    [Senate Hearing 117-38]
    [From the U.S. Government Publishing Office]

                                                             S. Hrg. 117-38

                    CONTROLLING FEDERAL LEGACY IT COSTS AND
                 CRAFTING 21ST CENTURY IT MANAGEMENT SOLUTIONS

    =======================================================================

                                    HEARING

                                   before the

                                SUBCOMMITTEE ON
                    EMERGING THREATS AND SPENDING OVERSIGHT

                                     of the

                                  COMMITTEE ON
                   HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS
                              UNITED STATES SENATE

                        ONE HUNDRED SEVENTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                 APRIL 27, 2021

                                   __________

            Available via the World Wide Web: http://www.govinfo.gov

                           Printed for the use of the
            Committee on Homeland Security and Governmental Affairs

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                 U.S. GOVERNMENT PUBLISHING OFFICE
    45-043 PDF           WASHINGTON : 2021

            COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                       GARY C. PETERS, Michigan, Chairman
    THOMAS R. CARPER, Delaware           ROB PORTMAN, Ohio
    MAGGIE HASSAN, New Hampshire         RON JOHNSON, Wisconsin
    KYRSTEN SINEMA, Arizona              RAND PAUL, Kentucky
    JACKY ROSEN, Nevada                  JAMES LANKFORD, Oklahoma
    ALEX PADILLA, California             MITT ROMNEY, Utah
    JON OSSOFF, Georgia                  RICK SCOTT, Florida
                                         JOSH HAWLEY, Missouri

                       David M. Weinberg, Staff Director
                        Zachary I. Schram, Chief Counsel
                    Pamela Thiessen, Minority Staff Director
        Andrew Dockham, Minority Chief Counsel and Deputy Staff Director
                         Laura W. Kilbride, Chief Clerk
                         Thomas J. Spino, Hearing Clerk

            SUBCOMMITTEE ON EMERGING THREATS AND SPENDING OVERSIGHT

                     MAGGIE HASSAN, New Hampshire, Chairman
    KYRSTEN SINEMA, Arizona              RAND PAUL, Kentucky
    JACKY ROSEN, Nevada                  MITT ROMNEY, Utah
    JON OSSOFF, Georgia                  RICK SCOTT, Florida
                                         JOSH HAWLEY, Missouri

                         Jason Yanussi, Staff Director
                Allison Tinsey, Counsel for Governmental Affairs
                     Greg McNeill, Minority Staff Director
                    Adam Salmon, Minority Research Assistant
                          Kate Kielceski, Chief Clerk

                                C O N T E N T S

                                     ------
    Opening statements:
                                                                       Page
        Senator Hassan...............................................     1
        Senator Rosen................................................    13
    Prepared statements:
        Senator Hassan...............................................    29

                                   WITNESSES
                            Tuesday, April 27, 2021

    Kevin Walsh, Director, Information Technology and Cybersecurity,
      U.S. Government Accountability Office..........................     3
    Casey Coleman, Former Chief Information Officer (2007-2014) at
      the U.S. General Services Administration.......................     5
    Renee P. Wynn, Former Chief Information Officer (2015-2020) at
      the National Aeronautics and Space Administration..............     7
    Max Everett, Former Chief Information Officer (2017-2020) at the
      U.S. Department of Energy......................................     8

                         Alphabetical List of Witnesses

    Coleman, Casey:
        Testimony....................................................     5
        Prepared statement...........................................    72
    Everett, Max:
        Testimony....................................................     8
        Prepared statement...........................................    91
    Walsh, Kevin:
        Testimony....................................................     3
        Prepared statement...........................................    31
    Wynn, Renee P.:
        Testimony....................................................     7
        Prepared statement...........................................    86

                                    APPENDIX

    Responses to post-hearing questions for the Record:
        Mr. Walsh....................................................    95
        Ms. Coleman..................................................   100
        Ms. Wynn.....................................................   102
        Mr. Everett..................................................   105

                      CONTROLLING FEDERAL LEGACY IT COSTS

               AND CRAFTING 21ST CENTURY IT MANAGEMENT SOLUTIONS

                                  ----------

                            TUESDAY, APRIL 27, 2021

                                         U.S. Senate,
                           Subcommittee on Emerging Threats and
                                            Spending Oversight,
                        of the Committee on Homeland Security
                                      and Governmental Affairs,
                                                        Washington, DC.
        The Subcommittee met, pursuant to notice, at 10 a.m. in
    room 342, Dirksen Senate Office Building, Hon. Maggie Hassan,
    Chair of the Subcommittee, presiding.
        Present: Senators Hassan, Sinema, Rosen, Ossoff, Scott, and
    Hawley.

                 OPENING STATEMENT OF SENATOR HASSAN\1\

        Senator Hassan. Good morning, everybody.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Senator Hassan appears in the
    Appendix on page 29.
    ---------------------------------------------------------------------------
        I want to start by thanking all of our witnesses for
    appearing today to discuss controlling Federal legacy
    information technology (IT) costs and crafting 21st century IT
    management solutions. I also want to thank Ranking Member Paul
    and his staff for working with us on this hearing and for our
    continued partnership to address wasteful spending and
    government inefficiencies. Even though Ranking Member Paul is
    unable to join us this morning, I look forward to addressing
    the threats posed by the Federal Government's failure to
    maintain a modern and agile information technology
    infrastructure.
        Today is the first of multiple hearings on Federal legacy
    IT systems. By shining a light on this important issue, I hope
    that agencies will work to reduce their reliance on costly
    legacy IT systems, in partnership with Congress, the Biden
    administration, and industry stakeholders.
        Today's hearing will focus on identifying the costs and
    consequences of legacy IT, as well as the institutional
    barriers to modernization. According to the Office of
    Management and Budget (OMB) and Government Accountability
    Office (GAO) , in fiscal year (FY) 2020, the Federal Government
    spent nearly $90 billion on IT investments and operations.
    Based on analysis of agency expenditures, legacy IT maintenance
    costs accounted for one-third, about $29 billion, of that total
    spending. However, the actual cost is estimated to be much
    greater when we consider legacy IT's negative effects on
    security, delivery of services, and customer experience.
        To frame our discussion we should have a common definition
    of legacy IT. The term ``legacy IT'' describes the Federal
    Government's use of old technology or custom systems designed
    to support insular agency operations. That is, legacy IT
    includes technology and systems that are no longer supported by
    industry vendors, as well as those that require additional
    maintenance or specialized knowledge to operate.
        We have seen the consequence of relying on legacy IT
    systems. For example, in 2014, hackers stole the personal
    information of more than 20 million people from the Office of
    Personnel Management (OPM), because they were able to breach
    OPM's vulnerable legacy IT systems that lacked encryption.
    Despite this breach that was clearly linked to a failure to
    modernize, OPM still relies on a 34-year-old legacy IT system
    that costs $45 million annually, roughly one-third of OPM's
    annual IT budget, even though a modern system would only cost
    $10 million and produce $16 million in cost savings.
        At the Internal Revenue Service (IRS), the system used to
    annually process millions of tax documents is more than 50
    years old, and relies on a programming language called the
    Common Business-Oriented Language (COBOL), which was invented
    in 1959. In 2018, implementation of the 2017 tax law hit a
    major roadblock due to a shortage of staff with the specialized
    knowledge needed to update COBOL-based tax processing systems.
    IRS estimates that it costs $15.9 million annually to operate
    this system, and 60 percent of those costs are for labor alone.
        During the coronavirus disease 2019 (COVID-19) pandemic,
    IRS faced additional challenges because many of its aging
    systems rely on paper rather than digital records, paper that
    was inaccessible to IRS employees who were working remotely. As
    a result, the American people felt the burden of delayed tax
    returns and economic stimulus payments.
        Similarly, in 2016, the Social Security Administration
    (SSA) was forced to rehire retirees to maintain the COBOL
    system used for making payments to beneficiaries and their
    dependents. These systems cost the Social Security
    Administration about $146 million annually to operate. However,
    the Social Security Administration estimates that it would only
    cost $25 million over 5 years to modernize the system, and that
    would significantly improve functionality and security as well
    as eliminate the need for specialized programmers.
        This begs the question, what are agencies waiting for? What
    is holding them back from realizing significant cost savings,
    increasing security, and providing greater customer service
    delivery through reducing their reliance on legacy IT?
        In addition to the costs and consequences of relying on
    legacy IT systems, today's hearing will also discuss the
    institutional barriers that prevent agencies from moving
    forward with their modernization efforts. Our distinguished
    panel includes the Director of the Government Accountability
    Office's Information Technology and Cybersecurity team, as well
    as three former Federal agency Chief Information Officers
    (CIOs) who navigated the challenging IT modernization landscape
    and successfully moved their agencies away from legacy IT
    systems. I look forward to hearing from all of our witnesses
    about how they achieved success by leveraging available
    resources and by being innovative.
        Now we are going to move to the testimony of our witnesses,
    but before we do that it is the practice of the Homeland
    Security and Governmental Affairs Committee (HSGAC) to swear in
    witnesses. If you will all please stand, including our one
    witness who is remote, and raise your right hand.
        Do you swear that the testimony you give before this
    Subcommittee will be the truth, the whole truth, and nothing
    but the truth, so help you, God?
        Mr. Walsh. I do.
        Ms. Coleman. I do.
        Ms. Wynn. I do.
        Mr. Everett. I do.
        Senator Hassan. Thank you. You may be seated.
        Now we are going to start with the testimony of each
    witness, and I will introduce each witness and then they will
    go forward with their testimony.
        We will start with Kevin Walsh. Our first witness today,
    Mr. Kevin Walsh, is Director of the Cybersecurity and
    Information Technology team at the Government Accountability
    Office. He led the team that identified the 10 Federal legacy
    IT systems most in need of modernization. Mr. Walsh has 15
    years of experience at GAO, where he has led reviews of chief
    information officer authorities, management of legacy IT
    systems, and assessments of IT-related risks.
        Welcome, Mr. Walsh. You are now recognized for your opening
    statement.

     TESTIMONY OF KEVIN WALSH,\1\ DIRECTOR, INFORMATION TECHNOLOGY
        AND CYBERSECURITY, U.S. GOVERNMENT ACCOUNTABILITY OFFICE

        Mr. Walsh. Chair Hassan, Ranking Member Paul, and Members
    of the Subcommittee, thank you for inviting GAO to testify on
    this important issue.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Walsh appears in the Appendix on
    page 31.
    ---------------------------------------------------------------------------
        Generally, we envision legacy systems as archaic government
    computers, stuffed in a basement with fluorescent lights
    dismally flickering above, or perhaps in the warehouse next to
    Indiana Jones' Arc of the Covenant. While we do not need
    Harrison Ford for any IT systems that I am aware of, there are
    certainly government systems that are in desperate need of
    modernization.
        In our 2019 report on the topic, we asked agencies about
    their critical legacy systems that were most in need of
    modernization. In total, the agencies identified 65 systems
    which were, on average, about 24 years old. These systems
    support some of the most critical functions in government, such
    as wartime readiness, student loans, the operation of dams and
    power plants, tax processing, and Social Security payments.
        We took a deeper dive into the 65 systems and flagged the
    10 systems that we thought were the most vulnerable and in need
    of modernization. Some were operating with known
    vulnerabilities or were written in older code, such as COBOL or
    assembly languages, and others had hardware or software that
    was no longer supported by the vendor. As the recent hacks of
    the software supply chains demonstrate, we have no shortage of
    bad actors in the world willing to take advantage of
    vulnerabilities like these.
        We also asked the agencies that owed these 10 systems some
    very basic questions. Do you have a modernization plan? Does
    your plan include timeframes, a description of the work, and a
    plan to turn off the older system? Disappointingly, only the
    systems at the Department of Defense (DOD) and the Department
    of Interior (DOI) had these things in place. Further, there
    were no modernization plans for the systems at the Department
    of Education, the Department of Health and Human Services
    (HHS), and the Department of Transportation (DOT).
        To be fair, the hardware these systems ran on was not as
    old as their software. The hardware averaged a bit over 7 years
    old. However, to put that in context, Amazon made news early
    last year when it extended the useful life of its servers from
    3 to 4 years.
        In general, as our servers get older, and our systems with
    them, they cost more to secure, more to maintain, do not always
    meet mission needs, and, in some cases, the only people who can
    update them are retired. Basically, we are balancing cost,
    staffing, security, and functionality.
        To keep the lights on and systems running, we are accepting
    risks that, in hindsight, may not make sense. For example, as
    the Chair noted, OPM reported that some of its networks were
    too old to implement encryption, a rather important security
    step.
        Looking forward, modernization decisions need to carefully
    consider the following: how risky it is going to be, including
    risks to security and privacy; the criticality of the system;
    the cost to modernize or maintain the current system; potential
    cost savings; whether mission needs are being met; and if
    additional functionality or performance can be gained.
        After considering all of that, there will undoubtedly be
    instances where modernization may not make sense. For example,
    National Aeronautics and Space Administration (NASA) uses
    Fortran code to communicate with the Voyager space probes that
    we launched in 1977. We cannot catch and upgrade that hardware.
        On the other hand, we also identified a system at the IRS
    that reported annual labor and operating costs of about $16
    million. The IRS reported that it would cost a staggering $1.6
    billion to upgrade that system.
        We have also noted that agencies may not have a complete
    picture of their legacy systems. OMB drafted guidance in 2016,
    that would have required agencies to identify, evaluate, and
    prioritize their IT investments to make modernization
    decisions. Sadly, that guidance was never finalized.
        Until agencies are able to identify all of their legacy
    systems, assess them, and document their plans for
    modernization, they run the risk of wasting money on systems
    that are not meeting mission needs or are likely putting the
    agencies at risk.
        This concludes my comments, and I look forward to your
    questions.
        Senator Hassan. Thank you very much. Next we will move to
    Casey Coleman. Ms. Coleman is the Senior Vice President for
    Digital Transformation at Salesforce. In this role, she is
    responsible for developing strategies and solutions for
    government customers looking to modernize their IT systems.
    Prior to joining Salesforce, Ms. Coleman served as the Chief
    Information Officer at the General Services Administration
    (GSA), where she led several modernization initiatives,
    including the first agency-wide move to cloud-based email and
    collaboration platforms. She also led Federal efforts to
    develop the FedRAMP standards for cloud services and
    cybersecurity.
        Welcome, Ms. Coleman. You are now recognized for your
    opening statement.

    TESTIMONY OF CASEY COLEMAN,\1\ FORMER CHIEF INFORMATION OFFICER
        (2007-2014) AT THE U.S. GENERAL SERVICES ADMINISTRATION

        Ms. Coleman. Thank you, Chair Hassan, Ranking Member Paul,
    and Members of the Subcommittee for the opportunity to speak on
    today's important topic. It is very timely, because we have
    been talking about modernizing Federal IT for a long time, and
    it has been a priority, but the prospects for progress have
    been significantly improved with the emergence of modern,
    cloud-based digital platforms. The world's largest banks,
    manufacturers, retailers, and health care companies are already
    transforming their operations and customer service by embracing
    the cloud. The Federal Government can do the same.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Ms. Coleman appears in the Appendix
    on page 72.
    ---------------------------------------------------------------------------
        All of us engage with the government through interactions
    like paying taxes, adhering to regulations and laws, and
    receiving benefits and services, and IT has become the critical
    enabler to carry out vital missions of the government, such as
    defending the Nation, providing economic stability, and
    improving public health. It is in all of our best interests
    that government and its IT systems work well.
        But too often legacy IT is not an enabler but a concrete
    barricade, making the experience for employees and customers
    fragmented, opaque, and confusing. When I first came into
    government I was surprised to see how our systems did not work
    for us. We worked for them. I could not believe how the
    technology slowed us down and frustrated our efforts to
    collaborate. These are commonplace issues, and they do not
    really inspire trust or confidence.
        Meanwhile, in our personal lives, as consumers and
    customers, everything is online and mobile, personalized and
    accessible any time. We expect the same of government, but this
    creates a growing gap between what we expect and what is being
    delivered.
        The COVID pandemic really highlighted this growing gap.
    This was a crucial moment of need, and the organizations that
    delivered successfully, public sector and private, were those
    that moved to the cloud, so their employees could work from
    anywhere and deliver services online. We saw years of
    modernization compressed into a few months, from telehealth
    services to paycheck protection loans, employee wellness
    checks, and contact tracing.
        These programs were not on anyone's radar before the
    pandemic, so what made the difference? Moving to the cloud,
    with access to rapid innovation and secure online services from
    the commercial platforms already serving the world's largest
    companies.
        Why does this matter? For a farmer, they can get their
    crops in the ground by not getting off the tractor and going
    into town to get their crop loan but rather by doing it through
    a mobile app on their phone, not wasting time. For a veteran
    seeing their doctor by video means they continue to receive the
    treatment they need and the benefits they have earned.
        This pivot is important for government employees as well.
    No one comes into the government to step backward in time and
    do things the old way, with brittle tools that were state-of-
    the-art decades ago. They want to serve a mission and make a
    difference. If we want to recruit and retain talented public
    servants who have a choice, we have to give them tools to
    empower them and make their work effective.
        I am especially passionate about this because I have seen
    it first-hand. As the CIO for GSA through much of the Bush and
    Obama Administrations, I had the privilege of leading a
    multiyear modernization program to move GSA to the cloud and
    improve service delivery. When the Obama Administration
    announced the Cloud First policy, we led the way, becoming the
    first to move the entire agency to cloud platforms for email,
    collaboration, and productivity tools.
        Our previous system was on really old hardware. We did not
    know when it went down. I used to send myself emails at nights
    and weekends to make sure it was still working. By moving to
    the cloud, we had all our tools available anytime, anywhere,
    and when weather emergencies like Superstorm Sandy shut down
    all Federal offices, GSA kept going, working remotely as they
    have through the pandemic.
        In closing, modern cloud platforms are a complete game-
    changer for improving government service delivery and mission
    execution. I do not mean to suggest this is a silver bullet,
    and I have included recommendations in my written testimony for
    other reforms, but all of these factors only click when you add
    the cloud.
        Thank you, and I look forward to questions.
        Senator Hassan. Thank you, Ms. Coleman.
        We are now going to turn to the witness who is joining us
    remotely, Ms. Renee Wynn. Welcome, Ms. Wynn.
        From 2015 to 2020, Ms. Wynn was the Chief Information
    Officer for the National Aeronautics and Space Administration.
    She retired from NASA last April following a 29-year career in
    Federal service that included 9 years spent in Federal
    information technology. During her time at NASA, Ms. Wynn was a
    critical and creative leader in the formulation and
    implementation of the Modernizing Government Technology (MGT)
    Act, and she worked on several projects to reduce the agency's
    reliance on legacy IT system. She now operates her own
    consulting firm.
        Welcome, Ms. Wynn. You are now recognized for your opening
    statement.

    TESTIMONY OF RENEE P. WYNN,\1\ FORMER CHIEF INFORMATION OFFICER
           (2015-2020) AT THE NATIONAL AERONAUTICS AND SPACE
                             ADMINISTRATION

        Ms. Wynn. Good morning, Chair Hassan, and distinguished
    Members of the Subcommittee. I am honored to be here to testify
    today on the importance of IT modernization. Now is an ideal
    time for departments and agencies to focus on large, complex IT
    modernization projects. Many lessons have been learned about
    remote working and delivering Federal services during the COVID
    pandemic. These lessons can be used to accelerate modernization
    efforts. This, combined with having the right personnel,
    processes, and budgets significantly increase the probability
    that such projects will be successful.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Ms. Wynn appears in the Appendix on
    page 86.
    ---------------------------------------------------------------------------
        As the former Chief Information Officer at NASA, and the
    Acting CIO and Deputy CIO of the Environmental Protection
    Agency (EPA), I have had ample opportunity to understand the
    dynamics inherent in modernizing IT. These experiences gave me
    the best view of the biggest challenges a CIO faces when
    modernizing IT--an agency's culture, or sometimes referred to
    as ``the people challenge.''
        A CIO must have sustained support and funding for IT
    modernization from the agency heads, including her executive
    team. She must have the right people with the right skills, and
    she must build and maintain relationships across the agency and
    with the contractor community. Without this, complex IT
    projects will fail.
        When I was offered a position at NASA, I was over the moon
    with excitement at becoming a member of this iconic Federal
    agency. I was confident that I would find best-in-class IT
    management and cybersecurity practices. What I found was a work
    in progress--a need for more centralized or enterprise-wide IT
    services, systems in need of modernization, a poor
    cybersecurity posture, and a culture that viewed the NASA CIO
    with skepticism.
        Fortunately, NASA recognized this as well and had already
    completed a business services assessment (BSA). The BSA was
    undertaken to identify organizational and management
    improvement areas for NASA's mission support services,
    including IT. Based on the BSA recommendations, the CIO office
    developed and executed an implementation plan.
        Many valuable lessons were learned, and a big issue was
    identified, which was preventing NASA from gaining the full
    benefit of the BSA. Too much of NASA's IT budget and staff were
    not managed by the NASA CIO, making it difficult to modernize
    IT and control spending. Given this, NASA took the bold and
    politically charged step of having all the people and budget
    associated with a mission support function report to the head
    of that function.
        As I led the BSA implementation, the culture or people
    challenges were a constant. While NASA's top executives
    provided steadfast report, executives and staff below them were
    resistant and, at times, difficult. Nothing rattles a civil
    servant more than having portions of their budgets and staff
    reallocated.
        Congress has taken the steps to address IT management and
    cybersecurity risks through legislation, from the Clinger-Cohen
    Act to the Federal Information Security Modernization Act
    (FISMA) and on to the Federal Information Technology
    Acquisition Reform Act (FITARA). All were designed to advance
    IT in support of government services and provide improved
    information security. Support continued with the passage of the
    Modernizing Government Technology Act. This provided financial
    resources to agencies through the creation of a centralized
    modernization fund, called the Technology Modernization Fund
    (TMF).
        The oversight of Congress has also been a driving factor in
    making the intended improvements to IT modernization and
    cybersecurity. Legislative actions, combined with sustained
    oversight, have provided the foundation to improve IT
    management and cybersecurity.
        I will conclude today by emphasizing Congress should
    continue to hold oversight hearings and provide predictable
    funding and be prepared to act should gaps emerge in the
    Federal Government's ability to deliver more modern and
    effective public services. The CIO must have sustained support
    and budgets, plus a knowledgeable and skilled workforce, to
    meet the growing demands of IT modernization and cybersecurity.
    With this, the CIO can lead agencies forward to deliver IT
    modernization and improve cybersecurity so departments and
    agencies can deliver the mission for the American public.
        Thank you again for the opportunity to appear before the
    Subcommittee today, and I stand ready to answer your questions.
        Senator Hassan. Thank you very much, Ms. Wynn. Now let's
    turn to our last witness, Mr. Max Everett.
        Mr. Everett served as Chief Information Officer at the
    Department of Energy (DOE) following a career in IT security
    and risk management. During his time at Energy, Mr. Everett
    secured one of the first awards from the Technology
    Modernization Fund to migrate Energy's legacy email system to a
    cloud platform. He is now CEO of Adnovem Consulting Group,
    which works with public and private customers to provide
    services and promotes a lean and agile approach to IT
    modernization.
        Welcome, Mr. Everett. You are now recognized for your
    opening statement.

     TESTIMONY OF MAX EVERETT,\1\ FORMER CHIEF INFORMATION OFFICER
             (2017-2020), AT THE U.S. DEPARTMENT OF ENERGY

        Mr. Everett. Thank you, Chairwoman Hassan, Ranking Member
    Paul, and Members of the Committee. I appreciate the
    opportunity to be here this morning and talk about this. I
    appreciate the advocacy that you all are providing, and the
    support to all the CIOs who are currently going through the
    challenges of this. I would like to talk for a few minutes,
    after 20 years in and around Federal IT, to talk a little
    candidly about some of the challenges we have seen.
    ---------------------------------------------------------------------------
        \1\ The prepared statement of Mr. Everett appears in the Appendix
    on page 91.
    ---------------------------------------------------------------------------
        The events of the last year have obviously shown the
    critical importance of our IT and the challenges of legacy,
    whether that was supporting people impacted by COVID or some of
    the recent cybersecurity incidents that we are still grappling
    with.
        I would begin here suggesting, as a few people have talked
    about, that it is important to talk about what constitutes
    legacy IT, and I think it is a broad definition. It is not
    merely the electronic systems. Fax machines are probably the
    most common legacy IT in the U.S. Government. There is so much
    that is on paper right now that I think is a huge problem, and
    it is preventing us from serving our customers, citizens.
        I think this is important because the way that we value our
    electronic systems and IT is primarily data. Data is what we
    use to measure. We understand how we are doing. We are
    providing value with data. When that data is locked into paper,
    in warehouses--and I have been to a few of those warehouses
    that we own as the Federal Government--that is data and value
    that is locked away from us to use.
        When I was CIO at the Department of Energy, we spent a good
    amount of time, and it started on the front end, moving to
    digitizing documents, and that was both to provide better
    service, but it was also to free up some of that value of data.
    That data could help us drive our management better, it could
    help us serve better, not only citizens but everyone doing the
    mission in the Department, and that is really what we are
    supposed to be there for.
        I want to really quickly talk, and people have already hit,
    I think, on these two subjects. Most of the time in IT we talk
    about people and we talk about process. Renee already, I think,
    mentioned very well some of the people problems that we have in
    government. I can tell you that our human capital system needs
    dramatic improvement. We simply cannot compete. We cannot even
    get access to some of the people that we need to recruit in
    government if we are going to move to the cloud. If we are
    going to move to managed services, those are new skill sets.
    There is a place for retraining our employees, but right now we
    are not doing that very well either. I think it is important to
    continue to look at that issue of human capital.
        I can tell you, as a CIO, I had a number of authorities on
    paper to be able to go and hire new people, to use more
    creative ways of hiring. It was rare that I was ever able to
    use those. I would walk into meetings with people, having
    printed out documents from the OPM website stating my
    authorities to be able to hire, and yet was unable to use them.
    That is a critical failure that has to change, and it is a
    communication issue, and it is an oversight issue.
        I do also want to very quickly mention, with gratitude,
    that I know Congress recently allocated more money for the U.S.
    Digital Service (USDS) and other groups. I think that is
    important. The U.S. Digital Service is an opportunity to bring
    in some very experienced people from digital backgrounds who
    want to serve the U.S. Government, and that is great. My
    encouragement for them is that they focus on sustainable,
    commercial solutions. Those are the things that will last.
    Those are the things that the current CIOs are actually going
    to be able to sustain with the workforce that we have. I think
    that is important.
        I also want to quickly mention contractors. We cannot
    discuss the people issue in government without talking about
    contractors. In most departments, the number of contractors in
    IT typically outnumbers the Feds by 3 or 4 to 1, or more, and
    we need to understand that if we are going to deal with that
    problem.
        I very quickly, then, want to jump into a couple of things
    I know we will talk about further. We already mentioned TMF. I
    am a strong proponent of TMF. TMF is not about the money,
    although we certainly appreciate the billion dollars that have
    gone to TMF that will radically change that program. It is
    about the process of actually getting those grants, what you
    have to go through. It changes the way that we should be
    managing IT in government. I think TMF is important.
        I cannot let the opportunity pass without mentioning, I
    know that there have been some conversations about waiving the
    repayment. I would encourage that to be given some thought. I
    am supportive of it, as long as the process is followed. The
    TMF process is as important as the money, because it means we
    are counting our costs, we are looking for savings, and we are
    managing things in the way we would expect anybody to manage
    our own money. I think that is critically important in all
    those conversations, and to make sure that the TMF money that
    has gone over goes to the TMF process, that it goes through the
    committee and the board that is there, and goes through proper
    oversight. I think that is critical.
        With that I will conclude my remarks and look forward to
    your questions.
        Senator Hassan. Thank you to all of you for your excellent
    testimony. We are now going to go to rounds of questions from
    Members of the Subcommittee. I will start. Each round will be 7
    minutes, and do try to be mindful of Senators trying to move to
    other witnesses as you give your answers, please.
        Why don't I start with a question to Mr. Walsh. I would
    like to start by identifying the costs and consequences of
    relying on legacy IT. We have established what we mean by
    legacy IT, namely systems no longer supported by industry
    vendors or custom systems that are difficult to manage and
    adapt over time. However, what is more difficult to define are
    the costs, both quantitative and qualitative, that continued
    reliance on legacy IT produces.
        Mr. Walsh, how does GAO determine costs associated with
    legacy systems, and how can agencies improve their
    identification and reporting of these costs?
        Mr. Walsh. Identifying costs associated with legacy systems
    is more difficult than one might think. As Mr. Everett noted,
    the fax machines do not show up on a spreadsheet. They are hard
    to figure out. You can look at our inventory of IT systems, but
    we finished getting a complete inventory of our software
    licenses for each of the major CFO Act agencies this past year.
    We still need to work on getting better inventories of what IT
    we have out there before we can fully capture the cost.
        There is a nascent effort underway called technology
    business management (TBM), which would closely tie accounting
    systems to our IT oversight and management systems, which would
    help allow us to better track where the money is going. But to
    answer your question, there is no good way right now to
    identify all of the legacy IT in government.
        Senator Hassan. I want to follow up with that, because as I
    mentioned in my opening statement, roughly one-third of total
    Federal spending on IT went toward legacy systems in 2020, but
    many experts believe that that number does not capture the
    whole picture.
        Mr. Walsh, what are we leaving out of our calculations on
    legacy IT costs? How can we better factor in qualitative or
    performance costs associated with legacy IT systems?
        Mr. Walsh. One of the biggest issues with the dollar amount
    is the $90 billion that this is all predicated upon is
    dramatically understated. That $90 billion does not include
    weapons systems, satellites, or supercomputers. There is a lot
    of IT in the government that one might think, ``Hey, that is
    certainly IT,'' that actually is not included in that number.
        Getting all of that IT accounted for is the first big step.
    Once it is accounted for, having that accounting system tie
    into our technology management would help us get better to see
    if the money is going for specific hardware or software usages.
    But this is not a silver bullet, easy fix. This is going to
    take time.
        Senator Hassan. Thank you, and I will follow up with you on
    that probably in another round of questions.
        But let me move on to Ms. Coleman right now. The American
    people pay the price of failing to modernize legacy IT systems.
    The U.S. Government ranks among the lowest industries in
    customer satisfaction.
        Over the past year, in particular, my office has received
    hundreds of messages from constituents struggling to access
    passports and visas, unemployment benefits, economic stimulus
    payments, benefits information from the Department of Veterans
    Affairs (VA), and information on filing taxes. We have also
    heard from Federal employees like those at the National
    Passport Center in Portsmouth, New Hampshire, who want to
    respond to the needs of the American people but simply cannot
    do it because of their limited IT capabilities.
        Much of this is due to the antiquated paper-based systems
    that cannot support 21st century agency missions or respond to
    changing requirements during a pandemic. Ms. Coleman, how
    important is it for agencies to recognize that failing to
    modernize means failing to serve the American people?
        Ms. Coleman. Thank you, Chair Hassan. I think it is a vital
    issue, because, as you point out, we interact with the
    government on really critical services that we count on, and if
    those services are not delivered effectively there is a cost.
    There is a cost in terms of employee productivity and in terms
    of our time as citizens and as the public. There is also a
    public trust at stake. There is a confidence in the ability of
    government to deliver what we are anticipating as taxpayers and
    as citizens. I think that public trust is one of the key costs.
        I think that it starts from the way government has been
    designed and operated. Our systems reflect the way the
    government is set up, sort of from the inside out, with the
    programs designed around different siloed functions. As we
    interact with government we do not think that way, but we are
    forced to navigate the complexity of that bureaucracy. I think
    one criterion to change this is to start to think from the
    outside in, from the point of view of the customer or the
    resident that is navigating that process.
        There are very encouraging success stories. For example,
    U.S. Department of Agriculture (USDA) has created farmers.gov,
    which is a portal for all services delivered by the U.S.
    Department of Agriculture, so you do not have to navigate
    separate programs for crop loans or disaster insurance or
    conservation research. All of these things have been integrated
    and delivered in a holistic way, and it offers an example for
    others to be mindful of.
        Senator Hassan. Thank you.
        Let me follow up. Mr. Walsh, can you describe agency
    efforts to prioritize customer experience through IT
    modernization? Ms. Coleman mentioned one at the Department of
    Agriculture, but I think the Department of Education also comes
    to mind as a leader that has used IT modernization to improve
    customer service and mission readiness.
        Mr. Walsh. That is correct. The Department of Education has
    actually modernized all of its data centers. It is now almost
    entirely in the cloud, and to its credit it is moving to get
    away from legacy. That is not say that their modernization
    journey is done, but they are a leader in that area.
        Senator Hassan. Thank you. I am going to get through one
    more question. Some have argued, Mr. Walsh, that maintaining
    legacy systems, especially customer-built systems that rely on
    antiquated coding languages and lack connectivity to other
    agency systems are insulated from cyber threats and do not need
    to be modernized because they pose little risk.
        Mr. Walsh, do you agree with this argument, and if not,
    what would be a better risk management strategy than simply
    maintaining legacy IT systems in perpetuity?
        Mr. Walsh. Legacy systems represent a security risk. They
    are not good at meeting our mission needs. They cost more to
    maintain because a lot of times the people who can maintain
    them are retired or, in some cases, deceased. They increase our
    cost every year. I do not think that security through obscurity
    or hoping that the bad guys do not know the system code, is a
    good approach.
        Senator Hassan. Thank you. Ms. Wynn and Mr. Everett, the
    agencies you have worked for both handle extremely sensitive
    information that may be stored on legacy systems. How did you
    balance the need for modernizing legacy IT systems with
    mitigating risks inherent to storing sensitive information? Why
    don't we start with you, Mr. Everett, and then quickly on to
    Ms. Coleman?
        Mr. Everett. I will quickly say that was an enormous
    challenge for us, as Kevin already said. One of the issues you
    have with legacy systems is you cannot put modern protections
    on them--multifactor authentications, encryption. The secret of
    those systems is to even work today they often have to have a
    number of these little enabling things we call system accounts
    or administrative accounts. When you are an administrative
    account you know that is exactly what a bad guy wants to use,
    because once they have it they can use it to access and do
    other things in your system.
        That is one of the dirty secrets of those older legacy
    things. They are not protected more because people do not know
    them, they are, in fact, enabled by a bunch of other things,
    and pretty soon it is a Rube Goldberg apparatus.
        Security is also about resilience. One of the reasons your
    constituents cannot get on those is because they fail all the
    time. Why? Because they are old and they fall apart and nobody
    knows how to fix them. That, in and of itself, is a security
    risk, because everything else in the system has to adapt around
    that, which causes you to make all sorts of other security
    compromises to keep it going.
        Senator Hassan. Thank you. Ms. Coleman, very quickly on
    that issue, and then we are going to move to other Senators.
        Ms. Coleman. Thank you. The point is well taken, and one of
    the key issues with securing data, many times it is good cyber
    hygiene. Estimates are that well over 50 percent of all
    incidents are due to basic good cyber hygiene. With modern
    platforms you are really taking advantage of best-in-class
    security and a partner who can assist you with that. But
    really, ultimately, the government needs to start with basics
    and maintain good protocols.
        Senator Hassan. Thank you very much. I thank you all for
    your answers. Now we are going to turn to other Senators, and
    first up is Senator Rosen, who has been very patient and is
    very knowledgeable on this issue. Senator Rosen, you are
    recognized for 7 minutes.

                   OPENING STATEMENT OF SENATOR ROSEN

        Senator Rosen. Thank you, Chair Hassan, for organizing this
    important meeting. Chair Hassan, you have done so much work on
    the issue of Federal IT management. It is critically important
    to serving our taxpayers, to saving us money, to delivering
    services, as well as boosting the morale and effectiveness of
    our Federal agency workers. I really appreciate everything that
    you have done.
        Of course, a common theme that has emerged from all four of
    our witnesses is the importance of the Federal workforce in
    implementing IT modernization at our Federal agencies. I have
    to admit that I actually wrote COBOL legacy IT systems in the
    1980s and the 1990s, and so I intimately know exactly what you
    are talking about. It makes me feel a little old, but we do
    need to move forward on this.
        I have been working with my colleagues on this Committee
    and across the Senate to address the nation's shortage of these
    kinds of technical workers and cybersecurity workers, and
    Federal public service positions. They really should be
    attractive to those folks who want to work in tech.
        I joined Chairman Peters and Senator Hoeven in
    reintroducing the Federal Rotational Cyber Workforce Program
    Act. It is going to provide opportunities for our civilian
    cybersecurity employees to rotate amongst various Federal
    agencies. It expands their experience, expands their
    professional networks, and expands their opportunities to serve
    the country.
        Last week I introduced a bipartisan bill with Senator
    Blackburn to allow DHS and DOD to establish a Civilian
    Cybersecurity Reserve Pilot Program. It would call on former
    military and civilian cybersecurity employees and others for
    temporary assignments in the government. I think this can serve
    as a model for other agencies.
        Mr. Walsh, in the course of GAO's reporting on your IT
    modernization efforts, have you identified agencies that have
    done particularly well in recruiting and retaining these types
    of employees? How do we export those best practices? If you
    have not, does OMB and OPM play a role, and how do you see that
    role?
        Mr. Walsh. We have not done specific work--I should say I
    am not aware of specific work in that regard on hiring cyber
    employees. Now I do know that, as Mr. Everett mentioned
    earlier, the U.S. Digital Service as well as 18F serve as ways
    to get private sector talent into the government. I do not know
    if they are as quick as your proposed legislation is
    considering. But having that venue for external talent to come
    into the government and share ideas and propagate those ideas
    is very important.
        CIOs also do have additional authorities that they can use
    to hire and bring in folks from the outside, but Mr. Everett
    earlier identified issues with executing some of those
    authorities. GAO has not done specific work in that regard, but
    I am eager to work with your staff on that.
        Senator Rosen. Thank you. I appreciate it.
        Ms. Wynn, in your testimony, you mentioned there needs to
    be civil servants who are working on every Federal IT project
    and that those workers need to be reskilled. You said that
    early efforts to reskill existing Federal employees have been
    successful. Can you elaborate on what type of reskilling was
    the most successful, and what areas we need to still reskill
    in, so we might direct our efforts in creating workforce and
    training in that workforce pipeline?
        Ms. Wynn. Thank you for that one. The Office of Management
    and Budget, through the Federal CIO Council, through their
    Workforce Subcommittee, established a reskilling institution or
    program. A lot of Federal civil servants applied to this
    program. They took an aptitude test for cybersecurity, and from
    there the top folks were taken, and yet they still had to cut
    the number of participation to a low number, because it was our
    first-ever endeavor. Those folks went through some training
    programs and proved themselves to be very capable cybersecurity
    professionals, and then went on to seek future employment,
    still within the Federal Government, but in this case a job
    change.
        The bottom line is Federal Government workforce is
    talented. When we show them the way and give them the time and
    the support to get reskilled, we can take their talent and use
    them in other places, especially in cybersecurity.
        Senator Rosen. Thank you. I look forward to working on
    that.
        I would like to move on now, and again, Ms. Wynn, I want to
    talk to you about IT modernization and support to national
    security. Given your background at the Department of Energy,
    which houses the Nevada National Security Site, located not too
    far from Las Vegas, it is facilities that are critical to our
    security. Can you comment on why modernizing the Federal
    Government's IT and cybersecurity infrastructure is critical to
    our national security and safety. Particularly as it relates
    maybe even to our nuclear stockpile, how do we move forward,
    create more nimble, secure platforms and firewalls to protect
    our national interests?
        Mr. Everett. I think----
        Ms. Wynn. Senator Rosen, why don't I get started and then
    Max Everett might be able to----
        Senator Rosen. Perfect. I am going to him after you.
        Ms. Wynn. That is great. I will get it started because
    critical infrastructure, right now the space, and flying in
    space in satellites are being thought about as critical
    infrastructure because we rely on them for logistics. Moving
    anything around this globe requires satellites, navigation, if
    you expect it to get there and avoid significant weather
    events. That type of security is very challenging.
        You need the cooperation of a number of parties, including
    all those that operate the infrastructure. You have the
    electric grid, you have the water infrastructure, and in this
    instance I mentioned space, and those folks have to get
    together and first and foremost recognize that there are real
    threats in space, space needs to be acknowledged as an element
    of the business practice as well as part of critical
    infrastructure. In that case, work as a team to put into place
    and take steps toward securing it better.
        At NASA we were beginning to do that, by taking a look at
    our critical satellites and then trying to figure out the best
    way to secure them in this current environment. As noted
    previously, we cannot bring back our older satellites and give
    them a new operating system, but we can do things here on terra
    firma, as I call it, to secure them better, and then we have to
    apply good neighbor policies, because we fly in the same place
    as other countries, as well as the Department of Defense, and
    private sector. Again, working together to protect our critical
    infrastructure is what is needed to get the job done.
        Senator Rosen. Thank you. Mr. Everett, I know my time is
    up, but if you could be kind of quick about it, that would be
    fantastic.
        Senator Hassan. I will add that a number of Members have
    conflicts and are not going to be able to come, so Senator, if
    you want to take a couple of more minutes and the witness too,
    that is fine.
        Senator Rosen. OK. Mr. Everett, then please. Please
    elaborate.
        Mr. Everett. I will. Thank you. You are right. The
    Department of Energy, one of the great challenges at the
    Department is the breadth of its mission. Certainly some of us
    know that they have a nuclear mission for protecting, building,
    and designing the nuclear stockpile. But that mission stretches
    all the way down to fundamental science that is conducted with
    scientists around the planet. We have what are called user
    facilities that are used by the top scientists around the world
    to do collaborative scientific basic research that not only
    helps the United States, certainly, but really helps the entire
    planet. One could argue it is almost a diplomatic role that we
    play in science because of that. With those very divergent
    missions it adds an extra layer of challenge for the Department
    of Energy.
        I would say there are three sort of focus areas that we try
    to work on, that we think are the most important for that. One
    of them is simple visibility. Visibility is about being able to
    see and understand, as we talked about, what do you have? What
    actual systems do you have? What legacy systems do you have?
    Who is on your network? That is a critical element, and it is
    one we have not done very well as the Federal Government.
        I think some of you are already aware, and it has been
    discussed over the last few months with the cyber incidents we
    have had, there have been some significant challenges with the
    EINSTEIN program that needs to really be very carefully re-
    looked at. I would tell you in our own department that was a
    challenge of basic reporting and visibility of what was going
    on across our whole footprint.
        The second part of that is risk management, and this was
    where we put a lot of our focus. When you have a large
    enterprise like NASA, Department of Energy, GSA, and you have
    divergent levels of risk, we will never have enough resources.
    When I was CIO, I was always glad to come and ask Congress for
    more money, but you only have a certain amount of resources to
    go around. Risk management is looking at what are your top
    risks, what are your most important things, and they get the
    first dollar, and you find that balance.
        That is what risk management is, and it takes real thought,
    and it takes effort, and you need to document and discuss and
    be able to defend your efforts. We spent a significant amount
    of time because it is critically important.
        The third element I would talk about, and it starts to go
    to what we are talking about here today with legacy and
    modernization, is moving to new models. Some of you may have
    heard the term ``zero trust networks.'' Fundamentally, you
    cannot use zero trust networks with legacy, because they
    require some new tools to be able to better manage what is on
    your network and make sure that those things can essentially
    tell other things on the system that they are allowed to be
    there and do what they are doing. That is very difficult to
    plug into a 20-year-old system. These newer models like that
    simply will not work in those legacy environments. They have to
    be updated to do it.
        Another area I would mention here is FedRAMP. FedRAMP has
    been around. It was started for a good purpose. I still think
    it can serve a valuable purpose. But I would tell you FedRAMP
    is far too slow. I do not know of any vendor that I talked to
    in my time at CIO or now who does not complain about the
    timeline for FedRAMP.
        What that means is probably FedRAMP needs some more
    resources, because what FedRAMP does is it does the baseline
    security work one time, so it is a shared service. It is doing
    that one time for everybody so that you can then start to bring
    more innovative solutions to market more quickly in the Federal
    Government.
        We are missing out on opportunities. I recently talked to a
    venture capital person. He told me, for some small and mid-
    sized companies with unique new services, primarily software as
    a service, that it was taking them four to five people at $1
    million and a year to go through FedRAMP. For most of these
    startups who are coming up with new, innovative, new things to
    do, that is not sustainable, and we are going to miss out on
    those opportunities if we cannot improve that process.
        Senator Rosen. Thank you. I have a closing statement, but I
    am glad to ask other questions. But one thing I know for sure
    is that good code means speed. Good code means ease of use and
    data capture for the end user. Good code means the better the
    data capture for analytics for our future. It saves us time, it
    saves us money, it improves outcomes, and it helps us plan for
    the future.
        By modernizing these systems, by having safe, secure
    systems, by capturing more data in consistent ways, we are able
    to predict, plan, and protect ourselves, and we have to do
    that.
        Chair Hassan, I am glad to continue to talk about this. I
    am not sure if someone else is in the room, but you tell me.
        Senator Hassan. Thank you, Senator Rosen. I think right now
    it is just you and me, and I have another round of questions.
    But if you have a couple more why don't you go ahead and then I
    can finish up with my round.
        Senator Rosen. You know what? I am going to hand over to
    SASC, where I think I am finally up over there. I appreciate
    everyone being here. I appreciate what you do, and I sincerely
    hope that we can try to, I guess even one system at time,
    continue to get off those legacy systems onto something that is
    newer, more nimble, and allows us better data capture so we can
    continue to take care of everything that we need to. Thank you.
        Senator Hassan. Thank you, Senator. Now I will turn to a
    second round of questions, and I appreciate the testimony you
    all have provided so far. I am going to start with this
    question for Ms. Wynn.
        I have advocated for a biennial budgeting cycle where
    Congress would determine and appropriate the budget in one year
    and then year two can be spent on doing effective oversight to
    inform future spending. The current one-year cycle often leads
    to hasty decisionmaking and neglects capital investments that
    take several years to implement, including IT modernization
    projects designed to move away from legacy IT systems.
        Ms. Wynn, how difficult is it to manage IT modernization
    around the one-year budgeting and appropriations cycle, and how
    did you work within this cycle to achieve your goals? What
    would you have done differently if there was a biennial
    budgeting process?
        Ms. Wynn. Thank you, Chair Hassan, for the question. One of
    the things that I have found, first, is sort of annual
    appropriation, first thing you need to know is every time you
    cross a fiscal year with a project, and most IT projects cross
    a fiscal year, you add more risk to your plan, and that is
    because from year to year you face the potential loss of
    funding or the loss of people.
        Now you have disrupted your project, and now you have most
    likely extended when you are going to get that project done.
    That extension, if it goes on too long, means you are
    potentially using software that will no longer be considered
    modern or available, or could reach end of life by the time you
    use or get that system back in operation after it has been
    modernized.
        What I would do is, and probably what most CIOs would do,
    is I would take my total budget and I would create a reserve,
    and that way the reserve would be used to make sure that the
    most critical, the highest-risk projects would get funding,
    going into the secondary years of their project. That way I
    knew that they could be able to continue. If I did not do that,
    I would run the risk of work stoppage, and then I could lose
    the talent of my staff, of staff from other mission areas or
    mission support, or I could even lose contractor staff, and
    that would, again, start to slow down and add more risk to your
    project.
        If I had a second year added to it by a biennial, I would
    be able to take the projects and draw a timeline of people and
    dollars, and make sure that they were spent according to it,
    and hold people accountable to a two-year increment. This would
    reduce the risk in a complex IT project, because you did not
    have to worry about funding every few months, because by the
    time you get appropriations finished and you get the new
    authority money, several months in the fiscal year have gone
    by, you could actually plan about 18 months and be assured of
    those resources, therefore reducing the risk of managing a
    complex IT project and you could deliver that project a lot
    faster because you would take out that funding issue, or
    convert the funding issue to an 18-month issue instead of a 9-
    month issue. That would be hugely beneficial and a great gift
    to CIOs and program and project managers around the country.
        Senator Hassan. Thank you. Ms. Coleman, at GSA you worked
    to develop FedRAMP and streamline agency IT acquisitions in
    coordination with industry partners. You now work for one of
    those industry partners that is trying to help the Federal
    Government modernize its systems. What is the impact that the
    one-year budgeting and appropriations cycle has on industry and
    its ability to support IT modernization efforts?
        Ms. Coleman. Thank you, Chair. I agree with everything that
    Renee said about the ability to plan over long-time horizons.
    It is almost even not a nine-month planning horizon with the
    annual cycle we have now, because of the frequency of
    continuing resolutions (CR), which create even greater
    uncertainty about available funding and disruption of
    resources. That alone is a complication.
        One thing I would like to suggest as a companion idea to a
    two-year planning and budgeting cycle, which I think is a much
    needed and helpful measure, is greater use of agile DevOps
    tactics to break modernization projects into short sprints that
    deliver short and relatively quick intermediate results, so
    that there can be fine-tuning and transparency and oversight
    throughout the process. Any project that is intended to deliver
    results in 2 or 3 years is going to be out of date by the time
    results are delivered. We need to be thinking about very short,
    rapid cycles to deliver results, and the accompanying oversight
    and funding to go with it.
        Working capital funds of previous legislation have been
    very helpful. We used that with great success at GSA. We also
    implemented a zero-based budget so we could see where our
    incumbent costs were and understand where we needed to place
    our dollars for modernization priorities.
        Senator Hassan. Thank you. That brings me to another set of
    questions, and I am going to start with Mr. Walsh, concerning
    agency modernization plans.
        Currently, agencies are not required to develop or publish
    IT modernization plans. While many agencies have developed
    plans, some of these plans fail to establish concrete
    timelines, cost estimates, and goals. GAO recognizes that
    having an IT modernization plan in place is essential to
    reducing reliance on legacy IT systems.
        What makes these plans such a valuable tool, and how can
    agencies better leverage them to meet their goals and manage
    their resources?
        Mr. Walsh. Having these plans is valuable, to get agencies
    thinking about it. In agencies that do not have a documented
    plan, we are not sure what kind of resources they are going to
    be able to throw, what kind of timeframes, even the scope of
    the project. Having some idea of what needs to be done is kind
    of the most fundamental step, and in our 2019 report, it was
    very disheartening to see that three of the agencies did not
    have a plan, an additional five had some aspects of a plan, and
    only two really had a firm idea of what needed to be done.
        It is critical because modernizing legacy systems is
    critical to the government's security and privacy and how well
    we serve our citizens. Getting our agencies to be thinking
    about modernization is the first step.
        Senator Hassan. Thank you for that. One other key element
    that modernization plans, when they do exist, often omit is how
    the agency plans to manage costs arising from maintaining a
    legacy system while they are also implementing a modern system.
        Let me turn to Mr. Everett now. In your time as the Chief
    Information Officer at the Department of Energy, how did you
    manage the competing investment needs between existing systems
    and new systems? How might agencies leverage modernization
    plans and existing resources to offset what is essentially the
    cost of the overlap?
        Mr. Everett. I would tell you much of my experience was, to
    be very frank, robbing Peter to pay Paul. In most cases, to do
    those modernizations, you are going to have to take money from
    somewhere. I think to Kevin's good point that you already
    brought up, without a modernization plan you cannot have the
    planning. I was, frankly, somewhat fortunate as a CIO. We had
    some monies that were multi-year monies, that gave some level
    of help to us in being able to plan, but I know many of my
    peers had only single-year money, which was a great challenge.
    I think your discussion of a biennial is certainly helpful.
        The other one I would bring up, certainly, is things like
    TMF, and within the MGT Act, the idea of Working Capital Funds.
    I know that there is long-held concern about Working Capital
    Funds turning into slush funds and things of that nature. I
    think that simply means they need to have the appropriate
    oversight. But they would allow that level of longer-term
    planning.
        Listen, anybody can put out a modernization plan, but if
    they do not have the money to back it up or the people to
    execute on it, it is not going to work anyway.
        I will also say I think what Ms. Coleman said is absolutely
    correct. Kevin could probably sit for hours and tell us stories
    of programs that have been run in the government for multiple
    years, these large projects, millions, if not billions, of
    dollars wasted, that did not ever come to a finish line, or
    even worse, came to a finish line, and were probably even
    reported as being on time and schedule, and yet provided no
    actual value to citizens, to anyone.
        Breaking things up, that agile method of breaking things up
    and doing it in those smaller chunks is appropriate. There are
    very few systems that we should be building in government
    anyway. We should mostly be using commercial. Where we do need
    to build those--and certainly Energy, NASA, and other places
    have those use cases--they should be done in an agile way where
    you can have some oversight, make sure they are delivering
    value on an iterative basis, so that you do not have to plunge
    hundreds of millions of capital expense into something, only to
    come to the end of the road and the money is all gone. I think
    that has happened far too often.
        It always a challenge, again, for us. We had a little more
    flexibility, but even I had to have a lot of conversations.
    Renee made the right point--you often simply had to build a
    reserve, and that reserve was usually coming from other things
    you would have liked to have done that were customer service-
    oriented or those kind of things. It is a real trap, and it
    builds what we call technical debt. It is not the monetary
    debt. It is all the things we cannot do that are a part of
    that.
        Senator Hassan. I thank you for that, and I am going to
    take advantage of a rare moment in the Senate, because we have
    a little bit more time and you are such an excellent panel. I
    have two or three more questions, so bear with me. But I think
    we are learning a lot here.
        I want to turn now to the issue of the authority of Chief
    information officers. I want to start with a question to you,
    Ms. Wynn. The Federal Information Technology Acquisition Reform
    Act expanded the responsibilities of agency Chief information
    officers and requires their input on IT acquisitions to realize
    cost savings and to manage IT inventories. However, despite the
    good intentions of this law, GAO has found that Chief
    information officers do not receive adequate deference on IT
    planning, budgeting, and management.
        Ms. Wynn, can you speak to your own experience as a Chief
    Information Officer, both at the Environmental Protection
    Agency and at NASA, and how you worked to get institutional
    buy-in from agency leaders to advance your IT modernization
    efforts?
        Ms. Wynn. Chair Hassan, I would begin by saying never let a
    crisis go to waste, when it came to exercising the authority
    and making culture changes and process changes within a Federal
    agency.
        My first example comes when I first arrived at NASA and
    noticed that, as Max earlier said, you need to know who and
    what is on your network, and NASA did not have that ability to
    look at the network associated, used across the globe, and it
    is relied upon for the NASA flying assets, satellites. At that
    point I could easily go to the leadership and say, ``How do you
    know you don't have problems? How do you know you have
    problems?''
        We began the process of rolling on the Continuous
    Diagnostic and Mitigation Program. With that transparency, with
    that visibility, we got to see what was on our network, and
    there was a lot of inappropriate software and activity on the
    network. Then I used that data to share with agency leadership,
    to say, ``I do not think it is OK for us to have this type of
    software on NASA's network.''
        From there I would build, with this visibility that we got,
    tell stories back to folks, and turn it around to say, ``This
    is not acceptable for a public agency,'' and use the pride that
    my colleagues had about working for NASA to really propel us
    forward. With each fiscal year we got better at working as a
    team by gaining that visibility.
        Then what we did is when I mentioned the business services
    assessment, and also the follow-on to the business services
    assessment, when NASA said functional areas such as the CIO
    needed to have control over the appropriate IT budgets. This
    was also true for procurement. My colleague in the procurement
    office recognized that IT needed to be procured better, and
    stood up an IT division while I was still there, and we worked
    very closely with her to set that up. The establishment of that
    IT division meant that all IT purchases for NASA would have to
    go through that division, and that I or my team had significant
    influence over that acquisition process.
        That took about 18 months to get set up. It got going in
    full swing after I left NASA. But by having a crisis, by having
    visibility, and by forming partnerships, NASA was able to
    continually iterate in order to give the greater authority over
    to the CIO, gave IT procurement greater visibility into what
    NASA was buying, and with that visibility and with that
    partnership, each year that I was there at NASA we were saving
    about $50 million a year on software purchases alone.
        Real differences can be made through partnership, and I
    will close with the same thing I started--with never let a good
    crisis go to waste. Just stand in someone's office, make a
    friend, and get going on fixing the crisis and changing the
    processes that might have created that crisis.
        Senator Hassan. Thank you for that answer. There is a lot
    for us to learn from that and from your experience and your
    good work.
        Chief information officers spend an average of 2 years or
    less in their position, so I am concerned that this short
    tenure provides very little time for CIOs to be effective or
    establish fiscally responsible practices.
        Ms. Coleman, you spent 12 years at the General Services
    Administration. Do you think that your ability to stay with the
    agency for that long contributed to your success as a CIO, and
    how so?
        Ms. Coleman. Absolutely. It allowed me to really understand
    the culture of the agency, and to the point Renee made, to
    build relationships and partnerships with senior leaders,
    because modernization is a team sport. It is important that
    CIOs have adequate authority. But it is also important that top
    leadership understand the role that they play in supporting
    transformation. To the point you made earlier about the need
    for modernization plans, it should start at the top and be a
    priority, even of the Secretary or the administrator of the
    agency, and at the political appointee level.
        By having a long tenure at GSA, and in the role of CIO, I
    was able to understand that, and be able to use the tailwinds
    provided at GSA. It is an agency that provides business
    services to other agencies, so they take pride in understanding
    technologies to be a good supplier and partner with other
    agencies. That gave us momentum with moving to the cloud,
    because we were able to tap into the culture of what the agency
    is good at, and the DNA to support it across all lines of
    authority. That alignment, not only with leadership but also
    with my peer, the CFOs, the head of HR, and so forth gave us
    the unity of leadership to make real progress.
        Senator Hassan. Thank you. I am going to now turn to Mr.
    Everett, because you had a slightly different experience at
    Energy, because you had a brief tenure at the Department of
    Energy, but you were also able to be extremely effective. What
    do you recommend that current and future CIOs do to be most
    effective from their very first day, and then forward, at an
    agency?
        Mr. Everett. I think there are some tremendous challenges
    on that, and part of this gets into the conversation of
    political versus career CIOs.
        Senator Hassan. Yes.
        Mr. Everett. There is a tradeoff. I absolutely agree, the
    longevity is critical, because they can understand the mission.
    The political ones typically are going to have more access to
    senior leadership, so there is a bit of a balancing act there.
        What I would tell you is part of the reason I was able to
    be effective is I had been in Federal Government before. I knew
    the ropes. I knew what I was getting into. I routinely tell
    people, as just sort of shorthand, if you are new to Federal
    Government, it is going to take you a year to know which way is
    up. If you are coming, no matter how smart you are, from the
    private sector, you are going to have to go through a whole
    year, just to know which way is up, all the differences that
    you have there.
        Because of the nature of the timing--again, going back to
    budgets--because of the timing of budget, you are going to go 2
    years before you are working with your own budget that you had
    any input into. When I walked in, in 2017, my initials were at
    a budget formulation that had already been submitted to OMB. By
    the time that goes clinking around through the entire process
    of OMB, back to the Hill, it is October, a year and a half
    later. That is really challenging.
        I have talked to people from both parties who have been
    very involved in trying to recruit innovative leaders to come
    in as CIOs, and you will find ones that are willing to give up
    the money. They will divest their stock. They will take a
    salary hit. They will move their family. They are willing to
    serve our country, and then they find out, it is going to be 2
    years before you can actually make an impact? That is a killer,
    because their whole reason of doing such a thing is to make an
    impact. If they are politically appointed, they know they have
    a shelf life, and that is a really hard sale. It has made it
    really challenging.
        We have great career folks, as well, that have done really
    good jobs as CIOs, without question, and so my emphasis is
    definitely there, of giving them more authorities. I would love
    to get some of those outside CIOs, regardless of political
    affiliation, because, thankfully, IT is the last nonpartisan
    issue in town.
        I would love to have those people. I would love to have
    those innovators. But we do have to have the structure so that
    they feel it is worth the sacrifice to come in and bring that
    experience and innovation that they have from the private
    sector. It is critical. In the meantime, we have plenty of
    great careers, CIOs and deputies, out there. Giving them the
    tools. FITARA is an important tool, but you have to know how to
    use it.
        I have been in probably the three most spread-out
    agencies--DOE, I spent time at Commerce, and at DHS. I would
    describe them, at best, as a feudal system, if not a mob
    family, and you have to be able to pick your fights. I have
    seen CIOs who have gotten run over because they did not use
    FITARA appropriately.
        Renee made a great point. Procurement was a great ally to
    me in the process. I would tell people, walking in, your
    procurement officer is going to be a great help. I will pick a
    fight and say, we need more support versus the CFOs. CFOs
    typically are Senate confirmed.
        Senator Hassan. Yes.
        Mr. Everett. Only one CIO, VA, is Senate confirmed. In the
    pecking order of this town, it is very difficult for CIOs going
    up against a Senate-confirmed CFO. You can make a great
    relationship with them, but at the end of the day, they are
    higher in that pecking order, and that is a challenge for many
    CIOs, because you are not sort of quite at the same level.
        Senator Hassan. Thank you. I am going to turn to one other
    topic before I ask you a wrap-up question, and it is something
    all of you have mentioned, but I want to focus in on it a
    little bit. I want to start with Mr. Everett.
        As part of the American Rescue Plan, the Technology
    Modernization Fund received $1 billion to loan to agencies in
    order to modernize IT systems. Although we do not see the
    impact of these funds for years to come, this is a really major
    step forward to reduce reliance on legacy IT, and I hope that
    the fund prioritizes agency plans to replace the legacy IT
    systems that we have discussed today.
        Mr. Everett, as a CIO who successfully leveraged the
    Technology Modernization Fund to move away from legacy IT
    systems, how should agencies utilize the fund to ensure that
    they not only have the resources and infrastructure to support
    IT modernization, but also ensure that the systems they propose
    actually reduce reliance on legacy IT while contributing to
    better security and customer service?
        Mr. Everett. The first thing they should do is have the
    courage to actually go apply for those. I think if you go look,
    I believe it is still only five agencies that have actually
    received TMF funds. I spent a lot of time browbeating people,
    and I know people, they were simply afraid of the oversight,
    afraid of the visibility. They were also afraid of the
    repayment, which is why I think that has to be looked at.
        But a lot of them--listen, from my team, the culture chain
    was important. I had members of my team, my career team, come
    back and tell me they enjoyed the process. They went through a
    process that is similar to anybody who has ever worked in
    private sector. You can go right now to the website, the TMF
    website, and go through the spreadsheets, and see the level of
    detail that you were asked about your current cost basis and
    your future cost basis. That is how everybody in the private
    sector runs their IT. That is exactly how we should. We should
    know all of our costs, across the board. We should be able to
    project them out over years. That is what any mature
    organization would do, and that is a huge value of the TMF, and
    you need your people to do that.
        Literally, I do not care if you do not turn it in. Everyone
    should go do one of those today. Everybody in government. I
    think part of it is being brave enough to step forward and go
    ahead and do it, know that there is going to be that challenge.
    There is oversight to it. The board checks in on you, so you do
    not get a giant check.
        Senator Hassan. Right.
        Mr. Everett. There is a process to it, and that is
    critically important. I would urge all of you--I have been in
    this town 20 years. When Congress gave $1 billion to a program
    that most people kind of do not understand, I know for a fact,
    in this town, there are people eyeballing that money, who want
    to cut the line and avoid the process. I would strongly urge
    you to make sure that your oversight does not allow that to
    happen. That process has to be followed. Now, it can go to all
    sorts of things, and so to your point, those legacy systems are
    probably, arguably, the easiest ones to show, in many cases,
    where you can get value and return on the investment, and they
    are great.
        But I will also mention--and this is where some of those
    waivers need to be looked at--there are so many customer-facing
    systems, it is very hard to document the cost savings there.
    The customer service, we can talk about all day long. You can
    see it with your eyes. But it may be harder to show the cost
    savings on that system, and that is where I think we do need to
    look at some ability to defer away costs, as long as the
    process is followed.
        I am such a proponent, as you can tell, of TMF, because
    that process leads us to how we should manage things. It should
    not simply be giving things out to a most favored program.
        Senator Hassan. Right.
        Mr. Everett. We have done that too often, and that is a
    disaster. Making people go through the process is just so
    critical, and I think any CIO coming in right now, it is a
    great test of your team. Ask them to go find you--I would
    challenge any new CIO----
        Senator Hassan. Yes.
        Mr. Everett [continuing]. Tell your team to find one
    program or system that needs to be modernized, and make them
    fill the form out and take a look at it, and you should be able
    to tell right there, do they know their costs, do they know
    their systems, do they understand how to project that budget?
    If they do not, get help.
        Listen, there are some great groups in town, some truly
    private sector associations, that will come in, free of charge,
    and come help you with your acquisition and your budget
    process, and they are not trying to sell you anything.
        Senator Hassan. Yes.
        Mr. Everett. As well, Kevin mentioned TBM. Another great
    process you can go through to understand, in a very modern way,
    how your costs should be managed. There is help out there for
    anybody who is looking for it in the Federal Government right
    now, if they are willing to reach out.
        Senator Hassan. Thank you. I am going to turn to Ms.
    Coleman, too, about Working Capital Funds. I will also note
    that one of the issues you raised is how we go about qualifying
    and quantifying customer service value, right? Because,
    obviously, for taxpayers, our goal should be to make the
    interface with the Federal Government as customer friendly as
    possible, since taxpayers are footing the bill here. Trying to
    figure out a way to really assess value there, I think is
    really important.
        Ms. Coleman, Working Capital Funds are another mechanism
    that agencies can use to support their IT modernization
    priorities, outside of the one-year budgeting and
    appropriations cycle. While some agencies have the authority to
    establish these funds under the Modernizing Government
    Technology Act, some agencies were not given the authority,
    which is a technical error that I hope to address in future
    legislation.
        Ms. Coleman, the General Services Administration
    effectively uses Working Capital Funds and fees generated from
    its governmentwide services to fund its mission. Can you
    describe how GSA uses savings produced from modernization
    projects to keep the Working Capital Fund going?
        Ms. Coleman. Yes. Thank you. One of the keys is to take a
    portfolio approach, and I completely agree with what Max said
    earlier about the Working Capital Funds. Modernization, in and
    of itself, will incur cost and complexity when viewed in
    isolation. One way to counterbalance that is to look across all
    systems and all investments, and to be able to do puts and
    takes in a portfolio-based approach. If you have a Working
    Capital Fund, you can know your money and you can time the
    modernization according to your risk management and according
    to your most critical systems first, or the ones that deliver
    the greatest impact.
        As it pertains to customer service, that is a qualitative
    measure, not so much quantitative measure.
        Senator Hassan. Yes.
        Ms. Coleman. But the ability to stay up to date with
    platforms that are maintained by the vendor, rather than having
    to continually invest with agency resources for these big
    upgrades every 2 or 3 years, provides cost savings along the
    way as well.
        Senator Hassan. Thank you. Mr. Walsh, from GAO's
    perspective, what are the advantages or disadvantages of
    relying on the Technology Modernization Fund, or Working
    Capital Funds, to resource IT modernization rather than
    requesting funding through the annual budget requests?
        Mr. Walsh. As the other witnesses have noted, the TMF
    allows agencies to kind of shortcut the budget cycle. Now, it
    is still a loan. It is not a free gift to go out and spend
    willy nilly. You go through the application process. I will
    also note that the process, as described, going through TMF
    that Max talked about, is very similar to having the
    modernization plans that we described. You have to have some
    idea of the work to be done, the timelines, and a plan to turn
    off the old system.
        The disadvantage to the TMF is that it is linked to
    spending and cost savings. There are times where we need to
    modernize systems, and they will not save money.
        The OPM breach that we talked about earlier----
        Senator Hassan. Yes.
        Mr. Walsh [continuing]. The government had the choice to
    modernize those networks and systems to allow the data to be
    encrypted when it was at rest. It was a tradeoff. I am sure if
    OPM wanted to go back in time and had that decision to make,
    they would absolutely spend the money to modernize that. But
    they would not save any money by doing that modernization.
        Modernization is not about cost savings. It is about better
    services to our citizens, privacy, security. Cost savings can
    be a part of it, but there is a lot more to this decision than
    just the money.
        Senator Hassan. Thank you. That concludes the rounds of
    questions I had. I am going to ask you all one wrap-up
    question, and just double-check with staff--we are good on
    other Senators, right? OK.
        First of all, all four of you have been so generous, not
    only with your time this morning and your preparation for this
    hearing but with your expertise and your clear engagement with
    this issue and desire to help the Federal Government do its
    work much better in modernizing the IT sector at a time when we
    so desperately need to do that, for all the reasons, among
    others, that the pandemic has really laid clear. Thank you for
    your service, for your expertise, and for your testimony today.
        As we wrap up, I will ask each of you this, and I will
    start with Ms. Wynn. Could each of you describe what, in your
    opinion, is the greatest challenge presented by the sustained
    use of legacy IT systems? If you already feel like you have
    talked about it, just go ahead and say that. But I really do
    not want to let this opportunity go without giving you all a
    chance to focus on that.
        Ms. Wynn, we will start with you.
        Ms. Wynn. Great. Thank you, and thank you again for the
    honor to testify today. It is a great pleasure of mine to
    continue to give to the United States Federal Government after
    30 years of service.
        I would say the greatest challenge presented to us today
    are agency and department cultures. They must recognize that IT
    modernization is part of the path forward for the United States
    government to quickly and securely deliver new or better
    quality services to the American public. This needs to be done
    with a positive customer experience, and finally, it must be
    delivered in a way that improves national security and not poke
    a hole through it.
        Again, it was an honor to be here and to be with my former
    colleagues as well. Thank you.
        Senator Hassan. Thank you, Ms. Wynn. Mr. Everett.
        Mr. Everett. I would say I hope that we have covered it
    well for you. I would summarize by simply saying missed
    opportunities. To me, this challenge is we are missing
    opportunities across the board, opportunities to secure our
    systems, opportunities to entice people with new and innovative
    skills into government, and opportunities to serve the citizens
    of the country. All of those, they are these missed
    opportunities, over and over again, that we were stuck in these
    systems.
        Again, that word I used, technical debt, but that is what
    it means. It is not the money. As Renee said, it is the
    culture. It is so many of these things that we are missing out
    on, these missed opportunities, that we could get simply by
    doing some basic modernization of systems. The flow-down effect
    would be really, I think, dramatic in so many different areas.
        That is the part that disappoints me, but right now it also
    excites me, because we have gotten new resources, we have the
    attention of Congress and other folks. We have some really
    good, new opportunities right now, and everyone has seen the
    value that IT can bring to life and to meeting challenges. Just
    after this last year of dealing with COVID, there are so many
    things we are able to do because of technology. I think there
    is a unique time of recognition of that. I would love to see
    that progress, not pause but accelerate in 2021.
        Senator Hassan. Thank you. Ms. Coleman.
        Ms. Coleman. Chair Hassan, I think it is a mark of how
    aligned we all are that when you asked this question I wrote
    down ``culture change'' and ``missed opportunities,'' just like
    Renee and Max. I think that, just to double down on that
    statement, modern technology allows us to do things not just
    better but things we could not do before, and I think that is
    the missed opportunity if we do not modernize.
        I will give you one very quick example. The pandemic has
    illustrated so many areas where government is so critical to
    the well-being of the public. In New Mexico, unemployment
    claims spiked by 600 percent when people were thrust out of
    work, and call center workers were sent home, and they were not
    able to process claims in a timely way.
        We had the opportunity to help them with a virtual contact
    center, which allowed their workers to work from home, but also
    with chatbots. It let them answer questions in an automated
    fashion, and take some of that burden off of the call center
    agents to focus on the higher-value need, and get economic
    relief into the community quickly.
        There are things that can be done that we are not taking
    advantage of, at every level of government, and I think that
    the time is now to rethink that. Thank you.
        Senator Hassan. Thank you. Mr. Walsh.
        Mr. Walsh. It is hard to imagine a government function that
    is not somehow tied to IT. As we go along, IT has become more
    and more complex. If you look back, again to the Voyager
    probes, those were written with 3,000 lines of COBOL code. We
    have come a long way since then. Modern technology requires
    millions, if not billions, of lines of code.
        The problem is the longer we wait to modernize, the longer
    we procrastinate, the more it is going to cost, both in terms
    of money, in terms of breaches, in terms of security, in terms
    of lost--to quote my peers--lost opportunities, ways that we
    could have better served our citizens.
        It is an issue of procrastination. We need to act. We need
    to act now.
        Senator Hassan. Thank you. Thank you to all four of you,
    for your time and your testimony this morning. To Kevin Walsh,
    Casey Coleman, Renee Wynn, and Max Everett, your testimony
    provided really valuable insights on this topic, and your
    contributions to improving Federal IT systems in a fiscally
    responsible way are really appreciated.
        As I mentioned in my opening statement, this hearing is the
    first on the costs and challenges presented by reliance on
    legacy IT systems, and I look forward to continuing this
    important oversight work, to save taxpayer dollars, to deliver
    government services more efficiently, and to keep government IT
    systems secure.
        The hearing record will remain open for 15 days, until 5
    p.m. on May 12th, for submissions of statements and questions
    for the record.
        This hearing is now adjourned.
        [Whereupon, at 11:27 a.m., the Subcommittee was adjourned.]

                                A P P E N D I X

                                  ----------

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]