On Thursday the House Subcommittee on Government Operations held its 14th hearing on the Federal Information Technology Acquisition Reform Act (FITARA), which helps guide federal agency IT management and cybersecurity. The subcommittee heard testimonies from Carol C. Harris, Director of IT Oversight for GAO, Vaughn Noga, EPA CIO, John Sherman, DOD CIO, and David Shive, GSA CIO.

Witnesses agreed that the FITARA scorecard is a useful tool for measuring and monitoring agency IT and cybersecurity management, however, continued evolution over time is necessary.

Chairman Connolly in his opening statement remarked that the federal government has seen at least $24B in savings due to FITARA efforts and that the subcommittee is working with OMB and agencies to continue to evolve the scorecard to hold agencies accountable and improve IT postures. Scorecard changes include sunsetting previous data center scoring and in the future, potentially sunsetting the CIO reporting metric.  

FITARA 14.0 scores are below:

Harris testified that the scorecards have evolved and served as effective oversight tools. She went on to say that “both IT management and cybersecurity are on our High-Risk List. About 77% of the 5,300 recommendations we've made in these areas since 2010 have been implemented.” Harris also stated that the federal government had realized $24.8B savings from the IT Portfolio Stat process alone. She concluded by stating, “Tools such as the biannual scorecards can be essential in driving improvements. Moreover, implementation of outstanding GAO recommendations can be instrumental in delivering needed improvements.”

Subcommittee members, as well as witnesses, exalted the value of having the CIO report to the agency head or deputy head, giving them equal footing with other C suite agency executives and more authority to carry out responsibilities. According to the CIOs present, direct reporting drives routine discussions, budget decision-making, and early participation in problem-solving or capability development.  

Subcommittee members also expressed concern regarding this year’s cybersecurity scores. Harris remarked that this year’s scores were not comprehensive because they were only able to use one metric, unlike other years. OMB did not specify Cross-Agency Priority (CAP) goals for cybersecurity for the year, nor did they release an annual Federal Information Security Management Act (FISMA) audit for FY 2021. Because of this, the FITARA cyber grades only reflect a subset of systems and “are not generalizable across the entire organization.” The current scorecard only reflects grading based on data from the agency Inspectors General (IGs). Connolly went on to say that he met with OMB the day before and they admitted their culpability in the process and agreed to work with the subcommittee to correct the problem and provide the needed information in a more timely manner in the future.

When asked if the scorecard provided an accurate picture of an agency’s whole IT posture, Harris stated that generally, the scorecard provides an accurate reflection of the categories listed.  But there is a need to evolve and look at new and emerging areas like legacy systems. She said that there is a “challenge in this iteration for cyber due to only one metric and the absence of CAP goals from the administration, but for all other areas it’s a pretty accurate reflection.”

Some subcommittee members asked why the scorecard seemed to reflect stagnation and not continued upward progression. Harris offered that metrics for some categories should change, for example, the incremental development category.  “We need to evolve the methodology for where agencies are in their maturity.” She also suggested adding a category to monitor and improve legacy IT.

The witnesses and subcommittee concluded that the FITARA scorecard is an effective tool for helping measure and modernize IT, and it should continue to evolve along with agency progress and emerging IT capabilities.