http://www.gao.gov/new.items/ai99218.pdf">

[Most of intro snipped]

Dear Mr. Chairman:

At your request, we obtained information on federal agencies reporting to the Office of Management and Budget (OMB) on the Year 2000 status of their classified systems. Our objectives were to determine (1) whether agencies are including classified systems in their quarterly reports to OMB, (2) whether agencies are separately reporting to OMB on the status of their classified systems,1 and, if so, how OMB uses the information, and (3) for those agencies not reporting to OMB, the status of those systems. On May 27, 1999, we briefed your office on the results of our work. This letter summarizes and updates the information presented at that briefing.

To accomplish our objectives, we surveyed both OMB and the 34 major federal agencies that report quarterly to OMB on the status of their Year 2000 efforts. We then interviewed OMB and agency officials and requested and reviewed supporting documents, as appropriate, to clarify survey responses. We achieved a 100-percent response rate to our survey. We did not verify agency responses. We performed our work from March through July 1999 in accordance with generally accepted government auditing standards.

We requested comments from key agencies discussed in this letter. Their comments are discussed in the Agency Comments section of this letter.

---

Results in Brief

Of the 34 federal agencies surveyed, 21 agencies reported that they do not have any classified systems. Of the remaining 13 federal agencies, 12 agencies 2 reported that they include the Year 2000 status of their mission-critical, classified systems in their reports to OMB. OMB uses the information provided by the agencies to monitor Year 2000 progress across the federal government and to keep the Congress informed of agencies Year 2000 progress. As of July 1999, the Department of the Treasury had not reported the status of all of its mission-critical, classified systems to OMB. However, it plans to do so in its subsequent reports to OMB. Treasury reported that it has 13 systems that are not reported to OMB. Of these 13 systems, 7 systems are Year 2000 compliant, 5 systems are being repaired, and 1 system is being replaced. According to Treasury, the 5 systems being repaired and the 1 system being replaced are all in the testing/validation phase.

---

Background

In a May 7, 1997, memorandum, and in subsequent memorandums, OMB directed selected federal agencies to report to it quarterly on their Year 2000 progress.3 Among other things, OMB directed agencies to report on the status of their (1) data exchanges, (2) continuity and contingency planning efforts, (3) independent verification and validation methods, (4) Year 2000 remediation costs for mission-critical and nonmission-critical systems, (5) non-IT equipment (i.e., any products or devices using embedded chips), and (6) mission-critical information systems. For those systems being repaired, OMB directed the agencies to report on milestones and number of systems completed for each remediation phase:

 Assessmentincludes completing the inventory and assessment of information systems and their components and assessing the severity of the Year 2000 problem across the enterprise.

 Renovationincludes converting, replacing, or eliminating selected platforms, applications, databases, and utilities and the modification of interfaces.

 Validationincludes testing, verification, and validating converted or replaced platforms, applications, databases, and utilities.

 Implementationincludes implementing converted or replaced platforms, applications, databases, and utilities. OMB established March 31, 1999, as the milestone date for completing implementation of all mission-critical systems. OMB also directed agencies to provide a list of those mission-critical systems that could not be implemented by the March 1999 deadline.

---

Most Agencies that Reported Having Classified Systems are Reporting Their Year 2000 Status to OMB

Most federal agencies that reported having mission-critical, classified systems report the Year 2000 status of these systems to OMBs Office of Information and Regulatory Affairs (OIRA). Of the 34 major federal agencies reporting to OMB, 21 agencies reported that they do not have any classified systems. Of the 13 federal agencies that reported having classified systems, 12 agencies 4 reported that they include the Year 2000 status of these systems in their reports to OMB. Eleven agencies submit their reports to OMBs Office of Information and Regulatory Affairs. According to OMB officials, OMB uses the information provided by the agencies to monitor Year 2000 progress across the federal government and to keep the Congress informed of agencies Year 2000 progress.

The CIA reports the status of its mission-critical, classified systems quarterly to OMBs National Security Division for Command, Control, Computer, Communications, and Intelligence (NSD/C4I). NSD/C4I also uses the information provided by the CIA to monitor its Year 2000 progress and has shared this information upon request with the Presidents Council on Year 2000 Conversion.

---

One Agency Plans to Report the Status of Its Classified Systems to OMB

As of July 1999, one agencythe Department of the Treasuryhas not reported the status of its mission-critical, classified systems to OMB, however it plans to do so in its subsequent reports to OMB.

Treasury reported that it has 15 mission-critical, classified systems. Of these 15 systems, Treasury reports the Year 2000 status of only 2 to OMB. The status of the other 13 is not reported. According to Treasury, 7 systems are Year 2000 compliant, 5 systems are being repaired, and 1 system is being replaced. The 5 systems being repaired and the 1 system being replaced are all in the testing/validation phase. Treasury plans to have all of its mission-critical, classified systems fully implemented by August 31, 1999.

---

Agency Comments

We received comments from the Secretary of the Treasury, the Secretary of Transportation, the Director of the Executive Office of the President, Office of Administration, and the Director of the Office of Management and Budget. The main thrust of their comments was to provide updated information on the status of their Year 2000 reporting. We have incorporated the updated information in this letter as appropriate.

-- Chris (%$^&^@pond.com), September 06, 1999