DHS HART: Nine GAO Recs, One Priority, All Open | Avalon

The Finding

On September 12, 2023, GAO published Biometric Identity System: DHS Needs to Address Significant Shortcomings in Program Management and Privacy (opens in a new tab) (GAO-23-105959). It reviewed HART, the Homeland Advanced Recognition Technology system that DHS's Office of Biometric Identity Management (OBIM) is building to replace its IDENT system.

Two findings drive the nine recommendations. HART's 2022 cost and schedule estimates did not fully follow GAO's best practices, so GAO called them unreliable. And DHS fully implemented 5 of 12 selected OMB privacy requirements for HART, with the other 7 only partially implemented.

Rec 2 is the priority: revise the schedule estimate using GAO's Schedule Assessment Guide (opens in a new tab) (GAO-16-89G). Rec 1 asks for an updated cost estimate that follows GAO's Cost Estimating and Assessment Guide (opens in a new tab) (GAO-20-195G). The other seven recs are about privacy, from a timeline for updating the privacy impact assessment to making sure partners dispose of PII on schedule.

Why It Keeps Happening

GAO tied the schedule to scope and engineering decisions. The 2022 rebaseline came after DHS pulled full performance testing into increment 1, hit trouble in key subsystems such as an overly complex database structure, and ran HART and IDENT in parallel longer than planned. In April 2023, officials told GAO a third rebaseline was needed after software defects, security vulnerabilities, and performance issues surfaced.

The dates show the drift. Initial operational capability moved from December 31, 2020 to September 30, 2023, and GAO listed the full-program date as not yet planned. Meanwhile DHS planned to spend $155 million in fiscal 2023 just to keep IDENT running.

On privacy, GAO found the Privacy Office had documented assessment methods for 8 of 63 privacy control sub-elements. Its compliance review of HART was two years overdue, paused because the Director of Oversight position sat vacant. The Privacy Office reviewed parts of the authorization package but not the security control assessment, which GAO said conflicts with OMB guidance. Of 18 information sharing agreements GAO examined, 6 held all seven required conditions.

Since then the baseline has moved again. GAO's June 2026 DHS annual assessment (opens in a new tab) (GAO-26-108118) shows a 2023 baseline, Increment 1 full operational capability now planned for September 2027 against an initial September 2021, and one cost breach and three schedule breaches declared.

Why It Matters to Your Bid

GAO has put a priority schedule rec and a privacy gap on the public record, and DHS evaluators can read both. On biometric identity, modernization, or O&M work at DHS, the questions can land in four places.

The technical volume needs a schedule that shows its dependencies: environments, accounts, test data, and the time an authorization reassessment takes. Cost volumes should price a legacy system running alongside its replacement, since GAO put a number on that for IDENT. Compliance volumes need a stated method for assessing privacy controls, not only security controls. The management volume should also show how the Privacy Office gets to see the whole authorization package, security control assessment included.

Open recs can follow the work. DHS gave GAO target dates in 2024, those dates have passed, and the recs are still listed open, so a recompete offeror may be asked how it would help meet them. A separate DHS item, the annual IT portfolio review, is covered in this portfolio review brief.

Technical Approach

The methods below come from Avalon's IT Modernization service and its FISMA, FedRAMP, and NIST 800-53 audit service. They describe how the work is done, at the methodology level. The agency owns its lifecycle cost estimate, its schedule, and every authorization decision.

Cut the remaining scope into increments. Assign each remaining capability and each IDENT function it replaces a disposition (retain, replatform, replace, retire), then sequence 8 to 12 week increments whose working-software exit criteria are fixed at increment start. The program's schedulers build the schedule against GAO's guide from that plan.
Register agency-furnished dependencies with dates. List accounts, change-board slots, representative test data, and the authorization reassessment cycle per increment, because access and decisions slip schedules more often than engineering does. Tie each date to an equitable-adjustment clause so delay attribution stays factual.
Price the overlap. Build a rough-order-of-magnitude cost model that carries the parallel run as its own line, capped in the SOW, and a decommission report that quantifies the recurring cost removed when the legacy system is turned off. These feed the lifecycle cost estimate; they don't replace it.
Assess the privacy controls in scope under SP 800-53A. SP 800-53 Rev 5 and 800-53A Rev 5 cover privacy as well as security controls. The Security Assessment Plan lists the privacy controls in the baseline, and each gets a written examine, interview, or test procedure with an evidence reference. The plan also sets a dated schedule for fieldwork.
Hand back findings the agency can track. The Security Assessment Report, a findings register, and a POA&M input file formatted for the agency's GRC platform carry a corrective action for each finding. An evidence index lists every artifact in the package, the SAR included, so the agency can route the whole package to the Privacy Office.

Avalon doesn't write the system security plan it assesses, execute remediation, or issue an ATO. Recs 3, 8, and 9 (the privacy impact assessment update, the sharing agreement inventory, and partner PII disposal) sit outside these methods.

What "Fixed" Looks Like

GAO hasn't published closure evidence for any of the nine recs, so these are targets drawn from the rec text and what DHS told GAO.

A lifecycle cost estimate with a crosswalk to GAO's cost practices, which DHS told GAO it would produce.
A schedule that GAO's ongoing work accepts as meeting its Schedule Assessment Guide.
Written assessment methods that cover all 63 privacy control sub-elements, and a dated plan for the overdue compliance review.
Corrective plans for the seven open PIA deficiencies, tracked to closure.
A Privacy Office review of the complete authorization package before each future authorization.

Status Check

All nine recs were open as of GAO's last update on its product page, which carries a March 2026 note on rec 2 that GAO has ongoing work. Other status notes date to 2024 and cite DHS target dates, such as March 2025 for rec 9, that have since passed. GAO's June 2026 annual assessment lists Increment 1 full operational capability for September 2027.

Teaming Fit

Field	Detail
NAICS	541512, 541519
Avalon's sub role	Increment plan, agency-dependency register, and rough-order-of-magnitude cost inputs for the prime's modernization task, plus an SP 800-53A assessment of the controls in the authorization boundary with a Security Assessment Report, findings register, and POA&M input file
Small-business status	Small business; HUBZone (in progress)
Likely vehicles	GSA MAS (SIN 54151S IT Professional Services); GSA MAS (SIN 54151HACS Highly Adaptive Cybersecurity Services); GSA Alliant 3

If DHS biometric identity or modernization work is in your capture plan, Avalon teams as the sub that turns schedule dependencies, parallel-run costs, and privacy control findings into inputs the program office can track.

DHS HART Biometric System: Nine GAO Recs, One Priority, All Open