“Improving Software Licensing Management”

1[House Hearing, 119 Congress]2[From the U.S. Government Publishing Office]34                      IMPROVING SOFTWARE LICENSING56                               MANAGEMENT78=======================================================================910                                HEARING1112                               before the1314                SUBCOMMITTEE ON TECHNOLOGY MODERNIZATION1516                                 of the1718                     COMMITTEE ON VETERANS' AFFAIRS1920                     U.S. HOUSE OF REPRESENTATIVES2122                    ONE HUNDRED NINETEENTH CONGRESS2324                             FIRST SESSION2526                               __________2728                          MONDAY, MAY 19, 20252930                               __________3132                           Serial No. 119-223334                               __________3536       Printed for the use of the Committee on Veterans' Affairs3738       [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]3940                    Available via http://govinfo.gov4142             U.S. GOVERNMENT PUBLISHING OFFICE4361-164                 WASHINGTON : 20254445                     COMMITTEE ON VETERANS' AFFAIRS4647                     MIKE BOST, Illinois, Chairman4849AUMUA AMATA COLEMAN RADEWAGEN,       MARK TAKANO, California, Ranking50    American Samoa, Vice-Chairwoman      Member51JACK BERGMAN, Michigan               JULIA BROWNLEY, California52NANCY MACE, South Carolina           CHRIS PAPPAS, New Hampshire53MARIANNETTE MILLER-MEEKS, Iowa       SHEILA CHERFILUS-MCCORMICK,54GREGORY F. MURPHY, North Carolina        Florida55DERRICK VAN ORDEN, Wisconsin         MORGAN MCGARVEY, Kentucky56MORGAN LUTTRELL, Texas               DELIA RAMIREZ, Illinois57JUAN CISCOMANI, Arizona              NIKKI BUDZINSKI, Illinois58KEITH SELF, Texas                    TIMOTHY M. KENNEDY, New York59JEN KIGGANS, Virginia                MAXINE DEXTER, Oregon60ABE HAMADEH, Arizona                 HERB CONAWAY, New Jersey61KIMBERLYN KING-HINDS, Northern       KELLY MORRISON, Minnesota62    Mariana Islands63TOM BARRETT, Michigan6465                       Jon Clark, Staff Director66                  Matt Reel, Democratic Staff Director6768                SUBCOMMITTEE ON TECHNOLOGY MODERNIZATION6970                    TOM BARRETT, Michigan, Chairman7172NANCY MACE, South Carolina           NIKKI BUDZINSKI, Illinois, Ranking73MORGAN LUTTRELL, Texas                   Member74                                     SHEILA CHERFILUS-MCCORMICK,75                                         Florida7677Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public78hearing records of the Committee on Veterans' Affairs are also79published in electronic form. The printed hearing record remains the80official version. Because electronic submissions are used to prepare81both printed and electronic versions of the hearing record, the process82of converting between various electronic formats may introduce83unintentional errors or omissions. Such occurrences are inherent in the84current publication process and should diminish as the process is85further refined.86                         C  O  N  T  E  N  T  S8788                              ----------8990                          MONDAY, MAY 19, 20259192                                                                   Page9394                           OPENING STATEMENTS9596The Honorable Tom Barrett, Chairman..............................     197The Honorable Nikki Budzinski, Ranking Member....................     39899                               WITNESSES100101Mr. Jeff VanBemmel, Executive Director of End User Operations,102  End User Services, Office of Information Technology (OIT), U.S.103  Department of Veterans Affairs.................................     4104105        Accompanied by:106107    Mr. Don Carter, Executive Director for Contract and108        Operations Management, Office of Information Technology109        (OIT), U.S. Department of Veterans Affairs110111Ms. Carol Harris, Director, Information Technology and112  Cybersecurity Issues, U.S. Government Accountability Office....     6113114                                APPENDIX115                    Prepared Statements Of Witnesses116117Mr. Jeff VanBemmel Prepared Statement............................    31118Ms. Carol Harris Prepared Statement..............................    33119120                IMPROVING SOFTWARE LICENSING MANAGEMENT121122                              ----------123124                          MONDAY, MAY 19, 2025125126  Subcommittee on Technology Modernization,127                    Committee on Veterans' Affairs,128                             U.S. House of Representatives,129                                                    Washington, DC.130    The subcommittee met, pursuant to notice, at 3:02 p.m., in131room 360, Cannon House Office Building, Hon. Tom Barrett132(chairman of the subcommittee) presiding.133    Present: Representatives Barrett, Luttrell, Budzinski, and134Cherfilus-McCormick.135136           OPENING STATEMENT OF TOM BARRETT, CHAIRMAN137138    Mr. Barrett. All right. Good afternoon, everyone, and thank139you all for being here today. The subcommittee will come to140order. We are here today to talk about software license141management, an issue that affects every veteran who expects the142U.S. Department of Veterans Affairs (VA) to function143efficiently, securely and transparently, while also keeping144costs in mind.145    The VA spends over $1 billion on software licenses every146year and the Department has never done a good job of managing147it all or knowing how many they have. Without good data the VA148has no way of knowing how much money they are wasting on149duplicative or unnecessary licenses.150    In some ways, software licenses are a lot like library151cards. Just like a library card allows you to check out a book152from a library, a software license gives you access to the153software product. Each library represents a different software154product, and VA purchases software licenses, or library cards,155for their employees to use that product. We would have used to156call these Blockbuster cards back in the day, but those are no157longer applicable.158    VA purchases hundreds of thousands of library cards for159thousands of different libraries every year. VA simply cannot160make smart decisions about how many software licenses they buy161if they do not have complete and accurate data. At the162fundamental level, VA needs to understand what licenses they163own, and whether they are being used.164    Government Accountability Office (GAO) published a report165last year with several alarming findings about the state of166software license management at the VA. VA could not explain167what they paid for specific software products that are bundled168into a single license agreement because the cost for each169individual product are not broken down.170    VA could not track whether the licenses they purchased for171their most widely used software licenses are actually being172used. They can track some of them, but not all.173    VA is not able to compare software license usage to174purchase records so they can have the information they need to175negotiate better deals and identify cost savings. This basic176information that any organization needs to make sure they are177buying the right licenses for the right number of people at a178fair price.179    I understand that VA has made some progress resolving these180issues, and I expect to hear more about that from our VA181witnesses during this hearing.182    GAO and other organizations have been calling out the183Federal Government's problems with software license management184for over a decade. As long as this problem is unresolved, there185will be waste and inefficiencies to be realized.186    Earlier this year, the Federal Chief Information Officer187(CIO) asked each agency to submit inventories of the software188licenses they purchased from the five largest software vendors189in the Federal Government. I reviewed the VA's response last190week. For tens of millions of dollars worth of licenses, VA191wrote that the license usage in quantities were unknown. It is192clear that VA still has a long way to go.193    VA was supposed to produce a full inventory of all software194licenses by the end of April, but we have not seen that yet.195    I recognize that this problem was not created in 1 day, and196will not be solved in a single day either. I believe that the197VA wants to get this right, and I am committed to working with198the new administration to finding a solution to do that.199    I applaud the Trump administration's effort to put a stop200to this wasteful spending on software licensing by reviewing VA201and other software--other agency's software inventories.202    President Trump's executive order consolidating aspects of203Information Technology (IT) procurement into the general204services administration is another step in the right direction.205Let me be clear, consolidation alone will not solve the206problem. Agencies must be responsible and accountable.207    The VA must maintain an accurate software inventory to keep208track of what licenses are being used. They must track license209usage in real time, analyze performance data and hold vendors210accountable. These are not lofty ideals. They are basic good211business practices.212    Today I want to focus on three things: First, what is213preventing VA from keeping and a full and accurate inventory of214their software licenses that has clear price breakdowns and215tracks the usage by user?216    Second, how has software mismanagement impacted broader217technology and modernization efforts at the VA?218    Last, what can Congress do to help make sure that the VA is219not wasting valuable resources on software licenses that could220be spent on veterans?221    At the end of the day, every unused or duplicative software222license that VA pays for is not just a line item, it is a waste223of taxpayer dollars and a missed opportunity. An upgrade that224never happened, a fix that got delayed, a veteran waiting225longer for the care they earned. Let us change that.226    I can tell you I know that this is not a unique issue alone227to the VA, but this is the committee that I have jurisdiction228over and want to work with my committee members to fixing, and229that is why we are here today working on the VA.230    With that I yield to Ranking Member Budzinski for her231opening statement.232233      OPENING STATEMENT OF NIKKI BUDZINSKI, RANKING MEMBER234235    Ms. Budzinski. Thank you very much, Mr. Chairman. Thank you236for holding today's hearing about software licensing concerns237at the Department of Veterans' Affairs. I do look forward to238working with you to address this issue and coming up with239appropriate and commonsense solutions for the employees of the240VA, and our Nation's veterans. We owe it to them, and we do owe241it to the American taxpayer.242    I also want to thank our witnesses for attending today's243hearing to discuss the future of how VA manages its catalog of244software licenses and how it will procure them in light of the245recent executive order that could centralize all Federal246acquisitions of IT services under the General Services247Administration, GSA.248    As I have said many times, pretty much everything VA does249have some relationship to a computer, whether it is documenting250in a medical record, reviewing a veteran's benefits' claim, or251tracking staff schedules. VA's catalog of software is an252essential tool for the provision--for the provision of253healthcare and benefits to our Nation's veterans.254    I am concerned about VA's inability to account for the255number of software licenses they currently have, how many are256in actual use, and how much money has been wasted by the lack257of this accountability.258    A January 2024 Government Accountability Office report259identified several issues with 24 Federal agencies, including260the VA, where they observed wasteful spending--wasteful261spending of taxpayer funds on software licenses and systems262that at a time were not needed.263    In the report, GAO made two recommendations to the VA. One,264VA should track all licenses in its portfolio that are265currently in use; two, VA should compare the number of licenses266in use with the number of licenses VA actually paid for to267identify waste.268    As I understand it, VA Office of Information Technology269(OIT) leadership has acknowledged GAO's recommendations, and is270working diligently to implement solutions by the end of Fiscal271Year 2025. I am happy to hear the VA is making progress, but I272am curious if VA has looked at the higher-order processes. It273is easy to treat inspector general and GAO report findings like274a punch list, but is VA looking at the processes that275contributed to this mess?276    Shadow IT is a struggle that many major organizations277contend with. What is VA doing to get a handle on it? Software278is only part of the solution, how is VA addressing the policy279and process issues that have allowed it to explode?280    Also, in many--in my short time on this committee, I have281heard many times that poor requirements development has282contributed to almost every IT modernization failure at VA. How283is VA refining that process to ensure that the software end284user receive meets their needs? We need to stop playing whack-285a-mole and start thinking strategically.286    Finally, I am concerned about a recent executive order from287President Trump that will consolidate the procurement of all288common goods and services, including IT products under GSA. The289intent is to reduce waste and improve efficiencies. I fully290support making sure that VA is more efficient, but we must be291sure that any changes to IT procurement do not create292downstream disasters.293    I think we can have a conversation about how this can be294done with software like Microsoft and Adobe, but I am concerned295that this executive order does not take into account the unique296mission VA provides to our veterans.297    Most of the software used at VA is not commercial off-the-298shelf, or COTS products, but unique to VA because--I am sorry--299unique to VA providing care and benefits to veterans. This300executive order would remove VA's oversight in the purchasing301of the software and increase the risk of wasteful spending on302software that does not meet the VA's needs. Not to mention that303the Trump administration shuttered GSA's tech unit and plans to304cut its budget in half. How are we supposed to trust that GSA305can handle taking on VA's IT purchasing?306    The focus should be on serving our veterans and empowering307VA to make its own software purchasing decisions while308accounting for the number of software licenses it currently309has, and if they are being used. The focus should be on VA310using GAO's recommendations to improve its accountability over311its software licenses, and future purchasing of software312licenses. We owe it to our veterans and to the VA employees to313get this right. Thank you, Mr. Chairman, and I yield back.314    Mr. Barrett. Thank you so much. I will now introduce our315witnesses. From VA's Office of Information Technology, Mr. Jeff316VanBemmel, Executive Director of End User Operations. Thank you317for being here, sir.318    Mr. Don Carter, Executive Director for Contract and319Operations Management. Thank you.320    A familiar face to this committee is Ms. Carol Harris,321Director of Information Technology and Cybersecurity at the322Government Accountability Office. Thank you for being here as323well.324    I will now ask the witnesses to please stand for your oath,325and we will swear you in. Please raise your hand, right hand.326    [Witnesses sworn.]327    Mr. Barrett. Thank you. Let the record reflect all328witnesses have answered in the affirmative.329    Mr. VanBemmel, you are now recognized for 5 minutes to330deliver your opening statement on behalf of VA.331332                  STATEMENT OF JEFF VANBEMMEL333334    Mr. VanBemmel. Chairman Barrett, Ranking Member Budzinski,335and distinguish members of the subcommittee, thank you for the336opportunity to testify regarding the software asset management337(SAM) program at VA. Your long-standing support of veterans and338their families is greatly appreciated.339    I am accompanied today by Mr. Don Carter. He is our340executive director for contract and operations management, the341Office of Information Technology, OIT.342    OIT recognizes that software is a critical component in343delivering the care and services our veterans deserve. This344recognition has led to substantial investments in both345commercial and VA developed software solutions.346    The increase in software solutions has required VA to347constantly review and update its management policies and348practices, especially in areas such as decentralized349procurement and license oversight.350    In this vein, OIT has launched a strategic initiative to351address the recommendations documented in GAO's report,352``Federal Software Licenses: Agencies Need to Take Action to353Achieve Additional Savings.''354    OIT software asset management program mitigates risks, such355as decentralized software procurement, lack of product356ownership, loose license and data management. OIT will identify357existing capability gaps in software and asset visibility,358especially establishing a single source of truth for all359software data usage data and developing and implementing new360SAM policies and formal governance procedures.361    The SAM program is building a centralized software362repository to streamline software management and stakeholder363communication. OIT is also working to automate tasks within the364SAM lifecycle framework, where feasible, and leveraging365existing tools and systems for efficient implementation,366integration and reporting.367    This comprehensive approach allows VA to effectively plan368for future software needs, manage updates and ensure proper369disposal of outdated or unused software. OIT's recent progress370in the deployment management and retirement phases of software371asset lifecycle has realized significant software license cost372avoidance across its top 15 most widely used titles.373    OIT recognizes that software procured or deployed outside374of approved channels poses security, compliance and financial375risks. VA is working to mitigate those risks by establishing376this program, by providing training and facilitating a culture377of change, through continuous improvement and metrics, and by378rigorously applying policies on procurement and oversight. We379are strengthening governance mechanisms, improving software380visibility, and working with VA business owners to rationalize381requirements and minimize unauthorized software acquisitions.382    OIT is issuing guidance for all related--relevant staff,383focusing on requirements definition, acquisition planning,384software lifecycle management, and the risks associated with385unauthorized software procurement. Training staff on SAM386processes and policy compliance is a crucial aspect of the387program. By educating staff early in the acquisition process,388we aim to foster a culture of accountability and proactive389software management.390    VA is committed to refining our policies and practices to391ensure the most efficient use of resources and the best392possible outcomes for our veterans.393    VA's way forward includes improvements to VA directive3946008, which governs all IT acquisitions and enforces the chief395information officer oversight for software purchases ensuring396compliance with Federal laws. These procurements also go397through the Federal Information Technology Acquisition Reform398Act, FITARA, review processes.399    VA is also working on new guidance for product service400codes used in procurement and medical devices that have a401software component that are connected to the VA network, or402standalone medical devices that store persistent patient403information. These updates close many previous gaps that404allowed licenses to be purchased without centralized review.405    OIT is also establishing ways to measure the effectiveness406of the SAM program, including capturing our cost savings,407assessing compliance rates, utilization efficiency, and408resolving audit findings.409    OIT is committed to continuing our progress, strengthening410our governance, and fully optimizing our software portfolio,411but effective software management is not just the412responsibility of a single office, rather a collective effort413across VA's entire enterprise.414    Through OIT's ongoing efforts in the SAM program, VA aims415to ensure that every dollar spent on technology supports the416critical mission of serving America's veterans with excellence.417    Thank you for your continued support, and for the418opportunity to testify here today.419420    [The Prepared Statement Of Jeff VanBemmel Appears In The421Appendix]422423    Mr. Barrett. Very good. Thank you, sir. Mr. Carter, do you424have testimony, or were you guys joined together?425    Mr. Carter. We are joined together.426    Mr. Barrett. Okay. Very good. Ms. Harris, you are now427recognized for 5 minutes.428429                   STATEMENT OF CAROL HARRIS430431    Ms. Harris. Thank you. Chairman Barrett, Ranking Member432Budzinski, and members of the subcommittee, thank you for433inviting us to testify today on VA's software license434management.435    As requested, I will briefly summarize our prior work on436the Department's effort to track software license usage and437manage restrictive licensing practices.438    As you know, the use of IT is crucial to helping VA439effectively serve our Nation's veterans. The investment in IT440is substantial. In Fiscal Year 2025, VA plans to spend roughly441$985 million on software, including commercial software442licenses. I appreciate this subcommittee's attention on this443topic, because software licenses has been problematic across444the Federal Government for a long time, and especially at VA.445With more effective management, the potential for cost savings446could be huge.447    This afternoon I will highlight two key points. The first448is that VA lacks the ability to know if it is purchasing too449many or too few licenses. Last January we reported that VA did450not track software licenses currently in use, nor did it451regularly compare the inventories of those licenses to purchase452records. These are key activities needed to effectively manage453software licenses.454    While the Department was able to report to us its 5 most455widely used software vendors at that time, officials could not456demonstrate that they were tracking the appropriate number of457licenses for each item of software currently in use.458    In contrast, vendors perform these activities all the time459to ensure that customers are adhering to contract terms, and460can apply true-up penalties when customer use exceeds those461stated terms. Without data of its own, VA cannot verify whether462the vendor's information is accurate.463    Moreover, VA will continue to miss opportunities to reduce464costs on duplicate or unnecessary licenses. As such, we made465two recommendations to VA to fully address these key management466activities.467    In response to our recommendations, the VA has told us it468has implemented new procedures for its most widely used469software licenses, and will implement a centralized approach to470ensure software is tracked throughout the entire lifecycle. The471Department fully expects to address our recommendations by the472end of the year. We will continue to monitor VA's actions to do473so.474    My second point relates to work we did this past November475on restrictive software licensing practices which adversely476impacts agency's cloud-computing efforts, including those at477VA.478    According to VA officials, some of the restrictive479practices that they have encountered, including a vendor480requiring the agency to pay additional fees to use the vendor's481software on infrastructure from third-party clouds, making the482agency repurchase the existing software licenses being used on483its on-premise systems for use in the cloud, and also requiring484or promoting vendor lock-ins, such as not allowing another485vendor's software to be used with its own hardware.486    VA officials reported that the restrictive licensing487practices generally impacted the cost of cloud computing and488the choice of cloud service provider. However, the Department489had not established guidance for effectively managing the490impacts from these restrictive licensing practices.491    Further, VA had not assigned responsibility for managing492such practices.493    Accordingly, we made two recommendations to VA to address494these gaps. VA has concurred and stated it will provide actions495it plans to take to address both of these recommendations.496    Moving forward in the two areas I noted, it will be497critical for VA to fully implement our recommendations as soon498as possible. Doing so will present the VA with opportunities to499reduce costs on duplicate or unnecessary licenses, and also500take action to mitigate the impact of restrictive licensing501practices.502    As I mentioned earlier, the cost savings potential is503tremendous. The Department had previously reported it had saved504about $65 million over 3 years due to analyzing just one of its505software licenses. You can imagine the possibilities when you506apply that across the entire inventory of licenses.507    That concludes my statement, and I look forward to508addressing your questions.509510    [The Prepared Statement Of Carol Harris Appears In The511Appendix]512513    Mr. Barrett. Thank you. The written statement of both Ms.514Harris and Mr. VanBemmel will both be entered into the record,515so thank you.516    We will now proceed to questioning, and I am going to517recognize myself first for 5 minutes for questions.518    Ms. Harris, when you were saying that in your testimony,519vendors know very carefully if any contract that they are520under, if there is a level of usage in excess of the terms of521the contract, if they buy 10,000 licenses and 10,001 people try522and use it, they are going to know that and they are going to523charge the agency for that additional usage, it sounds like,524based upon your testimony today?525    Ms. Harris. That is right. It is called a true-up penalty.526    Mr. Barrett. Okay. It is not also the case that we are527being noticed if we bought 10,000 licenses and only 6,000 are528being used over the last, you know, 6 months to a year, some529period of time that we can get a pretty good indication whether530or not it was ever going to get used.531    Ms. Harris. Well, given that vendors do track the usage,532they most likely do know if the licenses are being533underutilized, but most likely they are not going to present534that information to the government.535    Mr. Barrett. Do we know if any of the terms that the536contract has would require that notice to be given back to--537specifically to the VA, or any other Federal agency that you538may have come across?539    Ms. Harris. We have not seen those terms stated in the VA540contracts during the course of our audit.541    Mr. Barrett. Okay. Is there a best practice that would call542for that type of awareness with a vendor contract, if you go543out and buy a number of licenses, to know how many are being544utilized?545    Ms. Harris. I would consider that to be a leading practice,546to have that included in the contract, but it is also important547for the government to do its own tracking of usage----548    Mr. Barrett. Sure.549    Ms. Harris [continuing]. because we need to be able to550verify that the vendor information is accurate.551    Mr. Barrett. Okay. Thank you. Then Mr. VanBemmel, you said552that this--back at the end of--or sometime in 2024, the SAM553office, right, remind me again what that stands for, the . . .554    Mr. VanBemmel. Software Asset Management program.555    Mr. Barrett. Okay. That is sort of designed to be an office556that really takes this into account; is that correct?557    Mr. VanBemmel. Yes, sir, that is correct.558    Mr. Barrett. If that is the case, I know we have got still559some lingering findings from Ms. Harris' review of this, can560you give us an update on the progress that is been made in that561effort to kind of true up what needs we have versus what we are562actually using?563    Mr. VanBemmel. Yes. On the two recommendations, we are564close to getting ready to close out with GAO formally the565tracking of the top 15 titles. That was one of their first566recommendations. We are now able to do that and reliably take567that inventory against our acquisition records and do true-ups568in real-time, as she indicated.569    The second one is a much larger recommendation. Getting570beyond the 15 titles you start--you know, we have very good571visibility on more than 80 percent of that. We can see almost572all of the software today, and we have made some investments in573visibility on the endpoints. We can actually not just see the574licenses assigned to this user, but we can actually tell if575that user is using that license, and that is a piece of576software that we did not have even a year ago.577    That improved visibility is really getting that visibility,578and then tying that together with the acquisition data is the579work that we still have together with us for all of those580larger----581    Mr. Barrett. To me, it is less about who is being granted582the license and more about whether or not they are using it.583There may be a portfolio of things as a basic package that an584employee may get, but if they do not need one of those585licenses, that is where I think the rub comes from is where do586you split out, yes, they need this, this, and this, but do they587need this enhancement of other products available?588    The other question I had for you is if I work at a local VA589hospital, say, perhaps in Michigan, not far from where I live590even, just to use an example, what--if I were working there and591I thought, Hey, I need this additional software program, what592is the process that is used by the VA to determine if that is593already under contract, and if I can just add onto that594contract, or are we duplicating efforts where the VA facility595close to my home is buying the exact same product that a VA596facility 500 miles away is purchasing and we have not bundled597that into a more efficient purchasing agreement?598    Mr. VanBemmel. That is right. That is one of the, I think,599longer term challenges that we are facing with the SAM program,600getting visibility on what is in use today and being able to601track license usage in real time and reconciling that so we are602not overbuying, underbuying, and that people are really using603the software that they have asked for.604    The second one is being able to rationalize requirements605with our business stakeholders. The hospital, for example,606has----607    Mr. Barrett. You said rationalize----608    Mr. VanBemmel. Requirements. When somebody asks for a609product, we often look at that as a requirement. In a software610category, we might have already purchased software that611fulfills that same requirement, and they could use one of the612existing softwares available in the catalog today, or it might613have--it might be part of a new requirement.614    Having a discussion with the stakeholders on the business615side and asking them about the requirements and making sure616that we buy smartly, and then to your point, this is a617submission from Michigan, how pervasive is this across the618entire enterprise? How common is this practice? Making sure619that we buy once and we do an enterprise approach to a620solution.621    I think that is really where the challenge is for this622program stem from, is the historical legacy of the way VA was623organized. That hospital in Michigan, for example, 5 or 10624years ago was an independent operating unit within the625Department of VA, and they made their own local procurement626decisions on software like that if it was related to the care627of veterans. Now we are trying to get a business side to look628at an enterprise approach as IT has been centralized over the629last 5 or 6 years, and taking those independent titles that are630out there--we have--a lot of our software catalog titles are631comprised of those individual titles and rationalizing them632down into a subset of softwares.633    Mr. Barrett. Okay. Thank you. Ranking Member Budzinski for6345 minutes.635    Ms. Budzinski. Thank you, Mr. Chairman. Mr. VanBemmel, the636VA's Software Access Management policy, VA Directive 6403,637outlines the roles and responsibilities of VA leadership, OIT638leadership, IT acquisition professionals and service legal639agreements, SLA, concerning VA OIT operations, this policy was640initially issued back in July 2015. Has the policy been updated641since then?642    Mr. VanBemmel. We are staffing changes that we are--we have643really learned a lot over the last year. This GAO report, as644you mentioned, in January 2024 prioritized software asset645management for the OIT. We put a lot of effort into it, and we646are learning a lot of things. We think that policy, along with6476008, and some of our other policies, and the processes that648stem from policy, need some updating.649    Ms. Budzinski. It is not updated yet, but it sounds like650you are working----651    Mr. VanBemmel. That is part of the overall plan of652establishing this program, updating that document, as well as653others.654    Ms. Budzinski. Okay. Great. Then maybe just to follow up a655little bit on what you were just discussing about kind of the656tracking system for the current user licenses. So what, I think657from what I understood, you are saying that currently it is658kind of tracked at the local level, but that you are trying to659move it more toward the enterprise where the enterprise is660tracking it, moving it out of the local kind of jurisdiction;661is that accurate?662    Mr. VanBemmel. Yes, for the most part, I would say that we663have good visibility now across the entire enterprise. The real664challenge is putting all of that into a central repository and665tying it to acquisition data so that we do not have to do a666manual reconciliation across different systems.667    Ms. Budzinski. That was going to lead to my next question.668What offices within the VA are going to be responsible, if they669are not already fully responsible for the enterprise, you know,670view of this work, what offices will be or are in charge of671understanding and storing the list of user licenses currently?672    Mr. VanBemmel. End user operations is the lead for this673effort, but we are doing it in partnership with several674different groups within OIT. Don's office, Office of Strategic675Sourcing which does a lot of the acquisition work is another676partner in that. Then we have a team that does a lot of the677cloud software development, platform management, those types of678product offerings. Software as a Service (SaaS) is largely in679their footprint. That is why we have these different680repositories because different groups had different681responsibilities. We are going to pull all of that into a682central system. My organization will be the lead for that683aggregation of data, and then pulling all of that together as a684corporate process.685    Ms. Budzinski. Am I understanding this correctly, there are686like 3 entities within the VA----687    Mr. VanBemmel. Largely, yes.688    Ms. Budzinski. Then eventually that is all going to be689consolidated into your kind of purview?690    Mr. VanBemmel. Right.691    Ms. Budzinski. Okay. Who has currently access to all of692this different--these different sets of information?693    Mr. VanBemmel. Can you clarify what you mean? Like people694in OI&T or----695    Ms. Budzinski. Well, the people in OIT, who in the VA,696outside of the VA, might have access to this type of data?697    Mr. VanBemmel. Okay. All of these repositories are internal698use really for the IT staff.699    Ms. Budzinski. Okay.700    Mr. VanBemmel. Our intention when we get into the central701repository is to be able to expose the software catalog to our702population of supported users. To your point about the user in703Michigan, when they have a software request they can look it up704and say, Hey, have we already bought this thing, and they could705see, oh, we do have this, we have 10 licenses we purchased, we706have five available.707    That is the overarching intent is that it is internal for708VA use. Right now, that data is really just the IT operators,709but we would like to be able to share that in a request-type710way with our end users.711    Ms. Budzinski. Am I understanding this correctly, using the712Michigan example, currently they kind of make that decision713locally, but eventually what is going to happen is they are714going to go to the VA, to your office specifically and kind of715inquire whether there is a license or a contract already--716    Mr. VanBemmel. Yes.717    Ms. Budzinski. They do not duplicate, basically, a contract718or recreate a license that exists.719    Mr. VanBemmel. That is correct.720    Ms. Budzinski. Thank you. Ms. Harris, my question, your721recent reports identified the need for clear roles and722responsibilities for effective software license management.723What steps has the VA taken to create, kind of speaking, I724think, a little bit to these earlier questions, better725ownership around these processes, what does the VA still need726to accomplish in this space from GAO's perspective?727    Ms. Harris. We are still waiting for information from the728VA in terms of what steps they are going to take to implement729our recommendations.730    You know, to Mr. VanBemmel's point, you know, I think he731did a really good job of laying down the groundwork for the732culture at VA of the decentralization of the software licenses,733and so now this movement to centralize is a very positive step734that is essential to effective license management. Then having,735you know, a single point of accountability is also something736that is going to be important. It sounds like it is going to be737funneled through his office, the buck will stop with him.738    It sounds like all the key, you know, the key things that739they are doing all sounds good. We are going to, you know, have740more dialog with VA and verify those activities, and then come741back to you with what we think.742    Ms. Budzinski. It looks like. Okay. Thank you. I will yield743back.744    Mr. Barrett. Thank you. Mr. Luttrell, 5 minutes.745    Mr. Luttrell. Thank you. Just for absolute clarification746for myself, Mr. VanBemmel, off the chair and the ranking747member, so I have DeBakey in my district, or in my area, excuse748me, Michigan, each of the 170-plus VA facilities will now have749to come directly to your office to get a software update,750upgrade or enhancement for their facility instead of going to751Microsoft or Oracle or Adobe or ServiceNow or Splunk, is that a752fair statement?753    Mr. VanBemmel. All of those procurements already come754through OI&T. The difference is that we are going to start755having a requirements discussion instead of, you know, we756talked about this one software for this one local hospital, we757will be looking at that as an enterprise approach. All of--in758terms of the large titles, the Microsofts, the Oracles, all of759those kinds of things, those are already under enterprise760license agreements. We already have a process in place by which761they request those licenses. We manage all of that software762inventory for them.763    Mr. Luttrell. When that request comes into your office, how764many people are responsible for making the decision for765DeBakey? Is it one person? Is there like a representative766inside your office that is speaking directly to me and--767proverbial me, and saying, Hey, you have got the green light on768this?769    Mr. VanBemmel. This is the part, when we talked about770governances processes and updating policies, establishing a771correct mix of stakeholders that can do those software reviews772and make those decisions--it will not be me all by myself. We773want to have representation from the business. We--you know,774this is relatively new construct in VA. Oftentimes we took, you775know, the Veterans Affairs Medical Center (VAMC) director's776request and we fulfilled that request if we had the software777dollars available. If we did not have the software dollars778available we worked on, you know, the tradeoffs there.779    In the future, what we really want to do is have a780collective conversation, and so, that also means that on the781stakeholders side of the house, for Veterans Health782Administration (VHA), Veterans Benefits Administration (VBA),783those sorts of entities, that they have representation on these784titles.785    The first thing we want to be able to do in this central786repository is expose the total--the totality of licenses in use787today.788    Mr. Luttrell. Is this something--forgive me. I need to789interject.790    Mr. VanBummel. Yes.791    Mr. Luttrell. Is this something that we are going to have792to purchase more software to do? If you are going to have to793build out an internal VA enclave infrastructure or something to794process what we are asking, will it be more money that we are795going to have to spend, or does something like this currently796exists?797    Mr. VanBemmel. Currently exists.798    Mr. Luttrell. Then how are we in this problem?799    Mr. VanBummel. How did we get into this problem?800    Mr. Luttrell. How are we here? If this already exists, how801are we here? I mean, we are $33 million on Oracle,802    $438--annually, $438 million for Microsoft every year.803    Mr. VanBemmel. Yes.804    Mr. Luttrell. $12 million on Adobe. Splunk, I have never805even heard of that, but it apparently search and makes806excessive large amounts of data, obviously it is not doing a807very good job, I mean, what are we missing here? If it already808exists currently inside the VA and we have this problem--how809long have you been in this position?810    Mr. VanBemmel. Two and a half years. The investment that I811am talking about was made very recently. In the last year, we812made two major investments that are improving our visibility.813One is a piece of software that gives us visibility across all814600,000 end points for VA, so I can see real-time usage of the815software. That is a different----816    Mr. Luttrell. Who is doing that?817    Mr. VanBummel. We have already done that.818    Mr. Luttrell. No, no, no. What is the name of the----819    Mr. VanBemmel. The vendor?820    Mr. Luttrell. Yes.821    Mr. VanBummel. The project is called Tachyon, it is from a822company called 1E.823    Mr. Luttrell. How much did that cost us?824    Mr. VanBemmel. It is about $12 million for the entire825fleet.826    Mr. Luttrell. We need to add that on to this list?827    Mr. VanBemmel. It was already paid for last year.828    Now, the other piece that we bought is a repository829software asset management module that goes on to our existing830IT Enterprise Resource Planning (ERP) that we use for all of831our incident and problem management. This is a place where we832are--we also have a module for hardware asset management, we833will now have a software asset management, again, it is a place834to store inventory. It is a place to----835    Mr. Luttrell. Is this in every single VA or specifically in836the VA department?837    Mr. VanBemmel. No. It is managed at the OIT centrally. All838those endpoints now will report back to the central repository839and be able to do reconciliations against that repository.840    Mr. Luttrell. I still do not understand why if that is the841case--then why cannot our hospitals talk to each other? I am--842--843    Mr. VanBemmel. I am not sure I understand.844    Mr. Luttrell. I know you are not--I am just kind of845throwing that out there. It seems that with the large amount of846money that we are spending on all these different software847profiles, you would think like one could do it alone. I am848assuming that is just not the case?849    Mr. VanBemmel. No, sir.850    Mr. Luttrell. I yield back, Mr. Chairman. Thank you, Mr.851VanBemmel.852    Mr. Barrett. Thank you. Mrs. Cherfilus-McCormick for 5853minutes.854    Ms. Cherfilus-McCormick. Thank you so much, I think both855sides will agree that there is a lot of money being wasted856based on the mismanagement of the software, and I do have some857concerns on how we are going through and streamlining the858process, so please indulge me as we go through these questions.859    Ms. Harris, how much money is wasted because VA does not860aggressively manage its licenses?861    Ms. Harris. We do not know that figure because VA does not862have the information available in terms of what they are863tracking because they are just unable to track the full864inventory at this time.865    Ms. Cherfilus-McCormick. Now, Mr. VanBemmel, who is the866executive in charge of the software assets management?867    Mr. VanBemmel. That is me.868    Ms. Cherfilus-McCormick. You are responsible for it?869    Mr. VanBemmel. Yes.870    Ms. Cherfilus-McCormick. Okay. This is a $7 billion a year871management system, correct?872    Mr. VanBemmel. No. Are you talking about the service873asset--the software asset management module in our ERP?874    Ms. Cherfilus-McCormick. Yes.875    Mr. VanBummel. Service now?876    Ms. Cherfilus-McCormick. Yes.877    Mr. VanBummel. No.878    Ms. Cherfilus-McCormick. How much is it?879    Mr. VanBemmel. I would have to take that back for the880record. I do not know, to be honest with you.881    Ms. Cherfilus-McCormick. How much would it cost to catalog882and maintain the catalog of all VA assets to include staff and883other costs?884    Mr. VanBemmel. How much would it cost to maintain this885entire program?886    Ms. Cherfilus-McCormick. Uh-huh.887    Mr. VanBemmel. Let me take that back for the record. It is888probably an evolving picture.889    Ms. Cherfilus-McCormick. Are you engaging in any use of890Artificial Intelligence (AI) to help manage?891    Mr. VanBemmel. Yes.892    Ms. Cherfilus-McCormick. How many are you actually using at893this current moment?894    Mr. VanBemmel. Again, let me take that back for the record.895There are a potential for AI involved in this process.896    Ms. Cherfilus-McCormick. Now, how long have you been using897any of these AIs?898    Mr. VanBemmel. In terms of the software asset management899system, that is a relatively new investment, and we have not900finished the work on fully fielding that. It will not be done901until the end of this year. Our intention is to be able to get902real-time feeds from the field, and then reconcile that data903against other data feeds. We do see an opportunity on the904platform to introduce AI to help with that work, but we have905not today integrated AI because we have not fully deployed the906system.907    Ms. Cherfilus-McCormick. Have you found any promising908information showing that it is actually going to identify any909costs, or help you with cost management?910    Mr. VanBemmel. Yes. We have already made--we have already911had some significant cost avoidance just in the top 15 titles.912To date, I think the number is somewhere about $136 million913that we have had in terms of getting better visibility.914    Ms. Cherfilus-McCormick. Have they done a good job in915identifying any redundancy or idle contracts in licensing?916    Mr. VanBemmel. I think the bigger issue that we have in917terms of redundancy is not duplicative software, but in a918software category, we have 4 or 5 titles that do the same types919of things just in a different way. Then the question would be,920what is the best value for VA in terms of reducing those four921or five titles to, say, one or two different options.922    Ms. Cherfilus-McCormick. Well, my question----923    Mr. VanBemmel. That is the work that we have ahead of us,924even after we get the asset management system in place, that is925a long term effort to try to go through all of those titles926today.927    Ms. Cherfilus-McCormick. My concern, and the reason I am928asking these questions is because I am wondering if we would be929better suited by having an actual executive, like people in930place to go through, or is AI a better way for us to actually931find these and identify these redundancies, especially since we932are limiting how much money you are going to have access to,933and the impact of those cuts into making sure that we can934identify.935    That is why I was asking to see what is actually promising,936or should the funding actually be put toward having individuals937there to actually map out how we can actually find those costs,938and have you found any AI programs that actually are working.939    To that extent, could you also provide us at a later time a940full list of all the AIs you have been using so we can actually941be watching that to see what is working and what is not?942    Mr. VanBemmel. Yes. Let me clarify, we are not in full943operation today, so we are not currently. We do have our eye on944some opportunities in this space.945    AI will help us with the aggregation of large datasets and946help us understand what is in use and what are the most likely947choices. Ultimately, conversations with the business, people948conversation, and then actually doing the work to migrate to do949an acquisition for, say, one to two titles versus the four or950five that we have in that product category, and then migrating951people from one set of softwares to those one and two titles952instead of the three or four that they may have. That is a953people-led issue. I would say that the investment in at least954the near term is going to be a people-led issue.955    Ms. Cherfilus-McCormick. If you do not have that investment956with people-led issues, how do you think the whole process and957really bringing down the cost that we are seeing, do you think958that is going to be successful, or will we have another year959where we are fighting the same problem?960    Mr. VanBummel. I also think that there is a lot of961opportunity here for us to do more with less. When you start to962get the information coming back from all of the endpoints and963you put it into a great repository there--right now that964process is very manual. We have to do manual reconciliations on965some of these products, and so that is much more labor966intensive. I think the automation piece and the ability, then,967to see data in one place is going to really reduce the overall968manpower requirements.969    Ms. Cherfilus-McCormick. Thank you so much. I yield back.970    Mr. Barrett. Thank you. I appreciate it. I will recognize971myself again for 5 more minutes.972    We have, Mr. VanBemmel, we have 170 independent VA hospital973facilities; is that correct?974    Mr. VanBemmel. I manage it by areas, and there are 137975areas, and within that we have a couple of hospitals--there are976a few areas that have more than one hospital in it, but yes, it977is 137 areas.978    Mr. Barrett. Well over a hundred.979    Mr. VanBemmel. Yes.980    Mr. Barrett. You know, more than 150 even.981    Mr. VanBemmel. Correct.982    Mr. Barrett. Prior to this establishment of the office that983you described, they were all kind of independent autonomous984agencies within VA, almost as if they were their own department985to a degree, more or less, purchasing their own software and986all of those things on their own. Through the formation of your987office, that IT purchasing should be consolidated through your988efforts; is that correct?989    Mr. VanBemmel. That is correct.990    Mr. Barrett. We are not quite a year and a half into this991now?992    Mr. VanBemmel. Well, so centralization in IT has been993ongoing for more than 6 or 7 years. We wrote VA Directive 6008994to help clarify what they could spend their non-IT acquisition995appropriations on, and what we would spend the IT appropriation996on. That regulation is evolving as we move forward. Yes,997essentially, you know, in the past, they were all operating as998independent units, and now we are managing IT centrally, and999software is one of those.1000    Mr. Barrett. Yes. I see a little parallel to a degree1001between this electronic health record rollout that we have been1002dealing with on this committee, as well as some of this other1003stuff where we had independent systems, and to Mr. Luttrel's1004point, they could not even then send files directly to one1005another because they had evolved separately over time, and then1006you have IT systems that are procured in different ways, and1007you may not know if the agency across town or across the State1008or across the country is purchasing that same IT equipment.1009There is not currently a catalog that you could go to to see if1010another agency is already purchasing software through this1011particular vendor that you could then add on to. Is that1012correct?1013    Mr. VanBemmel. That is correct. From the end user1014perspective, there is not.1015    Mr. Barrett. Then do you manage the contracts themselves,1016or just the purchasing of them?1017    Mr. VanBemmel. Just the purchasing of them.1018    Mr. Barrett. The license?1019    Mr. VanBemmel. Yep. Don's team does a lot of the1020acquisition work. We have another team that does the software--1021the software has a service, this cloud-based software.1022    Mr. Barrett. Mr. Carter, then, perhaps this question is1023best to you, is there anything that is standard boilerplate in1024our contracts as we are going out for large scale acquisition,1025not a 1s and 2s kind of acquisition of very, you know,1026something irregular, but a large portfolio that would require1027feedback to the VA as to actual license usage so we would know1028if we are over purchasing or not.1029    Mr. Carter. Thank you, Congressman, for that question. We1030actually do look at that when we develop the vehicle. A lot of1031times, and I think there is a misconception, all software1032purchased has to be reviewed. They have to use a correct1033product service code. That is what we have been harping on1034through the FITARA process since 2015. When the product is1035requested, it has to go through the process, reviewed, and then1036it is tracked from that point on.1037    The issue we have had is that at times, some of the medical1038folks purchase this, it might be for a medical device, and they1039focus on it as a medical device not letting us know that--or1040using the correct product service code, and that is when you1041get that IT purchase that we miss. The CIO does not have an1042opportunity to review it or add it into the catalog only until1043after the maintenance time comes around.1044    Mr. Barrett. Would that be a medical device like the1045program where people have a pacemaker that relays information1046to their cardiologist and there is an interfacing on the1047cardiologist's side, a piece of equipment that receives that1048information?1049    Mr. Carter. Yes, sir.1050    Mr. Barrett. Okay. Then, would it be also the case that1051sometimes there is a projection made where we buy, you know, a1052bulk number of licenses expecting them to get filled out over1053time, like we are not just going to buy for the 10 people that1054want it now, we are maybe going to buy more than that expecting1055it to be a greater need and that thing goes underutilized, are1056we over time calibrating that to the appropriate usage?1057    Mr. Carter. I can only speak to the ones that we have done.1058A great example is our award of the Microsoft contract1059recently. In the contract, what we have added in that contract1060is a clause that allows us, if the amount goes below 101061percent, we see an adjustment, then we are allowed to go back1062and readjust that contract. That was something that we did not1063have in before.1064    Mr. Barrett. Below 10 percent, so if 90 percent are going1065unused?1066    Mr. Carter. No. I mean, sir, 10 percent usage.1067    Mr. Barrett. Okay.1068    Mr. Carter. Below 10 percent usage of the total. We have1069over 570,000 license, so if 10 percent is not being used, we1070can go back and readjust that contract. During that contract,1071the award of that contract this past year, over the lifecycle1072of that contract for 5 years, we avoided $136 million.1073    Mr. Barrett. By calibrating it more precisely.1074    Mr. Carter. Overall cost avoidance on that contract.1075    Mr. Barrett. Okay. Thank you. I will have a few more1076questions, but I am going to yield to Ranking Member Budzinski1077for 5 minutes.1078    Ms. Budzinski. Thank you, Mr. Chairman. I think picking up1079on questions that some of my colleagues have had,1080    Mr. VanBemmel, if I could ask you, we are talking about how1081we are dealing with what is a largely decentralized licensing1082process, and so, how do we eliminate duplications and how do we1083coordinate, a local coordinate with the VA enterprise.1084    I am curious, the VA's business integration and outcome1085service, BIOS, what role would they play in getting at these1086questions and issues?1087    Mr. VanBemmel. The BIOS' office is an office within OI&T1088that essentially does that stakeholder engagement and1089management and has representatives from business on the other1090side of that conversation.1091    Ms. Budzinski. They are useful to this process as far as1092eliminating redundancies, being a resource to the local VAs1093that are looking for additional software support?1094    Mr. VanBemmel. In some way we need to manage those1095conversations with our business partners, yes.1096    Ms. Budzinski. That makes sense to me. They seem like an1097important--they play an important role.1098    I do want to ask you, what is the current status of BIOS?1099We have heard that BIOS, the BIOS team has been told that their1100work is not mission critical, that they are expecting to be a1101part of the reduction in force (RIF) plan. Do you know of any--1102are they included in the RIF planning?1103    Mr. VanBemmel. I am not managing that for larger OI&T. I1104have to take that back for the record.1105    Ms. Budzinski. Okay. Would Mr. Carter know?1106    Mr. Carter. No, ma'am. We would have to take that back for1107the record.1108    Ms. Budzinski. Okay. I would be very interested to know1109because I think there has been a lot of conversation around who1110is helping local VAs and how are they--they seem to be an1111entity that could be helpful moving forward.1112    Mr. VanBemmel, can I also ask, so going back to your1113testimony, you stated that when centralized data repository is1114completed at the end of the year, OIT will be able to establish1115clear key performance indicators to measure the effectiveness1116of the SAM program. Have those key performance indicators1117already been established?1118    Mr. VanBemmel. They have not. We are learning a whole lot1119over the course of this install, and as we get visibility on1120the software, and we want to start setting some goals. One of1121those questions is, to your point, what opportunities do we1122have for consolidation? We are looking at the totality. Now1123that we can see the totality of the endpoints and the software,1124breaking those down into the software product categories, and1125then saying is it reasonable to expect that we could get down1126to one or two titles per software category, and what does that1127timeline look like? Those would be the kinds of metrics that we1128are looking for.1129    Ms. Budzinski. That you are looking for. Okay. Thank you.1130    I would like to switch gears, Mr. VanBemmel, and ask you, I1131have read President Trump's executive order calling for the1132consolidation of common goods and services acquisition under1133the General Services Administration. I do have some concerns1134about how that would impact software purchasing at VA. How does1135the VA plan to respond to President Trump's executive order1136requiring GSA to take over IT procurement for the entire1137Federal Government?1138    Mr. VanBemmel. I am going to refer to Don, since he does1139acquisitions.1140    Ms. Budzinski. Sure. Yep.1141    Mr. Carter. Ms. Congresswoman, when we work with GSA, we1142have been involved in their category management, as well as1143conversations for the past year. Obviously, we still use the1144vehicles that are available, and when they come with a plan, we1145will be ready to support. We still go for the best value for1146the government when we are looking at contracts.1147    Ms. Budzinski. Okay. Do you think that GSA is equipped and1148capable of taking over all of VA's IT purchasing in addition to1149the rest of the Federal Government's? My second follow up would1150be, where would you draw the line between what GSA is allowed1151to take over versus what VA should maintain?1152    Mr. Carter. I think I would have to agree with what plan1153they come with, and we have to work through it. Again, it goes1154to the best value to the government. I think we have used GSA1155vehicles before, but we have also gone with other vehicles that1156show the best value and we have proved in the business case, so1157we are allowed to work that way.1158    Ms. Budzinski. Have you already started to engage in1159conversations, then, with the GSA over what this--what this1160would potentially look like?1161    Mr. Carter. No, ma'am, we have not gone down that road yet.1162    Ms. Budzinski. Not yet. Okay. I would love to keep in touch1163on that. I just, you know, want to make sure that the VA's, you1164know, ability I think to procure IT is not hurt in that process1165taking over such a big endeavor as GSA taking over all Federal1166Government's procurement.1167    How would GSA's goal of cutting its budget in half impact1168their abilities to carry out the VA's IT purchasing?1169    Mr. Carter. I cannot answer that question, ma'am.1170    Ms. Budzinski. Okay. Okay. I just remain concerned that1171this administration seems poised to move forward with this plan1172to restructure Federal IT acquisitions, but it is not clear how1173the impact--how that is going to impact, as I said, the VA's1174acquisition process.1175    Several articles have noted that they are losing too many1176key people, including some Senior Executive Service (SES) in1177the Federal acquisition service, so I just wanted to note that.1178    Mr. VanBemmel--well, actually, I am going to--I will yield1179since I only have 20 some seconds left. Go ahead.1180    Mr. Barrett. Do you have something quick?1181    Ms. Budzinski. That is Okay.1182    Mr. Barrett. Okay. All right. Mr. Luttrell.1183    Mr. Luttrell. Thank you, Mr. Chairman. This may be a1184question for you, Mr. Carter. Mr. VanBemmel, you said some1185software--we may have three or four of the same software1186profiles inside of an organization, so we are duplicating1187efforts, correct?1188    Mr. VanBemmel. In a product, software product category, I1189will give you a good example, Zoom and Teams, they both do1190video conferencing, but they are different. In our legal1191community very much uses Zoom, not a lot of Teams. Across1192Federal Government we use a lot of Teams. The question becomes,1193do we support one or both.1194    Mr. Luttrell. Or both. Right.1195    Mr. VanBemmel. There is probably two or three other titles1196in that same product category.1197    Mr. Luttrell. That is I am sure every single VA facility1198has a different argument.1199    Mr. VanBemmel. Correct, sir.1200    Mr. Luttrell. Mr. Carter, can we, when we are dealing with1201our business--do we have the opportunity to--I am assuming this1202is like bundling, we are saying, Hey, can we put this--can the1203VA put this together themselves, or does Microsoft or Adobe1204say, Hey, this is what we offer you and this is what you have1205to go with?1206    Mr. Carter. Sir, we work with the third-party resellers, so1207at times we do have an opportunity to speak to Microsoft so we1208tell them what our priorities are, what we are looking for, and1209then the price that we get back is what they offer the third-1210party resellers to sell to us.1211    Mr. Luttrell. How do we--how do we--this may seem--this1212seems like it may turn into a larger problem. Teams and Zoom is1213a great point. When we start to upgrade software and the1214expansiveness of technology starts to run, but our smaller1215facilities stay with Zoom and everyone else goes something1216different, we will always have to purchase Zoom for that1217smaller facility because that is what they want. As this starts1218to play itself out, even antiquated or dated software will1219continue to remain--correct me, I may be wrong on this, I am1220talking out loud to you. It seems to be that once the software1221at any particular level is inside the VA it is going to have to1222remain, and we are just going to start stacking things on top1223of it, or am I----1224    Mr. VanBemmel. No. I think our strategy is probably the1225opposite direction. There are a lot of local choices that were1226made that were maybe appropriate to their budget at the time.1227We are managing the IT software spend for VA now, and so it is1228really more about requirements. Then as to your point, as we1229bundle those requirements together, we do better buying and we1230pick better products.1231    Mr. Luttrell. If each facility makes the argument, Hey, we1232are a Teams facility, or we are a Zoom facility, is there going1233to be a point in which the VA says, Hey, look, we are going1234with a clean slate----1235    Mr. VanBemmel. Correct, sir. We are going to have to choose1236an every product category, the best value of that--best value1237for VA, and then we would reduce--and there is a lot of hidden1238costs in supporting so many titles per product category, and so1239reducing that really does not only make a standardized VA,1240which reduces operational costs, it also reduces our IT costs.1241    Mr. Luttrell. It is the challenging part with what we are1242dealing with with the electronic filter, each facility is1243different and they are making a different argument whether or1244not, Hey, look, we do not have the body count or we do not have1245the expertise to implement this system, so--it is a challenge1246because every single institution is its own institution1247underneath the VA umbrella.1248    Mr. VanBemmel. I would say that if you ran this as a1249business you would not want to have every one of your hospital1250to be totally different. It is not cost effective.1251    Mr. Luttrell. True statement. Yes, sir. Thank you, Mr.1252Chairman. I yield back.1253    Mr. Barrett. I will recognize myself for a minute. I would1254say that while that may be how we would have designed it from1255the beginning, we also woke up in the America of today this1256morning, so we have to confront what we have, and I find myself1257saying that more often as I am here longer.1258    To the ranking member's point about the GSA consolidating1259some of the large scale purchasing, I know that there was a1260report with Adobe where we achieved a 70 percent discounted1261procurement based on the overall bundled nature of the software1262license. I am pretty sure Adobe does not care whether you are1263doing work at the VA or whether you are doing work in the1264Internal Revenue Service (IRS), like, they are software is1265going to operate the same in both, and that license holder is1266insignificant to them, and if we are achieving a much more1267bundled, you know, the Costco model of buying software licenses1268versus the one off retail model that you would otherwise get,1269should we expect to see more of that cost savings as this1270effort is continued?1271    Mr. VanBemmel. Again, it is more of an acquisition question1272for Don.1273    Mr. Barrett. Sure.1274    Mr. VanBemmel. I would only say that we definitely--and Don1275and I spoke about this before, we agree that there is better1276buying power in consolidating requirements, and in commodities1277software, there is an opportunity to do that. It really is1278devil is in the details, what does GSA get as a price versus1279what we have negotiated on previous agreements. We really want1280to look at that.1281    To the Congresswoman's point, that really rings true in the1282commodity space, but as you start to get into specialized1283software for the mission that VA does, that is probably not1284true.1285    Mr. Barrett. Yes, the cardiologist program not the same as1286Adobe.1287    Mr. VanBemmel. There is a lot of specialty software for1288medical and benefits delivery that is unique to VA.1289    Mr. Barrett. Sure. Okay.1290    Mr. Carter, I do not know if you have anything you want to1291add to that.1292    Mr. Carter. Oh, yes, sir. Yes, Congressman. This past year,1293even about eight of our contracts, our larger contracts, we had1294a cost savings--cost avoidance of over $230 million.1295    Mr. Barrett. Was that through GSA or was that through your1296own negotiating?1297    Mr. Carter. Through our own negotiating.1298    Mr. Barrett. Okay.1299    Mr. Carter. I think the biggest thing of that was looking1300at what we are buying and really going down to where the need1301is, even lot pricing on some of the software, but also looking1302at the usage level of that software. We have been working1303toward that the past year and a half of looking a lot closer1304when we come in.1305    Also understand that when we purchase software, when it1306comes over the requirement, it goes through a governance board,1307so all users get an opportunity to review and have comments1308before it gets to the FITARA area, and we look at it to ensure1309that we are getting the best value before it goes out for1310solicitation.1311    Mr. Barrett. Thank you.1312    Mr. VanBemmel, I mentioned in my opening remarks that the1313Federal CIO asked VA to submit software inventories for the1314five vendors that GAO identified in their report. Now, for1315nearly $30 million worth of licenses, VA said it was unknown1316whether the licenses were being used. Does that mean that we1317did not know if part of that was being spent on licenses, or we1318did not know that the licenses being procured were actually1319being used by the end user that is assigned to that computer1320that it was installed on?1321    Mr. VanBemmel. I do not have that data call in front of me,1322so I would have to take that back for the record, but we can1323certainly help with that.1324    Mr. Barrett. Okay. We look forward to your response and1325appreciate you looking into that.1326    Ms. Harris, in Michigan, I spent time in the State1327legislature before coming here, and there was kind of a1328department that managed a lot of this procurement for a lot of1329different things, whether it was hardware, software, a lot of1330different aspects of that. Not unlike--it seems to me a lot1331like what the GSA is looking to do with software licensing on a1332bigger scale in the Federal Government. Do we have anything1333like this through the VA, or is really this GSA model the1334closest thing that would somewhat resemble that?1335    Ms. Harris. I mean, the GSA model is probably the closest1336for the Federal Government. I think within VA, I would say that1337probably OIT purchasing software on behalf of the enterprise is1338probably the closest--next closest at the Department level.1339    Mr. Barrett. Do you look at all at the best practices of1340other governmental agencies like, you know, how States do it? I1341understand that is obviously a much smaller scale than Federal1342Government would be, but maybe some lessons learned can come1343from whether or not you have autonomous agencies buying their1344own, and then from there subautonomous agencies like the VA has1345had through the medical, you know, hospitals for so long to1346where you are really kind of diminishing your purchasing power1347through that whole chain of, you know, chain of command1348basically.1349    Ms. Harris. Sure. We have not done any work at the State1350level to identify best practices, at least as it relates to1351managing software licenses. We do it in other areas of work,1352like in unemployment insurance systems, for example, but we1353have not done that. That would be a very interesting review for1354sure. We do intend to evaluate GSA's work to consolidate that1355the buying power across the Federal Government, we do intend to1356start that work toward the end of the year, so that is1357something that we do--that I think the results of that will be1358very interesting in terms of how they intend to implement that1359executive order.1360    Mr. Barrett. Thank you. Appreciate it. Member Budzinski.1361    Ms. Budzinski. Thank you, Mr. Chairman. Ms. Harris,1362actually, can I just follow up on my questioning around GSA1363kind of taking over VA's IT procurement. Could you give, just1364from GAO's perspective, any kind of concerns or opportunities1365you see in that, just any reflections on that happening?1366    Ms. Harris. I mean, I think that certainly we have done a1367lot of work in the telecommunication space as it relates to,1368you know, GSA having this large government vehicle for the1369government to utilize, and typically what we have seen are, you1370know, cost overruns, and delays and agencies implementing, you1371know, and moving off of one legacy contract to the new1372contract. I think that, you know, in terms of how GSA1373implements this, I think Mr. VanBemmel was very correct that,1374you know, when it comes to the commodity IT, Microsoft, Adobe,1375Salesforce, those are probably the areas where you can get that1376economy to scale, but the devil is going to be in the details,1377as he said. I agree with that.1378    Ms. Budzinski. Okay. That is helpful. Thank you.1379    Mr. VanBemmel, can I--I have heard some concerning stories1380about Department of Government Efficiency's (DOGE) impact at1381the VA. For example, we have heard that a DOGE employee Sahil1382Lavingia has been using AI to write code and has been1383integrating that code into some of VA's existing systems. What1384government structures are in place to ensure that any code1385added to VA's system is not going to have unintended1386consequences?1387    Mr. VanBemmel. I have to take that one back for the record.1388That is a complicated software engineering question I would not1389be able to answer right here.1390    Ms. Budzinski. Okay. Has DOGE been required to abide by any1391governing structures that you--governance structures that you1392have as it relates to IT?1393    Ms. Harris. I would have to take that one back for the1394record, ma'am.1395    Ms. Budzinski. Okay. Do you know what qualifications Mr.1396Lavingia has--have to be modifying VA systems, any1397qualifications he has to be dealing with the system is the1398question?1399    Mr. VanBemmel. I am not aware, but I would have to take1400that one back.1401    Ms. Budzinski. Okay. I just have obviously some grave1402concerns about these special government employees who have no1403experience working in government, or the programs that they are1404toying with having unfettered access into the VA's IT systems.1405The committee has sent several Request For Information (RFI)1406about this, and we have really received zero response. While1407you take it back, I appreciate that. We really would like to1408see responses to these questions.1409    Mr. VanBemmel, I am going to switch gears. It is my1410understanding that the software used by VA employees is only a1411portion of the software VA purchases. Does your office also1412monitor IT resources provided to veterans by the Office of1413Connected Care (OCC)?1414    Mr. VanBemmel. No, ma'am.1415    Ms. Budzinski. Okay. Do you know how OCC tracks the1416software that they provide to veterans?1417    Mr. VanBemmel. I do not.1418    Ms. Budzinski. Okay. Ms. Harris, when GAO did its1419evaluation of software licenses at VA, did it include software1420provided to veterans as well as a software purchased for1421employee usage?1422    Ms. Harris. My understanding is that it was just employee1423usage of the inventory, so I do not believe it included that1424universe of software.1425    Ms. Budzinski. If we are going to focus on all this effort1426on centralizing software license management as discussed, why1427would we create a whole separate process for software provided1428to veterans?1429    Ms. Harris. Yes. I mean, I think that, to your earlier1430point about shadow IT, it is important for VA to have full1431visibility into all of the software that is being purchased for1432the Department, whether it is for the VA users or for veterans.1433    Ms. Budzinski. Okay. My last question, Mr. VanBemmel, what1434would it take for the VA to adopt a more enterprise-like1435approach to assistive tech procurement for veterans?1436    Mr. VanBemmel. Can you help me with assisted tech, what you1437mean?1438    Ms. Budzinski. Blind and low vision veterans, excuse me,1439yes.1440    Mr. VanBemmel. Okay. We do procure software for our1441employees. A distinction on a question there, our appropriation1442is for VA to provide for VA employees on the VA network, so not1443to provide services or software to veterans directly. This is1444the corporate internal VA usage. The Office of Connected Care,1445for example, that software is procured through a different1446appropriation, and it is not on the VA network, and so it is1447separate. Any of those assistive technologies for veterans that1448are not on the VA network, I do not manage that, but if you are1449a VA employee and you need assistive technology, we do manage1450that and we have the responsibility for procurement.1451    Ms. Budzinski. Okay. Great. Thank you. I yield back.1452    Mr. Barrett. Thank you. I will now recognize myself again.1453    Mr. VanBemmel, what is the breakdown in spending between1454VA's 15 largest software titles and the rest of the VA software1455spending?1456    Mr. VanBemmel. Can I take that one back?1457    Mr. Barrett. Sure.1458    Mr. VanBemmel. We manage the----1459    Mr. Barrett. I know there is quite a few, but I know the1460top several account for the largest share of the total pie, but1461then there is a smattering of many others beyond that.1462    Mr. VanBemmel. Yep.1463    Mr. Barrett. Does the Department know exactly how many1464total software licenses they have purchased, and what they are1465using currently, or is that inventory still being done?1466    Mr. VanBemmel. We now have 100 percent visibility. I can1467tell you that we are managing about 4,400 titles, 4,4331468commercial off-the-shelf titles, and about another 224 SaaS1469offerings.1470    Mr. Barrett. Okay. Sorry. 300 some off-the-shelf. You are1471talking, like, Microsoft Word, something like that?1472    Mr. VanBemmel. 4,433, and those are all commercial off-the-1473shelf offerings, and so it goes to--you know, it is everything1474that runs that gamut now. Microsoft Office 365 would be a SaaS1475offering. That is in our other titles.1476    Mr. Barrett. What is--sorry. I can go get Microsoft 365----1477    Mr. VanBemmel. Right.1478    Mr. Barrett [continuing]. at Best Buy right now or I can go1479online and download it.1480    Mr. VanBemmel. Right.1481    Mr. Barrett. How is that not a commercial off-the-shelf1482product?1483    Mr. VanBemmel. Yes. The distinction is if you install it1484locally on the machine, commercial off-the-shelf product, that1485is a different category of management. SaaS is a cloud-based1486offering, and so if you get Office 365, it is not actually1487installed on your machine.1488    Mr. Barrett. Okay. What does SaaS stand for?1489    Mr. VanBemmel. Software as a Service.1490    Mr. Barrett. Okay. That is the cloud-based----1491    Mr. VanBemmel. Yes.1492    Mr. Barrett. The shift from when you used to get Microsoft1493on a disk.1494    Mr. VanBemmel. Yes.1495    Mr. Barrett. You know, office products on a disk to now1496getting it where you pay a subscription----1497    Mr. VanBemmel. Correct.1498    Mr. Barrett. Per year or something and it stores your1499information on the cloud.1500    Mr. VanBemmel. Yes.1501    Mr. Barrett. Okay. Now, that commercial off-the-shelf, that1502is still basically downloaded, or disk-installed on it on an1503actual individual device?1504    Mr. VanBemmel. Yes.1505    Mr. Barrett. Okay. We have thousands of those and hundreds1506of SaaS?1507    Mr. VanBemmel. Correct, sir.1508    Mr. Barrett. Okay. All right. Then the Federal CIO asked1509for that information by the end of April. Have you provided1510that to them already?1511    Mr. VanBemmel. We are largely, I would say, 90, 95 percent1512through with that entire inventory.1513    Mr. Barrett. Okay.1514    Mr. VanBemmel. The gaps that we have on the inventory are1515not on the identification of the software or even the licenses1516in use, but it is really down to who owns the software in VA,1517who is the person accountable for that license. That really is1518the work that we have going forward to identify the accountable1519person for every software title, and then, you know, working1520with that requirements owner on the way ahead for their1521product.1522    Mr. Barrett. Okay. Then from there, how many different1523organizations within VA are currently purchasing software1524licenses? Is it all now consolidated through your office?1525    Mr. VanBemmel. Yes. It all comes to our office.1526    Mr. Barrett. Battle Creek VA, you know, 40 minutes from my1527house, they want to download or install something, it is got to1528go through your office now.1529    Mr. VanBemmel. That is right, and we are reviewing every1530one of those acquisitions.1531    Mr. Barrett. Okay. Then how many different vendors is VA1532currently buying software licenses from? I assume in that1533thousands and hundreds, some of those are the same vendor with1534different products.1535    Mr. VanBemmel. Correct, sir. I would have to take that one1536back to get you the correct answer.1537    Mr. Barrett. Okay. Thank you. I believe I had a question1538for Ms. Harris, if I am not mistaken. Actually, Mr. Carter. I1539apologize. GAO's recommendation on comparing data on software1540license usage to purchase records is still open. What is VA1541currently doing to compare what they are buying to what they1542are using?1543    Mr. Carter. We are actually looking at what we buy. A1544couple software titles like Oracle and Oracle Java, those are1545unlimited license agreements that we have.1546    Mr. Barrett. Okay.1547    Mr. Carter. Also what we are doing is we are trying to1548measure out what we have. It was not for the best value. When1549Oracle Java, which is strictly for development, we can do that1550and recheck that. This is a better value to go with unlimited1551license, and we are able to prove that. Oracle is a little bit1552different only because Oracle has about 190 products, so that1553is an ongoing effort.1554    Mr. Barrett. It is not everything Oracle. It is just that1555product you can buy on an unlimited basis and then if you want1556to buy something else, it is a different contract.1557    Mr. Carter. Correct.1558    Mr. Barrett. Okay.1559    Mr. Carter. Microsoft, we are down to who is using what on1560all that license.1561    Mr. Barrett. Okay. With Microsoft, we are not buying all-1562you-can-eat buffet of Microsoft like we are with Java. It is a1563different system that we have.1564    Mr. Carter. Correct. Just like when you buy 365, you also1565have to buy a virus protection. That is included as well and1566that is per license, per software, per individual user, and it1567goes as well on virtual machines and everything.1568    Mr. Barrett. What--this will be my last question before I1569yield again. What--would you say is it common or uncommon to1570have the--as many as you want enterprise-wide unlimited license1571versus a per user license? It feels to me like the per user is1572more common.1573    Mr. Carter. Yes, sir. Per user is more common.1574    Mr. Barrett. Okay. Thank you.1575    Ranking Member Budzinski, you have any more questions?1576    Ms. Budzinski. No.1577    Mr. Barrett. Okay. I just have a couple more that I will1578run through and then we can close out. Mr. Carter, once VA has1579a complete inventory in one system and is able to compare data1580on whether a license is being used to purchase records, how1581long will it take to VA to go through each software title to1582figure out if they are overspending?1583    Mr. Carter. I will have to let Mr. VanBemmel answer that,1584but for the Microsoft in our new agreement, we used to do a1585reclamation every 90 days.1586    Mr. Barrett. Okay.1587    Mr. Carter. We now have a written where we do it every 30.1588We go back and review. If it is not being used, we can pull it1589back to inventory.1590    Mr. Barrett. Okay. Thank you. All right. I think we are1591good. Appreciate both of you being here today. Before I close1592out, I will yield to the ranking member if you want to give1593your closing.1594    Ms. Budzinski. Thank you, Mr. Chairman, and thank you again1595to the witnesses for being here. I am glad to hear that the VA1596is making progress in getting its software asset management1597systems in order. I agree that it is important to be able to1598track what the Department owns and what it is being used to1599minimize waste and unnecessary cost. I am concerned, though,1600that the Department is not looking strategically at ways this1601program can be expanded to cover all assets purchased by the1602Department. Until the Department is tracking all its assets to1603include those utilized by veterans as well as employees, we can1604never be totally sure that it is preventing waste.1605    I am also seriously concerned about the potential of1606moving, especially the specialized software of VA's IT1607acquisition to what I believe will be a gutted GSA. If the1608Trump administration were serious about this executive order,1609they would be fortifying GSA to handle the onslaught of1610requirements from across the Federal Government. Instead, they1611are bleeding it dry just like other agencies. There is no other1612way--there is no way that an anemic GSA is prepared for this.1613VA employees and veterans should not have to wait in line1614behind other agencies to get their resources they need,1615especially when they have fully functional processes to get1616these resources in-house.1617    Also, I want to be real clear that we cannot allow the1618Department to continue to obscure the activities of DOGE in the1619VA. It is unacceptable that these people are given unfettered1620access to VA, access to contracts and its IT systems with zero1621transparency and zero oversight. If these actions are in the1622best interest of veterans, then I ask why is the Department1623hiding them? I am terrified of what kind of damage they are1624doing and what the lasting impacts will be for our veterans. We1625must do better and I look forward to working with the chairman1626to do the necessary oversight to ensure that our veterans are1627protected.1628    Thank you, Mr. Chairman. I yield back.1629    Mr. Barrett. Thank you, Ranking Member Budzinski, and I1630want to thank our witnesses again for appearing today to1631discuss VA software licensing and management practices. Thank1632you for your candor with your answering of questions, and for1633those that are being taken back, we look forward to your1634response. I have made this point before, but information1635technology is the backbone of every service and benefit that VA1636delivers to veterans, whether you are filing a claim, whether1637you are going in for an exam, whether you are receiving your1638health benefits or your disability claim payment, everything1639runs on information technology right now. We all understand1640that.1641    This is not the VA of 40 years ago and software is an1642essential aspect of VA operations. Mr. VanBemmel, to your1643point, a generation ago, each of these VA facilities were very1644autonomously operated and run, and now we are trying to do the1645hard work of having some standardization. We are seeing that1646with electronic health record rollout. We are seeing it with1647other software licensing as well, so I am encouraged by that1648desire to get that done.1649    As VA and the Federal Government's technology footprint has1650grown over the years, it has clearly led to inefficiencies in1651waste of over purchasing and underutilization, and not right-1652sizing what every product would be designed for. It would be1653hard-pressed to find any expert on software licensing that1654would disagree with this. As I said, I know this is not unique1655to the VA, but this is the committee that, you know, has1656oversight of the VA and that is why I want to leave this effort1657here.1658    VA employees need software to do their job, but there is no1659good reason why VA cannot do better at cutting waste and1660negotiating prices. Part of House Republicans' mission and why1661the American people gave us the majority is to root out1662inefficiencies and waste where they exist in government to make1663it work better.1664    Software licensing is a clear example of this that has been1665acknowledged for years by both side of the aisle. To the VA1666witnesses, as I said, I appreciate your candor today, but now1667this subcommittee needs a commitment, a commitment to1668transparency, timelines, and accountability. We are ready to1669support you, but we will also hold you accountable as well. Let1670us cleanup the mess and stop the waste and keep our focus where1671it belongs: Providing good, forward-thinking care and services1672to veterans who earn them.1673    I ask unanimous consent that all members have 5 legislative1674days to revise and extend their remarks and exclude1675extraneous--include extraneous material. Without objection, so1676ordered. This hearing is adjourned.1677    [Whereupon, at 4:21 p.m., the subcommittee was adjourned.]16781679?16801681=======================================================================16821683                         A  P  P  E  N  D  I  X16841685=======================================================================16861687                    Prepared Statements of Witnesses16881689                              ----------16901691                  Prepared Statement of Jeff VanBemmel16921693Introduction16941695    Chairman Barrett, Ranking Member Budzinski, and distinguished1696Members of the Subcommittee, thank you for the opportunity to testify1697regarding Software Licensing at VA. Your longstanding support of1698Veterans and their families is greatly appreciated. I am accompanied by1699Don Carter, Don Carter, Executive Director for Contract and Operations1700Management, OIT.17011702VA's Past Software Asset Management State17031704    OIT recognizes that software is a critical component in delivering1705the care and services our Veterans deserve. This recognition has led to1706substantial investments in both commercial and VA-developed software1707solutions. The increase in software solutions has required VA to1708constantly review and update its management policies and practices,1709especially in areas such as decentralized procurement and license1710oversight.17111712Current Efforts of the SAM Program17131714    In January 2024, OIT established the Enterprise Software Asset1715Management (SAM) program to address the two GAO recommendations made in1716GAO-240105717 including issues such as decentralized software1717procurement, lack of product ownership, loose license management, and1718data management. The core aspects of this program are:17191720        1. Centralization and Standardization: Establishing a1721        centralized data repository for software inventory, deploying1722        modern tools for tracking software usage, and assigning clear1723        product ownership across the enterprise. Previously, software1724        was managed in a decentralized manner. The SAM program will1725        assign product ownership to enhance communications with1726        software stakeholders and streamline management.17271728        2. Automation and Efficiency: Automating tasks within the SAM1729        lifecycle framework where feasible while leveraging existing1730        tools and systems for efficient SAM implementation and1731        improving the integration of tools, systems, and reporting1732        mechanisms. The process includes managing licensing, data1733        migration, configuration, and other related services.17341735        3. Continuous Improvement: The SAM program incorporates1736        Continuous Process Improvement to meet future software needs,1737        manage updates, and ensure proper retirement of unused1738        software. OIT has implemented tools to improve software1739        visibility and data management, and to consolidate data on1740        software usage into a singular centralized enterprise1741        repository for better oversight and management.1742    OIT's comprehensive approach involves planning for future software1743needs, managing updates, and ensuring proper disposal of outdated or1744unused software. The software management lifecycle comprises six1745phases: plan, request, procure, deploy, manage, and retire. Notable1746progress has been made in the area of Centralization and1747Standardization noted above including managing the software asset1748lifecycle from deployment to retirement, particularly in license1749management, software reclamation, and repurposing.17501751Current Challenges17521753    Starting with the top 15 most widely used software titles across1754VA, these improvements in license management tools and practices have1755already led to over $136M in software cost avoidance but challenges1756remain. Identified key challenges include:17571758      Business Led Information Technology (IT): Software1759procured or deployed outside approved channels poses security,1760compliance, and financial risks. We are strengthening governance1761mechanisms, improving software visibility, and working with VA business1762owners to rationalize requirements and minimize unauthorized software1763acquisitions.1764      Training and Culture Change: Training staff on SAM1765processes and policy compliance is crucial. OIT is rolling out guidance1766for all relevant staff, focusing on requirements definition,1767acquisition planning, software lifecycle management, and the risks1768associated with unauthorized software procurement. By educating staff1769early in the acquisition process, we aim to foster a culture of1770accountability and proactive software management.1771      Improving IT Visibility and Governance: Identifying1772existing capability gaps in software and asset visibility, establishing1773a ``single source of truth'' for software usage data, and developing1774and implementing new SAM policies and formal governance procedures.17751776Way Forward17771778    VA has accomplished the first recommendation made in GAO 24-105711779to track software for its most widely used titles. This improved1780management has produced the cost avoidance outlined in the testimony1781above. VA has made substantive progress on the second recommendation in1782GAO 24-10571. All software in use on the VA network has been identified1783and VA will complete the population of the centralized SAM data1784repository by the end of the year. This will enable VA to compare1785licenses in use against purchase records and make better informed1786investment decisions. VA's way forward includes:17871788      Strengthening Governance and Oversight: VA Directive17896008, Acquisition and Management of VA Information Technology1790Resources, governs all IT acquisitions and enforces Chief Information1791Officer oversight for software purchases, ensuring compliance with1792Federal laws. We also track IT procurements through product service1793codes and medical devices that have a software component. These1794procurements also go through our Federal Information Technology1795Acquisition Reform Act review process. This closes many previous gaps1796that allowed licenses to be purchased without centralized review.17971798      Metrics and Performance Measurement: When the centralized1799data repository is completed at the end of the year, OIT will be able1800to establish clear Key Performance Indicators to measure the1801effectiveness of the SAM program, including cost avoidance, compliance1802rates, utilization efficiency, and audit findings. These metrics can be1803included in the Annual Performance Plan.18041805      Ongoing Improvement: Effective software management is not1806the responsibility of a single office but a collective effort across1807VA's entire enterprise. The OIT team is committed to continuing our1808progress, strengthening our governance, and fully optimizing our1809software portfolio.18101811Conclusion18121813    Through OIT's ongoing efforts in the SAM program, VA aims to ensure1814that every dollar spent on technology supports the critical mission of1815serving America's Veterans with excellence. Thank you for your1816continued support and for the opportunity to testify here today.18171818                   Prepared Statement of Carol Harris1819[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]