GAO Assesses Status of Mission-Critical IT System Acquisitions

Key Takeaways:
> GAO identified 16 of these IT acquisitions as particularly critical to missions ranging from national security to public health to the economy.
> As of February 2025, there were 75 open GAO IT- and cybersecurity-related recommendations pertaining to nine of the 16 acquisitions.

Overview
The Government Accountability Office (GAO) released a new report examining 16 mission-critical IT acquisition programs across 11 federal agencies. These programs, essential to various government functions, including national security, public health, and economic operations, are projected to cost taxpayers at least $51.7 billion. The GAO study focuses on identifying key attributes and risks associated with these high-priority systems as part of its ongoing monitoring of federal IT acquisitions, an area that has been on GAO’s High-Risk List since 2015.

The report, titled “Mission-Critical Information Technology: Agencies Are Monitoring Selected Acquisitions for Cybersecurity and Privacy Risks” (GAO-25-106908), comes at a time when federal agencies continue to struggle with IT implementation challenges. As of February 2025, there were 75 open GAO IT- and cybersecurity-related recommendations pertaining to nine of the 16 acquisitions reviewed.

Findings
The GAO identified several significant findings in its analysis:

• Substantial Financial Investment: The 16 mission-critical acquisitions are collectively expected to cost at least $51.7 billion. For perspective, the Department of Health and Human Services alone plans to spend approximately $6.2 billion over 10 years on its electronic health records modernization effort.
• Mission-Critical Dependence: Officials from 10 of the 16 acquisitions reported that failing to proceed with these IT initiatives would jeopardize their agency’s ability to meet mission needs, improve customer service, or achieve cost savings. This underscores the essential nature of these systems to government operations.
• Cybersecurity and Privacy Concerns: Perhaps most alarming, seven acquisitions identified high risks associated with cybersecurity and information privacy. These high-risk designations indicate that an adverse cybersecurity or privacy incident could have severe or catastrophic effects on the agency, other agencies, or the nation as a whole.
• Escalating Risks: The report notes that cybersecurity and privacy risks continue to escalate as agencies’ IT infrastructures age while threats and vulnerabilities become increasingly sophisticated and difficult to defend against.

Among the highlighted examples, both Department of Education acquisitions – aimed at modernizing systems for federal student aid – contain large repositories of personally identifiable information (PII), making them particularly vulnerable targets.

Recommendations
While this specific report does not contain new recommendations, the GAO notes that there are currently 75 recommendations for nine of the 16 acquisitions examined remain unimplemented. The report serves as a status update and risk assessment rather than providing new directives. However, it implicitly reinforces the urgency of addressing previously identified issues, particularly in the areas of cybersecurity and privacy protection.

GAO provided a draft of this report to the 11 agencies with IT acquisitions profiled and to the Office of Management and Budget. Eight agencies provided technical comments, which GAO incorporated as appropriate.

Why It Matters
This report matters for several critical reasons:

1. Financial Implications: With at least $51.7 billion in taxpayer money at stake, ensuring these acquisitions succeed is fiscally responsible governance.
2. National Security and Public Safety: Many of these systems directly impact national security, public health, and economic stability. For example, the Department of Defense’s Joint Warfighting Cloud Capability and the Department of Homeland Security’s Homeland Advanced Recognition Technology are crucial to security operations.
3. Personal Data Vulnerability: Several systems, like the Education Department’s student aid processing systems, contain vast amounts of personally identifiable information that could be devastating if compromised.
4. Government Effectiveness: These IT systems directly affect how efficiently the government can serve citizens, from processing student loans to managing veterans’ health records.
5. Growing Threat Landscape: As the report notes, cybersecurity and privacy risks continue to escalate as infrastructure ages and threats become more complex, making continuous monitoring and improvement essential.

The GAO’s continued focus on IT acquisitions highlights the persistent challenges federal agencies face in implementing large-scale technology projects. As government operations become increasingly dependent on digital systems, the success or failure of these acquisitions will have profound implications for government effectiveness, national security, and the protection of sensitive personal information.

To read the full report, click here.