities. For  example, in January 2017, the IT Council approved an updated  definition for highly-specialized IT and established new expectations  about the extent to which highly-specialized IT investments would be  reviewed by the NASA CIO.

However, NASA has not clarified roles and responsibilities for  identifying such investments and ensuring they are reported by  mission directorate programs to the CIO. In addition, the agency has  not yet outlined procedures for how these investments that are  overseen by the agency-wide Agency Program Management Council  are to be reported to the CIO or IT-specific governance boards.

During a January 2017 IT Council meeting, the NASA CIO  acknowledged that roles and responsibilities for IT governance were  unclear and that it would take 1 to 2 years to clarify them. In July  2017, the Deputy CIO recognized that significant work remained for  NASA to achieve a consistent agency-wide governance approach with  established roles and responsibilities.

While the IT governance boards are meeting regularly, they are  not consistently operating as intended. Board charters finalized in  2016 defined the membership for the governance boards and  established expectations for the expertise to be made available to  support board decisions. However, the boards are not consistently  operating with all designated board members in attendance. For  example, the Chief Engineer was designated as a member of the IT  Council, but the council’s meeting minutes indicated that the Deputy  Chief Engineer regularly attends the council meetings instead.

In addition, IT Program Management Board meetings are consistently  held with fewer voting members than designated by the board’s  charter. The board’s meeting minutes indicated that fewer than six  voting members regularly attend board meetings instead of the eight  voting members outlined in the board charter. For example, the  minutes showed that each meeting has been held with only one  center and mission support directorate representative—instead of the  two required by the charter.

NASA officials, including the Associate CIO for Capital Planning and  Governance, stated that planned efforts to update the governance  structure and develop additional guidance for IT investment management  have impacted the agency’s time frames for fully establishing its new  boards and defining their roles and responsibilities. Specifically, these  officials stated that the Office of the CIO is working to develop a  comprehensive IT framework intended to update the governance  structure, fully establish the new governance boards, and define  governance roles and responsibilities. According to the officials, this  framework is expected to be finalized in 2018, but the office did not  provide a detailed schedule with milestones for completing the  framework. Without a detailed schedule for updating the governance  structure and establishing a comprehensive IT framework to help ensure  that the revised governance boards are fully established and operating as  intended, NASA may not be able to improve IT governance in accordance  with the requirements in the National Aeronautics and Space  Administration Transition Authorization Act of 2017.

NASA Has Not Completed or Updated Governance Selection Process Policies and Procedures and Lacks Established Guidance for Reselecting Investments

According to our IT investment management guide, defining policies and  procedures for selecting investments provides investment boards and  others with a structured process and a common understanding of how  investments will be selected. Selection policies and procedures should,  among other things, establish thresholds or criteria (e.g., investment size,  technical difficulty, risk, business impact, customer needs, and cost- benefit analysis) for boards to use in identifying, analyzing, prioritizing and  selecting new IT proposals.

In addition, outlining a process for reselecting ongoing projects is  intended to support board decisions about whether to continue to fund  projects not meeting established goals or plans. Using the defined  selection process promotes consistency and transparency in IT  governance decision making. Further, after the guidance has been  developed, organizations must actively maintain it, making sure that it  always reflects the board’s current structure and the processes that are  being used to manage the selection of the organization’s IT investments.

NASA’s defined selection process policies and procedures designated the  CIO with responsibility to ensure that IT governance, investment  management, and program/project management processes are  integrated to facilitate the selection of appropriate IT investments. The  agency has established multiple policies and procedures outlining certain  aspects of how both mission programs and business IT investments are  to be planned, such as standardized templates for requesting approval to  plan investments and direction for teams to use in planning for  investments. In addition, the Office of the CIO has established a Capital  Planning and Investment Control Guide for business IT investments and  issues annual budget guidance for requesting funding for IT investments.

The agency’s selection process also includes specific IT governance  processes developed by centers for the investments they review. For  example, Goddard Space Flight Center had developed additional center- specific guidance assigning lead responsibility for assessing new and  ongoing projects. The center also has established predetermined criteria,  such as whether projects conflict, overlap, or are redundant with other  projects, and the risk if the investment was not funded.

Nevertheless, NASA’s established process does not yet define thresholds  or criteria (e.g., qualitative or quantitative data) to be analyzed and  compared when governance boards make decisions to select  investments. Charters for NASA’s governance boards outline the  functions these boards are to perform and direct them to be involved in IT  governance. However, the charters do not outline specific thresholds or  procedures that the boards are to follow in selecting investments.

For example, NASA’s process does not fully define how investment risks  are to be evaluated. NASA policy establishes dollar thresholds for IT  governance board reviews, but does not define any other parameters for  how risk will be evaluated. In addition, NASA has established an  expectation that the new capital investment review process is to yield risk- based decisions for all investments and help mitigate IT security risks.  However, guidance for capital investment reviews does not address how  investment risks are to be evaluated.

Moreover, NASA’s selection process policies and procedures have not  been updated to reflect efforts to improve governance. Its guidance for  selecting investments (and for all aspects of its governance process) is  fragmented, and the agency has not updated its policies and procedures  to reflect current selection practices. In addition, this guidance does not  yet reflect recent efforts to clarify and standardize the definitions of  fundamental IT investment terms, such as “information technology” and  “major” investments.

Further, while NASA has begun changing its selection process to ensure  that the CIO and IT governance boards will be provided data about all IT  investments, including mission IT investments such as highly-specialized  IT, the agency’s selection policies have not been updated to reflect these  changes. NASA’s Capital Planning and Investment Control Guide does  not require all investments to be included in the selection process (or  other IT governance processes) and the NASA Space Flight Program and  Project Management procedures for mission program governance do not  address whether or how the investments within mission programs are to  be reported to the agency’s IT-specific governance boards.

In addition, NASA has not yet defined a reselection process for IT  investments. Current policies and guidance for selecting investments do  not clearly define a consistent approach for how performance is to be  considered in reselecting investments. Without a defined reselection  process, the agency’s boards lack structure and a common  understanding about how to make decisions about whether to continue to  fund projects not meeting established goals or plans.

NASA officials acknowledged that the current policies and procedures do  not establish sufficient content within the business cases and IT plans for  proposed investments to support effective governance decision making.

The agency has begun working to update its policy for IT program and  project management but did not expect to complete the update until April  2018. Further, even when this key IT investment management policy is  updated, the agency will still need to update related policies and  procedures to reflect changes it has made but not yet documented in the  investment selection process. NASA has not yet established plans for  when all needed updates to the policies and procedures will be  completed.

Until NASA updates its IT governance policies and procedures to  establish thresholds and procedures to guide its boards in decision  making and outline a process for reselecting investments, the agency will  be limited in its assurance that the investment selection process will  provide a consistent and structured method for selecting investments.  Further, until all relevant governance policies and procedures are updated  to reflect current investment selection practices and proposed changes  intended to provide the CIO with data about mission IT, the CIO will not  be positioned to minimize investments that present undue risk to the  agency and ensure accountability for both business and mission IT.

NASA Lacks Criteria for Assessing Investment Performance and Ensuring Oversight of All Investments

Organizations that provide effective IT investment oversight have  documented policies and procedures that, among other things, ensure  that data on actual performance (e.g., cost, schedule, benefit, and risk)  are provided to the appropriate IT investment board(s). In addition, such  organizations establish procedures for escalating or elevating unresolved  or significant issues; ensure that appropriate actions are taken to correct  or terminate underperforming IT projects based on defined criteria; and  regularly track corrective actions until they are completed.

As with investment selection, NASA has established multiple policies and  procedures for the oversight of IT investments. In October 2015, the  agency added to its oversight processes by establishing a capital  investment review process to improve the quality of the information  available for investment oversight and established a matrix defining dollar  thresholds to delineate oversight among the IT governance boards. The  IT Program Management Board is also assigned specific oversight  responsibilities for reviewing investment cost, schedule, performance, and  risk at key lifecycle decision points for investments submitted for its  review. In addition, the IT Program Management Board’s charter requires  this board to track, among other things, board decisions about  investments and action items.

In implementing NASA’s oversight practices, the IT Program  Management Board consistently reviewed updates on investment  performance (i.e., cost, schedule, and benefits) and progress. In addition,  the IT Program Management Board’s oversight decisions about IT  investments are documented in meeting minutes, and the board also  records any action items identified for investments in the decision  memorandums it submits to the CIO.

Nevertheless, we identified limitations in NASA’s established oversight  policies and procedures. For example, the agency’s policies and  procedures require IT investments to report data to the governance  boards at key decision points but do not establish specific thresholds or  other criteria for the governance boards to use in overseeing the  investments’ performance or escalating investments to review by other  boards. The oversight guidance also does not specify the conditions  under which a project would be terminated.

In addition, weaknesses we identified in oversight of specific NASA IT  investments highlighted additional limitations of the established oversight  process.

Specifically, NASA did not have a mechanism for alerting the IT  Program Management Board to provide oversight if investments were  underperforming or overdue for review. For example, significant  schedule overruns did not trigger additional oversight for one  investment. In March 2015, NASA approved the proposed design for  an investment to implement a security tool in June 2015 at an  expected cost of $1.3 million. Although the project fell 13 months  behind schedule and encountered unforeseen challenges, the IT  Program Management Board did not review the investment again until  June 2017—2 years later.

Not all IT investments followed the established oversight process. For  example, in our review of governance board meeting minutes and  documentation, we identified an investment that was close to  completion before the IT Program Management Board reviewed its  proposed design. Specifically, in February 2016, the board was  asked—1 day before the investment was to become operational—to  (1) approve the proposed design and (2) grant authority to operate for  the investment intended for use by NASA staff and external partners.  Although concerns about limited oversight were noted, the investment  was approved.

Further, NASA lacks procedures to ensure that action items identified  are tracked. We identified instances in which the IT Program  Management Board did not consistently track action items identified  for IT investments. NASA’s investments typically report back to the IT  Program Management Board at future decision point reviews about  steps taken to address documented action items. However, the  board’s meeting minutes and documentation identified multiple  examples of investments that were returned to the board at future  decision points without reporting on whether identified action items  had been addressed.

Moreover, NASA’s oversight processes do not encompass highly- specialized or other IT that supports mission programs. After reviewing  NASA’s fiscal year 2015 budget request, OMB directed NASA to identify  unreported IT investments throughout the agency to ensure that all  related spending would be documented. NASA established a team in  2016 to explore how to identify such investments so that they could be  reported to the CIO. The team initiated efforts to identify such investments  in mission directorates and evaluated various mechanisms that NASA  could employ to detect unreported IT. However, the agency has not yet  finalized decisions about how to implement the team’s recommendations,  including those for fully identifying investments for all mission directorates  or determining which mechanisms to employ to identify unreported IT.  According to NASA officials, time frames for completing these activities  have not yet been established.

In July 2017, NASA officials, including the Deputy CIO, acknowledged in  governance board meeting minutes describing needed improvements,  that the agency had not yet fully identified its IT footprint and needed to  establish a comprehensive investment management process to address  federal requirements, including those governing processes for selecting,  reselecting, and overseeing IT investments. NASA officials explained that  important progress had been made in improving oversight practices, but  that efforts to implement more thorough capital investment reviews and  identify IT investments across the agency had not yet been completed.  The officials reported that they anticipated additional improvement to be  made by the next annual budget cycle.

However, expanding NASA’s oversight of IT will require continued  coordination with the mission directorates to work through any needed  changes to the longstanding differences in NASA’s management of  mission and business IT. The scope and complexity of such efforts are  likely to be significant and may take time to plan and implement. Clearly  defining how IT across the agency is to be identified and reported to the  CIO would likely involve changes to policies and processes within and  across NASA’s IT, engineering, and mission program areas and would  involve expertise and collaboration from those same groups. Until such  practices are fully established, NASA will continue to operate with  limitations in its oversight process and projects that fall short of  performance expectations. In addition, the agency will face increased risk  that its oversight will fail to (1) prevent duplicative investments, (2) identify  opportunities to improve efficiency and effectiveness, and (3) ensure that  investment progress and performance meet expectations.

NASA Has Not Yet Fully Defined Policies and Procedures for Managing Investments as a Portfolio

The IT investment management framework developed by GAO notes  that, as investment management processes mature, agencies move from  project specific processes to managing investments as a portfolio. The  shift from investment management to IT portfolio management enables  agencies to evaluate potential investments by how well they support the  agency’s missions, strategies, and goals. According to the framework, the  investment board enhances the IT investment management process by  developing a complete investment portfolio. As part of the process to  develop a complete portfolio, an agency is to establish and implement  policies and procedures for developing the portfolio criteria, creating the  portfolio, and evaluating the portfolio.

NASA has not yet fully defined its policies and procedures for developing  the portfolio criteria, creating the portfolio, and evaluating the portfolio. In  its Annual Capital Investment Review Implementation Plan, dated  October 2015, NASA began documenting policies for IT portfolio  management and procedures for creating and evaluating the portfolio. For  example, the procedures state that NASA is to update its IT portfolio  annually in conjunction with the agency’s planning and budgeting  process. Additionally, in its IT Capital Planning and Investment Control  Process guide, dated October 2006, NASA outlined procedures the  agency can use to analyze the portfolio by establishing factors that should  be taken into consideration, including the relative benefits, costs, and  risks of the investment compared to all other proposals and the strength  of the investment’s linkage to NASA’s strategic business plan.

However, these documents do not constitute a comprehensive IT portfolio  management process in that they do not specifically define the  procedures for creating and modifying the IT portfolio selection criteria;  analyzing, selecting, and maintaining the investment portfolio; or  reviewing, evaluating, and improving the performance of its portfolio.  Further, the policies and procedures have not been updated to reflect  current NASA practices. Specifically, the current policies and procedures  have not been updated to reflect changes the agency made to its capital  investment review process that are relevant to portfolio management.

According to NASA officials, the reason that the agency has not fully  defined its policies and procedures is because they are intended to be  part of a new IT portfolio management framework that also requires  NASA to make changes to its investment management process.  Specifically, the IT portfolio management plan that NASA drafted in  January 2017 called for the agency to develop new IT investment criteria,  discover currently unreported IT investments, develop an investment  review process, and implement an IT investment dashboard and reporting  tool, and a communications plan.

Although the IT Council has not yet approved the IT portfolio  management plan, NASA has begun work to address elements of the  draft plan, including building the requirements for an IT dashboard and  reporting tool for implementation in 2018. In addition, according to Office  of the CIO officials, the capital planning team is continuing to work with  stakeholders to develop a comprehensive IT framework and investment  review process. However, no firm dates have been established for the  approval and implementation of the final plan or the framework. Until  NASA fully defines its policies and procedures for developing the portfolio  criteria, creating the portfolio, and evaluating the portfolio, the agency will  lack assurance it is identifying and selecting the appropriate mix of IT  projects that best meet its mission needs.

NASA Has Not Fully Established an Effective Approach for Managing Cybersecurity Risk

We have previously reported that securing federal government  computerized information systems and electronic data is vital to the  nation’s security, prosperity, and well-being. Yet, the security over these  systems is inconsistent and agencies have faced challenges in  establishing cybersecurity approaches. Accordingly, we have  recommended that federal agencies address control deficiencies and fully  implement organization-wide information security programs.

NIST’s cybersecurity framework is intended to support federal agencies  as they develop, implement, and continuously improve their cybersecurity  risk management programs. In this regard, the framework identifies  cybersecurity activities for achieving specific outcomes over the lifecycle  of an organization’s management of cybersecurity risk. According to  NIST, the first stage of the cybersecurity risk management lifecycle— which the framework refers to as “identify”—is focused on foundational  activities for effective risk management that provide agencies with the  organizational understanding to manage cybersecurity risk to systems,  assets, data, and capabilities. NIST also provides specific guidance for  implementing foundational activities and achieving desired outcomes that  calls for, among other things, the following:

A risk executive in the form of an individual or group that provides  agency-wide oversight of risk activities and facilitates collaboration  among stakeholders and consistent application of the risk  management strategy.

A cybersecurity risk management strategy that articulates how an  agency intends to assess, respond to, and monitor risk associated  with the operation and use of the information systems it relies on to  carry out the mission.

An information security program plan that describes the security  controls that are in place or planned for addressing an agency’s risks  and facilitating compliance with applicable federal laws, executive  orders, directives, policies, or regulations.

Risk-based policies and procedures that act as the primary  mechanisms through which current security requirements are  communicated to help reduce the agency’s risk of unauthorized  access or disruption of services.

However, NASA has not yet fully implemented these foundational  activities of effective cybersecurity risk management.

Efforts to Establish Executive Oversight of Cybersecurity Are Underway

According to NIST guidance, federal agencies should establish a risk  executive in the form of an individual or group that provides organization- wide oversight of risk activities and facilitates collaboration among  stakeholders and consistent application of the risk management strategy.  This functional role helps to ensure that risk management is  institutionalized into the day-to-day operations of organizations as a  priority and integral part of carrying out missions.

NASA has developed a policy regarding the establishment of a risk  executive function in accordance with NIST guidance, but it has not fully  implemented the policy. Specifically, the agency’s policy designates the  Senior Agency Information Security Officer (SAISO) as the risk executive.  According to the policy, the SAISO is charged with ensuring that  cybersecurity is considered and managed consistently across the  systems that support the agency and its partnerships—academic,  commercial, international, and others that leverage NASA resources and  extend scientific results. The policy also calls for the SAISO to establish  an office with the mission and resources for information security  operations, security governance, and cyber-threat analysis.

In accordance with its policy, NASA has designated an Acting SAISO.  Since April 2017, the Acting SAISO has led the IT Security Division within the Office of the CIO—an office that coordinates information security  operations, security governance, security architecture and engineering,  and cyber-threat analysis.

However, the agency has not yet established a risk executive office with  assigned leadership positions and defined roles and responsibilities.  According to NASA documentation, the agency had planned for the office  to become operational by mid-December 2016. Agency officials, including  the Acting Deputy Associate CIO for Information Security, explained that  an IT security program office was not established in 2016 because the  planned time frame for doing so was not realistic and failed to take into  account other risk management efforts competing for available resources.  For example, the officials stated that the agency was focused on a priority  goal of deploying a centralized tool across its centers that would provide  monitoring of implemented security controls to ensure they are  functioning adequately.

According to the NASA CIO, the agency planned to establish a  comprehensive risk executive function by employing a cybersecurity risk  manager in April 2018 and forming a program office—called the  Enterprise Security Office—by September 2018. NASA’s new  cybersecurity risk manager began work on April 2, 2018. The agency’s  plan to have the new cybersecurity risk manager establish a  comprehensive risk executive function should help ensure that current  risk management efforts and decisions are appropriate and consistently  carried out across the agency and its external partnerships.

NASA Has Not Yet Established an Agency-Wide Cybersecurity Risk Management Strategy

NIST guidance states that federal agencies should establish and  implement an organizational strategy for managing cybersecurity risk that  guides and informs how the agency assesses, responds to, and monitors  risk to the information systems being relied on to carry out its mission.  The strategy should, among other things, make explicit an agency’s risk  tolerance, accepted risk assessment methodologies, a process for  consistently evaluating risk across the organization, risk response  strategies, approaches for monitoring risk over time, and priorities for  investing in risk management.

In 2015, NASA recognized the need to establish and implement an  agency-wide strategy for managing its cybersecurity risks to address  weaknesses it had identified with the decentralized approach it was using.  Specifically, because the agency’s centers had independently developed  approaches for managing cybersecurity risk, there was little integration  regarding risk management and practices across the agency. Further,  NASA determined that the decentralized, center-level approach did not  provide sufficient transparency regarding risks that could affect mission  directorate programs.

To overcome the limitations of its decentralized approach, NASA planned  to develop and begin implementing a comprehensive cybersecurity  strategy by the end of September 2016 that was expected to include the  key elements identified in NIST guidance. For example, it was expected  to define the agency’s risk tolerance, establish a methodology for  identifying and assessing risks, and provide a clear understanding of  NASA’s risk posture.

However, the strategy was not completed as planned and is currently in  development. According to officials in the Office of the CIO, including the  Acting Deputy Associate CIO for Information Security, the strategy was  not completed as planned due to the complexity and scope of the effort.  For example, the officials stated that establishing an effective agency- wide strategy required insight into center-specific practices and significant  input from stakeholders at all levels of NASA. In addition, these officials  and the NASA CIO explained that the agency’s efforts were redirected in  order to respond to a new executive order from the President to develop  an action plan for adopting NIST’s cybersecurity framework in phases.

According to NASA’s CIO, the agency plans to move forward with drafting  an agency-wide cybersecurity strategy that reflects the agency’s  approach to using NIST’s framework; however, the agency has not yet  established time frames for completing this effort. Until NASA establishes  and implements a comprehensive strategy for managing its cybersecurity  risks using NIST’s framework, its ability to make operational decisions  that adequately address security risks and prioritize IT security  investments will be hindered.

NASA’s Information Security Program Plan Does Not Fully Address Relevant Leading Practices and Is Not Finalized

NIST recommends that federal agencies develop and disseminate an  information security program plan that describes the organization-wide  security controls that are in place or planned for addressing the agency’s  risks and complying with applicable federal laws, executive orders,  directives, policies, or regulations. Specifically, the plan should provide  a description of the agency’s program management controls and common  controls in place or planned for meeting relevant federal, legal, or  regulatory requirements; include the identification and assignment of  roles, responsibilities, and coordination among organizational entities  responsible for different aspects of information security; define the  frequency for reviews of the security program plan; and receive approval  from a senior official with responsibility and accountability for the risk  being incurred.

NASA issued a draft information security program plan in November 2017  that addresses many of the components called for in NIST guidance. For  example, the plan discusses program management controls that will be established, including the  development of an inventory of its information systems, measures to  determine information security performance, and an information  security workforce development and improvement program;  common controls that are to be implemented agency-wide, including  configuration management, contingency planning, and personnel  security;  roles and responsibilities for promoting collaboration and providing  consolidated unclassified security operations, and incident response  and IT security awareness and training capabilities; and  responsibility for ensuring that the information security program plan is  maintained, approved by the NASA CIO, and reviewed annually.

However, the plan is currently in draft and incomplete. For example, it  does not yet describe the majority of the security functions and services  that are to be carried out by the agency’s IT Security Division to address  the relevant federal statutory and regulatory requirements. Specifically,  the plan does not identify the agency-wide privacy controls derived from  standards promulgated pursuant to federal law and guidance that,  according to the agency, are an integral part of its security program.

According to NASA’s Acting Deputy Associate CIO for Information  Security, the information security program plan has not been finalized  because of an upcoming revision to NIST’s guidance for implementing  security controls. Specifically, a fifth revision of NIST SP 800-53 is  planned for release in December 2018. NASA’s Acting Deputy Associate  CIO for Information Security stated that the agency intends to finalize its  draft plan after incorporating the updated NIST guidance.

In the absence of an established information security program plan,  NASA’s view of the security controls that protect its systems will remain  decentralized, and it will lack assurance that it has established oversight  over security controls for all of its systems. In addition, the agency will  continue to operate its systems without defined and established  information security requirements that are essential to agency-wide  operations.

NASA’s Security Policies and Procedures Are Not Always Current or Integrated

NIST Special Publication 800-53 recommends that agencies create  policies and procedures to facilitate the appropriate application of security  controls. If properly implemented, these policies and procedures may be  able to effectively reduce the risk that could come from cybersecurity  threats such as unauthorized access or disruption of services. Because  risk-based policies and procedures are the primary mechanisms through  which federal agencies communicate views and requirements for  protecting their computing environments, it is important that they are  established and kept current.

NASA has taken steps to document policies and procedures that address  the security controls identified in NIST guidance for protecting information  systems. For example, the agency established an overarching security  policy that identified roles and responsibilities related to configuration  management, contingency planning, and incident response. In addition,  the agency issued procedures for implementing each of the NIST  controls.

However, NASA does not have current and fully integrated policies and  procedures. For example, the agency’s overarching policy for  implementing security controls expired in May 2017. In addition,  approximately one-third of the documents that guide the implementation  of these controls remained in effect past their expiration dates instead of  being updated before they had expired per NASA policy requirements.

Further, in July 2017, NASA determined that cybersecurity roles and  responsibilities were not always clear and sufficiently integrated across  policies. For example, responsibilities were not consistently well-defined  in the policies for governance, IT security, program and project  management, and systems engineering. In addition, although NASA’s  Policy Directive 2810.1E, NASA Information Security Policy provided the  SAISO with responsibility for the agency’s cybersecurity risk, the policy  assigned mission directorates control over risk decisions for their  missions and programs and the centers were given the authority to  implement any technical changes needed to address risk.

NASA’s Procedural Requirement 2810.1A, Security of Information  Technology states that the agency’s SAISO is responsible for ensuring  that information security policies and procedures are reviewed and  appropriately updated. However, according to officials in the Office of the  CIO, including the specialist for IT security, responsibilities for  establishing, reviewing, and updating policies and procedures are being  shared by two groups: the IT Security Division, led by the SAISO, and the  Capital Planning and Governance Division. Specifically, the IT Security  Division controls the content of IT-related policies and procedures but  does not have control over the established NASA-wide process for  reviewing the policies and procedures to determine if any changes are  needed to the content. Instead, the Capital Planning and Governance  Division is responsible for ensuring formal review and approval of any IT- related policies and procedures through the standard agency process and  schedule.

Officials from the Office of the CIO, including the specialist for IT security,  also stated that they intend to (1) establish a policy management  framework that would provide the SAISO with more control over policies  and procedures and include an annual document review, and (2) clarify  and update cybersecurity roles and responsibilities in NASA policies.  However, the agency has not yet developed a plan and specific time  frame for completing these activities.

In addition, the Acting Deputy Associate CIO for Information Security  stated that, having expired policies and procedures is not significant  because they will remain in use until they are rescinded or superseded by  updated versions. However, until NASA fully updates its policies and  procedures to govern security over the agency’s computing  environments, it will have limited assurance that controls over information  are appropriately applied to its systems.

NASA continues to pursue efforts to improve IT strategic planning,  workforce planning, IT governance, and cybersecurity, but consistently  lacks the documented processes needed to ensure that policies and  leading practices are fully addressed. Specifically, the agency has taken  steps to improve the content of its strategic plan and established an  agency-wide goal for improving its workforce. In addition, after analyzing  its IT management and governance structure, NASA took action to  streamline its governance boards and standardize and strengthen its  selection and oversight of investments, including initiating a portfolio  management process. NASA has also moved toward new strategies and  plans to bolster cybersecurity.

Nevertheless, while NASA has made progress, the agency has not yet  fully addressed many of the leading IT management practices noted in  this report or completed efforts to increase the CIO’s authority over, and  visibility into, agency-wide IT. Among other things, NASA has not fully  documented a process for IT strategic planning or addressed all key  elements of a comprehensive plan. In addition, it has not yet fully  implemented a workforce planning process and has gaps in efforts to  address leading practices. Regarding IT governance, its efforts to institute  an effective governance structure and update policies and procedures for  selecting IT investments are not yet complete. Moreover, NASA has not  yet addressed weaknesses in its oversight practices or fully defined  policies and procedures for developing an effective portfolio management  process.

Similarly, although NASA continues cybersecurity improvement efforts,  important elements of an effective cybersecurity approach have not been  completed, including establishing a risk management strategy, an  information security program plan, and updated policies and procedures.  Until NASA leadership fully addresses these leading practices, its ability  to overcome its longstanding weaknesses and ensure effective oversight  and management of IT across the agency will remain limited. Moreover,  NASA may be limited in its ability to strengthen its risk posture, including  ensuring effective cybersecurity across partnerships with commercial  entities, federal agencies, and other countries.

We are making 10 recommendations to the National Aeronautics and  Space Administration:

The Administrator should direct the Chief Information Officer to  develop a fully documented IT strategic planning process, including  methods by which the agency defines its IT needs and develops  strategies, systems, and capabilities to meet those needs.  (Recommendation 1)

The Administrator should direct the Chief Information Officer to update  the IT strategic plan for 2018 to 2021 and develop associated  implementation plans to ensure it fully describes strategies the agency  will use to achieve the desired results and descriptions of  interdependencies within and across programs. (Recommendation 2)

The Administrator should direct the Chief Information Officer to  address, in conjunction with the Chief Human Capital Officer, gaps in  IT workforce planning by fully implementing the eight key IT workforce  planning activities noted in this report. (Recommendation 3)

The Administrator should direct the Chief Information Officer to  institute an effective IT governance structure by completing planned  improvement efforts and finalizing charters to fully establish IT  governance boards, clearly defining roles and responsibilities for  selecting and overseeing IT investments, and ensuring that the  governance boards operate as intended. (Recommendation 4)

The Administrator should direct the Chief Information Officer to update  policies and procedures for selecting investments to provide a  structured process, including thresholds and criteria needed for,  among other things, evaluating investment risks as part of governance  board decision making, and outline a process for reselecting  investments. (Recommendation 5)

The Administrator should direct the Chief Information Officer to  address weaknesses in oversight practices and ensure routine  oversight of all investments by taking action to document criteria for  escalating investments among governance boards and establish  procedures for tracking corrective actions for underperforming  investments. (Recommendation 6)

The Administrator should ensure that the Chief Information Officer  fully defines policies and procedures for developing the portfolio  criteria, creating the portfolio, and evaluating the portfolio.  (Recommendation 7)

The Administrator should direct the Chief Information Officer to  establish an agency-wide approach to managing cybersecurity risk  that includes a cybersecurity strategy that, among other things, makes explicit  the agency’s risk tolerance, accepted risk assessment  methodologies, a process for consistently evaluating risk across  the organization, response strategies and approaches for  monitoring risk over time, and priorities for risk management  investments; (Recommendation 8) an information security program plan that fully reflects the  agency’s IT security functions and services and agency-wide  privacy controls for protecting information; (Recommendation 9)  and policies and procedures with well-defined roles and  responsibilities that are integrated and reflect NASA’s current  security practices and operating environment. (Recommendation  10)

We provided a draft of this product to NASA for comment. In its  comments, which are reproduced in appendix II, NASA concurred with  seven of the recommendations, partially concurred with two  recommendations, and did not concur with one recommendation.

NASA partially concurred with our first and second recommendations.  Specifically, consistent with the first recommendation, NASA agreed to  fully document its strategic planning process, including the methods by  which the agency defines IT needs and develops outcomes, strategies,  major actions, and performance measures to meet those needs.

In addition, our second recommendation called for NASA to update the  strategic plan and develop associated implementation plans. With regard  to updating the plan, NASA stated that its strategic plan provides the  context and parameters to support achievement of the agency's vision  and mission through the strategic use of IT. The agency also stated that  this plan describes the business outcomes, strategies, major actions, and  performance measures to achieve the desired results.

With regard to the implementation plans related to our first and second  recommendation, NASA agreed to develop the associated  implementation plans for accomplishing the IT strategic plan, including  descriptions of the interdependencies within and across programs.  Nevertheless, in commenting on both recommendations, as well as the  first recommendation, NASA stated that it does not believe that  implementation plans, including specific IT capability and system  changes, should be part of a strategic plan. The agency also maintained  that the implementation plans, including descriptions of  interdependencies within and across programs, are at a lower level than  the IT strategic plan, since detailed IT implementation plans are more  dynamic than the four-year NASA IT Strategic Plan.

However, our first and second recommendations do not call for NASA to  incorporate implementation plans within the strategic plan. Rather, as  discussed in the report, it is important that NASA document how it intends  to accomplish the activities outlined in the strategic plan. Further, we  continue to believe that NASA should address the weaknesses we  identified in this report by updating the strategic plan to incorporate  strategies on resources and time frames to achieve desired results and  descriptions of interdependencies within and across projects so that they  can be understood and managed. Thus, we stand by both  recommendations (recommendations 1 and 2) that the agency take these  actions.

NASA did not concur with our third recommendation to implement the IT  workforce planning activities noted in our report. In this regard, the  agency stated that its workforce improvement efforts were already  underway. Specifically, NASA stated that IT workforce planning is part of  the agencywide Mission Support Future Architecture Program. It added  that, among other things, this program is intended to ensure that mission  support resources, including the IT workforce, are optimally structured to  support NASA’s mission. In addition, NASA referenced our two additional  ongoing audits of the agency’s IT workforce, and noted that its activities  related to IT workforce planning would be centered on any  recommendations resulting from those audits.

In our view, neither of these circumstances should hinder NASA from  addressing our recommendation in this report. As of March 2018, the  agency’s IT workforce plans were out-of-date and incomplete because  activities the agency had been planning since 2015 had not been finalized  in an approved plan or implemented. Further, NASA had not yet  determined when the Office of the CIO would become an active part of  the agencywide Mission Support Future Architecture program or  developed plans for when that program’s assessment of the IT workforce  would be completed.

Thus, instead of limiting NASA’s ability to address our recommendation,  implementing the workforce planning activities discussed in this report  could complement the agency’s ongoing and future efforts. Specifically,  NASA could use the IT workforce leading practices described in this  report to strengthen any new workforce plans and assess the  implementation of any planned improvements. Until NASA documents an  IT workforce planning process and implements all of the key IT workforce  planning activities, the agency may not be effectively positioned to  anticipate and respond to changing staffing needs. Further, the agency is  likely to face challenges in controlling human capital risks when  developing, implementing, and operating IT systems.

NASA concurred with our four recommendations aimed at addressing  deficiencies in its IT governance (recommendations 4 through 7). In this  regard, the agency described planned actions intended to address each  of these recommendations. For example, among other activities, the  agency stated that it intended to publish charters for all IT governance  boards; have the IT Council review governance board operations  annually; document criteria for escalating investments among governance  boards; and update policies and procedures for managing its investments  as a portfolio.

Similarly, NASA concurred with our three recommendations related to  establishing an agency-wide approach to managing cybersecurity risk  (recommendations 8, 9, and 10). The agency described actions it had  taken or planned to address each of these recommendations. In  particular, with regard to establishing a cybersecurity risk management  strategy (recommendation 8), NASA asserted that it had already taken  actions that met the requirements of our recommendation. Specifically,  NASA stated that it had established an approach to developing its  cybersecurity risk management strategy by approving a charter for an  agency-wide team to address cybersecurity risk management needs and  hiring a Chief Cybersecurity Risk Officer to oversee agency-wide risk  management initiatives.

While these actions constitute steps toward addressing the  recommendation, we disagree that establishing a charter for a team and  hiring a Chief Cybersecurity Risk Officer fully addresses the  recommendation. As previously noted in this report, the agency does not  have a cybersecurity risk management strategy that includes elements of  NIST guidance. The strategy should, among other things, make explicit  the agency’s risk tolerance, accepted risk assessment methodologies, a  process for consistently evaluating risk across the organization, risk  response strategies, approaches for monitoring risk over time, and  priorities for investing in risk management. Ensuring that the established  agency-wide team and the Chief Cybersecurity Risk Officer develop a  cybersecurity risk management strategy that aligns with the NIST  guidance will be essential to fully address our recommendation.

NASA also provided technical comments on the draft report, which we  incorporated, as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Administrator of the National Aeronautics and Space  Administration, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.

Should you or your staffs have any questions on information discussed in  this report, please contact Carol Harris at (202) 512-4456 or  harriscc@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  GAO staff who made major contributions to this report are listed in  appendix III.

Appendix I: Objective, Scope, and Methodology

The National Aeronautics and Space Administration Transition  Authorization Act of 2017 included a provision for us to review the  effectiveness of the agency’s approach to overseeing and managing  information technology (IT), including its ability to ensure that resources  are aligned with agency missions, cost effective, and secure. Our  specific objective for this review was to address the extent to which the  National Aeronautics and Space Administration (NASA) has established  and implemented leading IT management practices in strategic planning,  workforce planning, governance, and cybersecurity.

To address this objective, we compared NASA’s IT management policies,  procedures, and other documentation to criteria established by federal  laws and leading practices. This documentation included the agency’s  strategic plans, workforce gap assessments, governance board meeting  minutes and briefings, charters, policies and procedures, and other  documentation of the Chief Information Officer’s (CIO) authority. We also  reviewed relevant reports by GAO and the NASA Office of Inspector  General.

With regard to IT strategic planning, we identified the strategic plans and  related planning guidance issued by NASA and the Office of the CIO,  including NASA’s Governance and Strategic Management Handbook,  dated November 26, 2014; NASA’s Information Resources Management  Strategic Plan, dated March 2014; and NASA’s updated Information  Technology Strategic Plan for fiscal years 2018 to 2021. We then  reviewed the agency’s overall strategic plan, and evaluated its previous  and current IT strategic plans against key practices for IT strategic  planning that we have previously identified. These practices call for  documenting the agency’s IT strategic planning processes and  developing an IT strategic plan that aligns with the agency’s overall strategy;  identifies the mission of the agency, results-oriented goals, and  performance measures that permit the agency to determine whether  implementation of the plan is succeeding;  includes strategies the governing IT organization will use to achieve  desired results; and provides descriptions of interdependencies within and across projects  so that they can be understood and managed.

To determine the extent to which NASA has established and implemented  leading IT workforce planning practices, we conducted a comparative  analysis of NASA’s IT workforce planning policies and documents.  Specifically, we compared agency documents, such as NASA policy  directives, the desk guide, and documentation of efforts to establish IT  workforce competencies and staffing requirements and conduct gap  assessments, to GAO’s IT workforce framework. GAO’s framework  consists of four IT workforce planning steps and eight key activities. The  eight key activities were identified in federal law, regulations, and  guidance, including the Clinger-Cohen Act of 1996, the legislation  referred to as the Federal Information Technology Acquisition Reform  Act, Office of Management and Budget (OMB) guidance, the Office of  Personnel Management’s Human Capital Framework, and GAO  reports.

Based on our assessment of the documentation and discussions with  agency officials, we assessed the extent to which the agency  implemented, partially implemented, or did not implement the activities.  We considered an activity to be fully implemented if NASA addressed all  of the underlying practices for the activity; partially implemented if it  addressed some but not all of the underlying practices for the activity; and  not implemented if it did not address any of the underlying practices for  the activity.

We assessed IT governance practices by comparing NASA  documentation to critical processes identified by GAO in the IT  investment management framework. To align our work with the provision in Section 811(a) of the National Aeronautics and Space  Administration Transition Authorization Act of 2017 calling for NASA to  take actions regarding IT governance, we selected critical processes  from Stage 2 of the framework:  instituting the investment board;  selecting and reselecting investments that meet business needs; and providing investment oversight.

For each critical process, we compared key practices outlined in the  framework to NASA documentation. The documentation we reviewed  included NASA’s IT governance policies and procedures, and charters  and other guidance. We also reviewed governance board meeting  minutes and briefings from each board’s first meeting in 2016 through  meetings held in August 2017.

In addition, we selected key practices for effective governance from Stage  3 of the IT investment management framework regarding establishing and  implementing policies and procedures for developing the portfolio criteria,  creating the portfolio, and evaluating the portfolio. We then compared  documentation, including NASA’s IT Capital Planning and Investment  Control Process guide dated October 2006, and Annual Capital  Investment Review Implementation Plan dated October 2015, and draft IT  portfolio management plans, against these practices.

Using standards and guidance from the National Institute of Standards  and Technology (NIST), which identify foundational elements of  effective cybersecurity risk management, we evaluated NASA’s  cybersecurity risk management approach by analyzing policies and plans for establishing a comprehensive risk evaluating documents and plans for establishing a cybersecurity risk  comparing a draft Information Security Program Plan to determine if it  was consistent with NIST guidance; and analyzing policies and procedures to determine if they address  relevant NIST security controls and are current.

In addition to assessing NASA headquarters, we reviewed IT  management practices at two of the agency’s nine centers (Marshall  Space Flight Center in Huntsville, Alabama; and Johnson Space Center  in Houston, Texas) and at one of NASA’s four mission directorates (the  Human Exploration and Operations Mission Directorate). The two centers  and one mission directorate were selected because they had the largest  fiscal year 2017 IT budgets, respectively, as reported on the federal IT  dashboard. We also visited the Goddard Space Flight Center in  Greenbelt, Maryland, because of the center’s proximity to GAO. The  results of our work at the selected NASA centers and mission directorate  are not generalizable to other NASA centers and mission directorates.

To assess the reliability of these data, we compared them to budgetary  data obtained directly from NASA’s Office of the CIO. We found the data  to be sufficiently reliable for the purpose of identifying the NASA centers  and mission directorate with the largest IT budgets. We also interviewed  cognizant officials with responsibilities for IT management at NASA  headquarters and for the selected centers and mission directorate.

We conducted this performance audit from May 2017 to May 2018 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objective.

Appendix II: Comments from the National Aeronautics and Space Administration

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact name above, the following staff also made key  contributions to this report: Eric Winter (Assistant Director), Donald Baca,  Rebecca Eyler, Amanda Gill (Analyst in Charge), Tom Johnson, Kate  Nielsen, Teresa Smith, and Niti Tandon.