Transcription
United States Government Accountability OfficeGAOReport to Congressional CommitteesMay 2007HOMELANDSECURITYDHS EnterpriseArchitectureContinues to Evolvebut ImprovementsNeededGAO-07-564
May 2007HOMELAND SECURITYAccountability Integrity ReliabilityHighlightsHighlights of GAO-07-564, a report tocongressional committeesDHS Enterprise Architecture Continues toEvolve but Improvements NeededWhy GAO Did This StudyWhat GAO FoundGAO designated the transformationof the Department of HomelandSecurity (DHS) as high risk in 2003,and it continues to do so today.One essential tool for facilitatingorganizational transformation is anenterprise architecture (EA)—acorporate blueprint that serves asan authoritative frame of referencefor information technologyinvestment decision making. TheCongress required DHS to submit areport that includes its EA and acapital investment plan forimplementing it. The Congress alsorequired that GAO review thereport. In June 2006, DHSsubmitted this report to theCongress. GAO’s objective was toassess the status of the EA,referred to as DHS EA 2006, andthe plan for implementing it. Tomeet this objective, GAO analyzedarchitectural documents relative toits prior recommendations;evaluated stakeholder commentsand the process used to obtainthem; and analyzed theimplementation plan againstrelevant guidance.DHS EA 2006 has evolved beyond prior versions, but missing architecturecontent and limited stakeholder input constrain its usability. While thearchitecture partially addresses each of the prior GAO recommendationsconcerning the content of DHS’s architecture, the full depth and breadth ofEA content that the recommendations solicited is still missing. For example,GAO recommended that DHS use, among other things, an analysis of thegaps between the current (“as-is”) and future (“to-be”) states of thearchitecture to define missing and needed capabilities and form the basis forits transition plan. However, DHS EA 2006 does not include a transition planand it does not include any evidence of a gap analysis.What GAO RecommendsWithout an architecture that is complete, internally consistent, andunderstandable, the usability of the DHS’s EA is diminished, which in turnlimits the department’s ability to guide and constrain IT investments in a waythat promotes interoperability, reduces overlap and duplication, andoptimizes overall mission performance.GAO is making recommendationsto DHS for tracing theimplementation of prior GAOrecommendations to EA content,and for more effectively solicitingand addressing EA stakeholdercomments. DHS agreed to traceGAO’s recommendations, butstated that it already adequatelydeals with stakeholder comments.GAO does not agree for reasonscited in this report, and thus standsby its 64.To view the full product, including the scopeand methodology, click on the link above.For more information, contact Randolph C.Hite at (202) 512-3439 or HiteR@gao.gov.In addition, department stakeholders, including component organizationsand the department’s EA support contractor, provided a range of commentsrelative to the completeness, internal consistency, and understandability of adraft of DHS EA 2006, but the majority of the comments were not addressed(see fig.). Moreover, key stakeholders, such as the Coast Guard and theTransportation Security Administration, did not comment on the draft. GAOfound that the extent of stakeholder participation was limited because theapproach EA officials used to solicit input did not clearly define the type ofinformation being requested and did not provide sufficient time forresponding.Furthermore, DHS’s capital investment plan for implementing itsarchitecture is not based on a transition plan and is missing key informationtechnology (IT) investments. Thus, the plan does not provide acomprehensive roadmap for transitioning the department to a targetarchitectural state. Also, the plan does not account for all of DHS’s plannedinvestments in IT (excluding about 2.5 billion in planned IT investments).Resolution of DHS Stakeholder Comments on a Draft of DHS EA 2006 (383 Total comments)Comments partially addressed27Comments not addressed but to be resolved in a laterEA version139101No resolutions identifiedComments fully addressed116Source: GAO analysis of DHS data.United States Government Accountability Office
ContentsLetterAppendix IAppendix IIAppendix III1DHS EA 2006 Has Evolved beyond Prior Versions, but MissingArchitecture Content and Limited Stakeholder Input ConstrainIts UsabilityConclusionsRecommendations for Executive ActionAgency Comments and Our Evaluation2344Briefing to the Staffs of the Subcommittees onHomeland Security Senate and House Committees onAppropriations7Comments from the Department of HomelandSecurity75GAO Contact and Staff Acknowledgments77Page iGAO-07-564 Homeland Security
AUS-VISITUSSSCustoms and Border Protectionchief information officercreate, update, reference, and eliminateDepartment of Homeland Securityenterprise architectureEnterprise Architecture Management MaturityFrameworkFederal Emergency Management AgencyImmigration and Customs Enforcementinformation technologyOffice of Management and Budgettechnical reference modelTransportation Security AdministrationUnited States Visitor and Immigrant Status IndicatorTechnologyUnited States Secret ServiceThis is a work of the U.S. government and is not subject to copyright protection in theUnited States. It may be reproduced and distributed in its entirety without furtherpermission from GAO. However, because this work may contain copyrighted images orother material, permission from the copyright holder may be necessary if you wish toreproduce this material separately.Page iiGAO-07-564 Homeland Security
United States Government Accountability OfficeWashington, DC 20548May 9, 2007The Honorable Robert C. ByrdChairmanThe Honorable Thad CochranRanking Minority MemberSubcommittee on Homeland SecurityCommittee on AppropriationsUnited States SenateThe Honorable David E. PriceChairmanThe Honorable Harold RogersRanking Minority MemberSubcommittee on Homeland SecurityCommittee on AppropriationsHouse of RepresentativesInformation technology (IT) is a critical tool in the Department ofHomeland Security’s (DHS) quest to transform 22 diverse and distinctagencies into one cohesive, high-performing department. Because of theimportance of this transformation and the magnitude of the associatedchallenges, we designated the department’s implementation andtransformation as a high-risk undertaking in 2003.1 In 2003 and in 2004, wereported that DHS needed to, among other things, develop and implementan enterprise architecture (EA)—a corporate blueprint that serves as anauthoritative frame of reference to guide and constrain IT investmentdecision making, promoting interoperability, minimizing wastefulduplication and redundancy, and optimizing departmentwide missionperformance.21GAO, High-Risk Series: An Update, GAO-03-119 (Washington, D.C.: January 2003); HighRisk Series: An Update, GAO-05-207 (Washington, D.C.: January 2005).2GAO, Homeland Security: Efforts to Improve Information Sharing Need to BeStrengthened, GAO-03-760 (Washington, D.C.: Aug. 27, 2003) and Department of HomelandSecurity: Formidable Information and Technology Management Challenge RequiresInstitutional Approach, GAO-04-702 (Washington, D.C.: Aug. 27, 2004).Page 1GAO-07-564 Homeland Security
Recognizing the importance that an EA plays in effectively leveraging ITfor organizational transformation, DHS issued an initial version of itsarchitecture in September 2003. Following our review of this EA andrecommendations for its improvement,3 the department issued a secondversion in October 2004. The DHS Appropriations Act of 2006 required thedepartment’s chief information officer (CIO) to submit to Congress areport that includes, among other things, an EA and a capital investmentplan for implementing the architecture.4 It also required GAO to review thereport. On June 16, 2006, the CIO submitted its report, which included thethird version of the department’s EA and a plan for implementing it, whichDHS referred to as DHS EA 2006 and Capital Investment Plan forImplementing the DHS Enterprise Architecture.Our objective was to assess the status of DHS EA 2006, including thecapital investment plan for implementing it. On February 28, 2007, webriefed your staffs on the results of our review, which included sensitiveinformation. This report transmits the slides from that briefing, withsensitive information removed. These slides, along with our scope andmethodology, are included as appendix I.DHS EA 2006 HasEvolved beyond PriorVersions, but MissingArchitecture Contentand LimitedStakeholder InputConstrain Its UsabilityDHS EA 2006 partially addresses the content shortcomings in earlierversions of the department’s architecture, which we had reported on andmade recommendations to correct. However, the full depth and breadth ofEA content that our 41 recommendations provided for is not reflected inDHS EA 2006. For example, we recommended that the architectureinclude a data dictionary, which is a repository of standard definitions ofkey terms. In response, DHS EA 2006 provides a data dictionary, but itdoes not include definitions of all key terms (e.g., first responder). We alsorecommended that DHS base its EA transition plan on, among otherthings, an analysis of the gaps between the current (“as-is”) and future(“to-be”) states of the architecture to define missing and neededcapabilities.5 However, DHS EA 2006 does not include a transition plan,3GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, butMuch Work Remains, GAO-04-777 (Washington, D.C.: Aug. 6, 2004).4The act also required DHS’s CIO report to include a description of the IT capital planningand investment control (CPIC) process and an IT human capital plan.5An EA describes how an entity currently operates (the “as-is” architecture) and how itplans to operate in the future (the “to-be” architecture); it also includes a plan for makingthat transition (the transition plan).Page 2GAO-07-564 Homeland Security
and it does not include any evidence of a gap analysis—a comparison ofthe “as-is” and “to-be” architectures to identify capability differences.Moreover, this version of the architecture does not address the majority ofthe 383 comments made on a draft of it by DHS stakeholders, includingcomponent organizations and the department’s EA support contractor. Forexample, Immigration and Customs Enforcement commented that theinputs it provided had not been incorporated, represented, or otherwiseaccommodated in any way. Of the comments, 139 were categorized asfully addressed, 27 as partially addressed, 101 as not addressed but to beresolved in a later EA version. The remaining 116 had no resolutionsspecified. In general, comments were raised about the architecture’scompleteness, internal consistency, and understandability. In addition,concerns were raised about the architecture’s usability as a departmentalframe of reference for informing IT investment decisions.In addition, the approach DHS used in soliciting comments did not clearlydefine the type of information requested and did not provide sufficienttime for detailed responses. Also, the extent to which comments wereobtained was limited. For example, key stakeholders, such as the CoastGuard and Transportation Security Administration, chose to not commenton a draft of DHS EA 2006.Lastly, DHS’s capital investment plan for implementing its architecture isnot based on an EA transition plan and is missing key IT investments. Forexample, the plan does not account for all of DHS’s planned investmentsin IT nor does it include information on certain major IT capitalinvestments.ConclusionsDHS’s approach to developing its EA through incremental releases orversions is reasonable, given the size and complexity of the departmentand the volumes of information needed to produce a complete,understandable, and usable architecture. As the department’s third versionof its EA, DHS EA 2006 is an improvement over prior versions, asevidenced by it at least partially addressing our prior recommendations.Moreover, DHS EA 2006 is partially responsive to stakeholder commentson a draft of it.Nevertheless, DHS EA 2006 is still not sufficiently complete and usable,given those aspects of our recommendations that it did not fully addressthe range of stakeholder comments that have not been resolved and thelimitations of the capital investment plan. Given the critical role that DHS’sPage 3GAO-07-564 Homeland Security
EA should play in the department’s transformation efforts, which we haveidentified as a high-risk undertaking, it is important for DHS to fullyaddress both our existing recommendations and stakeholder comments onincremental versions of its architecture.Finally, with regard to stakeholder comments, it is also important for DHSto ensure that it devotes sufficient time and adopts an effective approachto obtaining stakeholder comments on future versions. If it does not, thechances of developing a well-defined EA that is accepted and usable willbe diminished.Recommendations forExecutive ActionTo ensure that DHS fully implements our prior EA recommendations andeffectively solicits and addresses stakeholder comments on incrementalversions of its EA, we recommend that the Secretary of Homeland Securitydirect the department’s CIO to take the following two actions: Include in future versions of the department’s EA a traceability matrix thatexplicitly maps EA content to our recommendations in sufficient detail todemonstrate their implementation, and Ensure that future efforts to solicit stakeholder comments on thedepartment’s EA employ an effective approach that includes clearlydefining the type of information requested and allowing sufficient time forobtaining and responding to these comments.We are not making recommendations for addressing limitations in thedepartment’s capital investment plan for implementing its EA because ourexisting recommendations for an EA transition plan address suchlimitations.Agency Commentsand Our EvaluationIn DHS’s written comments on a draft of this report, signed by theDirector, Departmental GAO/OIG Liaison Office, and reprinted inappendix II, the department stated that the fourth release of its EA(referred to as HLS EA 2007) addresses many of the issues that our reportidentifies. In addition, DHS agreed to include in future EA releases atraceability matrix that explicitly maps its EA content to ourrecommendations, adding that this recommended tool will allow DHS tobetter track progress.However, DHS commented that its current approach to solicitingarchitecture stakeholders’ input is adequate, noting that this approachPage 4GAO-07-564 Homeland Security
provides stakeholders with unlimited opportunity to comment andobserving that its receipt of nearly 400 comments on DHS EA 2006demonstrates this opportunity. Moreover, the department stated that wehad an incorrect perception of how it treated stakeholder comments,adding that all comments that require resolution will be addressed infuture EA releases.We do not agree with DHS’s comments about the adequacy of its approachto obtaining and incorporating stakeholder comments for several reasons,each of which are cited in our report. For example, the approach did notadequately define the type and nature of the comments being solicited,and it did not provide sufficient time for stakeholders to comment, asevidenced by some stakeholders stating that the time was too limited.Also, most DHS component organizations, including large ones like theTransportation Security Agency and the Coast Guard, did not providecomments. Moreover, about 60 percent of the comments that werereceived on DHS EA 2006 were not to be addressed in the next version(HLS EA 2007), and it was not specified when they would be addressed.Given that comments were directed at the architecture’s completeness,internal consistency, understandability, and usability, which are allfundamental characteristics of an EA, we believe that ourrecommendation aimed at employing a more effective approach tosoliciting and responding to comments is warranted.We are sending copies of this report to the Chairmen and RankingMinority Members of other Senate and House committees that haveauthorization and oversight responsibilities for homeland security. We arealso sending a copy of this report to the Secretary of Homeland Securityand the Director of OMB. We will also make copies available to othersupon request. In addition, this report will be available at no charge on theGAO Web site at http://www.gao.gov.Page 5GAO-07-564 Homeland Security
If you or your staffs have any questions about this report, please contactme at (202) 512-3439 or hiter@gao.gov. Contact points for our Offices ofCongressional Relations and Public Affairs may be found on the last pageof this report. GAO staff members who made major contributions to thisreport are listed in appendix III.Randolph C. HiteDirector, Information Technology Architectureand Systems IssuesPage 6GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsAppendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsHomeland Security: DHS Enterprise ArchitectureContinues to Evolve but Improvements NeededBriefing to the Staffs of theSubcommittees on Homeland SecuritySenate and House Committees on AppropriationsFebruary 28, 20071Page 7GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsTable of ContentsIntroductionObjective, Scope, and MethodologyResults in ency CommentsAttachment 1: DHS EA 2006 StructureAttachment 2: Previous GAO Recommendations on DHS Enterprise Architecture2Page 8GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsIntroductionInformation technology (IT) is a critical tool in the Department of HomelandSecurity’s (DHS) quest to transform 22 diverse and distinct agencies into onecohesive, high-performing department. In light of the importance of thistransformation and the magnitude of the associated challenges, in 2003 wedesignated the department’s implementation and transformation as a high-riskundertaking.1In 2003 and in 2004, we reported that DHS needed to, among other things, developand implement an enterprise architecture (EA)—a corporate blueprint—as anauthoritative frame of reference to guide and constrain IT investment decisionmaking in a way that promoted interoperability, minimized wasteful duplication andredundancy, and optimized departmentwide mission performance.21GAO-03-1192GAO-03-760and GAO-05-207.and GAO-04-702.3Page 9GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsIntroductionRecognizing the importance that an EA plays in effectively leveraging IT fororganizational transformation, DHS issued an initial version of its architecture inSeptember 2003. Following our review and recommendations for improvement ofthis version,3 the department issued a second version in October 2004.The DHS Appropriations Act of 2006 required the department’s chief informationofficer (CIO) to submit to Congress a report that includes, among other things, anEA and a capital investment plan for implementing the architecture. It also requiredGAO to review the report.4 On June 16, 2006, the CIO submitted its report, whichincluded the third version of the department’s EA and a plan for implementing it,which DHS referred to as DHS EA 2006 and Capital Investment Plan forImplementing the DHS EA.3GAO-04-777.4The act also requiresDHS’s CIO to submit a report that includes a description of the information technology (IT) capital planning and investment control(CPIC) process and an IT human capital plan, which will also be reviewed by GAO.4Page 10GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsObjective, Scope, and MethodologyAs agreed with staff for the Chairmen and Ranking Minority Members of the Houseand Senate Appropriations Committees' respective homeland securitysubcommittees, our objective was to assess the status of DHS EA 2006, includingthe capital investment plan for implementing it.In order to meet this objective, we analyzed DHS EA 2006 and supporting documentation against our 41 priorrecommendations regarding DHS EA content; evaluated the nature, substance, and disposition of stakeholder comments,including documentation produced by DHS’s EA support contractor on DHSEA 2006; assessed DHS’s process for soliciting stakeholder comments relative toapplicable survey and data collection practices; analyzed DHS’s capitalinvestment plan against relevant guidance, including Office of Managementand Budget’s (OMB) capital planning guidance and applicable EA guidance;and interviewed DHS and contractor officials about their efforts to address ourrecommendations and resolve stakeholder comments, process for solicitingand responding to stakeholder comments, and basis for the capitalinvestment plan.5Page 11GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsObjective, Scope, and MethodologyWe conducted our work at DHS and contractor facilities in the Washington, D.C.,metropolitan area from June 2006 to February 2007 in accordance with generallyaccepted government auditing standards. For DHS data that we did notsubstantiate, we made appropriate attribution indicating the data source.6Page 12GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsResults in BriefDHS EA 2006 has evolved beyond prior versions, but missing architecture contentand limited stakeholder input constrain its usability. While the architecture partiallyaddresses prior GAO recommendations and stakeholder comments, the full depthand breadth of EA content that our recommendations provided for is still missing.Additionally, the majority of stakeholder comments, including concerns aboutarchitecture completeness, consistency, and understanding remain to beaddressed. Stakeholder commentary on draft DHS EA 2006 products was limitedby the approach used to solicit comments and the extent to which stakeholdersprovided comments. Further, DHS’s capital investment plan for implementing itsarchitecture is not based on an EA transition plan and is missing key ITinvestments. Without an EA that is complete, internally consistent, andunderstandable, DHS’s ability to guide and constrain IT investments in a way thatpromotes interoperability, reduces overlap and duplication, and optimizes missionperformance will be significantly diminished.We are making recommendations to ensure that DHS fully implements our prior EArecommendations and effectively solicits stakeholder comments on future versionsof its EA.7Page 13GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsResults in BriefIn commenting on a draft of this briefing, DHS officials, including the DHS ChiefInformation Officer (CIO) and the Chief Architect, acknowledged that DHS EA 2006is missing important content and stated that future versions will add content andimprove usability. Additionally, the Chief Architect generally agreed with ourrecommendations for mapping our prior recommendations to specific EA contentand for effectively soliciting stakeholder comments on future EA versions.8Page 14GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsBackgroundCreated in March 2003, DHS has assumed operational control of about 209,000civilian and military positions from 22 agencies and offices that specialize in one ormore aspects of homeland security.5 A major purpose of DHS’s establishment wasto improve coordination, communication, and information sharing among themultiple federal agencies responsible for protecting the homeland.As we previously reported, the creation of DHS6 is critically important and posessignificant management and leadership challenges. For these reasons, wedesignated the implementation of the department and its transformation as highrisk; we also pointed out that failure to effectively address DHS’s managementchallenges and program risks could have serious consequences for our nationalsecurity.5These specialties include intelligence analysis, law enforcement, border security, transportation security, biological research, critical infrastructureprotection, and disaster recovery.6For example, see GAO, Major Management Challenges and Program Risks: Department of Homeland Security, GAO-03-102 (Washington, D.C.:January 2003) and Homeland Security: Proposal for Cabinet Agency Has Merit, but Implementation Will be Pivotal to Success, GAO-02-886T(Washington, D.C.: June 25, 2002).9Page 15GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsBackgroundMission and OrganizationDHS’s mission is to lead the unified national effort to secure the United States bypreventing and deterring terrorist attacks and protecting against and responding tonational threats. Among other things, DHS is charged with ensuring safe andsecure borders, and promoting the free flow of commerce.To accomplish its mission, DHS is organized into various components, each ofwhich is responsible for specific homeland security missions and for coordinatingrelated efforts with its sibling components as well as with external entities. Table 1shows DHS’s principal organizations and their missions. Figure 1 shows asimplified view of the DHS organizational structure.10Page 16GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsBackgroundMission and OrganizationTable 1: Principal DHS Organizations and Their MissionsPrincipal organizationsaMissionsCitizenship and Immigration ServicesAdministers immigration and naturalization adjudication functions and establishes immigration services policies and priorities.Coast GuardProtects the public, the environment, and U.S. economic interests in the nation’s ports and waterways, along the coast, on internationalwaters, and in any maritime region as required to support national security.Customs and Border Protection (CBP)Protects the nation’s borders in order to prevent terrorists and terrorist weapons from entering the United States, while facilitating theflow of legitimate trade and travel.Federal Emergency Management Agency(FEMA)Prepares the nation for hazards, manages federal response and recovery efforts following any national incident, and administers theNational Flood Insurance Program.Immigration and Customs Enforcement (ICE)Identifies and addresses vulnerabilities in the nation’s border, economic, transportation, and infrastructure security.Management DirectorateManages department budgets and appropriations, expenditure of funds, accounting and finance, procurement, human resources, ITsystems, facilities and equipment, and performance measurements.Preparedness DirectorateWorks with state, local, and private sector partners to identify threats, determine vulnerabilities, and target resources where risk isgreatest, thereby safeguarding borders, seaports, bridges and highways, and critical information systems.Science and Technology DirectorateServes as the primary research and development arm of the department, responsible for providing federal, state, and local officials withthe technology to protect the homeland.Secret Service (USSS)Protects the President and other high-level officials and investigates counterfeiting and other financial crimes (including financialinstitution fraud, identity theft, and computer fraud) and computer-based attacks on the nation’s financial, banking, andtelecommunications infrastructure.Transportation Security Administration (TSA)Protects the nation’s transportation systems to ensure freedom of movement for people and commerce.U.S. Visitor and Immigrations Status IndicatorTechnology (US-VISIT)Develops and implements a governmentwide program to record the entry into and exit from the United States of selected individuals,verify their identity, and confirm their compliance with the terms of their admission into and stay in this country.Source: GAO analysis based on DHS data.aDoes not show all the organizations under each of the directorates or all organizations that report directly to the DHS Secretary and Deputy Secretary.11Page 17GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsBackgroundMission and OrganizationFigure 1: Simplified and Partial DHS Organizational StructureSource: GAO analysis based on DHS data.12Page 18GAO-07-564 Homeland Security
Appendix I: Briefing to the Staffs of theSubcommittees on Homeland Security Senateand House Committees on AppropriationsBackgroundEA: A Brief DescriptionAn EA provides systematic structural descriptions—in useful models, diagrams,tables, and narrative—of how an entity currently operates (the “as-is” archite
Architecture Content and Limited Stakeholder Input Constrain Its Usability 3GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: Aug. 6, 2004). 4The act also required DHS's CIO report to include a description of the IT capital planning
