OPM’s Troubled IT Upgrade Project on Track to Get Millions More in Funding

Mark Van Scyoc/Shutterstock.com

A new watchdog report finds funding for the project remains an issue in part because of poor planning by the agency.

The Office of Personnel Management is on track to receive a 75 percent budget increase for IT security upgrades at the once-hacked agency.

But a new internal watchdog report finds funding for the troubled project remains an issue in part because of poor planning by the agency. A broader Obama administration plan to shift responsibility for background investigation IT systems to the Pentagon could also put funding for OPM’s “Shell” IT modernization in jeopardy, according to a May 18 report from the OPM inspector general’s office.

The House Appropriations Financial Services and General Government Subcommittee on May 25 approved $37 million -- a $15 million boost -- in total funding for “the operation and strengthening” of OPM’s legacy IT systems as well as the new Shell environment.

The funding bill comes with some strings attached, though. To get all the new funding, OPM officials will have to put together a detailed spending plan reviewed and approved by the White House’s in-house digital fix-it squad, the U.S. Digital Service, as well as the Office of Management and Budget, the Homeland Security Department and OPM’s inspector general.

Such a plan is sorely needed, according to the IG’s new accounting, which finds the agency still lacks a “realistic budget” for the massive upgrade.

“OPM officials have candidly informed us that their cost estimates are ‘best guesses,’” the IG’s latest report stated. “In our opinion, these cost estimates significantly understate the true costs of the project.”

The new audit is the latest in a back-and-forth between the agency and the IG’s office over the status of the IT upgrades. The overhaul was initiated in the wake of a 2014 cyber intrusion and accelerated after OPM revealed last summer that hackers had made off with sensitive background investigations records on more than 21.5 million current and former federal employees and contractors.

Also complicating matters is the administration’s plan to transition the responsibility for conducting background checks to an independent “National Background Investigations Bureau,” and to task the Defense Department with managing and securing the new agency’s IT systems.

The new bureau could pose a problem because, according to the IG’s office, OPM had planned to use money from its revolving fund -- most of which comes from fees charged to other agencies to perform background checks -- “to fund a significant portion of the costs of the project.”

Now that the IT systems undergirding the background investigation process will be under the control of the Defense Department and not part of OPM’s Shell environment, “it would seem that a large portion of the planned funding source will not be available for the project,” the IG reported.

The IG also says it’s a problem OPM is only planning to spend limited amounts of funding on actually modernizing and migrating systems. Between fiscal 2017 through 2020, planning documents indicate, OPM only plans to spend between 20 and 25 percent of its budget on migrating systems. The rest will be spent on securing and maintaining both the existing legacy IT environment and the still-under-construction new Shell environment.

“As these two environments continue to age, the costs of keeping them functional and secure will continue to increase,” the IG’s report noted. “Eventually, maintenance costs could consume OPM’s entire budget for the project, leaving no funding available for modernization and migration.”

The IG calls this a “worst-case scenario,” because both environments would be left less secure, and the agency would be “susceptible to another data breach.”

OPM has addressed some of  the IG’s previous recommendations.

After repeated calls by the IG stretching back to last summer, OPM finally agreed to complete critical planning documents -- known as an IT business case -- related to the multimillion-dollar IT security overhaul by the end of September.

But the follow-up IG report says the agency rushed through those documents, skipping several “critical” steps.

The report also noted “some improvement” in developing an inventory of the agency’s legacy systems, including cost estimates for modernizing them.

OPM’s senior cybersecurity adviser, Clifton Triplett, “has developed a framework that we are optimistic can begin to provide OPM with this critical information,” the IG said.

“While this type of analysis should have occurred before heavily investing” in the Shell upgrade project, “we are pleased to see that OPM at least has a framework in place to begin developing true cost estimates for this project,” the IG said.

Earlier this month, the company hired to help OPM build a new IT environment, Imperatis, suddenly quit work on the contract a month early, citing financial distress.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.