The Federal Information Technology Acquisition Reform Act, known as FITARA, is a federal law enacted in December 2014 that restructured how the 24 major federal agencies covered by the Chief Financial Officers Act buy, manage, and secure their information technology. Its central move was to give agency Chief Information Officers genuine budget authority over IT spending, replacing the largely advisory role they had held under the Clinger-Cohen Act of 1996. A semi-annual public scorecard grades each covered agency on how well it is complying.
What FITARA Actually Requires of Agencies
Before FITARA, agency CIOs held the title but not the leverage. Program offices routinely bought their own technology without consulting the CIO, which produced duplicated systems, incompatible platforms, and cost overruns. FITARA codified specific authorities in 40 U.S.C. § 11319 that turned the CIO into a decision-maker.1Justia Law. United States Code Title 40 11319 – Resources, Planning, and Portfolio Management
Under the statute, the agency head must ensure the CIO has a significant role in all planning, programming, budgeting, and execution decisions related to IT. The CIO must approve the agency’s IT budget request before it goes to the Office of Management and Budget. No IT contract can move forward without CIO review and approval, and the agency cannot reprogram IT funds without the CIO signing off. These duties are non-delegable for major investments, though the CIO can delegate review of smaller, non-major investments to other officials.1Justia Law. United States Code Title 40 11319 – Resources, Planning, and Portfolio Management
The Department of Defense operates under a modified version of these rules. Rather than approving the IT budget outright, the DOD CIO reviews it and provides recommendations to the Secretary of Defense.1Justia Law. United States Code Title 40 11319 – Resources, Planning, and Portfolio Management
The CIO must also certify that IT investments adequately implement incremental development, meaning the agency delivers usable, tested functionality in short cycles rather than spending years building a system that may never work. OMB’s capital planning guidance sets this delivery cadence at every six months or less after the start of development.1Justia Law. United States Code Title 40 11319 – Resources, Planning, and Portfolio Management
How Failing IT Projects Get Caught
Under 40 U.S.C. § 11302, the CIO of each covered agency must report to OMB at least semi-annually on every major IT investment, categorizing each by risk level. When a major investment carries a high-risk rating for four consecutive quarters, the CIO and the program manager must conduct a formal review identifying root causes, potential fixes, and the probability of future success.2Office of the Law Revision Counsel. 40 USC 11302 – Capital Planning and Investment Control
If a high-risk investment remains high-risk one year after that review, OMB can deny any further funding for development, modernization, or enhancement until the CIO certifies the root causes have been addressed.2Office of the Law Revision Counsel. 40 USC 11302 – Capital Planning and Investment Control This is where the law has real teeth. Agencies can’t simply acknowledge a failing project and keep spending on it. Reporting flows publicly through the Federal IT Dashboard, managed by GSA.
OMB also runs a parallel process called PortfolioStat, a quarterly review in which agency leadership meets with OMB to examine the entire IT portfolio, identify duplicative systems, and consolidate services. Agencies use a framework called Technology Business Management to categorize IT costs consistently, which makes it possible to compare spending across agencies and see where money is going to maintain outdated systems.3CIO.GOV. PortfolioStat
The Scorecard That Drives Compliance
The most powerful enforcement mechanism behind FITARA isn’t a penalty clause. It’s embarrassment. Since 2015, the Government Accountability Office and the House Committee on Oversight and Government Reform have published a semi-annual scorecard grading each of the 24 CFO Act agencies on their FITARA implementation. Grades range from A to F and are publicly available.4House Committee on Oversight and Government Reform. FITARA 9.0
The scoring categories have shifted over time. Initial versions focused on incremental development, risk management, cost savings, and data center consolidation. Later editions added categories for software licensing, the Modernizing Government Technology Act, FISMA cybersecurity performance, and transition off legacy telecommunications contracts. Categories where all 24 agencies achieved top marks have been retired and replaced with new priorities.5U.S. Government Accountability Office. Information Technology and Cybersecurity – Using Scorecards To Monitor Agencies Implementation of Statutory Requirements As of Scorecard 18.0, released in September 2024, categories included CIO authority enhancements, data center optimization, portfolio review, transparency and risk management, software licensing, cybersecurity, MGT Act implementation, and network transition.
Agencies that receive poor grades have restructured CIO reporting lines, accelerated data center closures, and overhauled software purchasing practices. The public nature of the grades gives CIOs leverage inside their own agencies. When a program office resists central IT oversight, a looming scorecard downgrade tends to get leadership’s attention faster than a citation to the statute.
Where FITARA Has Reshaped Federal IT
Data Centers
Before the law, agencies operated thousands of data centers, many of them small server closets running at a fraction of capacity. FITARA and the related Data Center Optimization Initiative pushed agencies to close unnecessary facilities and consolidate workloads into more efficient environments, including commercial cloud services. OMB sets closure and optimization targets that agencies report against as part of their portfolio management. Some agencies have closed hundreds of data centers since the initiative began.
Software Licenses
Federal agencies spend billions on software, and before FITARA many had no centralized inventory of what they owned. Licenses expired unused while other offices bought the same product separately at higher cost. FITARA and the complementary MEGABYTE Act of 2016 require agencies to maintain regularly updated inventories of all software licenses and use that data to make cost-effective purchasing decisions. GSA supports this by negotiating government-wide Enterprise Software Agreements that contracting officers must evaluate before pursuing separate purchases.6Acquisition.GOV. PGI 208.74 – Enterprise Software Agreements
IT Workforce
A law that gives CIOs more authority only works if agencies have skilled people to execute the mission. FITARA requires agencies to assess gaps between their current IT workforce capabilities and future needs, then close those gaps through hiring and training. NIST maintains the NICE Workforce Framework for Cybersecurity, which agencies use to categorize IT and cybersecurity positions. As of early 2026, NIST was incorporating new work roles for cybersecurity supply chain risk management, general risk management, and learning program management, along with updated competency areas for cryptography and DevSecOps.7National Institute of Standards and Technology. One Week Away – Comment on Proposed NICE Framework Updates by February 2, 2026
Modernization Funding
The Modernizing Government Technology Act of 2017 extended FITARA’s framework by creating two funding mechanisms for IT modernization. Individual agencies can establish IT working capital funds, where savings from retiring legacy systems are reinvested in new technology. Separately, the government-wide Technology Modernization Fund is overseen by a board of federal technology leaders that awards funding competitively. Since its creation, Congress has appropriated over $1.23 billion to the TMF, which has funded 37 federal IT modernization projects.8U.S. Government Accountability Office. Technology Modernization Fund – Although Planned Amounts Repaid Have Increased, Concerns Remain Competitive proposals generally request less than $25 million and take no more than three years to implement, with agencies typically expected to repay the funds over five years.9Technology Modernization Fund. Agency and Project Fit
Cybersecurity and AI Under the CIO’s Umbrella
FITARA did not create federal cybersecurity requirements on its own, but by centralizing IT authority under the CIO, it gave cybersecurity leaders a clearer chain of command. Agency CIOs oversee cybersecurity strategy as part of their broader enterprise risk management responsibilities, working with Chief Information Security Officers to align security metrics with priorities like zero trust architecture. OMB tracks agency cybersecurity performance through FISMA reporting, which feeds directly into the FITARA scorecard.
The CIO’s cybersecurity role reaches into procurement. For Internet of Things and operational technology devices, the CIO must review and approve contracts before execution. If a device doesn’t comply with NIST IoT security standards, the agency cannot use it unless the CIO signs a determination that the waiver is necessary for national security, research purposes, or because alternative security methods are in place.
The same CIO-centric framework is now expanding to cover artificial intelligence. OMB has directed CFO Act agencies to designate Chief AI Officers responsible for coordinating AI adoption, managing risk, and maintaining an inventory of AI use cases. Agencies may designate an existing official like the CIO to fill this role, provided they have significant AI expertise. Each agency must also establish an AI Governance Board chaired by the Deputy Secretary. Agencies must submit updated AI compliance plans to OMB on a two-year cycle through 2036.
Why FITARA Worked Where Clinger-Cohen Did Not
FITARA is sometimes described as Clinger-Cohen with teeth. The Clinger-Cohen Act of 1996 established the CIO role in federal agencies and directed them to use performance-based management for IT investments, but it lacked enforcement. Agency CIOs were often sidelined by program offices that controlled their own budgets and procurement decisions.
FITARA addressed this by making CIO budget approval mandatory rather than advisory, creating the scorecard accountability framework, and requiring OMB to cut funding for chronically failing investments. The existence of a Federal CIO position with White House backing added sustained pressure that didn’t exist in 1996. Where Clinger-Cohen described what agencies should do, FITARA created consequences for agencies that don’t.