Statement of Matthew T Cornelius Executive Director of the Alliance for Digital Innovation Before the Subcommittee on Government Operations Committee on Oversight and Reform U S House of Representatives July 20 2020 Introduction Chairman Connolly Ranking Member Hice and Distinguished Members of the Subcommittee thank you for the opportunity to testify today and discuss the vitally important topic of Federal information technology IT modernization My name is Matthew Cornelius and I am the Executive Director of the Alliance for Digital Innovation ADI We are a non-profit organization made of up nearly two dozen of America’s most innovative commercial technology companies which focuses on empowering the public sector to deliver the modern secure effective digital experiences that citizens deserve and which taxpayers demand The continuing reliance on outdated insecure legacy technology fundamentally obstructs the creation of a modern secure 21st century government This hearing is a great opportunity to explore this critical problem Below I will share our perspective on both the IT challenges and opportunities agencies face and will offer some recommendations for actions that both the Executive Branch and Congress may consider to improve the speed scale and likelihood of success in modernizing legacy technology Background and IT Modernization Priorities ADI believes that the government exists to serve its citizens efficiently and competently – and that technology is the key driver behind this relationship While ADI focuses specifically on improving Federal agency technology outcomes our companies also have successful track records of modernization in large complex companies across both the public and private sector ADI advocates for stronger innovation in the public sector with a clear focus on driving specific changes to accelerate agencies’ adoption of commercial technology 2  The need to retire legacy systems and outdated business practices that stifle innovation impede effective cybersecurity and hinder citizen service delivery  The need to improve the way the government buys and uses commercial capabilities for mission outcomes and  The need for government to partner collaboratively with creative industry partners to pilot and scale innovative commercially developed technology solutions Prior to my current position at ADI I had the honor and privilege of serving in several roles in the government that focused on IT modernization and improving Federal cybersecurity I was a senior advisor for technology and cybersecurity policy in the Office of Management and Budget’s OMB Office of the Federal Chief Information Officer OFCIO as well as a senior advisor at the General Services Administration GSA While in government I led the execution of several key Federal technology efforts including the IT Modernization Cross-Agency Priority Goal one of the three key pillars of the President’s Management Agenda PMA and the Technology Modernization Fund TMF an important financial vehicle for IT transformation created by Congress through passage of the Modernizing Government Technology Act MGT Act I also served as the primary interagency lead at the Federal Chief Information Officers Council CIO Council where I worked across the Executive Branch to support agency implementation of such foundational laws as the Federal IT Acquisition Reform Act FITARA and the Federal Information Security Modernization Act FISMA I highlight these experiences in addition to my role at ADI because they collectively provide me with a unique understanding of Federal IT modernization that can be shared with the Subcommittee today 3 Retiring the Legacy Culture in Federal IT Often the primary focus of IT modernization is retiring legacy systems and outdated business practices that stifle innovation encumber effective cybersecurity and hinder citizen service delivery However when I describe the government’s “legacy” problem I want to note that it goes far beyond certain systems that are decades old First and foremost it is a cultural problem both inside government and out For starters the government is averse to market pressures such as service quality convenience or speed of delivery and often relies on a woefully outdated business model that prioritizes building and owning technology solutions inside agencies As a result innovative companies must find unique and compelling value propositions to enter the Federal market and propose new ideas or commercial offerings In addition there is little alignment of agency procurement and financial management processes to industry best practices because government often follows a compliancefirst as opposed to customer-first or risk-based mindset While some public sector agencies are investing wisely in cloud computing and other emerging technologies too many remain hamstrung by technical debt and antiquated operating models that lead to wasteful spending and the continued reliance on outdated ineffective IT systems The traditional approach of buying custom-built monolithic solutions leads to ballooning budgets parochial systems that are unable to communicate or collaborate with other agency technology investments and vendor lock-in Most importantly this antiquated approach to delivering IT limits the ability of new and non-traditional vendors to partner with the government The COVID-19 pandemic has shown in real and dramatic ways how public sector agencies can leverage cloud agile development and digital services to deal with these exigent circumstances ADI members in particular have gone above and beyond to support agency recovery and relief efforts 4 related to COVID-19 The government’s response to this crisis has highlighted many transformational changes in IT modernization where agencies and industry moved quickly together to meet the challenges of the moment Federal IT modernization has accelerated astronomically over the past few months and now more than ever agencies are more aware of the possibilities they can achieve in technology transformation Still more can be done Improving the way the government buys and uses commercial capabilities for mission outcomes A second key to empowering and accelerating IT modernization in government is to ensure that agencies can easily and effectively acquire and use commercial capabilities to achieve mission outcomes ADI has written extensively1 on the need for the government to follow current law such as the Federal Acquisition Streamlining Act FASA 2 which establishes a “commercial first” framework Government must prioritize the acquisition of commercial off the shelf COTS solutions which require no customization are easier to embed across the agency’s IT enterprise are more secure and cost substantially less than bespoke agency-specific systems Agencies need 1 an acquisition and IT workforce with the skills required to effectively embrace the culture of innovation and utilize innovative technologies 2 incentives to overcome the current challenges they face with legacy IT and 3 an understanding of the modern technology market and business practices Critically agency leaders must be empowered to take decisive actions that drive digital transformation 1 2 See https alliance4digitalinnovation org blog policy lost-opportunities Pub L 103-355 5 Agencies that were already prioritizing telework and ensuring that their Federal and contractor workforces had relevant commercial software and data management capabilities were able to respond to the maximum remote work posture the government has adopted over the past several months And those agencies that had shifted most of their infrastructure and operations to cloud environments were able to leverage the cloud’s elasticity to better meet demands for new programs excess bandwidth for employee operations and a dramatic increase in citizen service requests The recent report by the Pandemic Response Accountability Committee PRAC highlighted IT and cybersecurity as two of the critical management challenges faced by agencies during their response to COVID-19 However the report also pinpointed several examples such as the Department of Health and Human Services the Nuclear Regulatory Commission and the Department of Defense who best dealt with the significant disruption of COVID-19 because they had already invested in cloud computing and enhanced their telework capabilities and digital workflows 3 Common traits among these agencies are a commitment to IT modernization from senior leadership a workforce able to effectively buy and deploy these new technologies and a culture that that shuns the old-line incumbent business model and embraces modern technology practices Aligning Agency Financial Incentives Third any enterprise-wide change especially the modernization of a large and complex agency system requires many years of sustained investment and the ability of agency leaders to make adjustments and address challenges that occur along the way Unfortunately the budgeting and appropriations processes rarely provide the necessary flexibility to drive true modernization Simply 3 Pandemic Response Accountability Committee report “TOP CHALLENGES FACING FEDERAL AGENCIES COVID-19 Emergency Relief and Response Efforts ” available at https www oversight gov report prac top-challenges-facing-federalagencies-covid-19-emergency-relief-and-response-efforts 6 put the current model restricts the ability of agencies to effectively invest in modern commercial capabilities incentivizes maintaining outdated and nearly obsolete systems and leads to wasteful failing projects that cripple agency mission delivery ADI itself and in conjunction with many other trade association partners have called for Congress and the Administration to work together and find common ground on agency IT funding 4 The expansion of IT Working Capital Funds IT WCFs as envisioned under the MGT Act or providing authorities that allow current agency working capital funds to more effectively invest in IT modernization would allow agencies to make smarter long-term spending decisions rather than remaining beholden to yearly appropriations cycles However a full embrace of WCFs would only address individual agency projects To ensure that the Federal government can make enterprise-wide investments in foundational technologies such as digital collaboration tools identity management capabilities and commercial shared services ADI recommends significantly more money be provided to the Technology Modernization Fund TMF Changing the TMF model from a demand-driven process whereby the TMF Board primarily vets individual agency projects to a supply-driven process where OMB and GSA analyze the Federal enterprise and identify key investment opportunities to scale new technology solutions across multiple agencies would also accelerate the impact of modernization throughout the Executive Branch With both a bottom-up and top-down ability to rethink government IT spending these new outcomes can save millions of dollars and help countless citizens 4 See https alliance4digitalinnovation org blog 2020 06 29 adi-joins-other-trade-associations-expressing-support-for-itmodernization-funding-to-improve-covid-19-pandemic-response-and-relief-efforts and https alliance4digitalinnovation org blog policy letter-to-senate-appropriations-on-the-technology-modernization-fund 7 The Necessary Role of Congress in IT Modernization Finally there are several options Congress may consider as you drive the Executive Branch to retire their legacy systems and leverage modern secure digital capabilities to achieve mission outcomes In particular Congress should revise antiquated statutes that are no longer aligned to modern business practices and update other statutes to provide the necessary authorities and incentives for agencies to buy and use commercial technologies For example Congress should overhaul outdated Federal IT laws such as Clinger-Cohen and the E-Government Act to provide a timely sustainable foundation for Federal IT modernization more aligned to the technology environment of today and tomorrow In addition Congress can build on the oversight successes provided by the FITARA Scorecard to update several current metrics and include new metrics such as cloud adoption FedRAMP authorizations and reuse and the acquisition of commercial items These changes would better incentivize agencies to operate as a modern enterprise As mentioned previously Congress must ensure that agencies have the level of flexible agile funding necessary to effectively plan for and finance multi-year modernization efforts This could include the expansion of agency IT Working Capital Funds the appropriation of multi-year money for agencies with detailed legacy modernization plans and increasing appropriations for the TMF Additionally Congress can continue encouraging agencies to prioritize training the Federal workforce on new technology offerings agile acquisition authorities cybersecurity capabilities and digital tools The goal would be to empower staff in all job series and at all grade levels to learn and use modern commercial capabilities and to continuously keep those skills up to date Modernization is impossible without a highly skilled capable workforce Most importantly Congress should continue to make IT modernization a critical issue that unites both parties both chambers of Congress and both the Legislative and Executive Branches 8 Conclusion In conclusion IT modernization is vital not only because it saves money and enhances cybersecurity – it is the primary means for agencies to competently and capably deliver important citizen services to the American people Modernization happens when several critical factors are involved – including a powerful commitment from agency senior leadership agile acquisition authorities sustained reliable funding thoughtful oversight from Congress and OMB and strong collaboration between agencies and innovative industry partners ADI appreciates this chance to share our insights on eliminating costly wasteful legacy IT and creating a more effective efficient 21st century digital government Chairman Connolly Ranking Member Hice and Members of the Subcommittee - thank you again for the opportunity to appear before you today I look forward to your questions 9