    [House Hearing, 115 Congress]
    [From the U.S. Government Publishing Office]

           THE FEDERAL INFORMATION TECHNOLOGY ACQUISITION REFORM ACT

                             (FITARA) SCORECARD 5.0

    =======================================================================

                                 JOINT HEARING

                                   BEFORE THE

                                SUBCOMMITTEE ON
                             INFORMATION TECHNOLOGY

                                    AND THE

                                SUBCOMMITTEE ON
                             GOVERNMENT OPERATIONS

                                     OF THE

                             COMMITTEE ON OVERSIGHT
                             AND GOVERNMENT REFORM
                            HOUSE OF REPRESENTATIVES

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                               NOVEMBER 15, 2017

                                   __________

                               Serial No. 115-55

                                   __________

    Printed for the use of the Committee on Oversight and Government Reform

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

             Available via the World Wide Web: http://www.fdsys.gov
                           http://oversight.house.gov

                                _________

                    U.S. GOVERNMENT PUBLISHING OFFICE

     29-502 PDF              WASHINGTON : 2018
    ____________________________________________________________________
     For sale by the Superintendent of Documents, U.S. Government Publishing Office,
    Internet:bookstore.gpo.gov. Phone:toll free (866)512-1800;DC area (202)512-1800
      Fax:(202) 512-2104 Mail:Stop IDCC,Washington,DC 20402-001

                  Committee on Oversight and Government Reform

                      Trey Gowdy, South Carolina, Chairman
    John J. Duncan, Jr., Tennessee       Elijah E. Cummings, Maryland,
    Darrell E. Issa, California              Ranking Minority Member
    Jim Jordan, Ohio                     Carolyn B. Maloney, New York
    Mark Sanford, South Carolina         Eleanor Holmes Norton, District of
    Justin Amash, Michigan                   Columbia
    Paul A. Gosar, Arizona               Wm. Lacy Clay, Missouri
    Scott DesJarlais, Tennessee          Stephen F. Lynch, Massachusetts
    Blake Farenthold, Texas              Jim Cooper, Tennessee
    Virginia Foxx, North Carolina        Gerald E. Connolly, Virginia
    Thomas Massie, Kentucky              Robin L. Kelly, Illinois
    Mark Meadows, North Carolina         Brenda L. Lawrence, Michigan
    Ron DeSantis, Florida                Bonnie Watson Coleman, New Jersey
    Dennis A. Ross, Florida              Stacey E. Plaskett, Virgin Islands
    Mark Walker, North Carolina          Val Butler Demings, Florida
    Rod Blum, Iowa                       Raja Krishnamoorthi, Illinois
    Jody B. Hice, Georgia                Jamie Raskin, Maryland
    Steve Russell, Oklahoma              Peter Welch, Vermont
    Glenn Grothman, Wisconsin            Matt Cartwright, Pennsylvania
    Will Hurd, Texas                     Mark DeSaulnier, California
    Gary J. Palmer, Alabama              Jimmy Gomez,California
    James Comer, Kentucky
    Paul Mitchell, Michigan
    Greg Gianforte, Montana

                         Sheria Clarke, Staff Director
                      Robert Borden, Deputy Staff Director
                        William McKenna, General Counsel
       Troy Stock, Subcommittee on Information Technology Staff Director
                             Kiley Bidelman, Clerk
                     David Rapallo, Minority Staff Director
                     Subcommittee on Information Technology

                           Will Hurd, Texas, Chairman
    Paul Mitchell, Michigan, Vice Chair  Robin L. Kelly, Illinois, Ranking
    Darrell E. Issa, California              Minority Member
    Justin Amash, Michigan               Jamie Raskin, Maryland
    Blake Farenthold, Texas              Stephen F. Lynch, Massachusetts
    Steve Russell, Oklahoma              Gerald E. Connolly, Virginia
                                         Raja Krishnamoorthi, Illinois
                                     ------

                     Subcommittee on Government Operations

                     Mark Meadows, North Carolina, Chairman
    Jody B. Hice, Georgia, Vice Chair    Gerald E. Connolly, Virginia,
    Jim Jordan, Ohio                         Ranking Minority Member
    Mark Sanford, South Carolina         Carolyn B. Maloney, New York
    Thomas Massie, Kentucky              Eleanor Holmes Norton, District of
    Ron DeSantis, Florida                    Columbia
    Dennis A. Ross, Florida              Wm. Lacy Clay, Missouri
    Rod Blum, Iowa                       Brenda L. Lawrence, Michigan
                                         Bonnie Watson Coleman, New Jersey

                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on November 15, 2017................................     1

                                   WITNESSES

    Mr. Dave Powner, Director of IT Management Issues, Government
      Accountability Office
        Oral Statement...............................................     4
        Written Statement............................................     6
    Mr. Max Everett, Chief Information Officer, Department of Energy
        Oral Statement...............................................    41
        Joint Written Statement......................................    43
    Ms. Alison Doone, Acting Chief Financial Officer, Department of
      Energy.........................................................    53
    Mr. John Bashista, Director of Acquisition Management, Department
      of Energy......................................................    58
    Ms. Barbara Helland, Associate Director of Advanced Scientific
      Computing Research, Department of Energy.......................    58

                                   Panel II:

    Mr. Dave Powner, Director of IT Management Issues, Government
      Accountability Office
        Oral Statement...............................................    60
    Mr. Wade Warren, Acting Deputy Administrator, U.S. Agency for
      International Development
        Oral Statement...............................................    60
        Written Statement............................................    62
    Mr. Jay Mahanand, Chief Information Officer, U.S. Agency for
      International Development......................................    67
    Mr. Reginald Mitchell, Chief Financial Officer, U.S. Agency for
      International Development......................................    68

                                   Panel III:

    Mr. Dave Powner, Director of IT Management Issues, Government
      Accountability Office
        Oral Statement...............................................    74
    Ms. Althea Coetzee Leslie, Deputy Administrator, Small Business
      Administration
        Oral Statement...............................................    75
        Written Statement............................................    77
    Ms. Maria Roat, Chief Information Officer, Small Business
      Administration.................................................    82
    Mr. Tim Gribben, Chief Financial Officer, Small Business
      Administration.................................................    84

                                    APPENDIX

    Opening Statement of Ranking Member Gerald E. Connolly...........    86
    Memo from Mr. Max Everett to the Secretary of the Department of
      Energy regarding the designation of the CIO as direct report to
      the Secretary, submitted by Chairman Hurd......................    89

           THE FEDERAL INFORMATION TECHNOLOGY ACQUISITION REFORM ACT

                             (FITARA) SCORECARD 5.0

                                  ----------

                          Wednesday, November 15, 2017

                      House of Representatives,
     Subcommittee on Information Technology Joint with
                 Subcommittee on Government Operations,
                  Committee on Oversight and Government Reform,
                                                       Washington, D.C.
        The subcommittees met, pursuant to call, at 2:45 p.m., in
    Room 2154, Rayburn House Office Building, Hon. Will Hurd
    [chairman of the Subcommittee on Information Technology]
    presiding.
        Present: Representatives Hurd, Amash, Massie, Gianforte,
    Blum, Kelly, Connolly, Norton, and Krishnamoorthi.
        Mr. Hurd. The Subcommittee on Information Technology and
    the Subcommittee on Government Operations will come to order.
        Without objection, the chair is authorized to declare a
    recess at any time.
        And I now recognize myself for 5 minutes for my opening
    remarks.
        Good afternoon. I appreciate you all being here today.
    Today's hearing is part of this committee's continuing
    oversight of Federal IT. This began with GAO's high-risk report
    and the designation of IT acquisition on that report back in
    February of 2015, and it's been a priority of ours ever since.
        And due to the importance we place on this issue, our
    committee staffs worked with GAO to develop a scorecard to
    assess agencies' FITARA implementation efforts. This bipartisan
    scorecard has been issued every 6 months, beginning 2 years ago
    on November 4, 2015.
        The scorecard has evolved each iteration in response to GAO
    recommendations and stakeholder feedback. Scorecard 5.0 adds a
    fifth graded category to assess agencies' management of
    software licenses. We previewed this category as part of
    scorecard 4.0. For scorecard 6.0, a measure of whether agencies
    have established working capital funds as authorized by the MGT
    Act, which I was pleased to see included in the final NDAA,
    will be made a part of the scorecard.
        Ultimately, I'd like to see the scorecard evolve beyond
    FITARA implementation to more of a digital hygiene score for
    agencies. Adding megabyte implementation to this scorecard is a
    step in that direction.
        The inclusion of software licensing had a negative overall
    impact on the grades. Since the last scorecard, 3 agencies'
    grades increased, 15 agency grades stayed the same, and 6
    decreased. If software licensing were not included, 8 agencies'
    grades would have increased, 14 would have stayed the same, and
    2 would have decreased. So progress is being made, just not as
    quick as it should be and needs to be.
        Legacy IT is a continuing fiscal and cybersecurity risk to
    our Nation. Those 17 agencies received an F on this new metric
    for the FITARA scorecard 5.0. It is worth noting that each of
    these agencies has efforts underway to create and use an
    inventory of software licenses.
        I hope to hear from each agency today how they plan to
    improve their score in this area. I also hope to hear from Mr.
    Powner, his thoughts on where we will be governmentwide on this
    metric in 6 months for scorecard 6.0.
        Today's hearing features three panels, with officials from
    the Department of Energy, the United States Agency for
    International Development, and the Small Business
    Administration. Their grades are a D-plus, A-minus, and C-
    minus.
        As always, I'm honored to be exploring these issues in a
    bipartisan fashion with my friend and ranking member, the
    Honorable Robin Kelly, from Illinois. I'm also pleased to be
    joined by Chairman Meadows and Ranking Member Connolly from the
    Government Operations Subcommittee. I could not have asked for
    better partners in the effort to modernize technology in the
    Federal Government. And I thank my colleagues and the witnesses
    and all who have joined us in person, and for those folks who
    are watching online, for participating today.
        I now recognize my friend, the ranking member of the
    Information Technology Subcommittee, Ms. Kelly, for 5 minutes
    and her opening statement.
        Ms. Kelly. Before we begin today's hearing, I also want to
    thank you, Chairman Hurd, Chairman Meadows, and Ranking Member
    Connolly, for your steadfast leadership as our subcommittees
    continue working together to oversee the improvement of Federal
    IT systems. I'm glad to have such great partners in this
    endeavor.
        Improving the efficiency and security of the Federal
    Government's IT systems is essential to our Nation's security.
    Crucial to that effort is the ongoing oversight conducted by
    our subcommittees to hold agencies accountable for implementing
    key aspects of the Federal Information Technology Acquisition
    Reform Act. An important part of that oversight has been the
    scorecard our subcommittees developed for grading agency
    progress and meeting the FITARA requirements.
        Today, our subcommittee released the fifth version of the
    scorecard. It's been 2 years since we released the first one
    and held our first hearing on this issue. Since that time,
    we've strengthened the role of the CIO at many agencies,
    increased transparency in project management, and we've saved
    billions of taxpayer dollars. I'm proud of the work we've
    accomplished together so far.
        The new scorecard, however, shows that progress is
    difficult and that we still have a long way to go. For example,
    as the chairman talked about, while some agencies like the U.S.
    Agency for International Development has done well, going from
    a D in 2015 to an A-minus today, others like the SBA has fallen
    behind and gone from D in 2015 to a C-minus today.
        Overall, the grades for only three agencies went up on the
    scorecard, 15 stayed the same, and 6 actually went down. The
    scorecard makes clear that agencies still have a long way to go
    to address the challenge of reducing the growing number of
    Federal data centers.
        The FITARA Enhancement Act that was introduced by Ranking
    Member Connolly earlier this year would extend the timeline for
    agencies to close any unneeded data centers. The bill will also
    provide greater support to agency CIOs in their effort to
    eliminate and consolidate large numbers of data centers.
        Since the release of the last scorecard, the subcommittees
    have added software licensing as a metric of performance to
    this one. The overall grades in this category indicate that
    agencies are struggling when it comes to the management of
    their software licenses.
        I am concerned about this most recent scorecard
    performance, and look forward to hearing from today's agencies
    on the struggles and challenges they are facing in FITARA
    implementation and how Congress can be more helpful.
        There is simply too much at stake when it comes to FITARA.
    This isn't just about saving taxpayer money; it's about
    improving the overall general hygiene of the Federal
    Government, and the scored metrics here are the basics of
    running any shop.
        I want to thank the witnesses for testifying today.
        Mr. Powner, you might just be the most popular witness on
    the Hill. This is your fifth hearing with us on FITARA. I'm
    also looking forward to hearing from all the agencies here
    today. Thank you so much.
        Thank you, Mr. Chair.
        Mr. Hurd. Thank you, Ranking Member.
        And when the other members get here and want to do opening
    remarks, we can do that at the next panel. But let's go ahead
    and get into our first panel.
        I'd like to introduce the witnesses. As the gentlewoman
    from Illinois recognized, Mr. Dave Powner, one of probably--
    holds the record of number of times coming before this
    committee, the director of IT management issues at the
    Government Accountability Office.
        Max Everett, chief information officer at the Department of
    Energy; Ms. Alison Doone, acting chief financial officer at the
    Department of Energy; and Mr. John Bashista, director of
    acquisition management, also at DOE; and Ms. Barbara Helland,
    associate director of advanced scientific computing research at
    the Department of Energy. Appreciate you all being here.
        And pursuant to committee rules, all witnesses will be
    sworn before you testify, so please rise and raise your right
    hand.
        Do you solemnly swear or affirm that the testimony you're
    about to give is the truth, the whole truth, and nothing but
    the truth, so help you God?
        Thank you.
        Let the record reflect all witnesses answered in the
    affirmative.
        In order to allow time for discussion, please limit your
    testimony to 5 minutes, and your entire written statement will
    be made part of the record. As a reminder, the clock in front
    of you shows your remaining time. The light will turn yellow
    when you have 30 seconds left, and the red is when your time is
    up. Please also remember to push the button to turn on your
    microphone before speaking.
        And now I'd like to recognize Mr. Dave Powner for his
    opening remarks.

                           WITNESS STATEMENTS

                        STATEMENT OF DAVE POWNER

        Mr. Powner. Chairman Hurd, Ranking Member Kelly, and
    members of the subcommittees, I would like to thank you and
    your staff for your continued oversight on the implementation
    of FITARA with this fifth set of grades.
        We've added a fifth category to grades, software licensing,
    at your request, so now the FITARA scorecard covers five of the
    seven major areas of this law. Overall, three agencies' grades
    went up: Education, OPM, and SBA; 6 went down; and 15 remained
    the same. Of the six that went down--Energy, DHS, HUD,
    Transportation, EPA, and Justice--none had a software license
    inventory, and received Fs in this subcategory.
        Regarding the software license area, 6 months ago when you
    previewed this area with scorecard 4.0, only three agencies had
    complete inventories. Now, seven do. And six of these seven
    report savings in this area: Ag, Education, GSA, NASA, VA, and
    USAID. Those six received As for this. Labor gets a C, and 17
    agencies without inventories receive Fs. Progress, but clearly
    not enough, given that this was a major section of FITARA and
    was followed up with the MEGABYTE Act.
        Another area where significant progress needs to be made is
    optimizing data centers. SSA, EPA, and GSA report solid
    progress against the five optimization metrics. Education and
    HUD are out of the data center business, as they no longer have
    any agency-owned data centers. The other 19 agencies have a
    ways to go to optimize these centers.
        The key point here is that additional and substantial
    savings can still be realized as we see better utilization of
    these facilities and equipment.
        I'd like to conclude this overview by thanking this
    committee, Chairman Hurd and Meadows, and Ranking Members Kelly
    and Connolly, and your dedicated staff, not only for your
    consistent and thorough oversight of FITARA, but also for your
    followup with the FITARA extension and the MGT Act to give
    agencies more time to implement more completely and to provide
    additional avenues for reinvesting savings in modernization
    priorities.
        Now turning to the Department of Energy. Energy plans to
    spend about $1.8 billion on IT this year. About half of this
    spending is for IT programs at the National Nuclear Security
    Administration. Energy's grades have fluctuated over the five
    scorecards between Fs and Cs, and their current grade is a D-
    plus.
        The plus here is of major significance, and I would very
    much like to commend Max Everett and the Department's
    leadership as Energy is the only agency that has elevated their
    CIO reporting since FITARA was enacted.
        Another positive note is in the area of incremental
    development where they received an A. This is consistent with
    the report that we just issued on this topic where Energy was
    only one of four agencies that had incremental certification
    policy consistent with OMB guidance in FITARA.
        Turning to areas where Energy needs to improve, let's start
    with CIO tenure. Since 2004, the average CIO tenure at Energy
    has only been 1.7 years. This is a major issue and reason why
    IT has not been effectively managed.
        On data centers, Energy is reported saving $21 million
    between 2012 and 2017. However, they report not meeting any of
    the five metrics and have no additional planned savings. Their
    closures will fall short of OMB's goals for both small and
    large centers. The bottom line here is that if you're short on
    metrics, there is likely more closures and savings to be had.
        Energy's software license inventory is not complete. It
    covers CIO-controlled licenses, and they're working on
    completing the inventory for the other components.
        Finally, I'd like to note that our work for this committee
    on IT budgeting and CIO authorities shows that Energy's CIO has
    challenges in the area of IT budgeting and execution, meaning
    that there needs to be more visibility into the IT budget and
    better governance over their important system acquisitions.
        Mr. Chairman, this concludes my comments on the Department
    of Energy.
        [Prepared statement of Mr. Powner follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thank you, Mr. Powner.
        Now every agency is going to provide one oral remark, and I
    believe, Mr. Everett, you're going to do that for Department of
    Energy. So now you're recognized for 5 minutes.

                        STATEMENT OF MAX EVERETT

        Mr. Everett. Good afternoon, Chairman Hurd and Ranking
    Member Meadows, Ranking Member Kelly, and Ranking Member
    Connolly, and distinguished members of the committee.
        On behalf of the Secretary and deputy secretary, I want to
    thank you for inviting me to testify about the Department of
    Energy's implementation of FITARA. FITARA and its cybersecurity
    complement, FISMA, provide me the authority I need to manage
    DOE's information technology resources and cybersecurity
    program.
        I would also like to just mention, my colleagues have come
    up here who are helping us, that you introduced, they are going
    to be a critical part of telling you about the progress we're
    making at the Department.
        I would also like to acknowledge the dedicated career and
    contractor IT and cybersecurity professionals across the
    Department whose critical efforts transcend changes in
    administration. The team provided me a strong baseline from
    which to build, specifically, Mr. Robby Green, who did an
    outstanding job as the acting DOE CIO prior to my appointment.
        In order to effectively exercise FITARA responsibilities, I
    now report directly to the Secretary and deputy secretary, as
    Mr. Powner noted. They recognize not only the statutory
    requirement for this, but the best practice for public and
    private sector organizations to have technology leadership
    represented at the executive level.
        This change originated with a secretarial memorandum, and
    is reflected in the DOE organizational chart. I have regular
    meetings with the deputy secretary who every month calls to
    order the Department's senior leadership to evaluate progress
    on DOE's IT and cybersecurity strategic goals. My reporting and
    working relationships with them are evidence of the success of
    this FITARA requirement. Direct access to senior leadership is
    critical to effective IT management at the program office level
    as well.
        My office is developing guidance to program offices with
    embedded CIOs or officials with CIO-like functions, that they
    follow the FITARA reporting model and elevate these officials
    to a direct reporting relationship with their respective senior
    leadership.
        The deputy secretary has instructed that my office should
    be engaged in the hiring process for any IT management series
    2210s across the Department. Both at DOE and throughout Federal
    Government, the traditional outdated model of an IT worker is a
    challenge. We need professionals with multidisciplinary skills,
    not just the coding and network and typical skills that we look
    at for IT professionals.
        With respect to consolidation and optimization of data
    centers, we've closed 84 data centers since 2010, resulting in
    savings of approximately $21 million, and plan to shutter
    another 11 more by the end of fiscal year 2018. That said, we
    need to do more in this area, which is why we're examining ways
    to effectively accelerate that process.
        One catalyst for optimizing DOE data centers is our
    expanded use of cloud services. Our diverse department with 97
    sites in 27 States can see significant value from increasing
    our use of cloud computing.
        The National Labs are an integral component of the
    department, and as CIO, I engage with the labs through a number
    of means, including the annual laboratory planning and
    appraisal reviews. I have the opportunity to comment on
    National Lab IT activities and can refocus our efforts to
    address our concerns through development of performance
    evaluation and measurement plans, which define notable outcomes
    that the labs must meet in the coming year. I have regular
    meetings with our National Lab CIOs. I also speak regularly
    with the National Lab directors, as well as the lab operating
    board and participate in their governance meetings.
        DOE is closely monitoring the pending MGT Act to leverage
    any benefits that come out of that. We intend to use FITARA as
    well to continue to be more granular and transparent in our IT
    cost in order to prioritize the digital transformation that we
    need to undertake as a department.
        In detailing the changes, improvements, and the many
    challenges that I have seen, it's been my aim to demonstrate
    that our department is moving in the right direction. The
    Department's IT and cybersecurity governance mechanisms are
    inclusive, transparent, and we're seeking to facilitate timely
    performance of our diverse mission.
        I firmly believe we're continuing to advance and improve,
    which would not be possible without the authorities granted by
    FITARA. I'm encouraged by the interest and the efforts of this
    committee and the efforts as well shown by our leadership at
    the Department, and I look forward to achieving those shared
    goals.
        It's been my distinct honor to testify here today. And I
    would be pleased now to address your questions. Thank you.
        [Prepared joint statement of Mr. Everett, Ms. Doone, Mr.
    Bashista, and Ms. Helland follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thank you, Mr. Everett.
        Now I'm going to recognize the gentleman from Montana, Mr.
    Gianforte, for 5 minutes of questions.
        Mr. Gianforte. Thank you, Mr. Chairman and Ranking Member
    Kelly.
        I'm new on the Hill. I spent my career in the private
    sector doing IT deployments for large organizations, including
    deployments at 170 Federal agencies. So I very much appreciate
    you each being here.
        I wanted to focus on three specific things: First, for Mr.
    Powner generally and then Mr. Everett specifically at DOE,
    around some best practices that are used in the private sector
    and to what extent they're present. You've already mentioned
    one, Mr. Everett, the movement to the cloud. Why don't we start
    there.
        I'm curious, Mr. Powner, to what extent is movement to the
    cloud a priority within the agencies that you work with and
    audit? And do you have any metrics around percentage of
    enterprise applications moved into cloud facilities?
        Mr. Powner. I don't have good metrics on those percentages,
    but we have tracked movement to the cloud as a percentage of
    their IT budget. That's been somewhere in like--on average,
    it's about 4 to 5 percent when you look at agencies' IT budget.
        So the bottom line on this is clearly there needs to be
    more movement to the cloud. You know, we started this years
    ago, and the security was the big concern, and then you had the
    intel community going to the cloud. Folks felt more comfortable
    with that. We clearly need to go more to the cloud.
        I think when you look at the data center situation, there
    are about at least a third of the agencies that project they're
    going to be nowhere near optimizing their centers, and they
    ought to be looking to outsource that and go towards the cloud,
    you know, for many of those data centers and everything.
        A couple agencies are already out of the business. We
    probably need a few more of them if they can't manage this more
    effectively.
        Mr. Gianforte. And when you say cloud, do you mean
    consolidated data centers or are you actually moving to more
    commercial, multi-tenant applications?
        Mr. Powner. It's all the over the board. There's--you know,
    infrastructure is a service. You've also got software as a
    service. So it's both the infrastructure and some of the
    applications.
        Clearly, when you look at the commodity or business
    systems, there is--that's kind of a no-brainer. In a lot of
    those areas we ought to be going more towards cloud services.
    There is some big applications, electronic health records, I
    know we've talked to the chairman about this a lot, with the VA
    and DOD going to the common electronic health record. There's
    commercial products that are out there.
        Mr. Gianforte. Mr. Everett, at DOE.
        Mr. Everett. Sure. So I would certainly address, across the
    Federal Government, I think the numbers are disappointing. At
    DOE, I think they're--you know, having come in, I think they're
    very disappointing. We need to be moving much more quickly on--
    again, I think you hit on that--the commodity IT activities we
    need to move more quickly to the cloud. I think that will help
    us certainly with data center. I think there is some value to
    moving out of Federal data centers into hosted environments,
    not as an end goal, but I think that starts to break some of
    the workforce and cultural challenges we have.
        We've got to have the right skill sets to make a move to a
    cloud. It's a different--it is different skill sets. It's much
    more about managing services, managing service levels, rather
    than managing people and sort of the turning dials. We've got
    to do a lot of work around that. Those things have to go
    together. I believe they can go together in peril.
        In some cases, you know--frankly, my hope is that we just
    find some things and rip the Band-Aid and just move things.
    We've got a lot of commodity things that should, frankly, be
    able to move very quickly to the cloud.
        Mr. Gianforte. Yeah. As we talk about these scorecards, it
    might be interesting to look at what percentage have we moved
    to the cloud. I know in our own experience doing these
    enterprise deployments, an off-the-shelf cloud deployment
    typically can speed deployment by 5X and typically reduces
    operating cost by 80 percent over the life of the system, and
    that's just good for taxpayers and it's better from a security
    perspective.
        The second area I want to talk on, you mentioned the
    shortage of labor, particularly in the cybersecurity area. One
    of the practices in the private sector is the use of commercial
    third-party firms for either cybersecurity audits or
    penetration testing. To what extent is that a general practice,
    Mr. Powner, and then specifically at DOE?
        Mr. Powner. I think when you start looking at contractors
    and third parties, it's pretty heavy in the Federal Government.
    I think the challenge in the Federal Government is having
    enough of an IT workforce to oversee those contractors. I mean,
    because we've got prime contracts and then you've got program
    management that's being outsourced to private sector firms.
    Clearly, the security penetration tests and all that, that's
    going out.
        So the challenge, I think, in the government is having
    enough of qualified IT workforce to oversee those key contracts
    where we don't have the internal skills.
        Mr. Gianforte. Okay. Mr. Everett, we have about 30 seconds.
        Mr. Everett. I would concur with that. I think one of our
    challenges is we're, you know--frankly, we're very contractor
    heavy. We depend on the skills that our contractors bring, but
    we need--our Federal workforce has got to have some skills in
    terms of, again, managing them, managing business requirements,
    managing the budgets around that. I think those are a critical
    element to doing that. And we've got--and, again, that takes
    some of the Federal workforce. They have to know the right
    questions. They have to be looking for the right solutions to
    then bring in the proper contracting and talent and capability.
        And I think you know that recruiting, you know from your
    private sector experience as I do, that's an extraordinary
    challenge we face right now.
        Mr. Gianforte. Yeah. Okay. Thank you.
        I yield back, Mr. Chairman.
        Mr. Hurd. The gentleman yields back.
        I now recognize Ms. Kelly for 5 minutes of questions.
        Ms. Kelly. Thank you, Mr. Chair.
        The committee's scorecard shows that since the release of
    one of its last scorecards, June 2017, many agencies appear to
    have hit roadblocks in their progress under FITARA. For
    example, as we've talked about, the current scorecard shows
    that the overall letter grades for 15 agencies stayed the same,
    6 went down, and only 3 increased.
        Mr. Powner, in which of the five key areas of FITARA that
    was scored has GAO found agencies are struggling the most?
        Mr. Powner. Well, clearly, when you look back on the 4.0, I
    think the data center optimization, because we added the
    metrics category there, it wasn't just based on savings, and
    that was at the request of a lot of folks.
        And, again, there's about--there's 2 agencies that are out
    of the data center business, 3 agencies doing a decent job, and
    19 that I would say are doing poorly, and that's a big reason
    why the grades went down. And then now with 5.0, when you have
    17 agencies getting Fs because they don't have a software
    license inventory, that's a key reason. So those are the two
    big ones.
        Ms. Kelly. And so what accounts for the challenges? Is it
    just the software license, or what's accounting for the
    challenges?
        Mr. Powner. I think when you look at the data centers, I do
    think it's--given where we were at, for instance, on server
    utilization, to try to go from a 9 to 12 percent to 65 percent
    metric that OMB has, okay, that's a big leap.
        The software licensing, I have a hard time understanding
    that. We did a report 4 years ago that told agencies that they
    should get software licenses. It was in FITARA. It's one of the
    seven sections. You followed up with MEGABYTE. I think it's
    inexcusable that we do not have software license inventories at
    this point in time.
        Ms. Kelly. Thank you.
        Mr. Everett, the Department of Energy was one of the three
    agencies whose letter grade actually went down. What are the
    challenges you're facing?
        Mr. Everett. There's a number, as you can clearly see. I
    think, look, the reality is our scorecard accurately represents
    some significant challenges we have. And Mr. Powner hit on,
    frankly, two of them. One of them is we have too many data
    centers that we don't have a handle around, and we need to more
    aggressively--again, part of this is we're--on the data centers
    we're doing some things around DCIM, which gives us some better
    measurements of actually how we're using those existing data
    centers.
        I think that will drive some business requirements and some
    business cases to close some and help us actually use them
    better. But the better answer to that is move to the cloud.
    Again, for things that are a simple commodity, the answer is
    we've got to get to the cloud and we've got to do it faster.
        I can't disagree either on--you know, look, some of my
    nontechnical colleagues at the Department have asked me, why
    don't we have a software asset inventory. And they're right. It
    shouldn't be that hard.
        Now, I will say that we did a data call. We have, I think,
    over 64,000 lines within the database we collected of that. We
    have a significant inventory. It's not complete, and we're not
    going to represent it as complete until it is. The vast
    majority of that that came back was, in fact, provided
    electronically, so that exists in pockets in parts of our
    department.
        We have a number of gaps in the Department, areas that
    don't have that capability. So one of the things we're doing is
    leveraging. We're going back and looking at CDM. We have gaps
    in our CDM deployment, and we're actually going back and trying
    to line that up and find out, all right, where do we have gaps
    within programs and offices that need help at the enterprise
    level from my office to come back and fill the gaps so that we
    can have a complete software asset inventory.
        And, again, I just want to add, the software asset
    inventory is valuable not just to have it; it drives--you know,
    as I work with our acquisition team and work in conjunction
    with them, it's going to save us money. We know that for a
    fact.
        It's going to help us reduce our threat surface because
    it's going to tell us what kind of software we have or don't
    have. And then it's going to help us drive our IT
    transformation as we can see the gaps in capability or,
    frankly, where we have overlap in capability where we probably
    have people buying two or three different of the same
    capability in different software packages. That just needs to
    be eliminated.
        So there's no painting it any other way. Again, I
    understand many people are failing at it, but I don't--it's not
    rocket science. It's not hard. And we are pushing rapidly
    through those means to get it fixed.
        Ms. Kelly. And do you have any, not saying everything all
    at once, but any time projections or what do you see?
        Mr. Everett. So with respect to--certainly with the
    software inventory piece, we're in the process right now, we've
    brought somebody into actually to help us be strategic about
    CDM. And, again, our focus there is what are the gaps.
        We have a lot of people that have really great capabilities
    that meet many of the CDM requirements and needs. What we're
    looking for is where are the gaps. And then as an enterprise,
    as a department, how do we come in and help them fill those
    gaps.
        And, again, because we have a number--we have a very
    federated, diverse department, we have a lot of good best
    practices. We've got a lot of labs and other folks who have
    great tools in place. We're working with them to get actually
    what's working for them and try and replicate that or build it
    across the Department.
        I'll say on, again, on data centers, one of the immediate
    things we're working on is we've had some folks working on this
    DCM pilot. And, again, our labs have actually led the way. A
    number of our labs have put DCM tools in place and have worked
    with my team to share best practices that we can do across the
    Department. So our next step there is a pilot that we expand
    across the Department. That's going to give us a more accurate
    picture. And I think what it's going to show is that we have a
    lot of data centers. We just don't need anymore.
        Ms. Kelly. Thank you.
        Mr. Hurd. My first question's actually for Mr. Powner, but
    you're going to have to look for something. Towards the end of
    your statement, you talked about budget and system acquisition.
    I want you to pull that up. And while you're looking for that,
    I'm going to go to Mr. Everett.
        Mr. Everett, take about 30 seconds and tell me how your
    position changed from to reporting to directly to the agency
    head or the deputy agency head.
        Mr. Everett. Sure. Well, I--as I walked to the Department
    in July, you know, obviously I'd done a little research before
    I walked in. I knew that was the case. I've been around Federal
    Government and private sector the last number of years, so I
    was very aware that this is a challenge across government. And
    I knew walking in the door that that was something I was going
    to immediately have changed.
        The good news for me was I have a Secretary and a deputy
    secretary, both of whom have seen in public and private sector
    that that was valuable and important. They understood, without
    really any argument from me, that that was simply a best
    practice. And so, literally, it probably would have even
    happened faster. It just took a while to get the memo written
    and get it passed up to the front office.
        But for our office, I'll simply tell you that our
    leadership understood that it wasn't even really a question. It
    was an expectation that IT would be part of the leadership and
    part of this process.
        Mr. Hurd. I would like to attribute that to Secretary
    Perry's training at the illustrious Texas A&M University for
    giving him that understanding.
        And without objection, I'd like to introduce into the
    record a memo from Max Everett to the Secretary of Department
    of Energy about the designation of the CIO as a direct report
    to the Secretary, deputy secretary.
        So ordered.
        Mr. Hurd. For those that are going to read about this on
    FedScoop, and CIOs that are not reporting directly to an agency
    head or deputy agency head, they should see this memo. And
    unfortunately, there is still 12 departments or agencies where
    the Federal CIO doesn't report directly.
        I just want to clarify a point, Mr. Everett, because I
    think you addressed it fairly well. Can you answer that you
    know 100 percent of what's on your network?
        Mr. Everett. Right now, I would have to tell you the answer
    is no. I think the vast majority of people who tell you that,
    I'm not sure that they're being accurate.
        Mr. Hurd. Gotcha. Because my assumption is, if you have a
    number of agencies that don't understand what software they
    have on their system, they also don't know what hardware they
    have on their system. And that introduction of unknown
    vulnerabilities is scary.
        Mr. Powner, did you find the quote I was looking for?
        Mr. Powner. Yes, I did.
        Mr. Hurd. Can you repeat that statement, please?
        Mr. Powner. ``Finally, I'd like to note that our work for
    this committee on IT budgeting and CIO authority shows that
    Energy CIO is challenged in the areas of IT budgeting in
    execution, meaning that there needs to be better visibility
    into the IT budget and better governance over their system
    acquisitions.''
        Mr. Hurd. Ms. Doone, you're the CFO, correct, acting CFO?
        Ms. Doone. Yes.
        Mr. Hurd. What are you going to do to help Mr. Everett with
    that problem?
        Ms. Doone. We have been working--the CFO office has been
    working with CIO since the enactment of FITARA to do just that,
    to improve the alignment of the IT portfolio with the budgeting
    process.
        Even before the OMB guidance was issued back in 2015 for
    the fiscal year 2017 budget cycle, we issued guidance out to
    all the program offices to have them identifying their IT spend
    by program activity and by project. CIO did the likewise, so
    that their IT portfolio would start delineating the IT across
    the entire department.
        Mr. Hurd. Ms. Doone, do you have responsibility--financial
    responsibilities over the National Laboratories as well?
        Ms. Doone. The National Laboratories financial
    responsibility is managed by the program offices. So they
    report and they submit their budget request up through the
    program offices, who put their budgets included in their
    program office budgets that come to CFO.
        Mr. Hurd. So as the CFO of Department of Energy, you have
    the similar challenges that your colleague, Mr. Everett, has
    with these siloed activities by the National Labs, that even
    though you're responsible for all the Department of Energy,
    that you may not have the greatest insight into that. Is that
    an accurate statement?
        Ms. Doone. It is an accurate statement, but I would suggest
    that it's getting better. With the expansion of the IT
    portfolio over the last couple of years, we and CIO have
    expanded the number of data elements that the program offices
    are providing us. So we are now able to reconcile the IT
    portfolio with the budget submission that we are getting from
    the program offices.
        And I think one of the biggest benefits that we've had--we
    started working directly with CIO from the very beginning of
    the enactment of FITARA. I think the biggest accomplishment has
    been the budget and financial management staff in the program
    offices and their IT counterparts working closely together for
    the first time. And I think that's where we're going to begin
    to see more visibility and better transparency, and it's been
    both at the Federal program office level and at the National
    Laboratory level.
        Mr. Hurd. Thank you.
        The gentleman from the Commonwealth of Virginia is now
    recognized for his 5 minutes of questions.
        Mr. Connolly. I thank the chair, and welcome to the panel.
        By the way, I would say to my friend from Montana, as
    someone who also spent 20 years in the private sector before
    coming here, in the technology sector, one might look for
    metrics. If you want to know how you're doing in cloud, look at
    the data on data center consolidation, because you're not
    moving to the cloud if that's not being consolidated. If you're
    consolidating it, you are moving to the cloud, because you have
    to.
        Now, Mr. Everett, let me just say, I believe you get it and
    I believe you are an agent of change. And I think the memo the
    chairman cited gives evidence of that. So don't take this
    hostilely, but your words are welcome, but you got an F in data
    center consolidation. Your score went down, not up, which
    suggests regression.
        And it is the Department of Energy, the National Labs, that
    kind of in the dead of night went to the U.S. Senate and got an
    exemption for themselves. The ink wasn't even dry in FITARA.
    Last time I checked, that's under your purview, which would
    suggest resistance to change, to trying to get this right.
        So why should we believe, you notwithstanding, all of you
    being sincere human beings, why should we not believe that,
    frankly, the Department of Energy is retrograde, they're not
    with the program, they're not cooperating, they're treading
    water in the hopes we'll give up and stop looking, and
    progress, you know, is just not in the forecast?
        Mr. Everett. Well, we have to make that change.
        Mr. Connolly. I can't hear you.
        Mr. Everett. Apologies. Ranking Member, I think the answer
    is we have to make that change. I hope that you don't give up.
        Mr. Connolly. Oh, we won't give up.
        Mr. Everett. I know you won't, but, you know, even beyond
    my tenure, I hope that you don't give up. One of the reasons
    that Ms. Helland is up here is, I can tell you, in my 4\1/2\
    months at the Department, her work in the Office of Science has
    been a huge help and a huge part of correcting some of those
    issues.
        I can tell you that our approach, and this starts directly
    with my Secretary and deputy secretary, and I have been in
    their presence when they told this directly to the lab
    directors was that there is one department. That is their
    expectation. That is the expectation they have given to me.
    That is the expectation I repeat on a regular basis.
        And so I believe that's--you know, history aside, I believe
    that's a starting point. I'm glad that Ms. Helland joined us,
    because, again, she has been an ally to me. I think she can
    talk about some of the work she's actually been doing to help
    us build some of the reporting mechanisms around CPIC, around
    FITARA, around how we hold the labs to a level of
    accountability that we expect for everyone in the Federal
    Government.
        Mr. Connolly. And I want to hear that from Ms. Helland,
    but--just one more--but you got an F in data center
    consolidation, which is the heart and sole of FITARA. It's how
    we save money. It's how we reinvest in ourselves. It's how--
    it's an actual metric whereby we measure are we making progress
    or not. Tell me why you got an F.
        Mr. Everett. Because we haven't done the job. I mean, there
    is no way around it.
        Mr. Connolly. All right. Have you set metrics for yourself
    internally?
        Mr. Everett. We have.
        Mr. Connolly. Okay. How many data centers are there in the
    Department of Energy?
        Mr. Everett. I'll pull it up here, but there are----
        Mr. Connolly. All right. Take you time while we listen to
    Ms. Helland.
        Mr. Everett. 289.
        Mr. Connolly. 289, okay. He's telling the truth, right? No.
    So 289. Have you set a goal for yourself that by, you know, a
    year from now or the next report card there will be 289 minus
    X?
        Mr. Everett. The existing goal is 11, is to reduce it by
    11.
        Mr. Connolly. By 11?
        Mr. Everett. By 11.
        Mr. Connolly. Well, that's a pretty modest goal.
        Mr. Everett. I think that's exceedingly modest.
        Mr. Connolly. So can we be a little more robust in our goal
    setting?
        Mr. Everett. We will be more robust. We are pulling
    together and working hard. I want to be thoughtful. I don't
    want to give a number I can't back up.
        Mr. Connolly. I understand.
        Mr. Everett. But at the same time, no, the answer is 11 is
    a pittance.
        Mr. Connolly. But so I would just say, also again to my
    friend from Montana, and I think he would agree, I have
    experience both in the public sector and the private sector. If
    you don't set heroic goals, stretch goals, nothing happens.
    Now, not impossible goals, because then nothing happens either,
    but stretch goals. And so 11 is hardly a stretch goal. And I
    hope when you come back here, you're able to say, well, we said
    11 and it's 110. We got it off by a zero.
        My time is going to run out, but, Ms. Helland, I want to
    give you an opportunity to comment on the National Labs.
        Ms. Helland. Thank you. We actually started in 2015, July
    of 2015, working with the Office of Science labs. And at that
    time, we also had three Energy labs that we were working with
    to look at our lab planning and appraisal process, which is a
    way that we actually included CIOs in that process so that we
    could see--we asked them to report on their current IT spending
    and their current research computing, so that this instrument
    became effective for the other program office--or other program
    offices in the Office of Science.
        Mr. Connolly. Well, I just want to say in closing that I
    echo what the chairman and Ms. Kelly said. What makes me feel
    better about your score is you, because I think you are
    committed to making this happen, and the reporting sequence is
    now right. And when you're in that kind of position, you can
    make things happen, and it's pretty clear you're committed to
    doing that. And so we'll back you up. We'll help you. We're not
    going away.
        And I applaud my colleague, Mr. Hurd, on the Republican
    side of the aisle, for absolutely--and Mr. Meadows is near, but
    the four of us, you know, are just not going to give up. And
    we're here to try to both nudge and support and use it to your
    advantage. Thank you so much.
        Thank you, Mr. Chairman.
        Mr. Hurd. Now it's my pleasure to recognize the
    distinguished gentlewoman from the District of Columbia, Ms.
    Eleanor Holmes Norton, for her 5 minutes of questioning.
        Ms. Norton. I thank my friend for yielding, and I thank him
    for this hearing, and our witnesses for their informative
    testimony.
        This is a hearing about the Federal Information Technology
    Reform Act, the act itself. I'm trying not to use letters and
    acronyms. And it's essentially about IT and the progress we are
    making at a time when that can determine, in private industry,
    go or stop. I regard it as just as important for the Federal
    Government.
        I was intrigued by the work of the chief information
    officers that GAO looked at how enhanced authority was
    assisting the chief information officers in certifying major IT
    investments. And here's where I need clarification. They said,
    and I'm quoting here, ``adequately implementing incremental
    development.'' I got intrigued, what in the world is that, and
    had staff look it up, and discovered that adequately
    implementing incremental development is for the investment to
    deliver functionality every 6 months.
        So in order for me to understand what that meant, I took as
    an example, since you were testifying here today, Department of
    Energy, because it was among the agencies that achieved an A
    score on this particular--in this particular category.
        What was responsible--you make me understand incremental
    development. If you apply it to the Department of Energy, and
    make me understand how the Department of Energy earned an A
    rating for incremental development.
        Mr. Everett. So I'd love to take all the credit for that,
    but that I think has been a historical strength of the
    Department. And, again, some of our career folks have been a
    key component of keeping that going.
        The focus of that is around--I don't think it's a secret to
    many of us who have been around D.C. that, historically, when
    departments engage in long, multiyear projects, those tend to
    have significant problems in financial management and delivery.
        So the--I think it's a very good thing to be measuring
    that, because the importance of that is, when you're actually
    delivering capability--you know, this is--you know, in the
    private industry, it would typically cause sort of agile
    development. You're constantly adding showing capability.
    You're demonstrating that you're actually producing something.
        The flip side of that would be if we did some large,
    multiyear development and said, we'll start here, 2 years
    later, we'll see what happens, historically that has been a
    very poor management technique in IT and certainly in the
    Federal Government.
        What I've observed so far at the Department of Energy is I
    think we're deserving of that grade, because I think there's a
    lot of focus on, again, that incremental movement to make sure
    we're delivering something in sort of bite-sized manageable
    chunks.
        Ms. Norton. That really does make me understand it. It
    certainly makes me understand why this every 6 months. And for
    IT, clearly every 6 months is important.
        But since you already are looking every 6 months, what will
    you suggest for those who don't have--I mean, you're looking at
    them every 6 months too. So what do they need to do so that
    every 6 months--do we need a shorter timeframe for people who
    don't have A scores, for example?
        Mr. Everett. Yeah. I mean, I think you--you've got to
    start--you know, you may start to drive the metric a little
    shorter. You may not necessarily have delivery. But finding
    ways to measure that--again, the goal of it is just practically
    to be intermittently actually watching and seeing what's----
        Ms. Norton. Well, does it, in fact, result in increases in
    the score?
        Mr. Everett. Oh, yeah, it does. I mean, it certainly has
    for us.
        Ms. Norton. By looking every 6 months, even with those who
    haven't received this A rating, then their ratings tend to go
    up because you're looking every 6 months.
        Mr. Everett. Yeah. I think you've constantly got to watch
    that and measure it and make sure that they really are showing
    actual measurable deliverables and improvements.
        Ms. Norton. Mr. Powner, did you have anything to add to
    that?
        Mr. Powner. No. I think it's clearly a best practice to go
    with shorter deliveries instead of longer deliveries. I do
    think--you know, when we measure this, we know where all the
    warts are looking under the covers here. So the one thing is
    this is how they plan. If you look closely at whether they
    deliver against the plan, it might be a little less so we
    shouldn't get too comfortable.
        The other thing that I would like to say is, as we
    understand more what we actually spend on IT, there's probably
    more software development projects that should get listed under
    this category, and it might not look so rosy.
        So I don't want to rain on the parade, but I do think it's
    important to make sure we understand that there's still work
    for some of the those agencies that have As. Go small and it's
    much better.
        Ms. Norton. Appreciate that criticism.
        And thank you, Mr. Chairman.
        Mr. Hurd. Thank you.
        A couple of quick questions for you, Ms. Doone, and you,
    Ms. Helland.
        Ms. Doone, what are you going to do to help Mr. Everett
    populate the Working Capital Fund that we are going to create
    with a successful implementation of the MGT Act?
        Ms. Doone. Well, once the MGT is enacted, we'll have to
    take a look at the structure of the Working Capital Fund.
        DOE has an existing Working Capital Fund, and there are
    several line items in our current Working Capital Fund that are
    managed by CIO. The most significant one is a cybersecurity
    investment of about $35 million, which is intended for
    enterprise-wide cybersecurity. So we already leverage our
    existing Working Capital Fund to support his efforts in a
    number of areas, including network support as well.
        Mr. Hurd. So the Working Capital Funds created by MGT is
    something that only the CIO can touch, and it's to put money
    that is saved from doing things like transitioning into the
    cloud, getting your software licensing under control, because
    the savings that they're going to realize, they're not going to
    be able to use in that calendar year.
        How do we make sure that that's captured so that by the end
    of next fiscal year, that money is transferring to that
    account?
        Ms. Doone. Yeah. That would be something that we would have
    to look at. And, yes, if this were a mechanism totally
    dedicated to capturing the savings from the variety of IT
    savings, then that would be something that we could do and
    perhaps look at that and see if that could then support it.
    Because that would be a mechanism that would target that money,
    those savings directly recouping them and allowing CIO to
    invest into much-needed enterprise IT modernization.
        Mr. Hurd. Do you think we can do that within a calendar
    year, 12 months? There's only one answer to that, by the way.
        Ms. Doone. It's certainly a very straightforward request to
    recapture savings. The challenge is identifying those savings
    and getting them captured and moving them over to----
        Mr. Hurd. As long as you're in this position, are you
    committed to helping Mr. Everett do that?
        Ms. Doone. Oh, absolutely.
        Mr. Hurd. Mr. Bashista, are you involved too?
        Mr. Bashista. Yes, sir. A number of initiatives that we're
    supporting the CIO, as we discussed, the CFO and CIO in
    procurement and contracting, we face a lot of the same
    challenges being decentralized. So on a programmatic basis----
        Mr. Hurd. I get it. But are you going to help Mr. Everett
    make sure we capture that savings when he improves the software
    licensing, introduces CDM, and figures out their technology
    doesn't have, and he saves money, are you going to help us make
    sure and work with Ms. Doone in getting that in an MGT Working
    Capital Fund?
        Mr. Bashista. Absolutely.
        Mr. Hurd. Awesome.
        Ms. Helland, the National Laboratory CIO's council, who
    does that report to?
        Ms. Helland. It actually reports to--I mean, it was formed
    by the National Lab--the CIOs at the National Labs for them to
    identify common practices and best practices across the labs so
    that they could work together. Technically, I'm not sure it
    reports to anybody, but we certainly--both Max and I sit on the
    executive board.
        Mr. Hurd. Mr. Everett, do you have a response to that?
        Mr. Everett. So the NL CIO council reports to the--I
    believe it's to the National Lab director's executive council.
        Mr. Hurd. Do you have insight into the types of things the
    CIOs at the National Labs are putting on their network?
        Mr. Everett. We do. And we're--so we don't have full--
    again, and I tell you, in all honesty, I don't have that fully
    on our current network. We are in the process. And, again, at
    the direction of our deputy secretary, within 2 weeks of his
    joining, we put forward a memo under his name that I am
    responsible for as part of our iJC3, which is for our
    enterprise SOC, that all elements of the Department, including
    all laboratories, sites, Federal program offices, everybody is
    going to be responsible. And we're working right now to deliver
    certain data that I have put together a taxonomy on that will
    come up for us in a consolidated manner so that we have--and,
    again, that's an initial visibility across every network in the
    Department.
        The move from that will be to then incorporate the CDM
    capabilities, to your point, so that we can see hardware,
    software, all the other pieces, so that we can have that
    visibility of our cybersecurity posture across the entire
    Department, labs included.
        Mr. Hurd. Great. And, Mr. Powner, I'm looking forward to
    GAO reviewing and ensuring that is moving in that direction.
        I want to thank our witnesses for appearing before us.
        Mr. Connolly. Mr. Chairman?
        Mr. Hurd. Yes, sir.
        Mr. Connolly. Just a footnote to----
        Mr. Hurd. I yield to my gentleman--my friend from the
    Commonwealth.
        Mr. Connolly. I thank my friend.
        Just I was listening to your questioning of Ms. Doone, if
    you're looking for more savings, maybe you might expand that
    goal of 11 data centers being consolidated. I was just doing a
    little quick math on the back of my envelope, and with that--if
    that's our annual goal, it's going to take 27 years to address
    the total number of data centers you've got at the Department
    of Energy.
        So, I mean, I do think there's some real room for expansion
    there that would have big payoff, and the MGT legislation
    rewards it. And, oh, by the way, working with Mr. Powner and my
    colleagues, the FITARA extension bill that extends the sunsets,
    including a data center consolidation, is, as we speak, on its
    way to the President for his signature.
        So there will be several more years of scrutiny over data
    center consolidation. So use that time and effectuate those
    savings, especially in anticipation of the authority you're
    going to get, especially through the leadership of my friend
    Mr. Hurd, in the MGT legislation.
        Thank you, Mr. Chairman.
        Mr. Hurd. Thank you.
        I'd like to thank our witnesses for appearing before us
    today. The subcommittees will now have a very, very brief
    recess, 2 minutes, to set up for our second panel.
        The subcommittee stands in recess, subject to the call of
    the chair.
        [Recess.]
        Mr. Hurd. The subcommittees will come to order.
        I'm pleased to introduce our second panel. Again, the
    illustrious Dave Powner; Mr. Jay Mahanand, the CIO for the U.S.
    Agency for International Development; Mr. Reginald Mitchell,
    CFO for USAID; and Mr. Wade Warren, acting deputy
    administration at USAID. Welcome to you all.
        And pursuant to committee rules, all witnesses will be
    sworn in before they testify, so please rise and raise your
    right hand.
        Do you solemnly swear or affirm the testimony you're about
    to give is the truth, the whole truth, and nothing but the
    truth, so help you God?
        Thank you.
        Let the record reflect all witnesses answered in the
    affirmative.
        Again, in order to allow time for discussion, please limit
    your testimony to 5 minutes. The entire written statement will
    be made part of the record.
        Again, as a reminder, the clock in front of you, when it
    turns yellow, you have 30 seconds; when it turns red, your time
    is up. And please turn on and off your microphone.
        I now recognize Mr. Powner for an abbreviated statement.

                               PANEL II:

                        STATEMENT OF DAVE POWNER

        Mr. Powner. Thank you, Mr. Chairman.
        USAID plans to spend about $40 million on IT this year.
    Eighty-two percent of this is used for operational systems,
    leaving just over $25 million for new development. One of the
    largest investments is its financial management system that is
    used to manage and report on foreign assistance funds. Last
    year, over $13 million was spent on the system, and over the
    years, over $225 million has been spent on this critical
    system.
        USAID's overall grade jumped from three straight Ds with
    your first three scorecards to an A the last two. They are the
    only agency to receive an A on the FITARA scorecard.
        There are lots of positives here. Their CIO tenure is
    better than most. They have had only two CIOs since 2009. They
    have As in four of the five areas. They report the second
    highest portfolio stat savings as a percentage of their overall
    spend. Management of their software licenses has been
    centralized since 2004, resulting in an A in this area.
        The one area where we did not see an A is on data center
    optimization. USAID still needs to meet the server utilization
    metrics for its 80-plus nontiered or smaller data centers.
        Finally, I'd like to note that our work for this committee
    on CIO authorities shows that there is still some work to do on
    IT budgeting and execution, especially on improving governance
    over its IT acquisitions.
        Mr. Chairman, this concludes my comments on USAID.
        Mr. Hurd. Thank you, sir.
        Again, only one person is going to provide remarks for
    USAID. Who is that going to be?
        Mr. Warren, you're now recognized for 5 minutes.

                        STATEMENT OF WADE WARREN

        Mr. Warren. Thank you.
        Thank you, Chairman Hurd and Ranking Member Kelly and
    members of the subcommittee, for inviting me here to testify
    today regarding USAID's progress on FITARA. We're grateful for
    your support on this effort.
        I brought with me today my colleagues, Regi Mitchell, who
    is USAID's chief financial officer; and Jay Mahanand, who is
    our chief information officer. They have both been very
    instrumental in our technology reform efforts, and I'm happy to
    have them with me here today and to help answer questions.
        As you know, USAID is a global agency. Our work is often
    done under the most difficult circumstances, from a tent in
    Mexico City after the recent earthquake, to a small mission in
    East Timor where the internet connection is less than reliable,
    to a refugee camp in Jordan.
        Strong and effective information technology systems are
    essential to USAID achieving its mission in a modern world. And
    so USAID is proud to have received the first A rating ever
    given under the FITARA scorecard. But it hasn't always been
    this way at USAID.
        Eight years ago, USAID's IT was in disarray. In Washington,
    we spent hundreds of thousands of dollars every year acquiring
    new equipment and on powering and cooling our data center. What
    we got for it were regular outages and a system that left
    employees tethered to their desks.
        In the field, the situation was even worse. USAID often
    operates in countries with low bandwidth, and our old email
    system did not function well in this environment, leaving many
    staff waiting for long periods of time for email messages to
    load, if they were able to access email at all.
        Seven years ago, in February 2010, we realized that the
    status quo was not sustainable, and we began taking steps that
    ultimately gave USAID a cloud-based email system. And over the
    last few years, the Agency has developed into the leading
    Federal agency for cloud computing.
        So today, I would like to share with you what we view as
    the four keys to our success. First, we accepted that updating
    our IT system would be risky, that we would run into problems,
    and that we would not get everything right the first time. We
    knew that we needed to improve, and we were willing to take
    those risks. We embraced change.
        Second, we had real buy-in from agency leadership. We
    realized that for USAID to remain the world's premier
    international development agency, modernizing our technology
    had to be a top priority. We committed significant financial
    and human resources to this effort and championed it from the
    top down.
        Third, we continue to improve, plan for what we know will
    come, and deliver results. Today, we have embraced a culture of
    incremental progress. And we regularly make small investments
    in our information systems that keep them from going out of
    date or losing interoperability. And I'm proud to say that
    because of these investments, USAID is not operating a single
    legacy system.
        And fourth, we committed to hiring experts at a senior
    level who have the technical know-how to implement these
    changes and keep us ahead of the curve. We worked hard to
    recruit knowledgeable, experienced staff, and provide training
    and support for the staff we have.
        All of this hard work has led to important increases in
    efficiency for our workforce and significant cost savings that
    today we are using to reinvest in our platforms.
        Mr. Warren. Moving forward, we will ensure that we continue
    to remain ahead of the curve and lead the U.S. Government in
    our embrace and effective use of modern information technology.
        To further optimize data center operations, the agency is
    in the process of migrating our already outsourced data center
    to a cloud environment, and USAID is taking steps to actively
    manage the cybersecurity risks that we all are aware of today.
        So in conclusion, we are committed to maintaining our
    status as a Federal leader in IT space. We look forward to
    collaborating with you to address future challenges and new
    opportunities for reform.
        Thank you for your time, and thank you for your support of
    our efforts.
        [Prepared statement of Mr. Warren follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Well, Mr. Warren, thank you for not taking all of
    your time, number one. And I also want to say thank you for
    what your organization does. I had the honor of serving
    alongside many of the men and women in USAID, and I know the
    work that you do and saw it up close and personal. And, Mr.
    Mitchell and Mr. Mahanand, you facilitate that activity. So
    what you do is very important, not only for our country, but
    for the countries that we are working in. So I am a supporter
    of your organization.
        That being said, Mr. Warren, my first question is why does
    Mr. Mahanand not report directly to you or Ambassador Green?
        Mr. Warren. Thank you. We have--in our agency, we have an
    assistant administrator for management, and she has
    responsibility for the CFO function, the CIO function, the
    facilities management, and the budget of the operational budget
    for the agency. She reports to me. But the CIO and the CFO both
    have a dotted line to the administrator. They are free to go to
    him directly when they have issues that are of concern to them.
    And that's the way we've been managing ourselves over the--over
    the last number of years.
        You may be aware, however, that we are in a redesigned
    effort with the State Department now to look at how the State
    Department and USAID work together and how we can change our
    procedures internally to make them more effective and looking
    at the reporting relationships of the CIO and the CFO was part
    of what we are looking at now.
        Mr. Hurd. Mr. Powner, do you have any opinion?
        Mr. Powner. I think clearly it's much better if you report
    up to the box. Right? And I think as long as there's access.
    We've seen sometimes where there's this management guru in
    between, and we've heard this. The key question is whether that
    access is consistent and enough to the top when you need to get
    the right decisions and the right support.
        Mr. Hurd. Mr. Mahanand, I'm going to assume that since
    there's only been two CIOs--since when Mr. Powner?
        Mr. Powner. Since 2009.
        Mr. Hurd. --since 2009, I'm assuming you have a positive
    opinion of your access to senior leaders within your
    organization.
        Mr. Mahanand. Yes, I do. I mean, I've--any time there's a
    need to escalate, I will do that. But in the current structure,
    there is no need. The--as far as the system administrator for
    management, I mean, my daily op--my daily interaction is with
    her. And so I've not--don't have the need to actually go to
    her--or go to the administrator. Most of my activities go
    through her.
        Mr. Hurd. Can you answer with 100 percent certainty that
    you know everything's on your network?
        Mr. Mahanand. Maybe 99.9 percent. On our network, we do
    have--we do have monitoring software. I'm talking about the
    physical network here. So we do have port security. We have--
    anything that actually touches the network, we are notified of
    that.
        What we're not--what I'm not really sure about is really
    the services that's purchased outside and not necessarily
    connected in the network. That is something that we actually
    track in terms of looking into software, but there's--you know,
    there's a potential in shadow IT within the agency, and that is
    the only thing that I'm not positive about.
        Mr. Hurd. How do you do CDM?
        Mr. Mahanand. CDM, right now, we're in phase I, and it's
    scheduled to be deployed February of 2018.
        Mr. Hurd. Deployed in 2018. So complete within 4 months?
        Mr. Mahanand. Yes. I mean, we actually started about 2
    years ago. We've piloted CDM, and so the final deployment is in
    February of 2018.
        Mr. Hurd. So the pilot deployment, do you have the
    enforcement mode engaged?
        Mr. Mahanand. I believe so.
        Mr. Hurd. Can you get me an answer?
        Mr. Mahanand. Yes, I can.
        Mr. Hurd. Thank you.
        Mr. Mitchell, how are you going to help Mr. Mahanand create
    a Working Capital Fund once MGT is complete, so when he is able
    to get a complete insight into his network and saves money, he
    has access to that Working Capital Fund?
        Mr. Mitchell. We would--I will be able to support our chief
    information officer by setting up this fund and working with
    them to develop the procedures and policies governing the
    operations of this particular fund.
        I think it's important to note that the budget per se does
    not fall under my purview, but I do have budget execution. And
    I do work with Mr. Mahanand and his staff as far as providing
    them with real-time data, executional data, so that he can
    better have decision-making capabilities.
        Mr. Hurd. So if their budget doesn't fall under CFO, who
    does the budget fall under?
        Mr. Mitchell. The operation budget, including the capital
    investment fund, falls under the office of management policy,
    budget, and planning office, and that office is located in the
    Management Bureau.
        Mr. Hurd. And, Mr. Warren, that is this person you
    described----
        Mr. Warren. Yes. This assistant administrator for
    management has responsibility for the CFO, the CIO, and the
    operational budget.
        Mr. Hurd. So, Mr. Warren, in my remaining 15 seconds, what
    are you going to do to help to make sure Mr. Mahanand has the
    MGT Working Capital Fund so he can use that at the end of next
    fiscal year?
        Mr. Warren. Well, as I stated, the senior leaders of the
    Agency, both the career and the political staff, are very
    supportive of the IT function. We recognize that we can't do
    our work around the world without it. And we--I--Jay and Reggie
    and I work closely to ensure that our IT needs are met, so I'd
    be very supportive.
        Mr. Hurd. Ms. Kelly, you're recognized for 5 minutes.
        Ms. Kelly. Thank you.
        The IT Dashboard is a public website that allows Federal
    agencies, industry, and the general public to see the details
    about Federal information technology investments and their
    risks. Those risks are submitted by the CIO for those agencies.
        Mr. Powner, can you briefly explain why the IT Dashboard
    exists and what factors affect scoring?
        Mr. Powner. So the IT Dashboard is there to make sure we
    have visibility into the major investments. We look at the
    roughly $100 billion that we spend, so that's roughly half of
    what was on these major larger investments. So we know what
    they are, and we also have some costs and schedule performance.
    But a key part of that is the CIO rating.
        So, for instance, USAID has 87 major investments.
    Interestingly, they get an A in this area because they don't
    have a single green on the Dashboard, everything's red or
    yellow, where they acknowledge risk. You could do that
    different ways. We like to see the acknowledgement of risk
    because these things are typically difficult and you want to
    admit the risk so that they can be effectively managed.
        Ms. Kelly. And you talked about USAID, but the other
    agencies in general, are they doing a good job, accurately
    reporting, not doing a good job? And what are the implications
    for not accurately reporting?
        Mr. Powner. I think over time, especially with your
    scorecard, we see more risk acknowledged on that dashboard, so
    that's been a good thing. There's some agencies that had a
    complete flip. They were all green, and then all of a sudden,
    they're, you know, heavy on the reds and yellows, which that's
    a more accurate reporting.
        So we've seen improvements in these areas. There's still
    some concern.
        Yeah. The other area of concern is sometimes some large
    investments are categorized as nonmajors, and that's one way to
    hide visibility on the Dashboard. And again, we know who those
    agencies are, and we're kind of watching some of those larger
    nonmajors.
        Ms. Kelly. Okay. Thank you.
        Mr. Mahanand, in the category of transparency, USAID
    received transparency in risk management an A. Can you briefly
    explain how USAID goes about determining the levels of risk
    facing its major IT projects?
        Mr. Mahanand. Sorry. For us, we have five major business
    cases. Three of them is in operations. And so--but they provide
    critical function for the Agency. And so what we look--we take
    a look at--we start previously taking a look at the mid rating
    here, as far as the risk is concerned. So, you know, we look at
    the projects that's being executed. We looked at the overall
    importance of the specific program, and we make a determination
    of what is happening to--specifically in activities in those
    areas.
        And so when the--quarterly when the report comes to me, I
    take a look at it. We review it with the program staff. I make
    a determination exactly where we feel that the risk grading
    should reside. For the most part, we start with a three. We
    usually start with a five, because some of these business cases
    were in operations, and we didn't think necessarily that is
    something we need to really worry about.
        But given the fact, you know, we heard from GAO in terms of
    we want to see the risk grading realized, and actually we
    thought what we were doing and then started a three. And then
    we would make decisions based on where we are with those
    projects within those business cases or investments. We would
    make a decision whether or not the project is risky or not
    risky. But we continued this to start at a three and then we
    are way back and forth between a three, between a one and a
    five.
        Ms. Kelly. Just out of curiosity, because you have done so
    well with you're a ratings, do other agencies ever call and
    find out what you've done or what your secret is?
        Mr. Mahanand. Yeah. We've actually--we've gotten calls from
    three--about five agencies. We've spoken to them. We've
    actually spoken to the specific working group for GSA and some
    of the things we've done.
        I mean, just from a history perspective, some of the things
    we've done before previously, like the data center
    consolidation. We got rid of our data center NRB in 2011. We
    just didn't get credit for it as we move along, because we
    started really early in that. And from our perspective is that
    we just wanted to make sure that the data itself and the
    information and the reason behind the specific intent of each
    one of these scores.
        And so we looked at that--because I thought we did really
    well. We continue to do well, and I wanted to make sure that,
    you know, our progress, our performance reflects the scoring.
    That's where we actually found out there were some errors in
    how we were reporting. And so we--we basically worked with GAO
    and figure out what those areas are, corrected it, and
    basically provide the evidence that, you know, we are where we
    are with those scores. And that's why you saw from a D to an A.
        Mr. Warren. If I could just add a thought. Our approach and
    attitude about IT risk, I think, is part of a broader agency
    perspective on risk. And we work in some dangerous, risky
    places around the world. And so we try as an agency to be very
    aware of and forthright about the risk that we're facing. And
    Reggie and I actually lead an agencywide risk assessment
    process every year that looks at IT risks, financial risks,
    physical security risks. And so the sort of transparency that
    we bring to the IT risk, I think, is part of a broader culture
    in the agency about confronting risk.
        Ms. Kelly. I yield back.
        Mr. Hurd. The gentleman from Montana is recognized.
        Mr. Gianforte. Thank you, Mr. Chairman.
        Mr. Warren, I understand from your testimony that you've
    moved 100 percent to the cloud. Is that correct?
        Mr. Mahanand. I would say, again, maybe 99.9 percent.
        Mr. Gianforte. Let me congratulate you on your
    aggressiveness adoption of these newer technologies.
        I'm curious, in that transition, how much work was done to
    move from, let's say, more custom software to more commercial
    off-the-shelf software, and where would you be in that
    transition?
        Mr. Mahanand. So as far as moving to the cloud, there's
    specific things that we have in terms of infrastructure as a
    service, platform as a service, or software as a service. Every
    application we look at we basically make a determination. We go
    back to the cloud first policy. Any new application that comes
    up, we look at it, we basically said whether or not there is a
    surface--a service offering out there that we can actually use.
        So, for instance, we--when we were modernizing our internet
    on our internet, we basically look at the--look at the specific
    services, and we actually went with cloud services instead of
    going with, you know, commercial off-the-shelf software. So
    those are the types of decisions we make when we actually look
    at software or look at renewed software.
        Mr. Gianforte. And, Mr. Powner, is there, in your
    observations--I mean, we know that when we send a committee off
    to design a piece of software and we tell them we want a horse,
    we often get a camel as a result, because there's so many
    requirements that are included. And this--when we build custom
    software, it just drives up the cost and increases brittleness
    of integrations and these sorts of things.
        In your observations from working with the agencies, how do
    you--where are we in this transition from custom designing
    everything to the bias that Mr. Mahanand has expressed towards
    commercial off-the-shelf software?
        Mr. Powner. Collectively as a government, we still custom
    design way too much than we need to. And the problem there is
    in the government changing your business process to adapt to
    commercial products is, is we're way behind, especially when
    you compare that to the private sector. There's such an
    unwillingness to adapt those business processes and adopt to
    commercial software. So we need more and more of that going
    forward.
        Mr. Gianforte. But you believe that a bias towards
    commercial off-the-shelf would be a best practice and it would
    reduce cost?
        Mr. Powner. Absolutely. Absolutely. And change our business
    processes. Look at these financial management systems that we
    try to put in place. Why do some folks implement them right out
    of the box and others we try to modify 3 years to implement a
    commercial financial management system?
        Mr. Gianforte. Yeah. Mr. Mitchell, in this transition, how
    much money has been saved moving to the cloud?
        Mr. Mitchell. I would have to defer to our chief
    information officer.
        Mr. Mahanand. I think we'd have to look at each specific
    offering. For example, our data centers, we--from 2013 to 2016,
    we saved about $8 million, but each--we haven't--I don't think
    we have accumulated the number of our savings. I think it's
    about for the last--if we calculated, about maybe 60--I don't
    know, $50 to $60 million for the last 3 or 4 years.
        Mr. Gianforte. Just to put that in perspective, what
    percentage is that of your total budget?
        Mr. Mahanand. So our budget is about $100 million in OE and
    about $25 in DME, so that would actually be about 60 percent.
        Mr. Gianforte. Sixty percent savings from moving to the
    cloud?
        Mr. Mahanand. Yeah.
        Mr. Gianforte. Okay. And what have you experienced from a
    system reliability and security perspective? Has system
    reliability and security gotten better or is it harder in the
    cloud?
        Mr. Mahanand. I think its gotten better. I mean, I think,
    as Mr. Warren said, when we first moved emails to the cloud, I
    think we had outages daily. We moved to a cloud email system, I
    think we were the second in the Federal Government to do that.
    And I can't remember being down for more than an hour till now.
    And this happened in 2011, I think we started.
        Mr. Gianforte. And from a security perspective?
        Mr. Mahanand. You know, they go through the same controls
    as far as testing is concerned. So, you know, we look at their
    CNA packages; you know, we give it an ATO. So, you know, we
    have a part to play in of basically looking at the security
    profile of each one of these cloud vendors. So we are pretty
    confident the security is actually--I would say much better
    than, you know, having a system administrator in all these
    different places, not necessarily looking at what they're
    doing.
        So within the cloud, there's a single administrator. We
    control that administrator. So I think security is enhanced as
    well.
        Mr. Gianforte. Just to play back what I've heard, a 60
    percent reduction in costs, increase--dramatic increase in
    reliability, better security; sounds like it's a win.
        Mr. Mahanand. We think so.
        Mr. Gianforte. Okay. Thank you.
        I yield back.
        Mr. Hurd. Thank you.
        Now the gentleman from the Commonwealth of Virginia, you're
    on the clock.
        Mr. Connolly. Thank you.
        And congratulations to USAID. And I take a little bit of
    special interest. In my previous incarnation here on the Hill,
    before my 20 years in private sector, I spent 10 years on the
    Senate Foreign Relations Committee. And my job was to write the
    foreign aid bill. And I helped write the very last one to
    become law in 1986. That's how ancient I am. And it was so
    good, apparently, that we haven't passed one since.
        In any event, congratulations. And I think--well, let me
    ask you, Mr. Warren. What happened? You were getting a D and
    you moved it up to an A. I'm talking process and political
    decisions here, not we moved the grommet to the widget and the
    widget to the--what happened inside A that changed it--changed
    the will to want to do it differently?
        Mr. Warren. So two points to make, I think. The jump from
    the D to the A was largely from working with GAO to better
    report what we had been accomplishing over a longer period of
    time. So if you look at the scorecard, it looks like we had
    this quantum leap in 1 year. I think the quantum leap was
    really in better reporting. The changes to get from a D to an A
    took place over a longer period of time than that.
        But to answer the other part of your question, I think we
    were driven by the fact that we were having failures daily in
    the system as we were trying to manage it. And the fact that we
    have a worldwide workforce, and the only way we can communicate
    with our staff around the world and get our work done is
    through our IT systems. And if they are not working, we just
    can't do our job. And so it was kind of out of necessity that
    we realized we needed to make big changes. And then as I said,
    the political and the career----
        Mr. Connolly. Well, I would just say you say that as if, of
    course, we had to, we had no choice. I'm looking at a really
    big neighbor of yours in the Federal family, maybe the biggest,
    and it hasn't concluded that and it's got a worldwide
    enterprise too. And they're getting an F instead of an A.
        So something happened in A that galvanized you to do it
    differently, to make different decisions, to set goals for
    yourself, that, unfortunately, our Defense Department has yet
    to do. And it could bat you person for person and then some in
    terms of overseas bases, operations, personnel and the like.
    Bigger, much bigger, and maybe you could argue more difficult,
    but it's as far up along as you are, and it has yet to make the
    decisions or show the political will you've shown.
        And that's what I'm trying to get it, what--because I think
    that's how we all learn. You know, go talk to USAID in terms of
    how they did it, and I'm trying to get you on the record to get
    some of the elements of how did you do it.
        And, Mr. Powner, feel free to jump in here, because I know
    you had something to do with this as well.
        Mr. Powner. Yeah. I think it's a combination of both. I
    mean, clearly the data cleanup was a part, but also there was a
    focus on some of these areas, you know, going small and
    reporting more risk and that type of thing. We saw big
    improvements there.
        It was interesting, because a lot of this data's been
    reported to OMB for quite a while. And honestly, most agencies
    don't really focus on that adequately enough. This scorecard
    really helped. And this is important--this is important
    reporting because it's savings. It's things that we can use to
    reinvest in the Working Capital Funds. So this isn't just for
    the sake of reporting. It's real stuff that we need to actually
    get more efficient with our operational side of the house so
    that we can invest and modernize the government more.
        Mr. Connolly. Yep. And by the way, Mr. Mitchell, I hope
    your answer to Mr. Gianforte about savings was only on that
    one, because it's critical that the CFO understand what savings
    are being effectuated here because that's how we incentivize
    other agencies to do it too, right? Here's the--here's the
    carrot, here's the reward at the end of this process, and
    that's reliability, savings, freeing up capital, really
    worthwhile investment, and a happier, more productive
    workforce. But some of that we can measure in actual dollars.
    And I commend to you that the CFO, as well as the CIO, has to
    be monitoring those savings. I assume you are.
        Mr. Mitchell. Yes, I am.
        Mr. Connolly. Okay. Okay. Let me just say--end by saying
    this, and maybe, Mr. Warren, you take the lead working with Mr.
    Powner at GAO, but all of you, I really think it's important
    that this be written up electronically, but how did you do it?
    What were the key decision points? How low did you have to go
    before somebody said enough already? And show others that it's
    doable and replicable. Because when we don't really want to do
    something, we're going to isolate you as saying USAID's unique,
    no one else is like them, sure they can do it, but no one else
    can really--and we don't want--that doesn't serve our purpose
    at all and it's not true.
        And Dave--Mr. Powner, I would urge that in your spare time
    we help do this. And hopefully, Mr. Hurd and Ms. Kelly would
    agree, there's real value hearing your story, and we want to
    spread that good news to other agencies that it can be done in
    a reasonable timeframe and there's a reward at the end of the
    rainbow. So again, thank you, and congratulations.
        Mr. Hurd. I'd just like the record to reflect that that is
    the least grumpy line of questioning I've ever seen from the
    gentleman from the Commonwealth of Virginia, which is a pretty
    significant feat.
        So, Mr. Warren, Mr. Mitchell, Mr. Mahanand, these don't
    always go this way, and thank you for what you do and thank you
    for the support that you're showing our men and women that are
    putting themselves in some very difficult and extraordinary
    circumstances. Thank you for being here.
        And again, the subcommittees will now briefly recess for a
    few minutes for a third panel.
        The subcommittee stands in recess, subject to the call of
    the chair.
        [Recess.]
        Mr. Hurd. The subcommittees will come to order.
        I'm pleased to introduce our third panel. Mr. Powner, for
    the third time today, thank you for being here. Ms. Maria Roat,
    CIO for SBA; Mr. Tim Gribben, CFO for SBA; and Ms. Althea
    Coetzee Leslie, the deputy administrator at the Small Business
    Administration. Thank you all for being here. Welcome to you
    all.
        And pursuant to committee rules, all witnesses will be
    sworn in before they testify. Please rise and raise your right
    hand.
        Do you solemnly swear or affirm the testimony you're about
    to give is the truth, the whole truth, and nothing but the
    truth, so help you God?
        Thank you.
        Please let the record reflect that all witnesses answered
    in the affirmative.
        Again, to allow time for discussion--and we're racing
    against the clock, the votes are likely to be called soon--
    please limit your testimony to 5 minutes. The yellow light
    means you have 30 seconds; red, time is up. And please turn on
    the microphone.
        Mr. Powner, you're recognized for an abbreviated time for
    your opening remarks on this panel.

                               PANEL III:

                        STATEMENT OF DAVE POWNER

        Mr. Powner. Thank you, Mr. Chairman.
        SBA spends about $98 million on IT this year. About 80
    percent of this is used for operational systems, leaving just
    over 20 million for new development. This new development
    includes important efforts, like its Disaster Credit Management
    Modernization, which automates processing and approval for
    disaster loan assistance. SBA reports having spent over $100
    million--$150 million on this modernization in prior years.
        SBA's grades have consistently been in the D range, but
    their current grade is a C-minus. They're one of only three
    agencies whose grade went up.
        SBA scores best in incremental development, receiving an A
    in this area. Also, despite receiving a C in the data center
    area, SBA has plans to eventually close all but one of its 43
    nontiered or smaller centers, and plans to install a necessary
    metering equipment by 2018. SBA also plans to exceed OMB's key
    server utilization metric of 65 percent.
        Turning to areas where SBA needs to improve, let's start
    with CIO tenure. Since 2004, there have been 10 CIOs at SBA,
    and the average tenure has been only 1.4 years. This is a major
    issue in why IT has not been effectively managed. Their
    software license inventory is not complete. They have a plan to
    complete this in early 2018.
        Finally, I'd like to note that our work for this committee
    on IT budgeting, contracting, and CIO authority shows
    additional areas where SBA CIO has challenges is in budget
    formulation and strengthening their IT workforce. However,
    regarding FITARA's requirement for CIOs to review and improve
    IT contracts, SBA's processes here are quite good.
        Mr. Chairman, this concludes my comments on the Small
    Business Administration.
        Mr. Hurd. Thank you, sir.
        And I believe Ms. Althea Coetzee Leslie will do the opening
    remarks for the SBA panel.
        You're now recognized for 5 minutes.

                   STATEMENT OF ALTHEA COETZEE LESLIE

        Ms. Coetzee Leslie. Thank you.
        Mr. Chairman, ranking members, and committee members, thank
    you for the opportunity to discuss the SBA's implementation of
    FITARA.
        From July 2005 to October 2016, the SBA's OCIO leadership
    team experienced significant disruption with high turnover:
    eight different CIOs during that period. Further, prior to the
    current CIOs arrival in October 2016, the CIO position was
    vacant for over a year, from July 2015 to October 2016.
    Consequently, key programs like the Data Center Consolidation
    Initiative did not receive OCIO leadership attention.
        Immediately upon her arrival, the SBA CIO engaged in frank
    and honest conversations about the state of IT at the agency.
    The CFO responded in kind, and with the administrators and
    CFO's support, the CIO embarked on a fast-paced journey to
    change how the SBA builds, buys, and manages information
    technology to support small business entrepreneurs.
        Over the last 12 months, actions taken by the CIO, in close
    partnership with the CFO, are transforming SBA from an agency
    impeded by outdated technology and unstable infrastructure,
    stovepipes, duplication and significant gaps, no cybersecurity
    strategy or operational control, to a proactive and innovative
    provider of critical business technology services to the SBA
    program offices and small business entrepreneurs.
        SBA's governance model is maturing with a focus on creating
    and expanding strong enterprise-shared services. Program
    governance requires that all stakeholders are represented,
    engaged, and aligned to achieve program success. For example,
    the CIO and CFO co-chair the SBA Investment Review Board that
    met six times in fiscal year 2017. The IRB reviewed every major
    investment at least once, and the board recommendations
    resulted in tangible program improvements.
        Additionally, the CIO conducted four major investment deep
    dives to review milestones, technology capabilities, funding,
    and risks. During one of these deep dives, the CIO identified
    and provided direction to correct specific contractual and
    roadmap-related issues in time to prevent further
    complications. The SBA recognizes that transparency is critical
    for value creation, and the CIO promotes transparency in our IT
    procurements to prevent duplication, cybersecurity threats, and
    stovepiping.
        Last year, the CIO reviewed and approved all new IT
    contracts above $150,000. And this year, the threshold has been
    reduced to $50,000 to ensure we achieve our short and long-term
    modernization objectives.
        It is our responsibility to communicate our IT goals,
    vision, and strategy with acquisition professionals to ensure
    that the entire organization understands the technical
    ramifications of individual purchases. I am proud to report the
    SBA is leading innovation as the first agency to deploy DHS's
    CDM system in the cloud. This has resulted in a significant
    cost avoided by not investing in hardware that would require
    future recapitalization. Further, it sets the stage and puts
    SBA ahead of other agencies for future DHS cloud-based CDM
    solutions that will further strengthen SBA's cybersecurity
    posture.
        Along with our modernization efforts in technology, we are
    building our IT workforce and working to attract new IT staff
    to critical positions. We launched an IT strategic workforce
    plan to be able to support future technology initiatives. And
    thanks to congressional approval, we realigned our digital
    services team under the CIO to deliver improved mission-focused
    services and capabilities.
        Through the implementation of the authorities contained in
    FITARA, our CIO is leading the charge in the achievement of
    agencywide IT goals. The SBA's actions taken over the last 13
    months are laying the foundation for the agency's
    transformation into future enterprise objectives.
        As we proceed in executing our enterprise IT plan, we will
    continue to strengthen information technology to ensure a
    reliable, secure, and high-performing computing environment
    necessary to enable the SBA to efficiently and effectively
    perform its mission.
        Thank you again for the opportunity to share SBA's progress
    on FITARA implementation, and we are ready to answer any
    questions you may have.
        [Prepared statement of Ms. Coetzee Leslie follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thank you.
        And because votes have been called, we're going to limit
    our questioning time to about 2\1/2\ minutes. So, Mr.
    Gianforte, you're up first.
        Mr. Gianforte. Thank you, Mr. Chairman.
        So, Ms. Roat, sounds like you walked into a mess. And I'm
    just curious, what advice would you have for other Federal
    CIOs, given the experience you've had in trying to get your
    arms around it?
        Ms. Roat. Don't plan to plan, execute. Walking into a
    failing data center, our primary data center, we move very
    quickly. We had failing HVAC systems. Last November, I said
    very clearly to the team, no new hardware, period. And that's
    what embarked us moving forward on our data center, shutting
    down our primary data center, moving into the cloud very
    quickly, very fast. I brought in the right talent to do that,
    to be able to do that, and we executed. And it was driven by
    failing data centers, the gaps in technology, all of those
    things, and we executed.
        Mr. Gianforte. Okay. Just for my edification, where are you
    in the transformation to the cloud at this point, if you had to
    put a percentage on it?
        Ms. Roat. So for our primary data center, we've moved about
    40 systems already. We are not doing a lift and shift. We
    modernized everything first. So we did a migration, an actual
    architecture. We did a migration planning session, and we
    started execution of the migration in July of this year. So the
    200 systems that are in our primary data center, we've done
    about 40 right now.
        Mr. Gianforte. Okay. So what percentage would you say is in
    the cloud?
        Ms. Roat. That's roughly about 25 to 30 percent.
        Mr. Gianforte. Okay. And what success have you had in
    moving departments off of custom software compared onto
    commercial off-the-shelf software?
        Ms. Roat. To the extent that we're not building our own
    code, not doing our own coding, take advantage of commercial
    off-the-shelf software is a service, platform is a service, we
    are doing it. For one of our program offices, you know, they
    needed some investigation software. We're using a particular
    product, which is a software solution right in our cloud
    environment. So we are driving in that direction and getting
    away from actual hands-on coding.
        Mr. Gianforte. Okay. With that, Mr. Chairman, I yield back.
        Mr. Hurd. Robin Kelly, you're on the clock.
        Ms. Kelly. Mr. Powner, in GAO's assessment, I am assuming
    that you gave recommendations to SBA to improve their grades
    and software licensing. Is that correct?
        Mr. Powner. Yes. We've been working closely with SBA.
        Ms. Kelly. Okay. So, Ms. Roat and Mr. Gribben, do you
    believe you can implement these recommendations within the next
    year? And what do you think you can do? What do you think you
    can accomplish?
        Ms. Roat. For the software licensing, specifically there's
    three pieces to that we're taking into account. One is reducing
    the footprint of duplicative software. So that's the very first
    piece. We're reducing the number of licenses and providing the
    right level of software licenses to the users that need it.
        When you look at particular software platforms, you know
    there's different levels. We're making sure they're assigned.
    So we've already embarked on getting our arms around our
    licensing. In particular is we're moving into the cloud,
    getting our arms around that. We've put the monitoring tools in
    place.
        So we started a couple of months ago with this process in
    getting our arms around all of our software. And a year ago, I
    didn't have visibility into the entire enterprise; I do now. So
    that way that gives me the capability to be able to see what
    licenses are out there, what's deployed, not just on the cloud,
    but also on the desktop and the systems.
        Ms. Kelly. I don't know if you have any comment.
        Mr. Gribben. The only thing I would add to that is that as
    part of the budget execution process, the CIO has visibility
    into all of the IT requests of the program offices. And this
    year, we identified some offices that had some software
    licenses that would be better incorporated into an enterprise
    agreement that the CIO had already embarked on. So from that,
    we're reducing the software licenses, the one offsetter in the
    program offices.
        Ms. Kelly. Okay. It sounds like you're committed to making
    improvements, so we look forward to seeing your grades improve.
        I yield back.
        Mr. Hurd. Mr. Connolly.
        Mr. Connolly. I thank the chair.
        I just--gosh, at risk of destroying my reputation with the
    chairman, I think there's a lot of good news here. And a lot of
    it has to do, though, with having a CIO who, A, has the
    political will herself, but also a direct tie to the heavy
    agency so that she is empowered. And I assume you concur with
    that?
        Ms. Coetzee Leslie. Yes, we do. Our CIO has direct access
    to the administrator and myself as the deputy, and has also the
    authority to--or has control over authority to operate. And we
    have empowered her to do whatever is necessary to protect the
    agency and make sure that we are delivering the products as
    best we can.
        Mr. Connolly. Sounds like you were--before this CIO, Ms.
    Roat, it sounds like you were handing out glasses of hemlock of
    something, given the turnover that was occurring. So I don't
    know what you've done to make it a more pleasant and attractive
    place, but keep doing it.
        Ms. Roat, did you want to comment on that, not the hemlock
    so much?
        Ms. Roat. It's not the hemlock?
        Mr. Connolly. But the turnover and----
        Ms. Roat. While I can't speak to my predecessors, there
    were some very good people there. But I will say that I've got
    an incredible relationship with the CFO and then with access to
    the administrator and the deputy administrator. Myself and my
    deputy make the rounds informally about once a day in the front
    office. And we do have actual formal standard meetings and
    participate in many of the boards.
        Mr. Connolly. Just a final point. You actually met the
    metrics set by OMB on data center consolidation in terms of
    savings, as I understand it. Keep doing it, double down on it.
    I think that's really important, and that's how we reinvest in
    ourselves once the MGT legislation becomes law. Thank you, and
    congratulations on the progress you've achieved. Keep doing it.
        Ms. Roat. Thank you.
        Mr. Hurd. Thank you, Mr. Connolly.
        Mr. Powner, what do they need to do in order to get that N
    to a Y in the CIO reporting directly to the Secretary----
        Mr. Powner. It's just a lot of formal reporting. There's
    access, from what we understand, but in terms of the reporting,
    I don't see the direct reporting there to the dep secretary, to
    the assistant----
        Mr. Hurd. Ms. Coetzee Leslie, do you have any opinion on
    making that a more formal structure to ensure the CIO reports
    directly to you or Administrator McMahon?
        Ms. Coetzee Leslie. We have several changes that we're
    looking at with agency reform, and this is certainly one that
    we are considering.
        Mr. Hurd. That's great.
        Mr. Powner. And, Mr. Chairman, I would add, you know, I
    think what's really important here is we've got this history of
    1.4 years. Hopefully, Ms. Roat sticks around more than 1.4, but
    I think that change is important because, clearly, this is an
    executive team that we hear that is working well together and
    things are happening and there's great plans. But I think
    that's why that formality is important, the 1.4 history.
        Mr. Hurd. Ms. Roat, I'm sure you are expecting my question
    on your ability to answer whether you have 100 percent
    visibility of what's on your network.
        Ms. Roat. I do today. I did not a year ago.
        Mr. Hurd. And how are you deploying the CDM?
        Ms. Roat. We deployed CDM in the cloud. Last November when
    I said no new hardware on our data center, my team went back
    and they said but, but, but. And I said, but I want to put it
    on the cloud. And I said, why not? And I ask them that
    frequently, why not? And they went back to DHS and proposed it.
    DHS said let's go ahead and do it. And so we started small.
    Instead of buying 96 cores, spending all that money and all
    that hardware, we started small in the cloud, spinning up the
    virtual servers, adding on as we needed. So phase one we
    completed this summer. So, again, we're the first Federal
    agency to do it.
        Mr. Hurd. Awesome. Mr. Gribben, I'm sure you can expect
    what my question is going to be. How are you going to help Ms.
    Roat create the Working Capital Fund that MGT is going to give
    her, hopefully as early as tomorrow?
        Mr. Gribben. That is actually something that I'm going to
    have to work with the Office of Management and Budget and our
    appropriations committee. And how that would be implemented,
    currently what we do is any savings that are----
        Mr. Hurd. Let me stop you there. What conversations do you
    need to have with OPM--I mean OMB. Excuse me.
        Mr. Gribben. Most of the money we spend on information
    technology is 1-year money. And even with the reprogramming
    request into a Working Capital Fund, we'd still remain as 1-
    year money.
        Mr. Hurd. But that's what the legislation is changing where
    the Working Capital Fund gives the ability to, once you program
    that money into a working capital fund, you have 3 years to
    gain access. So what you're going to ultimately need is
    guidance from OMB on the steps to making that happen.
        Mr. Gribben. Exactly.
        Mr. Hurd. I would welcome your suggestions on those kinds
    of guidance. We should be going to OPM in this--OMB, excuse me.
    And, Ms. Roat, your suggestions on how to do that would be very
    helpful as well to ensure that you have one more tool in your
    toolkit.
        Ms. Coetzee Leslie, do you have any final comments on
    creating a culture within the organization to ensure you have
    Ms. Roat staying there for more than 1.4 years?
        Ms. Coetzee Leslie. Well, I've been telling everybody on my
    road trips and every forum that I attend and where I speak
    that, other than Disneyland, the SBA is the happiest place on
    Earth, and we intend to keep it that way. With the current
    administrator and the leadership team that's there now, we have
    a very, very functional team, and look forward to continuing
    that relationship and keeping Ms. Roat happy.
        Mr. Hurd. Excellent.
        Mr. Powner, you're a prince. Your team is amazing. Thanks
    for all the effort and work that you do on the scorecard, the
    minority and majority staffs' work on this. I really do think
    it is a tool that we are starting to see real changes across
    the Federal IT infrastructure.
        And for all of our witnesses, thank you for appearing here
    today.
        The hearing record will remain open for 2 weeks for any
    member to submit a written opening statement or questions for
    the record.
        If there's no further business, without objection, the
    subcommittees stand adjourned.
        [Whereupon, at 4:29 p.m., the subcommittees adjourned.]

                                    APPENDIX

                                  ----------

                   Material Submitted for the Hearing Record

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]