Joint Oversight Hearing on the Recovery Act Project to Replace the Social Security Administration's National Computer Center

Good morning, Mr. Chairman, Madam Chairman, Mr. Johnson, Mr. Diaz-Balart, and members of both Subcommittees. As always, it's a pleasure to appear before you, and I thank you for the invitation to be here today. I've appeared before the Subcommittee on Social Security several times this year, on critical issues involving the Social Security Administration (SSA) and the services it provides to the American people. Most recently, I testified last month about SSA's backlog in initial disability claims, and our work on finding ways to better serve the public continues. Today, we are examining the status of SSA's efforts to replace the National Computer Center (NCC), SSA's national data processing and storage facility, which houses 450 million records of Americans' earnings, as well as current benefit data for almost 56 million beneficiaries.

The importance of the NCC to SSA's operations cannot be understated. The NCC is the repository for the applications and data that support all of SSA's functions, as well as other government functions that rely on SSA data. Ensuring the continued operation of the NCC is critical; were there an outage, the Agency would be unable to process tens of thousands of retirement, survivors, and disability claims, as well as Social Security number verifications. This type of service interruption would severely affect the American public, likely hindering people's ability to obtain employment, driver's licenses, and even loans and mortgages.

The NCC, located at SSA Headquarters in Woodlawn, Maryland, was constructed in 1979, and the building in which it is housed is nearing the end of its useful physical life. The chance of a potentially crippling outage at the NCC increases as time passes-one study completed by Lockheed Martin in 2008 estimated the NCC would reach maximum capacity in three to five years. Swift and efficient planning for the replacement of the NCC is necessary for SSA to continue to provide benefits without delay to those who need and are entitled to them.

With the need to replace the NCC so critical, the importance of doing so in a timely and efficient manner cannot be overstated. As such, the SSA's Office of the Inspector General (OIG) was pleased when Congress passed and the President signed the American Recovery and Reinvestment Act of 2009, which provided $500 million for SSA to begin the process of replacing the NCC. However, the OIG is well aware of the challenges and delays that SSA faced in creating its Durham Support Center (DSC) in North Carolina. While we support SSA in its efforts to determine the most cost-effective and efficient course with regard to the NCC, we would like to see the process carefully managed and organized to avoid potentially costly delays.

The DSC was initiated in response to Agency vulnerabilities first identified in a 2002 Lockheed Martin assessment of SSA's disaster recovery plan. The assessment concluded that no backup facility existed that could meet the Agency's data processing needs in the event of a disaster that rendered the NCC unavailable.

It wasn't until three years later, in 2005, that SSA's Office of Facilities Management worked with the General Services Administration (GSA) to acquire a second DataCenter. SSA identified several specifics for the center, including size and location requirements. SSA did not take possession of the DSC until January 2009; though it was initially referred to as the SecondDataCenter, the DSC is actually a co-processing center, as routine operations will be divided between it and the NCC.

Currently, the DSC is still at least two years away from being "fully functional," due to the time needed for efficiency testing and additional equipment and data connections. When we say "fully functional," we mean that SSA will be able to meet its disaster recovery objectives by restoring critical functions within 24 hours of a disaster with less than one hour of data loss. Before the DSC is completely online in 2012, SSA's backup and recovery strategy continues to rely on a vendor hot site, an alternate facility equipped with the technological capacity and personnel required to recover critical business functions or information systems.

The Agency encountered a number of delays during the acquisition and construction of the DSC. We determined it took six years, starting in December 2002, for the Agency to plan, construct, and occupy the co-processing center. The Agency spent the first 26 months analyzing disaster recovery solutions, then 14 months selecting a site, then 32 months obtaining permits and constructing the new DataCenter. In May 2006, the DSC lease was awarded with an anticipated completion date of August 2007. Delays in construction pushed the DSC occupancy date to January 2009.

Given the importance of the Agency's current efforts to build a new NCC, we believe SSA should learn from its experience with the DSC and take the necessary steps to ensure proper planning to mitigate project delays and cost increases. The DSC's reliability will also be critical during construction of the new DataCenter, should outages occur at any time during the building process. In our September 2009 report, Processing Capacity of the Social Security Administration's DurhamSupportCenter, we made several recommendations regarding the NCC planning process. Specifically, we stated that SSA should:

1. Accelerate the use of the DSC as a fully functioning Data Center-with particular emphasis on using the DSC as the disaster recovery site for the NCC.
2. Develop a comprehensive, long-range information technology (IT) strategic plan that (i) is transparent and integrated with other SSA components; (ii) includes possible constraints and challenges on all aspects of IT projects; and (iii) conforms to the Agency's strategic plan. This applies to the Agency-level and project-level strategic plans.
3. Formally document the Agency's plan to accelerate the use of the DSC as part of SSA's overall disaster recovery plan; and continually update the disaster recovery plan as the DSC and NCC replacement become fully functional. The updated disaster recovery plan should consider the ability of the DSC to maximize SSA's ability to continue operations in the current NCC, as well as during the transition to its replacement.

The process to replace the NCC began in earnest in 2007, when SSA commissioned the Lockheed Martin NCC Feasibility Study to identify infrastructure and processing capacity issues. Lockheed Martin completed the study in February 2008, identifying three viable options for replacing the NCC: constructing a new NCC on the SSA campus, constructing a new NCC apart from the SSA campus, or leasing an existing off-campus DataCenter.

Based on an examination of the pros and cons of each alternative based on the risk to continuity of operations, timeline, and cost, Lockheed Martin recommended that SSA pursue the construction of a new off-campus DataCenter. According to Lockheed Martin, it would cost about $162 million for the DataCenter's electrical, raised floor, fire protection, general construction, and land costs; the estimate did not include the building shell or IT costs. Lockheed Martin projected the same work would cost about $172 million for an on-campus DataCenter.

On Lockheed Martin's recommendation, we understand that SSA plans to move forward with a new off-campus DataCenter within 40 miles of SSA Headquarters to maximize data-sharing speed and to limit the commute for relocated NCC staff. But following the Lockheed Martin study, GSA conducted a follow-up study to obtain a more detailed square footage assessment and construction estimate for the project. GSA estimated that the cost of a new off-campus DataCenter would be about $396 million, including the building shell, but that estimate did not include IT costs.

Subsequently, SSA engaged Booz Allen Hamilton (BAH) to conduct an NCC alternatives analysis. In a February 2009 report, BAH estimated that total costs for construction and building maintenance would be $748 million for a new off-campus DataCenter, versus an estimate of more than $803 million for an on-campus DataCenter.

BAH also issued a study on the preferred distance of the new DataCenter from SSA Headquarters in April of this year. BAH recommended against locating the DataCenter in Woodlawn for the following reasons:

1. Significant risk issues with pre-construction activities, such as rezoning;
2. Possibility of service disruption and/or outages during refurbishing of NCC; and
3. Higher operations and maintenance costs than any other alternative.

Thus, it has been consistently suggested that the off-campus option is the more efficient approach. The OIG did not initially receive the documentation and information it requested to conduct an independent analysis of this issue. However, we did receive additional information last month, and retained a contractor to conduct an independent verification and validation of the previous SSA contractor reports to ensure accuracy, completeness, and adherence to industry best practices and standards. The contractor, Strategic e-Business Solutions (SeBS), concluded that SSA had developed "a highly sophisticated set of selection criteria with which to evaluate general areas of consideration and prospective individual properties."

However, SeBS also concluded that questions remain concerning the process the SSA site selection team has employed in creating a short list of site properties. The contractor added that because of still-limited documentation, it is difficult to determine how the team intends to compare and contrast the sites that pass the initial threshold and meet the mandatory minimum criteria.

Additionally, SeBS developed for SSA and GSA the following recommended actions:

1. Site selection should incorporate a more detailed evaluation of prospective energy costs of potential DataCenter locations.
2. Process-planning documentation is needed that defines the methodology the team intends to follow in narrowing site selection.
3. Local power utility providers should be involved early in selection process.
4. Telecommunications providers should be involved early in selection process.

Further, after reviewing the SeBS report, we went back to SeBS and requested that they examine the cost and efficiency differences between building a new DataCenter on the SSA campus versus away from the SSA campus.

Our contractor has reported back to us and, while the report remains in draft, they share several of our concerns with respect to the decision regarding whether to locate the NCC replacement off-campus. First, they are concerned that there appears to have been confusion in prior studies as to the purported six-year delay for zoning and related land issues if the NCC is built on the SSA campus. While there are possible land acquisition and community concerns connected to an on-campus decision, zoning is decidedly not an issue, and six years does not appear to be a realistic estimate for such delays. Second, SeBS shares our concern that more attention needs to be given to the actual cost comparison between the on-campus and off-campus options. Since an on-campus project would be a significantly different undertaking than an off-campus one, there is a sense that apples are perhaps being compared to oranges, and that these differing factors need to be considered more carefully before a decision is made as to whether a new DataCenter in Woodlawn is a viable option.

We have learned only very recently that SSA and GSA appear to be thinking along these same lines, and have taken steps to address these concerns. We look forward to receiving additional documentation created in this process and providing these subcommittees with our analysis.

We have continually identified the NCC construction process as a significant issue facing SSA. In a June Congressional Response Report, The Social Security Administration's Information Technology Strategic Planning, we said, "Despite the corrective actions planned or taken by the Agency at the NCC in response to the 2008 Lockheed Martin study and the repairs and upgrades over the past 15 years, we believe the Agency should have taken action much sooner regarding many of the issues at the NCC."

My office is dedicated to working with SSA to ensure that the site selection effort for a new DataCenter follows best practices and is built on sound planning and management. SSA's efforts to date are commendable, and we look forward to continuing to assist in this vitally important undertaking. I thank you again for the invitation to speak with you today, and I'd be happy to answer any questions.