DHS OIG, OIG-14-112, U.S. Citizenship and Immigration Services Information Technology Management Progress and Challenges (2014)

Department of Homeland Security 2IÀFHRI,QVSHFWRU*HQHUDO U.S. Citizenship and Immigration Services Information Technology Management Progress and Challenges OIG-14-112 July 2014 OFFICE OF INSPECTOR GENERAL Department of Homeland Security Washington, DC 20528 / www.oig.dhs.gov     MEMORANDUMFOR:   FROM:  SUBJECT:   July3,2014 MarkSchwartz ChiefInformationOfficer U.S.CitizenshipandImmigrationServices  RichardHarsche ActingAssistantInspectorGeneral OfficeofInformationTechnologyAudits U.S.CitizenshipandImmigrationServicesInformation TechnologyManagementProgressandChallenges   Attachedforyourinformationisourfinalreport,U.S.CitizenshipandImmigration ServicesInformationTechnologyManagementProgressandChallenges.We incorporatedtheformalcommentsfromtheU.S.CitizenshipandImmigrationServices (USCIS)inthefinalreport.  ThereportcontainsfourrecommendationsaimedatimprovingUSCIS’information technologymanagement.Yourofficeconcurredwiththerecommendations.As prescribedbytheDepartmentofHomelandSecurityDirective077Ͳ01,FollowͲUpand ResolutionsforOfficeofInspectorGeneralReportRecommendations,within90daysof thedateofthismemorandum,pleaseprovideourofficewithawrittenresponsethat includesyour(1)correctiveactionplanand(2)targetcompletiondateforeach recommendation.Also,pleaseincluderesponsiblepartiesandanyothersupporting documentationnecessarytoinformusaboutthecurrentstatusoftherecommendation.  Onceyourofficehasfullyimplementedtherecommendations,pleasesubmitaformal closeoutrequesttouswithin30dayssothatwemayclosetherecommendations.The requestshouldbeaccompaniedbyevidenceofcompletionofagreedͲuponcorrective actions.  PleaseemailasignedPDFcopyofallresponsesandcloseoutrequeststo [email protected].Untilyourresponseisreceivedandevaluated,the recommendationswillbeconsideredopenandunresolved.  ConsistentwithourresponsibilityundertheInspectorGeneralAct,wewillprovide copiesofourreporttoappropriatecongressionalcommitteeswithoversightand OFFICE OF INSPECTOR GENERAL Department of Homeland Security   appropriationresponsibilityovertheDepartmentofHomelandSecurity.Wewillpost thereportonourwebsiteforpublicdissemination.  Pleasecallmewithanyquestions,oryourstaffmaycontactElizabethArgeris,Audit Manager,at(202)632Ͳ0223.  Attachment   2 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  TableofContents  ExecutiveSummary.............................................................................................................1  Background........................................................................................................................2  ResultsofAudit...................................................................................................................4  ITManagementCapabilitiesEstablished................................................................4 Recommendations...............................................................................................15 ManagementCommentsandOIGAnalysis.........................................................15  SupportofMissionNeeds.....................................................................................16 Recommendations...............................................................................................22 ManagementCommentsandOIGAnalysis.........................................................22  Appendixes  AppendixA:Objectives,Scope,andMethodology.............................................24 AppendixB:ManagementCommentstotheDraftReport................................26 AppendixC:MajorContributorstoThisReport.................................................29 AppendixD:ReportDistribution.........................................................................30  Abbreviations   ADIS  CARB  CIO CIVSIT CLAIMS3 CLAIMS4 DHS  EDMS   ELIS EPMO   FY  GAO  IT  ITAR  MD ArrivalandDepartureInformationSystem ComponentAcquisitionReviewBoard ChiefInformationOfficer CustomerIdentityVerificationSecondaryInspectionTool ComputerLinkedApplicationInformationManagementSystem3 ComputerLinkedApplicationInformationManagementSystem4 DepartmentofHomelandSecurity EnterpriseDocumentManagementSystem ElectronicImmigrationSystem EnterpriseProgramManagementOffice fiscalyear GovernmentAccountabilityOffice informationtechnology informationtechnologyacquisitionreview ManagementDirective www.oig.dhs.gov  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  OfficeoftheChiefInformationOfficer OfficeofInspectorGeneral OfficeofInformationTechnology OfficeofManagementandBudget systemsengineeringlifecycle UnitedStatesCitizenshipandImmigrationServices ViolenceAgainstWomenActof1994  OCIO  OIG  OIT  OMB  SELC USCIS  VAWA   www.oig.dhs.gov  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  ExecutiveSummary  InformationtechnologyplaysacriticalroleinenablingU.S.CitizenshipandImmigration Services(USCIS)toaccomplishitsmission.In2009,wereportedthatinsufficient informationtechnologystaffingandlimitedinformationtechnologybudgetauthority impededtheChiefInformationOfficer.WeconductedthisfollowͲupaudittodetermine USCIS’progressinestablishingkeyinformationtechnologymanagementcapabilitiesto supportmissionneeds.  TheUSCISChiefInformationOfficerhasestablishedkeyinformationtechnology managementcapabilitiestosupportUSCIS’mission.Specifically,theChiefInformation Officer:  x createdadraftinformationtechnologystrategicplan, x developedanenterprisearchitecture, x implementedinformationtechnologyacquisitionreviewandsystems engineeringlifecycleprocesses,and ledtheadvancementofagilemethodologiesforsoftwaredevelopment. x  TheChiefInformationOfficerstillfaceschallenges,however,incoordinatingacross internaldivisions.LimitedcommunicationandcoordinationcanhinderUSCIS’abilityto supportmissionneeds,useandallocateresourcesmoreeffectively,fosterasenseof collaboration,andimprovemorale. TheUSCISChiefInformationOfficeralsofaceschallengesinensuringthatthe informationtechnologyenvironmentfullysupportsUSCIS’missionneeds.Specifically, thesystemsdonotfullyprovidedesiredfunctionality,andsystemreliabilityisalsoa challenge.Limitedfunctionalityandreliabilitystemfromchallengeswithinfrastructure planning.Asaresult,theprocessingofbenefitsisdelayed,andUSCIScustomersmay havetowaitlongerforadecisionontheirapplicationsforbenefits.Inaddition,staff membersarenotalwayssurewhichsystemstouseorwhichsystemsareavailableto performspecificjobfunctions.Asaresult,staffmaynotbeaccessinginformationthatis availabletomakeinformeddecisionsonadjudicationofbenefits,andstaff’sabilityto carryoutUSCIS’missionmaybehampered. WemadefourrecommendationstotheChiefInformationOfficer,USCIS,tofinalizethe informationtechnologystrategicplan,developaplantoaddressseniorlevelstaffing vacancies,coordinatewithsystemownerstoensureusersareprovidedwithadequate training,anddevelopaplantorefreshoutdatedinformationtechnologyinfrastructure. www.oig.dhs.gov 1  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  Background  U.S.CitizenshipandImmigrationServicesoverseeslawfulimmigrationtotheUnited States.TheUSCISmissionistosecureAmerica’spromiseasanationofimmigrantsby:  x providingaccurateandusefulinformationtoitscustomers, x grantingimmigrationandcitizenshipbenefits, x promotinganawarenessandunderstandingofcitizenship,and x ensuringtheintegrityoftheU.S.immigrationsystem.  Toaccomplishitsmission,USCIShas18,000governmentemployeesandcontractors workingat250officesworldwide.USCISprovidesitsservicesthroughastructurethat consistsofitsheadquartersofficeinWashington,DC;4servicecenters;29district offices;136applicationsupportcenters;andfourregionaloffices.Inaddition,asylum offices,telephonecenters,theNationalRecordsCenter,andtheNationalBenefits Centerprovideservicestocustomersaswell.Onanaverageday,USCISemployees:  x process23,000applicationsforvariousimmigrationbenefits, x issue6,100permanentresidentcards, x process310refugeeapplications,and x grantasylumto55individuals.  Duringfiscalyear(FY)2012,USCISnaturalized763,690newcitizens.InFY2014,USCIS’ budgetwasapproximately$3.4billion.USCIS’budgetrepresents5percentofthe DepartmentofHomelandSecurity’s(DHS)overallbudgetofapproximately$59billion.  Informationtechnology(IT)systemsplayacriticalroleinenablingUSCIStoaccomplish itsmission.USCIS’OfficeofInformationTechnology(OIT)providestheIT,expertise,and strategicvisionnecessarytoenableUSCIStodelivereffective,efficient,andsecure immigrationservicesandproducts.OITsupportsUSCISpersonnelwhouse approximately25,000computers.AsofAugust2013,OITemployed2,138staff, including420Federalemployeesand1,718contractors.InFY2012,USCIS’ITspending wasapproximately$379million.  ToplanandmanageUSCIS’criticalITenvironment,OITisorganizedintosevenoffices anddivisions,asshowninfigure1:     www.oig.dhs.gov 2  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  x OfficeoftheChiefofStaff, x ResourceManagementDivision, x OfficeoftheChiefTechnologyOfficer, InformationSecurityDivision, x x EnterpriseInfrastructureDivision, x EndUserServicesDivision,and x SystemsEngineeringDivision.  Figure1.USCIS’OITOrganizationalStructureasofAugust2013   TheChiefofStaffassistsOITindeliveringITservicestotheenterprisethroughmanaging coordinationandcollaborationacrosstheorganization.TheResourceManagement Divisionleadsthedevelopment,execution,evaluation,andreportingoftheOITbudget, anddirectsandmanagesthefullcycleofallITacquisitions.TheChiefTechnologyOfficer providesenterprisearchitectureguidancetodeliverITcapabilitiesandtechnology solutionsinsupportofUSCIS’missionandstrategicobjectives.TheInformationSecurity DivisionimplementsDHSInformationSecurityProgrampolicies,procedures,standards, andguidelinesthroughouttheagency.  Inaddition,theEnterpriseInfrastructureDivisionprovidesITinfrastructureengineering, design,testing,implementation,andoperationalsupportservicesfortheagency, includingnetworks,serverrooms,datastorage,telecommunications,video conferencingservices,andinfrastructuresecurity.TheEndUserServicesDivision partnerswithUSCIScustomerstoenablethemtoaccessreliable,effective,secure,and flexibleenduserservicesessentialtoachievingtheirmissions.Finally,theSystems EngineeringDivisioncoordinates,directs,manages,andoverseesthedescription, design,development,andintegrationofITservicesthatsupportUSCIS.  www.oig.dhs.gov 3  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  OITisresponsiblefordesigning,developing,andintegratingallITsystemsthatsupport USCISoperations.SomeofUSCIS’majorITsystemsandprogramsincludethefollowing:  x ComputerLinkedApplicationInformationManagementSystem3(CLAIMS3)– Thislegacyimmigrationcasetrackingandprocessingsystemisusedfor adjudicatingapplicationsandpetitionsforimmigrationbenefitsandservices otherthannaturalization,refugeestatus,andasylum. x ComputerLinkedApplicationInformationManagementSystem4(CLAIMS4)– Thepurposeofthislegacysystemistoprovideimmigrationbenefitsandservices tonaturalizationapplicants. Infrastructure,EndUserSupport–Thisprogramsupportstheoperationsand maintenanceinfrastructureoftheagency. x x Transformation–Transformation’sgoalistomodernizeUSCISbytransitioning theagencyfromafragmented,paperͲbasedenvironmenttoacentralized, paperlessenvironmentusingelectronicadjudication. x VerificationInformationSystem/EmploymentEligibilityVerification–This programsupportstheSystematicAlienVerificationforEntitlementsProgram.In addition,theE–VerifyprogramusestheVerificationInformationSystemto allowparticipatingemployerstoverifyemploymenteligibilityofnewemployees. EffectivemanagementofITsystemsisimportanttosupportmissionoperations.In previousaudits,weidentifiedchallengeswithUSCIS’ITmanagementand infrastructure.Specifically,in2009,wereportedthatinsufficientITstaffingand limitedITbudgetauthorityimpededtheChiefInformationOfficer(CIO).1Although USCISimproveditsITinfrastructure,otherITeffortswerestalledduetolimited funds.In2011,wereportedITmanagementchallengesinUSCIS’implementationof itsTransformationprogram,suchasinsufficientlydefinedsystemrequirementsand governanceandstaffingproblems,whichledtodelaysinthedeliveryofcapabilities. Asaresult,USCIScontinuedtorelyonpaperͲbasedprocesses.2 ResultsofAudit  ITManagementCapabilitiesEstablished  TheCIOledactionstoestablishkeyITmanagementcapabilitiestosupportthe USCISmission.Specifically,theCIOdevelopedadraftITstrategicplanthat defineskeygoalsandobjectivesforfulfillingUSCISmissionresponsibilities.In  1OIGͲ09Ͳ90,U.S.CitizenshipandImmigrationServices’ProgressinModernizingInformationTechnology, July2009. 2OIGͲ12Ͳ12,U.S.CitizenshipandImmigrationServices’ProgressinTransformation,November2011. www.oig.dhs.gov 4  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  addition,theCIOdevelopedanenterprisearchitectureandimplementedIT acquisitionreview(ITAR)processes.TheCIOalsoimplementedasystems engineeringlifecycle(SELC)processtomanageITprograms.Further,theCIOled theadvancementofagilemethodologiesforsoftwaredevelopment.Asaresult, criticalcapabilitiesexistwithinOITtohelpensureeffectiveITmanagementand guidefutureinitiatives.  USCISOIThasalsomadeprogressincommunicatingandcoordinatinginternally andwithkeycomponentstakeholdersbyestablishingregularmeetingsand communicationchannels.However,USCISOITstillfaceschallengesin coordinatingacrossOITdivisionsdueinparttoseniorlevelstaffvacancies. LimitedcommunicationandcoordinationcanhinderUSCIS’abilitytosupport missionneeds,touseandallocateresourcesmoreeffectively,andtofostera senseofcollaborationandimprovemorale.  StrategicPlanning  TheGovernmentPerformanceandResultsActof1993holdsFederalagencies responsibleforstrategicplanningtoensureefficientandeffectiveoperations anduseofresourcestoachievemissionresults.3Additionally,Officeof ManagementandBudget(OMB)CircularAͲ130,asrevised,instructsagencyCIOs tocreatestrategicplansthatdemonstratehowinformationresourceswillbe usedtoimprovetheproductivity,efficiency,andeffectivenessofgovernment programs.4DHSManagementDirective(MD)0007.1requirescomponentCIOsto developandimplementanITstrategicplanthatclearlydefineshowITsupports anagency’smissionanddrivesinvestmentdecisions,guidingtheagencytoward itsgoalsandpriorities.5  TheUSCISCIOdraftedtheUSCISOITStrategicPlan,2013–2017.6Thegoalofthe draftplanistoprovideavisionforanOITofthefuture,suchasthesystemsand capabilitiesitwilloffertheagencyandtheprocessesOITwilluse.Inaddition, theplanconveyshowOITwillworkwiththerestoftheManagementDirectorate tosupporttheagency’smission.  ThedraftplanidentifiesanITstrategythatdescribestheCIO’svision,mission, goals,andobjectivesthrough2017.Theplanincludesfivegoals:  3PublicLaw103о62,GovernmentPerformanceandResultsActof1993,August3,1993. 4OMBCircularAͲ130,ManagementofFederalInformationResources,TransmittalMemorandum#4, November28,2000. 5DHSMD0007.1,InformationTechnologyIntegrationandManagement,March15,2007. 6Atthetimeofourfieldwork,USCIShadnotfinalizedandimplementedtheOITStrategicPlan. www.oig.dhs.gov 5  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security   x increaseresponsivenesstoagencyneedsbyexecutingprojectsrapidly, nimbly,reliably,andefficiently,usingbestpracticesandfocusingon businessresults, x provideaninfrastructureandarchitecturethatarealignedwiththe futureneedsoftheagencyandDepartment, x betrustworthystewardsoftheagency’sresources, x supportTransformationwithaviewtowardmakingtheElectronic ImmigrationSystemthecenterofOIT’sfuturearchitectureand processes,and x expandOIT’sfootprintgentlybyusingittodrivebusinessvaluecreation.  Toaccomplishthesegoals,theUSCISCIOestablishedspecificobjectivesforeach goal.Forexample,tomeetthegoaltoincreaseresponsivenesstoagencyneeds, theplanidentifiesthreeobjectives:  x developaprojectandprogrammanagementfunctionthatiscustomerͲ centricandorientedtowardresultsmeasuredinbusinessvalue, x buildanagileorganizationandinfrastructuretoprovideflexibility,faster solutions,andreducedcoststotheagency,and x measurebusinessresultsandservicelevelsagainstpreͲestablishedgoals.  ThegoalsdescribedintheUSCISOITStrategicPlan,2013–2017alignwithUSCIS agencyͲwidegoals.Theplansupportsagencygoalstoprovideeffective customerͲorientedimmigrationbenefitandinformationservices,strengthenthe securityandintegrityoftheimmigrationsystem,andstrengtheninfrastructure.  TheplanalsoalignswiththeDHSITStrategicPlan,2011–2015toensurethat USCISOITsupportstheDHSCIO’sDepartmentͲwideITgoals.Table1showsthe alignmentofUSCISOITgoalswithDHSITgoals.   www.oig.dhs.gov 6  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security   Table1.AlignmentofUSCISOITGoalswithDHSITGoals USCISOITGoals   DHSIT Goals Goal1:EstablishsecureITservicesand capabilitiestoprotectthehomelandand enhancetheNation’spreparedness, mitigation,andrecoverycapabilities. Goal2:Improvesecureandtrusted internalandexternalinformationsharing. Goal3:Improvetransparency, accountability,andefficienciesofservices andprogramsthrougheffective governance,programmanagement,and enterprisearchitecture. Goal4:Transformtheorganizational healthoftheDHSITcommunityby developinganexceptionalworkforcethat willfunctioneffectively,deliveroperational excellence,andgrowfromwithin. Goal1 Goal2 Goal3 Goal4 Goal5   9   9  9   9    9   9  9  9    9     Toprovideamorecompletevision,OITalsodraftedaStrategicHumanCapital PlanandaUSCISOITEnterpriseArchitectureVision.TheStrategicHumanCapital PlanprovidestheconceptforhowOITwilldevelop,recruit,andsupporttheOIT workforcefrom2013through2017.TheEnterpriseArchitectureVisionillustrates wherethedesignoftheagency’ssystemswillmoveduringthatperiod.OIT’s developmentoftheHumanCapitalPlanandEnterpriseArchitectureVision,in additiontotheOITStrategicPlan,providesamorecompletestrategytoensure thealignmentofpeople,processes,andtechnologytoachieveDepartmental andUSCISgoals.  EnterpriseArchitecture  TheClingerͲCohenActof1996,asamended,andOMBcircularsmandatethe establishmentanduseofanenterprisearchitecturetoguideanddirect governmentinvestmentsfrominceptionthroughretirement.7Inaddition,OMB MemorandumMͲ11Ͳ29statesthatCIOsmustuseanenterprisearchitectureto consolidateduplicativeinvestmentsandapplications.8Anenterprisearchitecture  7PublicLaw104о106,DivisionE,February10,1996.Thelaw,iniƟallyƟtledtheInformation TechnologyManagementReformActof1996,wassubsequentlyrenamedtheClingerͲCohenActof1996 inPublicLaw104о208,September30,1996.OMBCircularAͲ130,Revised,ManagementofFederal InformationResources,November28,2000;andOMBCircularAͲ11,Revised,Preparation,Submission, andExecutionoftheBudget,August3,2012. 8OMBMͲ11Ͳ29,ChiefInformationOfficerAuthorities,August8,2011. www.oig.dhs.gov 7  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  describesthecurrentarchitecture,targetarchitecture,andtransitionstrategy forattainingthetargetgoalsandobjectives.Anenterprisearchitectureenables leadershiptoprioritizeavailableresourcestosupportmissionfunctions,ensures thatmissionrequirementsdrivetechnologyinvestments,andidentifiescurrent capabilitiesandperformancegapsaswellasprojectedfuturegaps.  TheUSCISCIOdevelopedandimplementedanenterprisearchitecturetoalign withtheDepartment’sarchitectureandguidetheUSCISITenvironment.Since FY2011,USCIShasprovidedtheDepartmentwithaselfͲassessmentstatus reporteachquarteronitsenterprisearchitectureprogram.Inthesequarterly assessments,USCISrateditsprogressagainsttheGovernmentAccountability Office(GAO)EnterpriseArchitectureManagementMaturityFramework.9In FY2011,USCISidentifieditsenterprisearchitecturematurityatstagethreeof thesixstagesoftheframework,whichindicatedthatUSCISwasdeveloping initialenterprisearchitectureversions.InFY2013,USCISrateditsprogressat stagesixmaturity.Inthisstage,USCISiscontinuouslyimprovingtheenterprise architectureanditsusetosupporttheagency’smission.Figure2showsUSCIS’ enterprisearchitecturematuritywithinthestagesoftheEnterpriseArchitecture ManagementMaturityFramework.  Figure2.USCISMaturitywithintheEnterpriseArchitectureManagement MaturityFramework  Since2011,theHomelandSecuritySystemsEngineeringandDevelopment Institute,theDepartment’sfederallyfundedresearchanddevelopmentcenter,   9GAOͲ10Ͳ846G,AFrameworkforAssessingandImprovingEnterpriseArchitectureManagement(Version 2.0),August2010. www.oig.dhs.gov 8  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  hasconductedindependent,objectivereviewsofthequarterlystatusreportsof selectDHScomponents.AsofthesecondquarterofFY2013,theInstitute independentlyidentifiedtheUSCISenterprisearchitectureprogramatstagesix maturity.Accordingtotheindependentassessment,theUSCISenterprise architectureprogramishighͲperformingandextremelymature.  ITAcquisitionReview  DHSMD0007.1requirescomponentCIOstosubmitITacquisitionsvaluedat $2.5millionorgreatertotheDHSCIOforreview.Thisdirectivealsorequires componentCIOstoapproveITacquisitionslessthan$2.5million. USCISimplementedITacquisitionandinvestmentmanagementprocessesthat complywithDHSpolicies.Specifically,USCISissuedManagement Directive102Ͳ001,AcquisitionandInvestmentManagement.ThisDirective providestransparencyintoprogramperformance,ensureseffectiveutilizationof resources,andenableseffectivedecisionmakingbyseniorleadership,including theUSCISCIO.10  TheDirectiverequiresthatUSCIScustomerssubmitarequesttoOITfor acquisitionreviewaftercompletingaMissionNeedsStatement.AMissionNeeds StatementincludesabusinesscaseexplainingwhytheITinvestmentisneeded. Duringtheacquisitionreviewprocess,OITresponsibilitiesinclude:  x ensuringthatcurrentandproposedITinvestments,programs,and projectsareincompliancewiththeenterprisearchitectureandsupport DHSandUSCISstrategicgoals, x evaluatingcompliancewithdata,privacy,andsecurityrequirementsofIT investments,and x vettingandreportingITinvestmentspriortotheirsubmissiontothe ComponentAcquisitionReviewBoard(CARB),theComponentAcquisition Executive,andtheDepartmentforreviewandapproval.  Whentheacquisitionreviewiscomplete,OITsubmitsallacquisitionswith $150,000ormoreinlifecyclecoststotheCARB.TheCARBisasenior managementboardthatensuresacquisitionsalignwithstrategicobjectives, reflectUSCISpriorities,andmeetmissionneeds.TheCARBischairedbythe AssociateDirectorforManagementandcomprisedofseniorrepresentatives fromselectedagencylinesofbusinessincludingOIT,Directorateleadership,the  10USCISManagementDirectiveNo.102Ͳ001,AcquisitionandInvestmentManagement,April27,2010. www.oig.dhs.gov 9  OIGͲ14Ͳ112  OFFICE OF INSPECTOR GENERAL Department of Homeland Security  OfficeofTransformationCoordination,theOfficeoftheChiefFinancialOfficer, andtheinvestmentsponsor.Further,theUSCISCIO,ortheDeputyCIO,andthe DirectorofManagement,whoistheComponentAcquisitionExecutive,approve ITacquisitionsover$150,000.  OnceapprovedbytheCARB,USCISITacquisitionrequeststotaling$2.5million ormorearesubmittedtotheDHSOfficeoftheChiefInformationOfficer(OCIO) forapproval.TheDHSOCIOreviewseachacquisitionfromanenterprisebusiness andtechnicalperspectivetoensurealignmentwithDHSenterprisearchitecture, informationsecurity,andaccessibilitystandardsandpolicies. AsynopsisoftheacquisitionisthenprovidedtotheDHSOCIOandmanagement forfinalreviewandapproval.InFY2013,USCISsubmitted51acquisition requeststotheDHSOCIOforapproval.  SystemsEngineeringLifeCycle  DHSAcquisitionInstruction/Guidebook#102Ͳ01Ͳ001,AppendixB,requires agenciestofollowaSELCprocess.11ThepurposeoftheDHSSELCistoestablisha standardsystemlifecycleframeworkacrossDHSagenciesandtoensurethat DHSITcapabilitiesaredeliveredefficientlyandeffectively.  TheUSCISCIOimplementedtheDHSSELCprocessincompliancewith Departmentalguidance.OITusestheUSCISSELCGuidetomanageUSCISIT projectsusingtheSELCmethodology.12TheUSCISSELCGuidehighlightskey componentsofthelifecyclewithinformationonhowthelifecycleappliesto USCISprojectmanagersandotherstakeholdersintheprojectlifecycle.It describesSELCrequirementsandpresentscriticalinformationforeachstageof theSELC.Figure3showsthestagesoftheSELC.    11DHSAcquisitionInstruction/Guidebook#102Ͳ01Ͳ001,AppendixB,InterimVersion2.0,September21, 2010. 12UnitedStatesCitizenshipandImmigrationServiceSystemsEngineeringLifeCycleGuide,Version2.0, January24,2011. www.oig.dhs.gov 10  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security    Figure3.USCISSELCStages  TheOITEnterpriseProgramManagementOffice(EPMO)managesandmaintains theUSCISSELC.EPMOstaffassistbusinessowners,projectmanagers, infrastructureliaisons,oranyoneleadingaproject,change,orreleaseinitiative toclarifylifecyclerequirements,providetemplates,andgenerallyguide programmaticactivitiesassociatedwithSELCcompliance.Additionally,EPMO representativesprovideguidanceincraftinganappropriateProjectTailoring Plan,developingdocumentation,andpreparingforreviews.  TheCIO’simplementationoftheSELCprocessshouldhelpUSCISensurethatits ITinvestmentswillsupportUSCISandDHSstrategicgoals. AgileDevelopmentProcess  TheUSCISCIOadoptedanagileapproachforsoftwaredevelopment.Inaddition, theUSCISCIOhasledtheadvancementofagilemethodologiesthroughoutDHS. Agileapproachesuseaniterative,incrementalprocessthatischaracterizedby small,frequentreleasesdevelopedinclosecollaborationwiththecustomer. Thesepracticesprovidefrequentopportunitiestoobtaincustomerfeedbackand improvethequalityoftheproduct.  USCISOITbeganimplementingstandards,processes,andtoolstosupportagile bestpractices.OIT’sManagementInstructionCISͲOITͲ001,AgileDevelopment Policy,establishestheUSCISpolicy,procedures,requirements,and responsibilitiesfortheuseofanagiledevelopmentapproach.13Toprovidetools foragiledevelopment,OITisdevelopingtheStandardManagementAnalysis ReportingToolBusinessIntelligenceenvironment,whichwillprovidebetter accesstodataforreportingneeds.OITalsodevelopedtheStandardLightweight OperationalProgrammingEnvironment,whichprovidesUSCISbusinesslines withlocalapplicationdevelopmenttomeettheITdemandsofthebusiness.In addition,OITisreworkingtheSELC,streamlininggovernanceprocesses,and  13USCISManagementInstructionCISͲOITͲ001,AgileDevelopmentPolicy,April10,2013. www.oig.dhs.gov 11  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  leveragingDHS’cloudasͲaͲserviceofferings,whichreducecostsandimprove overallservicelevels.  TheUSCISCIOprovidedagiledevelopmenttrainingtoUSCISstaff.Forexample, tofacilitatethechangeinternally,theCIObroughtinagilecoachestotrainOIT staff;operationalstaff,suchasprogrammanagersintheCustomerServiceand PublicEngagementDirectorateandtheOfficeofTransformationCoordination; andUSCISleadership.Otherformsoftrainingincludebrownbagsessions,inͲ houseclasses,recommendedreadinglists,andagiletrainingevents.  USCISOITusedagilemethodstodeliveranumberofsystemsandreleases successfully.Forexample,USCISusedagiledevelopmenttocreatetheRefugee OfficerSchedulingSystem,whichallowsrefugeeofficerstoreviewcalendarsand schedulingreportstoensureaccuracy.Thesuccessofthissmallagileprojectled tolargerscaleprojects.Specifically,OITtransitionedtheTransformation program—alarge,complexITproject—toanagileapproach.Transformation’s goalistomodernizeUSCISbytransitioningtheagencyfromapaperͲbased environmenttoapaperlessenvironmentusingelectronicadjudication.Aspartof theTransformationprogram,USCISlaunchedthefirstphaseoftheElectronic ImmigrationSystem(ELIS),anonline,accountͲbasedsystem.ThroughELIS, customerselectronicallysubmitapplicationsandsupportingdocuments.  Fortheprogram’sfirstreleaseofELIS,Transformationusedawaterfall developmentmethodology.Thismethodologyisoftenusedtodeveloptheearly releasesoflargeITprojects.14In2012,forthedevelopmentofthesecond releaseofELIS,theTransformationprogrambegantransitioningtoagile softwaredevelopmentmethodology.Agileteamsbeganworkingonreleasesfor enhancingthefunctionalityavailabletoadjudicatorsandbackgroundcheck officers.OITissuedreleasesofthesystemevery4months.TheOfficeof TransformationCoordinationidentifiedtheTransformationreformfrom waterfalltoagileasitsbiggestsuccess.  Agilemethodsusedduringsoftwaredevelopmentprojectscanreducetheriskof projectfailureandassurethatthedeliveredsystemperformsasintended.These methodsaimtoimprovevalue,reduceprojectrisk,lowercost,improvevisibility, andbetteradapttochangingneeds.Withtheappropriateblendoftools, processes,andpeoplewithappropriateskillsets,theUSCISCIOcanusethese  14Waterfalldevelopmentmethodologyisahighlystructureddevelopmentprocesswhereallstagesmust beconductedsequentiallyuntilallrequirementsarefulfilledinacompletesystem. www.oig.dhs.gov 12  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  agileapproachestosupporttheagencybetterinitsgoals,suchascompleting theUSCISTransformationeffort.  Communication  AccordingtoDHSMD0007.1,ITintegrationandmanagementrequirestrong communication.  TheCIOincreasedcommunicationchannelswithinOITandwithinternalUSCIS customers.Specifically,eachweek,theCIOmeetswithseniorOITstafftodiscuss OIT’skeypriorities.Additionally,theDeputyCIOmeetswithseniorOITstaffto discussindetailoperationalconcernsandfinancialinformation.Further,theCIO holdsamonthlymeetingwithallOITstaff,andparticipatesinamonthlymeeting withUSCISseniorleaders,includingregionalandServiceCenterdirectors.  SeniorstaffoutsideofOITinofficessuchasManagement,CustomerServiceand PublicEngagement,andTransformationnotedtheincreasedcollaborationwith OIT.OIT’sSystemsEngineeringDivisionholdsmonthlymeetingswiththe EnterpriseServicesDirectorateandFieldOperations.Inaddition,theSystems EngineeringDivisionholdsweeklymeetingswithVerification,andalsoconducts frequentmeetingsandprojectmanagementreviewsforspecificprojects. Further,OITEndUserServicescommunicatesinformationtothefieldvia newslettersandemails,andholdsmonthlytownhallmeetingswithField OperationsandServiceCenterOperationstoexchangeinformationwith customersinthefieldoffices.Regionalofficestaffwithwhomwemetsaidthat thesemonthlymeetingsarehelpfulforsharinginformationanddiscussing problems.  Inaddition,OITcreatedcustomerserviceliaisonpositions,whichhashelped increasecoordinationbetweenOITandthefield.Customerserviceliaisons coordinatebetweenOITandtheendusersinfieldlocationstoenhance communication,toprovidegreatercoordinationofservicedelivery,andtohelp satisfycustomerneeds.AsthefaceofOITtoendusers,customerserviceliaisons offeracriticalcommunicationpipelinebetweenOITandendusers.Customer serviceliaisonscommunicateOITpoliciesandgoalstoendusersinthefield,and areabletocommunicateuserrequirementstoOITmanagement.  USCISleadershipattributedthismorecollaborativeapproachinparttonewOIT leadership,includingtheCIO,DeputyCIO,andmultipledivisiondirectors.   www.oig.dhs.gov 13  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  ChallengeswithCommunicationandCoordination  Althoughcommunicationhasincreased,USCISOITstillfaceschallengesin coordinatingacrossOITdivisions.Staffwithwhomwemetatheadquartersand inthefieldnotedaneedformorecommunication,collaboration,and coordinationwithintheOITorganization.Forexample,whenanewcontractorͲ ownedfacilityinKentuckywasbeingsetup,theEnterpriseInfrastructure DivisionwasinformedinJuly2013thatitwasresponsibleformakingthenew siteoperationalin90to120days.Thistaskincludedinstallingcircuits,firewalls, switches,androuters.AnOITteamfromVermonthadtostopworkonother projectstosetupthefacility,andthedeadlinesformakingthesiteoperational weremet.  Inaddition,OITdivisionswouldoverlapinrolesandresponsibilitieswhen carryingouttheenterpriseͲwideWorkPlaceasaServiceoffering,whichwas beingpilotedatUSCISatthetimeofourfieldwork.WorkPlaceasaService providesuserswithsecurevirtualaccesstoDHSandUSCISdesktopoperating systemsandapplicationsthroughtheuseofITdevices,suchaslaptopsand tablets.Forexample,theEndUserServicesDivisionisresponsiblefororderingIT equipmentforUSCIS,whiletheEnterpriseInfrastructureDivisionisresponsible forcoordinatingwiththeEnterpriseDataCenterinwhichthesystemishosted. However,theEnterpriseInfrastructureDivisionreceivedfundstomanagethe purchaseoftabletsforthepilotswithoutEndUserServicesmanagementbeing informed.Asaresult,EndUserServices,whichtracksequipmenttoavoidtheft, couldnotvettheprocessproperly.  USCISalsofacedsignificantchallengeswithcoordinatingsoftwarelicense management.OITstafftoldusthat,priorto2013,licensesandmaintenance agreementswerenotcentrallymanaged.Instead,eachOITdivisionwas responsibleformanaginglicensesonitsown.Insomecases,USCIScontractors installedmorelicensesthanwereavailable,requiringUSCISmanagementto workwiththesoftwarevendorstoresolvetheissue.  TheCIOisawareofexistingchallengeswithlicensemaintenancerenewalsand hasmadeitapriority.OITestablishedaworkinggroupresponsibleformanaging allsoftwareandlicensingagreements.Further,OITbeganimplementinga licensingandmaintenancemanagementprocess,andcreatedaposition descriptionfortheChief,StrategicVendorManagement,whowillberesponsible formanagingsoftwareacquisition,compliancewithvendorcontracts, maintenancerenewals,andlifecycleplanningandcosting.  www.oig.dhs.gov 14  OIGͲ14Ͳ112  OFFICE OF INSPECTOR GENERAL Department of Homeland Security  Communication,coordination,andcollaborationgapswithinOITaredueinpart toseniorlevelstaffvacancies.Atthetimeofourfieldwork,OIT’sChiefofStaff andChiefTechnologyOfficerpositionswerebothvacant,makingitmoredifficult forOITtoincreaseorganizationalcoordinationandcontrol.Limited communicationandcoordinationcanhinderUSCIS’abilitytosupportmission needs,touseandallocateresourcesmosteffectively,andtofosterasenseof collaborationandmorale.  Recommendations  WerecommendthattheChiefInformationOfficer,U.S.Citizenshipand ImmigrationServices:  Recommendation#1:  FinalizeandcommunicateUSCIS’ITStrategicPlantoensurethatITsupportsthe missionofUSCISandtheDepartment. Recommendation#2:  Developandimplementaplanofactionandmilestonestoaddressseniorlevel staffingvacanciesincludingChiefofStaff,ChiefTechnologyOfficer,andChief, StrategicVendorManagement.  ManagementCommentsandOIGAnalysis  WeobtainedwrittencommentsonadraftofthisreportfromtheActingDeputy Director,U.S.CitizenshipandImmigrationServices.Wehaveincludedacopyof thesecommentsintheirentiretyinappendixB.  Inthecomments,theActingDeputyDirectorconcurredwithour recommendationsandprovideddetailsonstepsbeingtakentoaddressspecific findingsandrecommendationsinthereport.Wehavereviewedmanagement’s commentsandprovidedanevaluationoftheissuesoutlinedinthecomments below.  Inresponsetorecommendationone,theActingDeputyDirectorconcurredand statedthatthedraftUSCISOITStrategicPlan2013വ2017hasbeenreviewed throughoutUSCISandiscurrentlyundergoingfinalreviewbytheUSCISCIO. USCISexpectstofinalizeandpublishthedocumentbySeptember30,2014.At thattime,thedocumentwillbemadeavailableonUSCIS’intranetand www.oig.dhs.gov 15  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  communicatedviaanagencyͲwideelectronicnewsletter.Werecognizethis actionasapositivesteptowardaddressingthisrecommendationandlook forwardtolearningmoreaboutcontinuedprogressinthefuture.  Inresponsetorecommendationtwo,theActingDeputyDirectorconcurredand statedthatOIThasmadesignificantprogressinaddressingseniorlevelstaffing vacancies.OITselectedanewChiefofStaff,whoiscurrentlygoingthroughpreͲ employmentclearanceprocesses.OITisalsointerviewingcandidatesforthenew StrategicVendorManagementposition.  Further,OITcreatedanewdivision,theAppliedTechnologyDivision,inMay 2014toensurethatITsystemsandservicesaredeliveredatahighlevelof qualityandareconsistentwiththeenterprisevisionforarchitectureand practices.TheChiefTechnologyOfficerpositionwillresideinthisdivision.  TheActingDeputyDirectorstatedthatUSCISiscommittedtofillingthepositions notedinourrecommendationandisontracktodosobyOctoberof2014.We believethatsucheffortsaregoodstepstowardaddressingourrecommendation andlookforwardtolearningmoreaboutcontinuedprogressinthisregard.  SupportofMissionNeeds TheCIOfaceschallengesinensuringthattheITenvironmentfullysupportsUSCIS missionneeds.Specifically,thesystemsdonotfullyprovidedesired functionality.Systemreliabilityisalsoachallenge.ThelimitedITfunctionality andreliabilityexperiencedbyusersstemfromchallengeswithinfrastructure planning.Asaresult,benefitsprocessinganddeterminationsonapplicationsfor benefitsmightbedelayed.  Inaddition,staffmembersarenotalwayssurewhichsystemstouseorwhich systemsareavailabletoperformspecificjobfunctions.Asaresult,staffmaynot beaccessinginformationthatisavailabletomakeinformeddecisionson adjudicationofbenefits,andsuchconditionsmighthamperstaff’sabilitytocarry outUSCIS’mission.  ITFunctionality  AccordingtoDHSMD0007.1,theComponentCIOisresponsibleforthetimely deliveryofmissionITservicesindirectsupportofcomponentmission,goals, objectives,andprograms.Further,theComponentCIOisresponsiblefor acquiring,developing,operating,andmaintainingallmissionrelatedsystems  www.oig.dhs.gov 16  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  andservices.Inaddition,accordingtothePaperworkReductionActof1995, agenciesarerequiredtopromotetheuseofITtoimprovetheproductivity, efficiency,andeffectivenessofagencyprograms,includingthereductionof informationcollectionburdensonthepublic.15  USCIS’ITsystemsdonotfullyprovidethefunctionalityneededtosupportits mission.Forexample,aspartofitsTransformationprogram,USCIScreatedELIS, anelectronicimmigrationsystem.TheaimofELISistoprovideamoreefficient andhigherqualityadjudicationprocess.However,insteadofimproved efficiency,timestudiesconductedbyservicecentersshowthatadjudicatingon paperisatleasttwotimesfasterthanadjudicatinginELIS.16Immigration servicesofficerstakelongertoadjudicateinELISinpartbecauseofthe estimated100to150clicksrequiredtomoveamongsublevelsandopen documentstocompletetheprocess.StaffalsoreportedthatELISdoesnot providesystemfeaturessuchastabsandhighlighting,andthatthesearch functionisrestrictedanddoesnotproduceusableresults.  OITandtheOfficeofTransformationCoordinationleadershipareawareofthe problemswithELISandsolicitedconcernsfromusersinoperations.USCISmade changesinsubsequentreleasesofELIS,suchasreducingthenumberofclicks requiredtoperformoperations.However,USCIShasbeenlimitedinitsabilityto makechangestoELISbecauseofchallengeswiththeexistingarchitecture.The architectureconsistsof29commercialsoftwareproducts,whicharedifficultto integrate.Mostchanges,likeadjustingtheinterfacetomakeitmoreintuitive, willbeimplementedaspartoftheprogram’stransitiontoamoreflexible architecture.ThestartofdevelopmentinthenewarchitecturebeganinOctober 2013.ELIS2isscheduledtobedeployedbytheendofcalendaryear2014.  Inaddition,staffsaidthatittakeslongertoprocessadjudicationswhenusingthe EnterpriseDocumentManagementSystem(EDMS)thanwhenusingpaperͲ basedprocesses.EDMSisawebͲbasedsystemthatallowsauthorizedusersto viewandsearchelectroniccopiesofthepaperͲbasedcasefiles.USCISstaff accessthecasefilestolearnthestatusofindividuals,includingpermanent residents,naturalizedcitizens,andotherindividualsofinterest.Staffmembers  15PublicLaw104വ13,PaperworkReductionActof1995,May22,1995. 16Onelocation’sstudyshowedusersadjudicating1.68casesperhouronpaperversus0.76casesinELIS, andanotherlocation’scomparisonfoundthatuserscanadjudicate2.16casesperhouronpaperand0.86 casesinELIS. www.oig.dhs.gov 17  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  usetheinformationtocompletetheirjobfunctions,suchasadjudicating requestsforTemporaryProtectedStatus.17  DigitizationofthefilesinEDMSreducesthedocumentdeliverytime,asthefiles donothavetobeshippedacrossUSCISlocations.However,staffsaidthatusing EDMSisburdensome.Eachdocumentisaseparatefilethatcantake30seconds ormoretoload,andstaffmembersareabletolookatonlyonedocumentata time.Inaddition,documentsarenotsearchable.Thefilenamesuseddonot alwaysproperlyidentifytheinformationcontainedinthefile,andkey documentsaresometimesburiedinthemiddleofalongerfile.Staffsaidthat thesedocumentissuesmaycauseanimmigrationservicesofficertomiss importantinformation.Severalstaffmemberssaidthattheydelayworkthat requirestheuseofEDMS,withsomedelayingEDMScasesformonthsandeven uptoayear.  WorkinginELISandEDMScreatesamarkedslowdownintheworkprocessesof adjudicators.Theslowersystemsleadtouserfrustrationandreluctancetoadapt toelectronicprocessing.SeveralpersonneltoldusthatITsystemssuchasEDMS madetheirjobsmoredifficultinsteadofeasier.Staffmembersexpressed concernabouttheirslowerproductivity,andthepotentialeffectontheir performanceratings,whenusingsystemssuchasELISandEDMS.In2012,prior tothedeploymentofELIS,USCISsignedamemorandumofagreementwiththe Uniontoensurethatstaffmemberswhoadjudicateinthesystemwouldnotbe penalizedforlowerproductionrates.InNovember2013,USCISsignedan updatedmemorandumofagreement,statingthatadjudicatorswouldnotbe penalizedforlowerproductionratesintheeventofanELISoutageornonͲ availabilityevent.  Mostcritically,becauseoflongerprocessingtimes,applicantsmaywaitlongerto receivetheirbenefitsordecisionsontheirpetitions.Thedelaymaybeespecially criticalforEDMSbecauseitisusedtoprocesscasesfiledundertheImmigration andNationalityActasamendedbytheViolenceAgainstWomenActof1994 (VAWA).18Forinstance,applicantswhohavefiled—orwhoarerecipientsofa filingontheirbehalf—animmigrantvisapetitionundertheVAWAprovisions includeabusedspouses,parents,andchildren.Immigrationservicesofficerssaid thattheeffectofdelayedcasereviewduetoproductivityissuessurrounding  17TemporaryProtectedStatusisatemporaryimmigrationstatusgrantedtoeligibleindividualsfrom designatedcountries,suchascountrieswithconditionsthatpreventtheindividualsfromreturningsafely. 18PublicLaw89–236,ImmigrationandNationalityActof1965,asamendedbytheViolenceAgainst WomenActof1994,PublicLaw103Ͳ322,TitleIV,Sections40001വ40703oftheViolentCrimeControland LawEnforcementActof1994,September13,1994. www.oig.dhs.gov 18  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  EDMScanbeextremelydireifaVAWAapplicantisharmedbyanabuserwhile awaitingadjudication.  OITandprogramleadershipindicatedthatusersmayfacedifficultieswithELIS andEDMSbecausetheseusersfeeluncomfortableswitchingfrompaperͲbased processestosystemͲbasedprocesses.Inaddition,sincestaffmaynotuseELISor EDMSonafrequentbasis,usersmaybeunawareofnewsystemfeatures,such astheoptiontoloadimagesmorequicklyinEDMS.Staffmemberswhousethe systemsinfrequentlymayalsohavedifficultyoperatingthesystemsafteradelay inuse.WhileELISandEDMSprogrammanagerscommunicateinformationabout systemchangesandprovidetrainingtoendusers,theyacknowledgedthatthere maybeaneedforrefreshertrainingforusers.Suchtrainingwouldhelpensure usersareawareofnewersystemfunctionsandprovideopportunitiesto reacquaintstaffwithasystemtheymightnotusefrequently.  ITReliability  USCISOITalsofaceschallengeswithsystemreliability.Forexample,inMay 2013,USCISlaunchedtheCustomerIdentityVerificationSecondaryInspection Tool(CIVSIT)toenhancetheintegrityoftheimmigrationsystemandprotect applicantsfromidentityfraud.Aspartofrequestingimmigrationor naturalizationbenefits,applicantsvisitoneofUSCIS’ApplicationSupportCenters toprovidetheirbiometricinformation.USCISusesthisinformationtohelp determineeligibilityforrequestedbenefits.ApplicantsvisitingaUSCISfield officeforaninterviewortobeissuedevidenceofanimmigrationbenefit,such astemporarytraveldocuments,arerequiredtohavetheiridentitybiometrically reverified.ThisidentificationcheckentailsUSCISstaffelectronicallyscanningtwo fingerprintsandtakingapictureoftheapplicanttoverifyhisorheridentity.CIV SITmakesitpossibletoidentifyapplicantsbymatchingtheapplicantusingthe twofingerprintscanandpictureandcomparingtheprintsandimagesonfile.  However,systemfailuresoccurredwithinthefirsttwohoursofCIVSIT’srollout. Althoughthesystemfailuresoccurredattheserver,effortstoaddressthe systemfailureswerehamperedbyhardwareproblems.AninternalUSCIS assessmentreportedhardwareproblems;forexample,threeofthefour camerastestedforusewithCIVSIThadpreͲexistingcompatibilityproblems. Further,theequipmentforCIVSITwasnotstandardizedpriortothesystem’s release.Thevarietyoftypesofcamerasandscannersateachsite,withsome sitesinheritingsecondͲhandequipmentfromU.S.CustomsandBorder Protection,contributedtosystemreliabilityissues.BecausethetypeofIT www.oig.dhs.gov 19  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  equipmentvariedacrosslocations,itwasdifficulttopinpointsystemissuesand fixes.  InSeptember2013,CIVSITredeployedsuccessfully.However,challengeswith CIVSITcontinued,andseniorstaffsaidthatUSCISisconsideringnewsolutions. StaffsaidthatCIVSITsometimesdroppedordidnotcapturekeybiometric information.Asaresult,staffmustspendtimelocatingthemissinginformation. Inoneinstance,theadjudicatorsubmittedarequestformissinginformationon aMondayandwaiteduntilthatThursdayfortheultimateresolution.Further, misplaceddataandsystemfailurecancreateaburdenforapplicantswhomust waitwhilestaffattempttofindmissinginformationorwhohavetoreturntoa fieldoffice,sometimesseveralhoursaway,torepeattheirbiometriccapture.  InfrastructurePlanning  AlimitedITrefreshplanandhistoricalchallengeswithstandardizingandfunding ITinfrastructurecontributedtoproblemswithsystemfunctionalityand reliability.USCISOIThasyettoimplementafullITrefreshplanthatincludes workstations,printers,andotherITequipment.Upperlevelmanagementwithin USCISandOITacknowledgedthatOITstruggledwithrefreshplanning.Staffwith whomwemetsaidthatUSCISwastooreactiveinregardstorefreshesandcould bemoreproactiveinplanning.  OIThasmadeprogressinupgradinghardware;however,challengesremain.For example,USCISbeganimplementingaWorkstationRefreshProgramtoreplace computersthatdonotmeetUSCISstandards.InFY2012andFY2013,USCIS replacedmorethan6,000computers.Inaddition,OIT’sEndUserServices DivisionwasworkingonastrategicplanforUSCIStoensurethatthecomputer technologyprovidedtoeachUSCISemployeekeepspacewithtechnological developmentsandconcepts.Thisplanwillinvolveadoptinga4Ͳyearcyclefor userlevelcomputerreplacement.However,someofUSCIS’largestfacilitiesare stillwaitingforarefresh.AsofDecember2013,allfourservicecenters,the NationalBenefitCenter,theNationalRecordsCenter,andtheUSCIS headquartersprogramofficesinWashington,DC,wereawaitingarefresh.  USCISOIThasmadeprogressinupgradingoperatingsystemsandsoftware.In March2012,71percentofUSCIScomputerscouldnotrunMicrosoftOffice2010 orWindows7.AsofOctober2013,83percentofUSCIScomputerswereableto runOffice2010andWindows7.However,fullimplementationhasbeendelayed duetolegacysystemsthatarenotcompatiblewithWindows7.Forexample, USCISstruggledwithmigratingtoWindows7becauselegacyapplications,such www.oig.dhs.gov 20  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  asCLAIMS3andCLAIMS4,arereliantonolderoperatingsystemsandare incompatiblewithWindows7.  USCISandOITmanagementareawareoftheneedforcomprehensive infrastructureplanningandaformalrefreshplanbeyondworkstations.AUSCIS officialsaidthatOIThadchallengeswithproducingaplanwithdatesand milestonesfortheWindows7deploymentduetoaneedforincreased coordinationbetweenOITdivisions.Inaddition,membersofOITmanagement saidthatfundingwasoneofthelargestchallengesfacingtherefresh. Historically,definitivereplacementcycleshavebeendifficulttoestablish consistentlyacrossUSCISduetobudgetconstraintsanddisparatefunding sources,aswellasthedecentralizednatureinhowUSCISfieldofficeshad independentlyprocuredITinfrastructure.BecauseITissocentraltoUSCIS’ operationsandabilitytofulfillitsmission,datedandobsoletetechnologyhasa negativeeffectonproductivity,customerservice,andsupportcosts.  Whiledelayingrefreshmaydecreasecostsintheshortrun,thedelaycan increaseoperationalcostsinthelongrun.Outdatedinfrastructurecanleadto higherhardwareͲbasedfailurerates,increasedsoftwareconflicts,extended warrantyfees,andmorestaffhoursdedicatedtoendͲusersupport.Because USCIShashistoricallynothadacomprehensiverefreshprogramorastandard baselineofequipment,theagencyhasaccumulatedmultiplecomputer configurations.Themultipletypesofequipmentincreasethecomplexityofthe ITenvironmentbaselineandthusthetotalcostofownership.Additionally,IT Securityofficialstoldusthatinfrastructureandsecurityconcernsarelinked. OutdatedinfrastructurecausesvulnerabilitiesonUSCIS’internalapplications. Thesevulnerabilities,whilenotyetexploited,arereflectedintheagency’s FederalInformationSecurityManagementActScorecard.  ITSystemUse  USCISstaffmembersarenotalwayssureofwhichsystemstouseorwhich systemsareavailabletothemtocompletebusinessprocesses.Forexample,staff membersinsomelocationswerenotawarethattheyshouldbeusingtheArrival andDepartureInformationSystem(ADIS)duringtheadjudicationprocess.ADIS isaDHSOfficeofBiometricIdentityManagementsystemusedtocollectand maintainthearrivalanddepartureinformationofnonͲU.S.citizenstravelingto theU.S.Ahighlevelofficialinthefieldlearnedaboutthevalueofthesystem whenaFraudDetectionandNationalSecuritysupervisorbroughtittothe official’sattention.Seniorfieldofficialstoldustheyexperiencedanincreasein customers’withdrawalsofapplicationsforbenefitsafterimplementingtheuse www.oig.dhs.gov 21  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  ofADIS.Duetotheincreasedinformationadjudicatorswereabletogather,they hadafullerpictureoftheapplicant.  Inaddition,somestaffmemberswerenotawarethattheymayqualifyforaccess tocertainsystems,suchasthePublicAccesstoCourtElectronicRecordssystem operatedbytheAdministrativeOfficeoftheU.S.Courts.Inonecase,aUSCIS employeeusedtheaccountinformationofaU.S.ImmigrationandCustoms Enforcementemployeetoaccessthecourtelectronicrecordssystembecause theemployeedidnotknowitwaspossibletogainaccessthroughUSCIS.Other staffmemberswithwhomwemetwerenotawareofsystemsavailabletothem, suchasformseditingsoftwareoradditionalbackgroundchecktools.  SeniorfieldofficialswithwhomwemetexpressedconcernregardingnonͲ standardsystemuse.Forexample,officialswereconcernedthatifeverysiteis notusingthesamesystems,applicantscouldtraveltodifferentfieldofficesto receivedifferentresults.Inaddition,suchasinthecaseofADIS,ifimmigration servicesofficersatdifferentsitesarenotaccessingthesameinformation, officerscouldbemissinginformationthatwouldhelpthemcarryoutUSCIS’goal ofstrengtheningthesecurityandintegrityoftheimmigrationsystem.  Recommendations  WerecommendthattheChiefInformationOfficer,U.S.Citizenshipand ImmigrationServices:  Recommendation#3:  CoordinatewiththeownersofELISandEDMStoensureusersareprovidedwith adequatetraining.  Recommendation#4:  DevelopandcommunicateaplanofactionandmilestonestorefreshoutdatedIT infrastructure,includingcomputers,printers,andsoftware.  ManagementCommentsandOIGAnalysis  TheActingDeputyDirector,U.S.CitizenshipandImmigrationServices,concurred withourrecommendationsandprovideddetailsonstepsbeingtakentoaddress specificfindingsandrecommendationsinthereport.Wehavereviewed www.oig.dhs.gov 22  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  management’scommentsandprovidedanevaluationoftheissuesoutlinedin thecommentsbelow.  Inresponsetorecommendationthree,theActingDeputyDirectorconcurredand statedthatcoordinationandcommunicationbetweensystemownersand businessownersiscrucialtothesuccessofUSCISmeetingitsmission.TheActing DeputyDirectorstatedthat,withinUSCIS,respectiveprogramofficesare responsiblefortrainingusersontheITsystemsappropriatefortheindividual’s jobfunction.However,OITsupportsthistrainingbyensuringthatusermanuals andtrainingdocumentsareuptodate.Additionally,OITcanprovide demonstrationsandtrainingsessionswiththeprogramofficestoensuresystems areusedtotheirfullextent.TheActingDeputyDirectorsaidthatOITexpectsto completeupdatestotheELISandtheEDMSusermanualsandtraining documentsbyNovember2014.Werecognizethisactionasapositivestep towardaddressingthisrecommendation.  Inresponsetorecommendationfour,theActingDeputyDirectorconcurredand statedthatsincetheissuanceofourdraftreport,OIThasmadeprogressin refreshingoutdatedworkstationsandperipherals.Inthecurrentcycle,OITisset tocompleteupgradesatallmajorServiceCentersbyAugust2014.Additionally, OITisexpandingitsWorkstationRefreshStrategy2013വ2017toinclude infrastructure.ThenewTechnologyRefreshStrategy2014വ2018goesbeyond theworkstationrefreshandalsoincludesaplanofactionandmilestonesfor updatingallIThardwareandinfrastructure.TheTechnologyRefreshStrategy 2014വ2018willbecompletedbySeptember30,2014.Werecognizethisaction asaconstructivesteptowardaddressingthisrecommendationandlookforward tohearingmoreaboutcontinuedprogressinthefuture.     www.oig.dhs.gov 23  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  AppendixA Objectives,Scope,andMethodology  TheDHSOfficeofInspectorGeneral(OIG)wasestablishedbytheHomelandSecurityAct of2002(PublicLaw107о296)byamendmenttotheInspectorGeneralActof1978.This isoneofaseriesofaudit,inspection,andspecialreportspreparedaspartofour oversightresponsibilitiestopromoteeconomy,efficiency,andeffectivenesswithinthe Department.  Aspartofourongoingresponsibilitiestoassesstheefficiency,effectiveness,and economyofDepartmentalprogramsandoperations,weconductedanauditto determineUSCIS’progressinestablishingkeyITmanagementcapabilitiestosupport missionneeds.  WeresearchedandreviewedFederallaws,managementdirectives,andagencyplans andstrategiesrelatedtoITsystems,management,andgovernance.Weobtained publishedreports,documents,andnewsarticlesregardingUSCIS’managementanduse ofIT.Additionally,wereviewedrecentGAOandDHSOIGreportstoidentifyprior findingsandrecommendations.Weusedthisinformationtoestablishadatacollection approachthatconsistedoffocusedinformationͲgatheringmeetings,documentation analysis,sitevisits,andsystemdemonstrationstoaccomplishourauditobjectives.  WeheldmeetingsandteleconferenceswithUSCISstaffatheadquartersandfield offices.Collectively,wemetwithmorethan170individuals,includingheadquarters officials,fieldofficestaff,andsystemusers,tolearnaboutUSCISITfunctions,processes, andcapabilities.Atheadquarters,wemetwiththeUSCISActingDeputyDirectorand stafffromtheManagementDirectorate,OfficeofTransformationCoordination, EnterpriseServicesDirectorate,andtheCustomerServiceandPublicEngagement Directorate.WemetwithUSCISOITofficialsincludingtheCIO,DeputyCIO,division directors,branchchiefs,andprogrammanagerstodiscusstheirrolesand responsibilitiesrelatedtoUSCISITmanagement.WemetwithstafffromOITofficesand divisions,includingEndUserServices,ResourceManagement,InformationSecurity, EnterpriseInfrastructure,andSystemsEngineering.Inaddition,wemetwithDHSOCIO staff.  WevisitedUSCISfieldlocationsincludingtheCaliforniaServiceCenter,theVermont ServiceCenter,theWesternRegionOffice,theNortheastRegionOffice,theSanDiego DistrictOffice,theSanDiegoFieldOffice,theChulaVistaFieldOffice,andtheSt.Albans FieldOffice.AtUSCISfieldlocations,wemetwithservicecenterexecutivestaff,regional officemanagement,districtofficemanagement,fieldofficedirectors,immigration www.oig.dhs.gov 24  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  servicesofficers,immigrationanalysts,trainingandsupportstaff,immigrationofficers, ITspecialists,andothersystemuserstounderstandITdevelopmentpractices,user requirements,andsystemuseinthefield.WediscussedthecurrentITenvironmentand theextenttowhichitsupportsmissionneeds,localITdevelopmentpractices,anduser involvementandcommunicationwithheadquarters.Wecollectedsupporting documentsabouttheUSCISITenvironment,ITmanagementfunctions,Transformation, othercurrentinitiatives,andimprovementinitiatives.  WeconductedthisperformanceauditbetweenSeptember2013andFebruary2014 pursuanttotheInspectorGeneralActof1978,asamended,andaccordingtogenerally acceptedgovernmentauditingstandards.Thosestandardsrequirethatweplanand performtheaudittoobtainsufficient,appropriateevidencetoprovideareasonable basisforourfindingsandconclusionsbaseduponourauditobjectives.Webelievethat theevidenceobtainedprovidesareasonablebasisforourfindingsandconclusions baseduponourauditobjectives.  TheprincipalOIGpointofcontactforthisauditisRichardHarsche,ActingAssistant InspectorGeneralforInformationTechnologyAuditsandDirectorofInformation Management.MajorOIGcontributorstotheauditareidentifiedinappendixC.     www.oig.dhs.gov 25  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  AppendixB ManagementCommentstotheDraftReport   www.oig.dhs.gov 26   OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security    www.oig.dhs.gov 27   OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security     www.oig.dhs.gov 28   OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  AppendixC MajorContributorstoThisReport  RichardHarsche,ActingAssistantInspectorGeneral ElizabethArgeris,AuditManager SwatiNijhawan,SeniorProgramAnalyst AnnaHamlin,SeniorProgramAnalyst TheaCalder,SeniorProgramAnalyst RajPatel,ProgramAnalyst BridgetGlazier,Referencer www.oig.dhs.gov 29  OIGͲ14Ͳ112 OFFICE OF INSPECTOR GENERAL Department of Homeland Security  AppendixD ReportDistribution  DepartmentofHomelandSecurity  Secretary DeputySecretary ChiefofStaff DeputyChiefofStaff GeneralCounsel ExecutiveSecretary Director,GAO/OIGLiaisonOffice AssistantSecretaryforOfficeofPolicy AssistantSecretaryforOfficeofPublicAffairs AssistantSecretaryforOfficeofLegislativeAffairs Director,USCIS DeputyDirector,USCIS ChiefInformationOfficer,USCIS Liaison,USCIS ChiefPrivacyOfficer  OfficeofManagementandBudget  Chief,HomelandSecurityBranch DHSOIGBudgetExaminer  Congress  CongressionalOversightandAppropriationsCommittees,asappropriate  www.oig.dhs.gov 30  OIGͲ14Ͳ112 ADDITIONAL INFORMATION To view this and any of our other reports, please visit our website at: www.oig.dhs.gov. For further information or questions, please contact Office of Inspector General (OIG) Office of Public Affairs at: [email protected], or follow us on Twitter at: @dhsoig.

OIG HOTLINE

To expedite the reporting of alleged fraud, waste, abuse or mismanagement, or any other kinds of criminal or noncriminal misconduct relative to Department of Homeland Security (DHS) programs and operations, please visit our website at www.oig.dhs.gov and click on the red tab titled "Hotline" to report. You will be directed to complete and submit an automated DHS OIG Investigative Referral Submission Form. Submission through our website ensures that your complaint will be promptly received and reviewed by DHS OIG. Should you be unable to access our website, you may submit your complaint in writing to: Department of Homeland Security Office of Inspector General, Mail Stop 0305 Attention: Office of Investigations Hotline 245 Murray Drive, SW Washington, DC 20528-0305 You may also call 1(800) 323-8603 or fax the complaint directly to us at (202) 254-4297.

The OIG seeks to protect the identity of each writer and caller.