By GAO found that none of 24 agencies fully met FITARA's annual IT portfolio review requirements. DHS could not show the CIO ran a review, and GSA never held one with the Federal CIO. Both recommendations sat open in GAO's July 2025 CIO letters.
In November 2024, GAO published IT Portfolio Management: OMB and Agencies Are Not Fully Addressing Selected Statutory Requirements (opens in a new tab) (GAO-25-107041). It checked 24 agencies against FITARA's portfolio review provision and found that none of the 24 fully met the requirements for annual IT portfolio reviews (opens in a new tab).
The statute is short. Under 40 U.S.C. 11319(d)(3) (opens in a new tab), the CIO of each covered agency, "in conjunction with the Chief Operating Officer or Deputy Secretary (or equivalent)" and the Administrator of the Office of Electronic Government, "shall conduct an annual review of the information technology portfolio." That administrator is the Federal CIO.
GAO scored each agency on four questions: was there an annual review, did the CIO conduct it, was the deputy in the room, and was the Federal CIO. DHS got a partial on the first and a no on the other three. GSA got a partial on the first, a yes on the CIO and its deputy, and a no on the Federal CIO.
GAO sent each department a recommendation to work with OMB so the annual reviews happen as FITARA prescribes. Both appear in GAO's July 2025 CIO letters to DHS (opens in a new tab) (GAO-25-108460) and GSA (opens in a new tab) (GAO-25-108537).
GAO's main explanation sits with OMB. The review FITARA describes is a joint one, and OMB stopped running it: according to GAO, OMB's IDC instructions state that PortfolioStat reviews were discontinued in 2017 and replaced with desk officer reviews. Fifteen agencies said OMB's lack of involvement was an issue.
That explains the Federal CIO column. No agency earned a yes there, and only eight could show the Federal CIO's office was involved at all.
The rest is documentation. GAO gave DHS its partial because the department did not provide adequate documentation that it reviewed the portfolio annually, and its documentation did not demonstrate that the portfolio was reviewed. GSA's partial rests on the first reason alone.
OMB's position leaves the gap in place. OMB did not agree or disagree with GAO's recommendations, and it maintains that it meets FITARA through ongoing exchanges between agency CIOs and desk officers from the Office of the Federal CIO. GSA deferred to OMB's response. DHS told GAO it planned a standard operating procedure to make sure an annual review with the necessary stakeholders takes place, estimated for completion by September 30, 2025.
A portfolio review is where an agency decides which systems keep their funding. FITARA's process exists to find ways to make IT investments more efficient, consolidate services, and identify potential duplication, waste, and cost savings. Those decisions drive what the next modernization or O&M task order looks like.
GAO spelled out the risk in its DHS letter. Until DHS acts, "investments with substantial cost, schedule, and performance problems may continue unabated without necessary corrective action." For GSA, the cost is missed chances to find duplication.
For a prime, that changes what the technical volume needs. An offeror that understands the requirement shows how its work produces per-system evidence the CIO can carry into a review: what each system costs to run, what it risks, and what should happen to it. An evaluator reading a DHS or GSA modernization proposal next to this finding will look for decisions, not just a delivery plan.
Recompetes add a second angle. An incumbent O&M contract that runs systems nobody has formally reviewed is exposed. A challenger that offers to score the portfolio during transition gives the CIO material for the next review cycle.
The method comes from Avalon's IT Modernization service, scoped to one bureau's unclassified portfolio. Avalon produces inputs to the review; the CIO, the deputy, and OMB hold the review itself.
GAO's own rating columns set the bar. A closed recommendation would show:
For DHS, all four are open items. For GSA, only the last one is.
Targets for the evidence underneath: every in-scope system with a recorded disposition and rationale, and every claimed saving traced to a system that was turned off.
GAO's July 2025 CIO letters list both recommendations as open: DHS recommendation 17 and GSA recommendation 36 from GAO-25-107041. DHS also carries three open recommendations from the same report on high-risk IT investment reviews. Neither department had a newer letter as of October 2026.
| Field | Detail |
|---|---|
| NAICS | 541512, 541611 |
| Avalon's sub role | Bureau-level legacy disposition assessment: scored inventory, keep, fix, replace or retire decisions with written rationale, authorization-impact notes, and decommission criteria that feed the CIO's annual portfolio review |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | The agencies buy this work through GSA MAS (SIN 54151S IT Professional Services), GSA Alliant 3, and GSA OASIS+ |
If DHS or GSA modernization work is in your capture plan, Avalon teams as the sub that gives the CIO a scored, documented disposition for every system in a bureau's portfolio, ready for the annual review FITARA requires.
