Electronic Records Archives: The National Archives and Records	 
Administration's Fiscal Year 2006 Expenditure Plan (18-AUG-06,	 
GAO-06-906).							 
                                                                 
Since 2001, the National Archives and Records Administration	 
(NARA) has been working to acquire the Electronic Records	 
Archives (ERA) system, which is intended to address critical	 
issues in the creation, management, and use of federal electronic
records. As required by law, the agency submitted its fiscal year
2006 expenditure plan to the congressional appropriations	 
committees, seeking the release of about $22 million for the	 
development of the system. GAO's objectives in reviewing the	 
expenditure plan were to (1) determine the extent to which the	 
expenditure plan satisfied the legislative conditions specified  
in the appropriations act; (2) determine the extent to which NARA
has implemented GAO's prior recommendations; and (3) provide any 
other observations about the expenditure plan and the ERA	 
acquisition. We reviewed the expenditure plan and analyzed it	 
against the legislative conditions and assessed NARA's progress  
in addressing prior recommendations.				 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-906 					        
    ACCNO:   A58943						        
  TITLE:     Electronic Records Archives: The National Archives and   
Records Administration's Fiscal Year 2006 Expenditure Plan	 
     DATE:   08/18/2006 
  SUBJECT:   Electronic records 				 
	     Electronic records archive 			 
	     Electronic records management			 
	     Federal records management 			 
	     Information security				 
	     Information security management			 
	     Information technology				 
	     Procurement planning				 
	     Risk management					 
	     NARA Electronic Records Archives			 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-906

     

     * Report to Congressional Committees
          * August 2006
     * ELECTRONIC RECORDS ARCHIVES
          * The National Archives and Records Administration's Fiscal Year
            2006 Expenditure Plan
     * Contents
          * Recommendation for Executive Action
          * Agency Comments
     * Briefing Slides
     * Comments from the National Archives and Records Administration
     * GAO Contacts and Staff Acknowledgments

                 United States Government Accountability Office

GAO

                                  August 2006

ELECTRONIC RECORDS ARCHIVES

The National Archives and Records Administration's Fiscal Year 2006 Expenditure
                                      Plan

                                       a

ELECTRONIC RECORDS ARCHIVES

The National Archives and Records Administration's Fiscal Year 2006
Expenditure Plan

  What GAO Found

NARA's fiscal year 2006 expenditure plan fully satisfies three of the six
legislative conditions and partially satisfies the remaining conditions
(see table).

Fiscal Year 2006 Expenditure Plan: Compliance with Legislative Conditions

                         Legislative conditions Status

1. Meet OMB capital planning and investment control review requirements
       Partially satisfied
2. Comply with NARA's enterprise architecture Partially satisfied
3. Conform to NARA's enterprise life cycle methodology Partially
       satisfied
4. Comply with acquisition rules, requirements, guidelines, and system
       acquisition management practices of the federal government Satisfied
5. Approval by NARA and OMB Satisfied
6. Review by GAO Satisfied

Source: GAO.

The agency continues to make progress in addressing prior GAO
recommendations: the agency has fully implemented three of five and has
partially implemented the remaining two. The agency has (1) strengthened
information security by developing a program that includes agencywide
assessments of information security risks; (2) developed and implemented a
document review process to ensure that recommendations from reviewers are
addressed and incorporated into acquisition policies and plans; and (3)
improved federal records management by implementing strategies to raise
agencies' awareness of records management principles, functions, and
programs. However, while NARA has completed the development of an
enterprise architecture, it lacks an agencywide board for reviewing
information technology projects for conformance to the architecture,
including projects that are interdependent with ERA. In addition, the
agency revised four out of five key policies and plans to comply with
industry standards. At the time of our briefing, the Risk Management Plan
was under revision. It was completed in July 2006. Until the agency fully
addresses all prior recommendations, risks remain to the successful
implementation of the system.

NARA's expenditure plan does not contain the level and scope of
information needed by Congress to understand the agency's plans and
commitments relative to system capabilities, benefits, schedules, and
costs. For example, it does not fully describe how the infrastructure
elements that are to be procured will fit into the overall system design.
Until the agency improves future expenditure plans to include information
on system capabilities, benefits, schedules, and costs, Congress will not
have the information needed to oversee plans and progress on the
acquisition of the system. We performed our work at NARA's College Park,
Maryland, location in accordance with generally accepted government
auditing standards.

                 United States Government Accountability Office

Contents

Letter                                                                   1 
                            Recommendation for Executive Action             3 
                            Agency Comments                                 3 
Appendixes                                                              
                Appendix I: Briefing Slides                                 5 
               Appendix II: Comments from the National Archives and        
                            Records                                        
                            Administration                                 34 
              Appendix III: GAO Contacts and Staff Acknowledgments         36 

                                 Abbreviations

       ERA          Electronic Records Archives                           
       EA           Enterprise Architecture                               
       FISMA        Federal Information Security Management Act           
       IT           Information Technology                                
       NARA         National Archives and Records Administration          
       OIG          Office of Inspector General                           
       OMB          Office of Management and Budget                       
       SCAMPI       Standard CMMI(R) Appraisal Methodology for Process    
                    Improvement                                           
       SEI          Software Engineering Institute                        

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

A

United States Government Accountability Office Washington, D.C. 20548

August 18, 2006

The Honorable Christopher S. Bond Chairman The Honorable Patty Murray
Ranking Minority Member Subcommittee on Transportation, Treasury, the
Judiciary,

Housing and Urban Development, and Related Agencies Committee on
Appropriations United States Senate

The Honorable Joe Knollenberg Chairman The Honorable John W. Olver Ranking
Minority Member Subcommittee on Transportation, Treasury, and Housing

and Urban Development, the Judiciary, and District of Columbia,

and Independent Agencies Committee on Appropriations House of
Representatives

As required by law, the National Archives and Records Administration
(NARA) submitted its fiscal year 2006 expenditure plan in March 2006 to
congressional appropriations committees, seeking the release of about $22
million for the development of the Electronic Records Archives (ERA). ERA
is a major information system that is intended to address critical issues
in creating, managing, and using federal electronic records and automating
the records management and archiving life cycle. Our objectives in
reviewing the plan were to (1) determine whether the plan satisfied the
conditions specified in the law,1 (2) determine the extent to which NARA
has implemented our prior recommendations, and (3) provide any other
observations about the expenditure plan and the ERA acquisit ion.

1NARA's fiscal year 2006 appropriations act provides that the agency must
submit an expenditure plan before obligating fiscal 2006 funds for the ERA
program. The plan must (1) meet the capital planning and investment
control review requirements established by the Office of Management and
Budget (OMB), including Circular A-11; (2) comply with NARA's enterprise
architecture; (3) conform with NARA's enterprise life cycle methodology;
(4) comply with the acquisition rules, requirements, guidelines, and
system acquisition management practices of the federal government; (5) be
approved by NARA and OMB; and

(6) be reviewed by GAO. See P.L. No. 109-115, November 30, 2005, Div. A,
Title VI, 119 Stat. 2486.

In May 2006, we transmitted a copy of our briefing to your staff and
briefed staff from the Senate Appropriations Subcommittee on
Transportation, Treasury, the Judiciary, Housing and Urban Development,
and Related Agencies on the results of our review. This report transmits
the materials we used at the briefing and provides the recommendation that
we made to the Archivist of the United States. The full briefing
materials, including our scope and methodology, are reprinted as appendix
I.

In summary, we made the following major points:

     o NARA's fiscal year 2006 expenditure plan has fully satisfied three of
       the six legislative conditions. The agency's plan (1) has complied
       with acquisition rules, requirements, guidelines, and system
       acquisition management practices of the federal government; (2) was
       approved by NARA and the Office of Management and Budget (OMB); and
       (3) was reviewed by GAO. The agency has partially satisfied the three
       remaining conditions by (1) meeting OMB's capital planning and
       investment control review requirements for the ERA acquisition, but
       has not appointed a group to regularly review ERA and other ongoing
       information technology (IT) investments, including those that have
       interdependencies with ERA; (2) developing and implementing a
       procedure to ensure that ERA complies with the agency's enterprise
       architecture, but has not established a board to assess IT projects
       agencywide, including those that have interdependencies with ERA, to
       ensure conformity to the EA; and (3) implementing procedures to ensure
       ERA conform s to the agency's life cycle methodology, but has not yet
       fully established an agencywide risk management capability.
          * NARA continues to make progress in addressing our prior
            recommendations. The agency has fully implemented three of five
            recommendations and has partially implemented the remaining two.
            The agency has (1) strengthened information security by
            developing a program that includes agencywide assessments of
            information security risks and an enterprise architecture that
            addresses information security issues agencywide; (2) developed
            and implemented a document review process to ensure that
            recommendations from independent verification and validation
            reviews are addressed and incorporated into acquisition policies
            and plans; and (3) improved federal records management by
            implementing strategies to raise agencies' awareness of records
            management principles, functions, and programs and by monitoring
            the performance of agencies' records management programs and
            practices. The agency has partially implemented two other
            recommendations that
          * are essential for the successful management of the acquisition.
            It has (1) completed the development of an enterprise
            architecture, but lacks a board for reviewing IT projects
            agencywide, including projects that are interdependent with ERA
            and (2) revised four out of five key policies and plans to comply
            with industry standards. At the time of our briefing, the
            remaining document-the Risk Management Plan-was under revision
            with an expected completion date of June 2006. The Risk
            Management Plan was subsequently completed in July 2006.
     o NARA's expenditure plan provides only general information on how the
       $22 million is to be spent and does not fully describe, for example,
       how the infrastructure elements that are to be procured will fit into
       the overall system design. The legislative requirement for submitting
       an ERA expenditure plan to the appropriations committees is intended
       to provide lawmakers with a sufficient understanding of the system
       acquisition in order to permit effective oversight and to allow for
       informed decision making about the use of appropriated funds. To
       achieve these objectives, the plan needs to disclose a sufficient
       level and scope of information to understand what system capabilities
       and benefits are to be delivered, by when, at what cost, and the
       progress being made against the commitments that were made in prior
       expenditure plans. Without this complete information, Congress does
       not have the information needed to oversee plans and progress on the
       acquisition of the ERA system.

  Recommendation for Executive Action
  
To reduce the risks associated with NARA's efforts to acquire ERA, we
recommend that the Archivist of the United States ensure that future
expenditure plans include a sufficient level and scope of information to
enable Congress to understand what system capabilities and benefits are to
be delivered, by when, and at what cost, and report on the progress being
made against the commitments that were made in prior expenditure plans.

                                Agency Comments

In written comments on a draft of this report, the Archivist of the United
States agreed with the results and recommendation. In addition, he stated
that the agency has submitted an action plan to relevant congressional
committees documenting how it plans to satisfy the legislative conditions
that we identified as partially implemented. He also noted that NARA has
proposed to the committees that the agency submit an addendum to its
expenditure plan that would provide more detailed information on the
allocation of funds, infrastructure elements, workflow capability, and
business applications in the ERA system.

We are sending copies of this report to the Archivist of the United
States. We will make copies available to others on request. In addition,
the report will be available at no charge on the GAO Web site at
http://www.gao.gov/.

If you or your staff have any questions concerning this report, please
call me at 202-512-6240; I can also be reached by e-mail at
[email protected]. Contact points for our Offices of Congressional Relations
and Public Affairs may be found on the last page of this report. GAO staff
who made major contributions to this report are listed in appendix III.

Linda D. Koontz Director, Information Management Issues 

Appendix I

Briefing Slides

  Electronic Records Archives: The National Archives and Records
  Administration's Fiscal Year 2006 Expenditure Plan

Briefing for Staff Members of the

Subcommittee on Transportation, Treasury, the Judiciary, Housing and Urban
Development, and Related Agencies Senate Committee on Appropriations

and the Subcommittee on Transportation, Treasury, and Housing and Urban
Development, the Judiciary, District of Columbia, and Independent Agencies

House Committee on Appropriations1

May 26, 2006

1

A technical clarification was added on p. 20.

Introduction Objectives, Scope, and Methodology Results in Brief
Background Legislative Conditions Implementation of Prior Recommendations

x Enterprise Architecture x Information Security x Document Review Process
x Acquisition Policies and Plans x Records Management

Observation on the ERA Expenditure Plan Conclusions Recommendation for
Executive Action Agency Comments and Our Evaluation

The mission of the National Archives and Records Administration (NARA) is
to ensure "ready access to essential evidence" for the public, the
President, Congress, and the courts. NARA is responsible for oversight of
records management and archiving, which increasingly involves dealing with
documents that are electronically created and stored. Accordingly, the
Archivist of the United States plans to develop the Electronic Records
Archives (ERA) to address critical issues in the creation, management, and
use of federal electronic records. ERA is a major information system that
NARA envisions will have the ability to preserve and provide access to
massive volumes of all types and formats of electronic records. Overall,
the system is to automate the records management and archiving life cycle.
Specifically, ERA is to consist of

x infrastructure elements, including hardware and operating systems; x
business applications that will provide for scheduling electronic records,
accessioning, preserving

and storing records; and x public access provided by a Web browser and the
public Internet. In 2001, NARA hired a contractor to develop policies and
plans using the standards of the Institute of

Electrical and Electronics Engineers, Inc., (IEEE) to guide the overall
acquisition of an electronic records system.

In December 2003, the agency released a request for proposals for the
design of ERA. In August 2004, NARA awarded two firm fixed-price
contracts2 for the design phase totaling about $20 million- one to Harris
Corporation and the other to Lockheed Martin Corporation. On September 8,
2005, NARA announced the selection of Lockheed Martin Corporation to build
the ERA system.

NARA's fiscal year 2006 appropriations act3 provides that the agency must
submit an expenditure plan before obligating fiscal 2006 funds for the ERA
program. The plan must

x meet the capital planning and investment control review requirements     
     established by the Office                                                
     of Management and Budget (OMB), including Circular A-11;                 
x comply with NARA's enterprise architecture;                              
x conform with NARA's enterprise life cycle methodology;                   
x comply with the acquisition rules, requirements, guidelines, and system  
     acquisition management                                                   
     practices of the federal government;                                     
x be approved by NARA and OMB; and                                         
x be reviewed by GAO.                                                      

2

According to the Federal Acquisition Regulation, a firm fixed-price
contract provides for a price that is not subject to any adjustment on the
basis of the contractor's cost experience in performing the contract. This
type of contract places maximum risk and full responsibility for all costs
and resulting profit or loss on the contractor(s).

3

P.L. 109-115, November 30, 2005, Div. A, Title VI, 119 Stat. 2486.

On March 16, 2006, NARA submitted its 2006 expenditure plan to the
relevant House and Senate appropriations subcommittees, seeking release of
about $22 million for the development contract with Lockheed Martin.

Since June 2002, we have completed several reports assessing NARA's
efforts to acquire the ERA system.4 In these reports, we made a total of
10 recommendations; 5 have been implemented while the following remained
to be addressed at the beginning of this review.

x Develop an enterprise architecture.                                      
x Improve information security in order to address the lack of (1) a       
     capability to assess agencywide                                          
     information security risks and (2) a security architecture that          
     addresses information security                                           
     issues agencywide.                                                       
x Design and implement a process to ensure that recommendations from       
     verification and validation                                              
     reviews are addressed and incorporated into ERA's acquisition policies   
     and plans.                                                               
     Revise five key ERA program policies and plans to conform to IEEE        
x standards.                                                               

4GAO, Information Management: Challenges in Managing and Preserving
Electronic Records, GAO-02-586 (Washington, D.C.: June 17, 2002); GAO,
Records Management: National Archives and Records Administration's
Acquisition of Major System Faces Risks, GAO-03-880 (Washington, D.C.:
Aug. 22, 2003); GAO, Records Management: Planning for the Electronic
Records Archives Has Improved, GAO-04-927 (Washington, D.C.: Sept. 23,
2004); and GAO, Information Management: Acquisition of the Electronic
Records Archives is Progressing, GAO-05-802 (Washington, D.C.: July 15,
2005).

x Develop a documented strategy for (1) raising agency senior management
awareness of and commitment to records management principles, functions,
and programs and (2) conducting systematic inspections of agency records
management programs to (a) periodically assess agency progress in
improving records management programs and (b) evaluate the efficacy of
NARA's governmentwide guidance.

    As agreed, our objectives were to

x determine the extent to which NARA's fiscal year 2006 expenditure plan
satisfies the legislative conditions specified in NARA's appropriations
act, x determine the extent to which NARA has implemented our prior
recommendations, and x provide any other observations about the
expenditure plan and the ERA acquisition.

To assess compliance with legislative conditions, we

x reviewed the fiscal year 2006 expenditure plan submitted by NARA in
March 2006 and analyzed the plan against the legislative conditions to
identify any variances; x reviewed and analyzed NARA's processes to ensure
the ERA system acquisition conforms to the agency's enterprise
architecture;

x reviewed NARA's fiscal year 2006 A-11, section 300 submission to OMB and
identified and analyzed NARA's responses to determine the extent to which
the agency has complied with OMB's capital planning and investment control
requirements; and

x reviewed the systems development life cycle policy that the agency is
using to guide the ERA acquisition and analyzed relevant items for
compliance.

    To determine the extent to which NARA has implemented prior recommendations,
    we

x evaluated the agency's enterprise architecture plans and products and
conducted interviews of senior NARA officials to determine the status of
the agency's efforts to develop an enterprise architecture;

x reviewed Federal Information Security Management Act (FISMA) reports and
NARA's security program plan, security architecture, and system security
plans; interviewed senior NARA officials and Office of Inspector General
(OIG) auditors to determine the status of the agency's efforts to
strengthen information security;

x reviewed key ERA policies and plans and independent verification and
validation reports on the policies and plans and interviewed ERA officials
to determine what progress the program had made in addressing our
recommendation that policies and plans conform to industry standards;

x assessed the program's process for reviewing and finalizing policies and
plans and interviewed ERA officials responsible for the review process to
determine the extent to which the review process was developed and
implemented; and

x interviewed NARA officials and reviewed documents to determine the
progress the agency has made in addressing our recommendation to raise
awareness among senior federal officials of the importance of federal
records management and increase their commitment to federal records
management; and to conduct systematic inspections of agency records
management programs to (a) periodically assess agency progress in
improving records management programs and (b) evaluate the efficacy of
NARA's governmentwide guidance.

    To develop our observation on the ERA expenditure plan and acquisition, we

x assessed the completeness of the cost and schedule information contained
in the expenditure

plan and interviewed NARA officials in order to gain an understanding of
the data. We performed our work from December 2005 to May 2006 at NARA's
College Park, Maryland, location in accordance with generally accepted
government auditing standards.

    Legislative Conditions

NARA's fiscal year 2006 expenditure plan fully satisfies three of the six
legislative conditions. The plan partially satisfies the legislative
conditions that ERA meet OMB's capital planning and investment control
review requirements, conform to the enterprise architecture, and comply
with the requirements of the systems development life cycle.

    Prior Recommendations

NARA has fully implemented three of five prior GAO recommendations and
partially implemented the remaining two.

Table 1: Summary Status of NARA's Progress in Implementing Prior
Recommendations

Prior recommendation       Status       Progress                           
1. Enterprise architecture partially    NARA has completed a baseline,     
                              implemented  target, and a plan for             
                                           transitioning from the baseline to 
                                           the target architecture. However,  
                                           the agency lacks a board for       
                                           reviewing IT projects agencywide,  
                                           including projects that are        
                                           interdependent with ERA.           
2. Information security    implemented  NARA has developed a program that  
                                           includes agencywide                
                                           assessments of information         
                                           security risks and an enterprise   
                                           architecture that addresses        
                                           information security issues        
                                           agencywide.                        

                                Results in Brief

Prior recommendation        Status       Progress                          
3. Document review process  implemented  A document review process has     
                                            been developed and implemented to 
                                            ensure that recommendations from  
                                            independent verification and      
                                            validation reviews are addressed  
                                            and incorporated into acquisition 
                                            policies and plans.               
4. Acquisition program      partially    NARA has revised four out of five 
policies and plans          implemented  key policies and plans to comply  
                                            with IEEE standards. According to 
                                            NARA officials, the remaining     
                                            document-the Risk Management      
                                            Plan-is currently under revision. 
5. Federal records          implemented  NARA has implemented strategies   
management                               to raise agencies' awareness of   
                                            records management principles,    
                                            functions, and programs and to    
                                            monitor the performance of        
                                            agencies' records management      
                                            programs and practices.           

Source: GAO.

    Observations on the ERA Expenditure Plan and Program

NARA's expenditure plan does not contain the level and scope of
information needed for Congress to understand its plans and commitments
relative to system capabilities, benefits, schedules, and costs.

We are making a recommendation to NARA to improve the utility of future
expenditure plans. In commenting on a draft of these briefing slides, the
Archivist generally agreed with the contents and our recommendation.

  NARA's fiscal year 2006 expenditure plan includes a description of plans to
  complete initial operating capability of the ERA system5 by September 2007.
               Table 2 shows the schedule of planned activities.

Table 2: Summary of Planned Activities

Milestone                                 Start date     Completion date   
Develop ERA through initial operating   October 1, 2005     August 7, 2006 
capability                                              
Establish ERA system infrastructure        June 5, 2006  November 24, 2006 
Provide business applications for       August 17, 2006 September 30, 2006 
appraisal, scheduling, limited                          
preservation, and internal                              
dissemination of electronic records                     
Complete initial operating capability                    September 7, 2007 

Source: GAO.

Successfully acquiring the ERA system also involves the management of
interdependent IT projects. The current environment consists of a number
of legacy systems that do not adequately fulfill mission needs,
comprehensively address the entire life cycle management of records, or
support all of NARA's evolving business processes. These legacy systems
will be subsumed into the new system.

A senior ERA official indicated that these dates were tentative and would
not be finalized until August 7, 2006, when Lockheed Martin and NARA
complete the design.

NARA's fiscal year 2006 expenditure plan for the ERA program also includes
a summary of funding to complete initial operating capability of the ERA
system.

Table 3: Summary of NARA's Fiscal Year 2006 ERA Expenditure Plan

Project category                                                    Amount 
Program management                                             $12,019,698 
Research and development                                         3,500,000 
Site deployment                                                  1,980,000 
Development contract - Lockheed Martin                          21,780,000 
Independent verification and validation6                         1,549,909 
Total                                                          $40,829,607 

Source: NARA 2006 Expenditure Plan.

Of these funds, NARA cannot obligate the $21,780,000 for the development
contract with Lockheed Martin until Congress reviews and approves the
expenditure plan. Congress released the remaining funds when NARA's
appropriations bill was signed in November 2005.

NARA contracted with Northrop Grumman to perform independent verification
and validation on policies and plans produced by the ERA program and
contractual deliverables produced by Lockheed Martin.

                             Legislative Conditions

NARA has fully satisfied three of the six legislative conditions and
partially satisfied three.

Table 4: Fiscal Year 2006 Expenditure Plan Provisions for Satisfying
Legislative Conditions

Legislative          Status    Progress                                    
condition                      
                                  NARA meets OMB's capital planning and       
                                  investment control review requirements for  
1. Meet OMB capital            the ERA acquisition. It identified funding  
planning and                   required for acquiring ERA and conducts     
investment control   Partially regular reviews of the program. However,    
review requirements  satisfied while NARA has appointed a                  
                                  agency does not regularly review other      
                                  ongoing IT investments, including those     
                                  group comprised of senior managers that     
                                  meets weekly to review ERA, the             
                                  that have interdependencies with ERA.       
2. Comply with       Partially NARA has developed and implemented a        
NARA's enterprise    satisfied procedure to ensure that ERA complies with  
architecture                   the agency's enterprise architecture (EA).  
                                  However, while the chief technology officer 
                                  reviews and approves ERA's conformance to   
                                  the agency's EA, NARA has not yet           
                                  established a board to assess IT projects   
                                  agencywide, including those that have       
                                  interdependencies with ERA, to ensure they  
                                  conform to the EA.                          
3. Conform to NARA's Partially ERA conforms to the life cycle methodology. 
                                  For example, the plan includes              
enterprise life      satisfied descriptions of the incremental approach    
cycle methodology              the agency has adopted for acquiring ERA    
                                  and the program performs risk and           
                                  performance management. However, NARA has   
                                  not yet fully established an agencywide     
                                  risk management capability.                 
                                  While it has established a Risk Review      
                                  Board and assigned a chairperson to it,     
                                  identified risks, and is developing         
                                  processes, it has not yet completed a risk  
                                  management plan or strategy.                

                             Legislative Conditions

Legislative       Status    Progress        
condition                   
4. Comply with    Satisfied           NARA satisfied this provision by (1)
acquisition                             conducting internal assessments in
guidelines, and             CMM8 methods to determine the maturity of
system rules,               ERA's system policies, 2002 and 2004 that used
requirements,               the Software Engineering Institute's (SEI)7
acquisition                 SAprocesses, and practices; (2) implemented a
management                  process to address the
practices of the            
federal                     
government                  improvement (SCAMPIsm)10 appraisal of ERA in
                               FY 2007. assessment's recommendations; and (3)
                               is planning to commission an independent
                               standard CMMI(R)9 appraisal methodology for
                               process         
5. Approval by    Satisfied               x OMB - March 14, 2006           
NARA and OMB                                
                                             x NARA - March 16, 2006          
6. Review by GAO  Satisfied x               GAO - May 26, 2006, briefing   
                               subcommittees.  to NARA's appropriations       

Source: GAO.

7

SEI is a federally funded research and development center operated by
Carnegie Mellon University and sponsored by the Department of Defense. Its
objective is to provide leadership in software engineering and in the
transition of new software engineering technology into practice.

8

SA-CMM: Identifies key process areas that are essential to effectively
managing software-intensive system acquisitions.

9

CMMI is registered in the U.S. Patent and Trademark Office by Carnegie
Mellon University. The CMMI is SEI's process model that describes how to
develop the processes needed for software development and specific
practices that organizations should follow.

10

SCAMPI (SM) is a service mark of Carnegie Mellon University. It is a
method used for appraising organizations using CMMI.

NARA recognizes the weaknesses associated with the legislative conditions.
According to its Chief Information Officer, the agency x intends to
establish a group to assess IT projects' compliance with the EA, x plans
to establish a process for regular reviews by management of ongoing IT
investments, and x has begun to establish an agencywide risk management
capability.

In our June 2002 report, we recommended that NARA strengthen its IT
management capabilities by developing an EA. An EA provides a
description-in useful models, diagrams, and narrative-of the mode of
operation for an agency. It describes the agency in logical terms, such as
interrelated business locations and users, and in IT operational terms,
such as hardware, software, data, communications, and information security
attributes and standards. It provides these perspectives both for the
baseline and target environments as well as a plan for transitioning from
the baseline to the target. Furthermore, the agency should establish an
architecture review board that meets regularly to evaluate projects'
compliance with the EA.

The agency has established baseline and target architectures that include

x business process definitions and flows for interrelated activities;

x IT defined in operational terms including hardware, software, data, and
security; and

x a plan to transition from the baseline to the target architecture.
However, as previously noted, the agency lacks a review board for ensuring
that IT projects conform

to the EA. Until a board is established, the agency lacks assurance that
projects are fully consistent with the architecture.

In our June 2002 report, we recommended that the agency improve
information security because it lacked a program for assessing agencywide
information security risks and an EA that addresses security issues across
the agency.

NARA has strengthened information security by: x improving its information
security program plan, performing agencywide assessments of information
security risks, and developing plans of action and milestones for
identified weaknesses and x developing its EA to encompass information
security and providing documentation that identifies and specifies NARA's
requirements for IT security management, processes, and technologies
across the agency. Because of several assessments that identified numerous
security weaknesses, the Archivist declared information security a
material weakness in fiscal year 2000. According to the Archivist,
corrective actions taken since then to address these weaknesses were
completed in fiscal year 2005,

and information security is no longer considered a material weakness.
However, in its annual FISMA reports, the OIG has identified numerous NARA
IT security weaknesses. While the agency has addressed our specific
recommendation, NARA will need to continue to be

vigilant in identifying and addressing information security weaknesses.

In our September 2004 report, we reported that the program lacked a
process to ensure that the results of verification and validation reviews
of policies and plans were incorporated into final versions. We
recommended that the Archivist direct the ERA program director to design
and implement a process to ensure that recommendations from verification
and validation reviews are addressed and incorporated into acquisition
policies and plans. We noted that such a process reduces the risk that
acquisition policies and plans do not meet industry standards. Without a
documented process, NARA cannot ensure that reviewers' comments are
integrated into the final versions.

NARA has developed and implemented standard operating procedures to ensure
that reviewers' recommendations are addressed in the final versions of
ERA's acquisition policies and plans. Specifically, acquisition policies
and plans are assessed by an independent verification and validation
contractor, who reviews them against applicable industry standards and
prepares a report with results and recommendations. After the policies and
plans have been revised and recommendations incorporated, they are
returned to the independent verification and validation contractor to
ensure that all recommendations have been incorporated. NARA recently
applied these procedures in its revisions to key ERA policies and plans,
including the acquisition strategy and configuration management plan.

By ensuring that independent verification and validation comments are
addressed and incorporated into final versions of its policies and plans,
NARA has increased assurance that it now has compliant acquisition
policies and plans to guide its efforts.

We previously reported that ERA had developed key acquisition policies and
plans to guide its acquisition, but that the documents did not fully
conform to the IEEE standards selected by the agency. These policies and
plans are essential for managing the acquisition and providing critical
guidance to the contractor who will be developing the system. As a result,
we recommended that ERA revise these policies and plans to conform to
industry standards.

NARA has revised these four of five key acquisition policies and plans to
comply with IEEE standards x Acquisition Strategy x Configuration
Management Plan x Quality Management Plan x Program Management Plan

The revised acquisition policies and plans have been reviewed by an
independent verification and validation contractor. According to these
reviews, these documents are compliant with IEEE standards.

According to the Director of the ERA Program Support Division, the
remaining document-the risk

management plan-is currently under revision and should be completed by
June 2006.11 By revising these key ERA policies and plans to meet industry
standards, NARA has strengthened the guidance it needs to acquire the ERA
system.

11

The Risk Management Plan was subsequently completed in July 2006.

We previously reported that records management was generally afforded low
priority by federal agencies and that NARA lacked strategies to address
the low priority given to records functions and to monitor the performance
of records management programs and practices on an ongoing basis. We
recommended that the Archivist develop documented strategies for

x raising senior management awareness of and commitment to records
management principles, functions, and programs and

x conducting systematic inspections of agency records management programs
to (1) periodically assess agency progress in improving records management
programs and (2) evaluate the efficacy of NARA's governmentwide guidance.

NARA has implemented our recommendation by x briefing agency leaders on
the importance of records and information management and providing
guidance and support on electronic records to senior agency officials; x
assessing agency records management programs by (1) conducting
cross-government studies to identify and analyze records management best
practices; (2) developing governmentwide recommendations and guidance on
these practices; and (3) developing a plan to undertake agency inspections
based on a risk-based model, government studies, or reports from the
media; and x conducting a survey of agency federal records officers that
determined that the officers were generally satisfied with the utility of
NARA guidance products.

In addition, NARA plans to broaden the survey to include electronic
records guidance, records

management training, and scheduling and appraisal services. The plans and
strategies implemented by NARA should raise agencies' awareness of records
management principles, functions, and programs.

The legislative requirement to submit an expenditure plan for ERA to the
appropriations committees is intended to provide lawmakers with a
sufficient understanding of the system acquisition to permit effective
oversight and to allow for informed decision making about the use of
appropriated funds. For this to occur, however, these plans need to
disclose a sufficient level and scope of information to understand what
system capabilities and benefits are to be delivered, by when, at what
cost, and what progress is being made against the commitments that were
made in prior expenditure plans.

NARA's expenditure plan does not contain the level and scope of
information needed for Congress to understand its plans and commitments
relative to system capabilities, benefits, schedules, and costs. More
specifically, the plan provides only general information on how the $22
million, for which it is requesting release, is to be spent. According to
the plan, these funds are to enable the development contractor, Lockheed
Martin, to

x Provide the infrastructure for systems operations, including security,
systems management, common services, and limited storage capabilities.
This is to enable receiving, storing, and maintaining the integrity of
electronic records being ingested into ERA. The plan also notes that a key
element of this infrastructure is an "automated workflow capability."

x Initiate work on business applications needed to support records
appraisal, scheduling, limited preservation, and limited internal
dissemination.

However, the spend plan does not contain details on, for example: x how
the $22 million requested is to be allocated among planned tasks; x the
infrastructure elements-including software and hardware-that are to be
procured or how

these will fit into the overall system design; x what is meant by an
"automated workflow capability" and its relationship to system
requirements and benefits; and x the portion of the work on business
applications that will be completed during fiscal year 2006 with the funds
requested. We also note that the schedule provided in the expenditure plan
has changed since the plan was submitted to the appropriations committees.
Specifically, while the plan indicates that the review and approval of the
infrastructure design was to be completed by May 23, 2006, NARA officials
stated that

the current plan is to conduct a series of reviews that will result in
approval of both the infrastructure and business applications designs by
August 7, 2006. NARA officials stated that they had attempted to use
another agency's plans as models in developing

their own. They also indicated that they have more detailed information on
their plans-including a list

of the equipment to be procured-but did not include it because they
believed it was too detailed. A listing of specific equipment would be of
limited value; however, the plan does not provide sufficient information
on system capabilities, benefits, schedules or costs to fully inform the
Congress on what is being acquired. Without this information, Congress
does not have the information needed to oversee plans and progress on the
acquisition of the system.

NARA's expenditure plan satisfies three of six legislative conditions and
the agency has continued to make significant progress in implementing our
recommendations. The agency plans to address outstanding issues. If NARA
complies with the legislative conditions and implements our
recommendations, the agency should be better positioned to successfully
acquire the ERA system.

NARA has not included a sufficient level and scope of information on
infrastructure elements, automated workflow capability, and business
applications to be completed in fiscal year 2006 so that Congress will be
able to understand what system capabilities and benefits are to be
delivered, by when, and at what cost. Without sufficient detail in future
expenditure plans, Congress may be hampered in its ability to effectively
oversee the program.

We recommend that the Archivist of the United States ensure that future
expenditure plans include a sufficient level and scope of information so
that Congress will be able to understand what system capabilities and
benefits are to be delivered, by when, and at what cost, and what progress
is being made against the commitments that were made in prior expenditure
plans.

In written comments on a draft of our briefing slides, the Archivist of
the United States generally agreed with the contents and our
recommendation. He stated that he was pleased to note the recognition of
the progress made towards implementing our recommendations and indicated
that the agency would make every effort to complete those identified as
being partially implemented.

Regarding the information provided in this year's spend plan, the
Archivist said that providing more detail to Congress was inappropriate
because (1) funding had fallen far short of expectations, (2) the agency
and its contractor were replanning ERA to match available resources, and
(3) the plan's details had not been finalized. However, NARA's spend plan
did not provide information on these developments. Without this
information, it is difficult for Congress to discern from the expenditure
plan that NARA is significantly revising ERA's cost, schedule, and
performance goals. Nonetheless, the Archivist agreed that NARA would
provide additional information in future expenditure plans, as we
recommended.

The Archivist also stated that, because of substantial corrective actions
completed in fiscal year 2005, information security is no longer
considered to be a material weakness. We have clarified this in our
briefing. However, information security must continue to be a priority as
the agency increases reliance on its IT infrastructure for records
management and archiving of electronic information.

Appendix II

Comments from the National Archives and Records Administration

Appendix III

                     GAO Contacts and Staff Acknowledgments

GAO Contact

Linda Koontz, (202) 512-6240

Staff Acknowledgements
  
In addition to the contact named above, Naba Barkakati, Timothy Case,
Mike Dolak, Nancy Glover, Mary Hatcher, Jacqueline Mai, and Amos Tevelow
made key contributions to this report.

  GAO's Mission

The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in meeting its
constitutional responsibilities and to help improve the performance and
accountability of the federal government for the American people. GAO
examines the use of public funds; evaluates federal programs and policies;
and provides analyses, recommendations, and other assistance to help
Congress make informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony 

The fastest and easiest way to obtain copies of GAO documents at no cost
is through GAO's Web site ( www.gao.gov ). Each weekday, GAO posts GAO
Reports and newly released reports, testimony, and correspondence on its
Web site. To have GAO e-mail you a list of newly posted products every
afternoon, go to www.gao.gov and select "Subscribe to Updates."

                             Order by Mail or Phone

The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent of
Documents. GAO also accepts VISA and Mastercard. Orders for 100 or more
copies mailed to a single address are discounted 25 percent. Orders should
be sent to:

U.S. Government Accountability Office 441 G Street NW, Room LM Washington,
D.C. 20548

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202)
512-6061

Contact:

To Report Fraud, Web site: www.gao.gov/fraudnet/fraudnet.htm

  E-mail: [email protected]

Federal Programs Automated answering system: (800) 424-5454 or (202)
512-7470

Congressional Relations

Gloria Jarmon, Managing Director, [email protected] (202) 512-4400 U.S.
Government Accountability Office, 441 G Street NW, Room 7125 Relations
Washington, D.C. 20548

Public Affairs
  
Paul Anderson, Managing Director, [email protected] (202) 512-4800
U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, D.C. 20548
*** End of document. ***