The 1996 legislation that created a new role was the Information Technology Management Reform Act, better known as the Clinger-Cohen Act, and the role it created was the agency Chief Information Officer. The law required every federal executive agency to designate a CIO to advise the agency head on technology purchases, manage the agency’s information resources, and answer for how technology dollars get spent.1Office of the Law Revision Counsel. 40 USC 11315 – Agency Chief Information Officer Before 1996, no single official in most agencies held that responsibility.
Why Congress Created the Position
For decades, federal IT procurement was centralized under the General Services Administration through the Brooks Act. That law required agencies to route most computer purchases through GSA, which created bottlenecks and left individual agencies with little control over their own technology decisions. The Clinger-Cohen Act repealed that framework and handed procurement authority directly to each agency head.2U.S. Department of the Treasury. Clinger-Cohen Act of 1996 – Section 5101
Decentralization needed a counterweight. If each agency was going to run its own technology procurement, someone inside each agency had to be personally accountable for the results. That was the CIO. The same law also introduced capital planning requirements, performance-based management, and a preference for modular contracting, replacing the old approach of massive, years-long procurement cycles with smaller, incremental purchases that could be tested along the way.3U.S. Department of the Treasury. Clinger-Cohen Act of 1996 – Section 5202
The statute picked up its familiar name a year later, when the fiscal year 1997 Omnibus Consolidated Appropriations Act formally renamed it the Clinger-Cohen Act. Its provisions are now codified primarily in Subtitle III of Title 40 of the U.S. Code.4Office of the Law Revision Counsel. 40 USC Subtitle III – Information Technology Management
What the Agency CIO Does
The statutory duties fall into three broad areas. The CIO advises the agency head and senior leadership so that technology purchases and information resources are managed consistently with federal policy and the agency’s own priorities.1Office of the Law Revision Counsel. 40 USC 11315 – Agency Chief Information Officer In practice, that means sitting at the table during budget discussions and acquisition planning, not after decisions are already made.
The CIO also develops and maintains what the statute calls an “information technology architecture,” an integrated framework for maintaining existing systems and acquiring new ones in alignment with the agency’s strategic goals.1Office of the Law Revision Counsel. 40 USC 11315 – Agency Chief Information Officer Architecture work is what keeps an agency from buying dozens of incompatible systems that cannot share data with each other.
The third area is program oversight. The CIO monitors the performance of the agency’s IT programs, evaluates them against applicable performance measurements, and advises the agency head on whether to continue, modify, or kill a program that is not delivering results.1Office of the Law Revision Counsel. 40 USC 11315 – Agency Chief Information Officer That termination authority is where the role gets real teeth. Federal IT projects have a long history of running over budget and behind schedule, and giving the CIO explicit standing to recommend pulling the plug was one of the act’s most consequential provisions.
On top of those three pillars, the CIO carries workforce planning duties. Each year the CIO must assess whether agency personnel have adequate knowledge and skills in information resources management, identify gaps, and develop hiring and training strategies to close them, then report progress to the agency head as part of the annual strategic planning cycle.1Office of the Law Revision Counsel. 40 USC 11315 – Agency Chief Information Officer
The CIO also runs the agency’s capital planning process for IT investments. That process must cover selecting investments, managing them, and evaluating results; integrate IT decisions into the broader agency budget; apply minimum criteria such as risk-adjusted return on investment before an investment is approved; flag investments that could benefit other agencies or state and local governments; and give senior management timely, independently verifiable progress data on cost, capability, timeliness, and quality.5Office of the Law Revision Counsel. 40 USC 11312 – Capital Planning and Investment Control
How CIOs Get the Job
The appointment process is simpler than many people assume. The head of each agency designates the CIO, who then reports directly to that agency head. Most agency CIOs are not subject to Senate confirmation. The statute does not prescribe specific degrees or certifications, but it does require that the CIO’s primary duty be information resources management and that the person and supporting staff be “selected with special attention to the professional qualifications required” for the role.6Office of the Law Revision Counsel. 44 USC 3506 – Federal Agency Responsibilities
For agencies listed under 31 U.S.C. 901(b), which covers the major departments such as Defense, Treasury, and Health and Human Services, the CIO must treat information resources management as their primary responsibility rather than wearing it as a secondary hat.1Office of the Law Revision Counsel. 40 USC 11315 – Agency Chief Information Officer The reason is simple. The role demands someone whose attention is not split across unrelated duties.
How the Role Grew After 1996
The CIO position Congress created in 1996 looked quite different from what it looks like now. Three later laws stacked new duties and new authorities onto the original job.
FISMA and Cybersecurity
The original Clinger-Cohen Act addressed information security in general terms. The Federal Information Security Modernization Act significantly expanded what agency CIOs must do on the cybersecurity front. Under FISMA, the agency head delegates authority to the CIO to ensure compliance with all federal information security requirements, including designating a senior information security officer, running an agency-wide security program covering risk assessments, policies, awareness training, incident response, and continuity of operations, testing security controls, documenting fixes, and reporting annually to the agency head on how well the program is working.7Office of the Law Revision Counsel. 44 USC 3554 – Federal Agency Responsibilities
The E-Government Act and the CIO Council
The Clinger-Cohen Act created CIOs within individual agencies, but it took the E-Government Act of 2002 to build the connective tissue between them. That law established the Chief Information Officers Council, made up of CIOs from every major agency along with representatives from OMB and the intelligence community, as a forum for sharing practices, coordinating cross-agency initiatives, and developing government-wide standards.8U.S. Congress. H. Rept. 107-787 – E-Government Act of 2002
FITARA and Budget Authority
Clinger-Cohen gave CIOs an advisory role. The Federal IT Acquisition Reform Act of 2014, known as FITARA, gave them something closer to a veto. Under FITARA, the CIO of each covered agency (other than the Department of Defense, which has a slightly different structure) must approve the agency’s entire IT budget request before it goes to OMB. An agency cannot enter into any contract for IT or IT services unless the CIO has reviewed and approved it, and for major investments that authority cannot be delegated. Funds designated for IT cannot be reprogrammed without CIO approval, and the CIO must certify that IT investments are using incremental development practices as defined in OMB guidance.9Office of the Law Revision Counsel. 40 USC 11319 – Resources, Planning, and Portfolio Management
FITARA closed a loophole where program offices would commit to technology contracts without the CIO’s knowledge, then present the spending as a done deal. Congress tracks how well agencies comply through periodic FITARA scorecards that grade categories such as data center optimization, IT portfolio transparency, and risk management.
What the Role Looks Like Now
The cumulative effect of these laws is a position that touches nearly every operational decision an agency makes. Cloud migration strategies, zero-trust security frameworks, data center consolidation, workforce upskilling, and artificial intelligence governance all land on the CIO’s desk. Because FITARA scorecards are public, CIO performance is not just an internal matter but one that Congress and the press watch closely. The role Congress established in 1996 as a technology advisor has become one of the most consequential leadership positions in the federal government.