Information Technology: FBI Needs an Enterprise Architecture to Guide Its Modernization Activities

In September 2003, the FBI Director designated EA development, maintenance, and implementation a bureau priority, and, in early September 2005, the bureau began taking the necessary steps to lay an effective EA management foundation. For example, the bureau established an Enterprise Architecture Board with division representatives (among others) to direct, oversee, and approve the EA. In addition, the bureau adopted a framework and automated tool (Popkin) for its enterprise architecture repository. Further, it established a program office, with responsibility for the development, implementation, and maintenance of the EA. Moreover, this office developed a program management plan in October 2004 that specifies how and when the EA is to be developed and issued; provides for the bureau's "as-is" and "to-be" environments, as well as a sequencing plan for transitioning from the "as-is" to the "to-be"; calls for describing the enterprise in terms of business, data, applications, and technology, including describing security related to each; and establishes metrics for measuring EA progress, quality, compliance, and return on investment. More recently, the bureau has adopted an EA methodology and allocated the necessary resources for the bureau?s EA activities.

In early September 2005, we reported (in Information Technology, FBI Is Taking Steps to Develop an Enterprise Architecture, but Much Remains to be Developed, GAO-05-363) that the FBI had a written and approved policy for EA development, and that EA products, such as the program management plan, have been placed under configuration management. We also reported that the bureau is in the process of developing its "as-is" and "to-be" architectures which describe the enterprise's business, performance, data, applications and technology, including descriptions for security services. Further, we reported that the bureau's EA products are to describe the "as-is" environment, the "to-be" environment, and a sequencing plan. In addition, we reported that the FBI is measuring and reporting progress against EA plans.

In early September 2005, we reported that the FBI hired a contractor to begin performing independent verification and validation on EA products and management processes. Since that time, independent verification and validation of EA products and management processes has occurred. In addition, the bureau established a plan that addresses EA maintenance. Further, the FBI's EA Baseline Architecture, the EA Target Architecture, and to a limited extent, the FBI Transition & Sequencing Plan specify a number of critical products, such as descriptions of the bureau's business, data, applications, and technology, as well as the "as-is" and "to-be" environments. A number of EA products have been approved by the CIO and relevant oversight committees within the bureau, such as the Enterprise Architecture Board. In addition, the FBI defined measures and metrics for its EA work and reports that it is instituting regular reporting on progress against those metrics.

In early September 2005, we reported that the bureau had established a written policy for IT investment compliance with its EA (recommendation element 1), and had developed a configuration management plan, which defines a process to formally manage change. Since that time, the FBI CIO developed an IT Investment Management Process that makes EA part of IT investment management, ensures that EA products are updated, and that explicitly evaluates IT investment based on EA compliance. In addition, the FBI Director approved several of the current EA documents, including the FBI EA Target Architecture. Moreover, the FBI reports that it is instituting regular reporting on the return on its EA investments, although we have yet to receive documentation demonstrating actual measurement and reporting. Further, a number of relevant EA documents have been approved by the FBI Director.

According to FBI's CIO, the bureau has developed and implemented a strategy for mitigating the risks associated with continued investment absent its EA. The strategy calls for the CIO and the enterprise architecture board (EAB) to review all IT proposals and investments to ensure alignment with the bureau's EA vision--a set of foundational principles. In addition, the bureau reports it has begun implementing the strategy on its IT investments. For example, according to the CIO, in June 2004, he and the board reviewed five proposed investments for consistency with the bureau's EA vision. Further, the CIO stated that as EA products evolve and are delivered, the bureau plans to use them to guide and constrain IT investment decision-making, which our review of EAB minutes shows is happening.