▶ 0:12:14All right, good afternoon everyone and thank you all for being here today. Subcommittee will Sub- The subcommittee will come to order. We're here today to talk about software license management. An issue that affects every veteran who expects VA to function efficiently, securely, and transparently while also keeping costs in mind.
▶ 0:12:33The VA spends over a billion dollars on software licenses every year, and the department has never done a good job of managing it all or knowing how many they Without good data, the VA has no way of knowing how much money they are wasting on duplicative or unnecessary licenses. In some ways, software licenses are a lot like library cards.
▶ 0:12:52Just like a library card allows you to check out a book from a library, a software license gives you access to the software Each library represents a different software product, and VA purchases software licenses or library cards for their employees to use that product. Um we would have used to call these Blockbuster cards back in the day, but those are no longer applicable. VA purchases hundreds of thousands of library cards for thousands of different libraries every year.
▶ 0:13:18VA simply cannot make smart decisions about how many software licenses they buy if they don't have complete and accurate data. At the fundamental level, VA needs to understand what licenses they own and whether they are being used. The GAO published a report last year with several alarming findings about the state of software license management at the VA. VA could not explain what they paid for specific software products that are bundled into a single license agreement because the cost for each individual product are not broken down.
▶ 0:13:49VA could not track whether licenses they purchased for their most widely used software licenses are actually being They can track some of them but not all. VA is not able to compare software license usage to purchase records so they can have the information they need to negotiate better deals and identify cost savings. This basic information that any organization needs to make sure they are buying the right licenses for the right number of people at a fair price.
▶ 0:14:15I understand the VA has made some progress resolving these issues and I expect to hear more about that from our VA witnesses during this hearing. GAO and other organizations have been calling out the federal government's problems with software license management for over a decade. As long as this problem is unresolved, there will be waste and inefficiencies to be realized. Earlier this year, the federal CIO asked each agency to submit inventories of the software licenses they purchased from the five largest software vendors in the federal government.
▶ 0:14:45I reviewed the VA's response last week. For tens of millions of dollars worth of licenses, VA wrote that the license usage and quantities were unknown. It's clear that VA still has a long way to go. VA was supposed to produce a full inventory of all software licenses by the end of April, but we have not seen that yet. I recognize that this problem wasn't created in one day and won't be solved in a single day either.
▶ 0:15:12I believe that the VA wants to get this right and I'm committed to working with the new administration to finding a solution to do that. I applaud the Trump administration's effort to put a stop to this wasteful spending on software licensing by reviewing VA and other software uh other agencies software inventories. President Trump's executive order consolidating aspects of IT procurement into the General Services Administration is another step in the right direction. Let me be clear, consolidation alone will not solve the problem.
▶ 0:15:40Agencies must be responsible and accountable. VA must maintain an accurate software inventory to keep track of what licenses are being used. They must track license usage in real time, analyze performance data, and hold These aren't lofty ideals. They are basic good business practices. So, today I want to focus on three things.
▶ 0:16:03First, what is preventing VA from keeping a full and accurate inventory of their software licenses that has clear price breakdowns and tracks the usage by user. Second, how has software mismanagement impacted broader technology and modernization efforts at the VA? Lastly, what can Congress do to help make sure that VA is not wasting valuable resources on software licenses that could be spent on veterans?
▶ 0:16:30At the end of the day, every unused or duplicative software license that VA pays for isn't just a line item, it's a waste of taxpayer dollars and a missed An upgrade that never happened, a fix that got delayed, a veteran waiting longer for the care they earned. Let's change that. And I can tell you I know that this isn't a unique issue alone uh to the VA, but this is the committee that I have jurisdiction over and want to work with my committee members to fixing, and that's why we're here today working on the VA. And with that, I yield to Ranking Member Businski for her opening statement.
▶ 0:17:00Thank you very much, Mr. Chairman, and thank you for holding today's hearing about software licensing concerns at the Department of Veterans Affairs. I do look forward to working with you to address this issue and coming up with appropriate and common sense solutions for the employees of the VA and our nation's veterans. We owe it to them and we do owe it to the American taxpayer.
▶ 0:17:20I also want to thank our witnesses for attending uh today's hearing to discuss the future of how VA manages its catalog of software licenses and how it will procure them in light of the recent executive order that could centralize all federal acquisitions of IT services under the General Services Administration GSA.
▶ 0:17:40As I have said many times, pretty much everything VA does has some relationship to a computer, whether it's documenting in a medical record, reviewing a veteran's benefits claim, or tracking staff um staff schedules. VA's catalog of software is an essential tool for the for the provision of health care and benefits to our nation's veterans. I am concerned about VA's inability to account for the number of software licenses they currently have. How many are in actual use?
▶ 0:18:10And how much money has been wasted by the lack of this accountability? A January 2024 Government Accountability Office report identified several issues with 24 federal agencies, including the VA, where they observed wasteful spending wasteful spending of taxpayer funds on software licenses and systems that at a time were not needed. In the report, GAO made two recommendations to the VA.
▶ 0:18:35One, VA should track all licenses in its portfolio that are currently in use. Two, VA should compare the number of licenses in use with the number of license VA actually paid for to identify waste. As I understand it, VA OIT leadership has acknowledged GAO's recommendations and is working diligently to implement solutions by the end of fiscal year 2025.
▶ 0:19:01I'm happy to hear that VA is making progress, but I'm curious if VA has looked at the higher order processes. It's easy to treat Inspector General and GAO report findings like a punch list, but is VA looking at the processes that contributed to this mess? Shadow IT is a struggle that many major organizations contend with. What is VA doing to get a handle on it? Software is only part of the solution.
▶ 0:19:27How is VA addressing the policy and process issues that have allowed it to explode? Also, in many in my short time on this committee, I've heard many times that poor requirements development has contributed to almost every IT modernization failure at a at VA. How is VA refining that process to ensure that the software end user receive meet receive meets their needs? We need to stop playing whack-a-mole and start thinking strategically.
▶ 0:19:58Finally, I'm concerned about a recent executive order from President Trump that would consolidate the procurement of all common goods and services, including IT products, under GSA. The intent is to reduce waste and improve efficiencies. I fully support making sure that VA is more efficient, but we must be sure that any changes to IT procurement don't create downstream disasters.
▶ 0:20:23I think we can have a conversation about how this can be done with software like Microsoft and Adobe, but I am concerned that executive that this executive order does not take into account the unique mission VA provides to our veterans. Most of the software used at VA is not commercial off-the-shelf or COTS products, but unique to VA because I'm sorry, unique to VA providing care and benefits to veterans.
▶ 0:20:51This executive order would remove VA's oversight in the purchasing of the software and increase the risk of wasteful spend spending on software that does not meet the VA's needs. Not to mention that the Trump administration shuttered GSA's tech unit and plans to cut its budget in half. How are we supposed to trust the GSA can handle taking on VA's IT purchasing?
▶ 0:21:16The focus should be on serving our veterans and empowering VA to make its own software purchasing decisions while accounting for the number of software licenses it currently has and if they are being used. The focus should be on VA using GAO's recommendations to improve its accountability over its software licenses and future purchasing of software licenses. We owe it to our veterans and the VA employees to get this right. Thank you, Mr. Chairman, and I yield back.
▶ 0:21:47Thank you so much and I will now introduce our witnesses. From VA's Office of Information Technology, we have Mr. Jeff Van Bemmel, Executive Director for End User Operations. Thank you for being here, Mr. Don Carter, Executive Director for Contract and Operations Management. Thank you. And a familiar face to this committee is Ms. Carol Harris, Director of Information Technology and Cybersecurity at the Government Accountability Office. Thank you for being here as well.
▶ 0:22:15I will now ask the witnesses to please stand for your oath and we will swear you in. Please raise your hand, right hand. Do you solemnly swear under penalty of perjury that the testimony you are about to provide is the truth, the whole truth and nothing but the truth? Thank you. Let the record reflect that all witnesses have answered in the Mr. Van Bemmel, you are now recognized for 5 minutes to deliver your opening statement on behalf of VA.
▶ 0:22:42Chairman Barrett, Ranking Member Bergman, and distinguished members of the subcommittee, thank you for the opportunity to testify regarding the software asset management program at VA. Your long-standing support of veterans and their families is greatly I'm accompanied today by Mr. Don Carter. He's our Executive Director for Contract and Operations Management at the Office of Information Technology, OIT. OIT recognizes that software is a critical component in delivering the care and services our veterans deserve.
▶ 0:23:11This recognition has led to substantial investments in both commercial and VA developed software solutions. The increase in software solutions has required VA to constantly review and update its management policies and practices, especially in areas such as decentralized procurement and license In this vein, OIT has launched a strategic initiative to address the recommendations documented in GAO's report Federal Software Licenses: Agencies Need Need to Take Action to Achieve Additional Savings.
▶ 0:23:42OIT's Software Asset Management Program mitigates risks such as decentralized software procurement, lack of product ownership, loose license and data OIT will identify existing capability gaps in software and asset visibility, establishing a single source of truth for all software data usage data, and developing and implementing new SAM policies and formal uh governance procedures.
▶ 0:24:08The SAM program is being building a centralized software repository to streamline software management and stakeholder communication. OIT is also working to automate tasks within the SAM lifecycle framework where feasible, and leveraging existing tools and systems for efficient implementation, integration, and This comprehensive approach allows VA to effectively plan for future software needs, manage updates, and ensure proper disposal of outdated or unused software.
▶ 0:24:38OIT's recent progress in the deployment, management, and retirement phases of software asset lifecycle has realized significant software license cost avoidance across its top 15 most widely used OIT recognizes that software procured or deployed outside of approved channels poses security, compliance, and financial risks.
▶ 0:25:02VA is working to mitigate those risks by establishing this program by providing training and facilitating a culture of change through continuous improvement and metrics and by rigorously applying policies on procurement and oversight.
▶ 0:25:16We are strengthening governance mechanisms, improving software visibility, and working with VA business owners to rationalize requirements, minimize unauthorized software OIT is issuing guidance for all related relevant staff focusing on requirements definition, acquisition planning, software life cycle management, and the risks associated with unauthorized software procurement. Training staff on SAM processes and policy compliance is a crucial aspect of the program.
▶ 0:25:47By educating staff early in the acquisition process, we aim to foster a culture of accountability and proactive software management. VA is committed to refining our policies and practices to ensure the most efficient use of resources and the best possible outcomes for our veterans.
▶ 0:26:03VA's way forward includes improvements to VA directive 6008, which governs all IT acquisitions and enforces the Chief Information Officer oversight for software purchases, ensuring compliance with federal laws. These procurements also go through the Federal Information Technology Acquisition Reform Act FITARA review processes.
▶ 0:26:26VA is also working on new guidance for product service codes used in procurement and medical devices that have a software component that are connected to the VA network or stand-alone medical devices that store persistent patient information. These updates close many previous gaps that allowed licenses to be purchased without centralized review.
▶ 0:26:46OIT is also establishing ways to measure the effectiveness effectiveness of the SAM program, including capturing our cost savings, assessing compliance rates, utilization efficiency, and resolving audit findings. OIT is committed to continuing our progress, strengthening our government, and fully optimizing our software portfolio. But effective software management is not just the responsibility of a single office, a collect rather a collective effort across VA's entire enterprise.
▶ 0:27:15Through OIT's ongoing efforts in the SAM program, VA hope aims to ensure that every dollar spent on technology supports the critical mission of serving America's veterans with excellence. Thank you for your continued support and for the opportunity to testify here Very good. Thank you, sir. Mr. Carter, do you have testimony or were you guys joint uh together? We're joint together. Okay, very good. And Ms.
▶ 0:27:43Harris uh now you're now recognized for 5 minutes. Thank you, Chairman Barrett, Ranking Member Budzinski, and members of the subcommittee. Thank you for inviting us to testify today on VA's software license management. As requested, I'll briefly summarize our prior work on the Department's efforts to track software license usage and manage restrictive licensing practices. As you know, the use of IT is crucial to helping VA effectively serve our nation's veterans, and the investment in IT is substantial.
▶ 0:28:12In fiscal year 2025, VA plans to spend roughly 985 million dollars on software, including commercial software licenses. And I appreciate the subcommittee's attention on this topic because software licenses has been problematic across the federal government for a long time, and especially at VA. And with more effective management, the potential for cost savings could be This afternoon, I'll highlight two key The first is that VA lacks the ability to know if it's purchasing too many or too few licenses.
▶ 0:28:42Last January, we reported that VA did not track software licenses currently in use, nor did it regularly compare the inventories of those licenses to purchase records. These are key activities needed to effectively manage software licenses. And while the department was able to report to us its five most widely used software vendors at that time, officials could not demonstrate that they were tracking the appropriate number of licenses for each item of software currently in use.
▶ 0:29:10In contrast, vendors perform these activities all the time to ensure that customers are adhering to contract terms and can apply cure up penalties when customer use exceeds those stated terms. Without data of its own, VA cannot verify whether the vendor's information is accurate. Moreover, VA will continue to miss opportunities to reduce costs on duplicate or unnecessary licenses.
▶ 0:29:33As such, we made two recommendations to VA to fully address these key management In response to our recommendations, VA has told us it has implemented new procedures for its most widely used software licenses and will implement a centralized approach to ensure software is tracked throughout the entire life The department fully expects to address our recommendations by the end of the We will continue to monitor VA's actions to do so.
▶ 0:29:59My second point relates to work we did this past November on restrictive software licensing practices, which adversely impacts agencies cloud computing efforts, including those at According to VA officials, some of the restricted practices that they have encountered including um a vendor requiring the agency to pay additional fees to use the vendor's software on infrastructure from third-party clouds, making the agency repurchase the existing software licenses being used on its on-premise
▶ 0:30:29systems for use in the and also requiring or promoting vendor lock-in such as by not allowing another vendor software to be used in it with its own hardware. VA officials reported that the restrictive licensing practices generally impacted the the cost of cloud computing and the choice of cloud service provider. However, the department had not established guidance for effectively managing the impacts from these restrictive licensing practices.
▶ 0:30:56Further, VA had not assigned responsibility for managing such Accordingly, we made two recommendations to VA to address these gaps. VA has has concurred and stated it will provide actions it plans to take to address both of these recommendations. So, moving forward in the two areas I noted, it will be critical for VA to fully implement our recommendations as soon as possible.
▶ 0:31:20Doing so will present VA with opportunities to reduce costs on duplicate or unnecessary licenses and also take action to mitigate the impact of restrictive licensing practices. And as I mentioned earlier, the cost savings potential is tremendous. The department had previously reported it had saved about $65 million over 3 years due to analyzing just one of its software licenses. So, you can imagine the possibilities when you apply that across the entire inventory of licenses. That concludes my statement and I look forward to addressing your questions.
▶ 0:31:52Thank you. And the written statement of both Ms. Harris and Mr. Van Bemmel will both be entered into the record. So, thank you. Um and we'll now proceed to questioning and I'm going to recognize myself first for 5 minutes for for questions. Lights just came on. So, Ms.
▶ 0:32:19Harris, when when you were saying that um in your testimony, vendors know very carefully if any contract that they're under if there's level of usage in excess of the terms of the contract. If they buy 10,000 licenses and 10,001 people try and use it, they're going to know that and they're going to charge uh the agency for that additional usage, it sounds like based upon your testimony today. That's right. It's It's called a true-up penalty. Okay.
▶ 0:32:48but it's not also the case that we are being noticed if we bought 10,000 licenses and only 6,000 are being used over the last, you know, 6 months to a year, some some period of time that we could get a pretty good indication whether or not it was ever going to get used. Well, given that vendors do track the usage, they most likely do know if the licenses are being underutilized, but most likely they're not going to present that information to the government.
▶ 0:33:14Do we know if any of the that the contract has would require that notice to be given back to specifically the VA or any other federal agency that you may have come across? We have not seen those terms stated in the the VA contracts during the course of our audit. Is there a best practice that would call for that type of awareness with a vendor contract? If you go out and buy a number of licenses to know how many are being utilized?
▶ 0:33:39I would consider that to be a leading practice to have that included in the contract, but it's also important for the government to do its own tracking of usage because we need to be able to verify that the vendor information is accurate. Okay. Thank you. Um and then Mr. Van Bemmel, you said that this um back at the end of or sometime in 2024, uh the SAM office, right? Uh remind me again what that stands for. Software asset management program. Okay.
▶ 0:34:08And that's sort of designed to be an office that really takes this into account, is that correct? Yes, sir, that's correct. And if if that's the case, I know we've got still some lingering findings from Ms. Harris's review of this, can you give us an update on the progress that's been made in that effort to kind of true up what what needs we have versus what we're actually using? Yes.
▶ 0:34:33On the two recommendations, we're we are close to getting ready to close out with GAO formally. The tracking of the top 15 titles that was one of the first recommendations. We we are now able to do that and reliably take that inventory against our acquisition records and do true ups in real time as as she indicated.
▶ 0:34:53And the second one is a much larger Getting beyond the 15 titles, you start you know, we have very good visibility on more than 80% of that. We can see almost all of the software today. And we have made some investments in the visibility on the end point. So we can actually not just see the licenses assigned to this user, but we can actually tell if that user is using that license.
▶ 0:35:19And that's a a piece of software that we did not have even a year ago. And so that improved visibility is really getting that visibility and then tying that together with the acquisition data is the work that we still have together with us for all of those larger remaining titles. So to me it's less about who's being granted the license and more about whether or not they're using it.
▶ 0:35:40So there may be a portfolio of things as a basic package that an employee may get, but if they don't need one of those licenses, that's where I think the rub comes from is where do you split out? Yes, they need this, this and this, but do they need this enhancement of other products available? The other question I had for you is if I work at a local VA hospital say perhaps in Michigan, not far from where I live even. Just to use an example.
▶ 0:36:08What if I were working there and I thought, hey, I need this additional software program. What is the process that is used by the VA to determine if that is already under contract and if I can just add on to that contract or are we duplicating efforts where the VA facility in in close to my home is buying the exact same product that a VA facility 500 miles away is purchasing and we haven't bundled that into a more efficient purchasing agreement.
▶ 0:36:36That's one of the I think longer-term challenges that we're we're facing with the SAM program. Getting visibility on what's in use today and being able to track license usage in real time and reconciling that so we're not overbuying, underbuying, and that people are really using the software that they've asked for. The second one is being able to rationalize requirements with our business stakeholders. The hospital, for example, has Sorry, you said rationalize a requirement.
▶ 0:37:03So, when somebody asks for a product, we often look at that as a requirement. In a software category, we might have already purchased software that fulfills that same requirement and they could use one of the existing softwares available in the catalog today or it might have a it might be part of a new requirement. And so, having a discussion with the the stakeholders on the business side and asking them about the requirements and and making sure that we buy smartly. And then like to your point, this is a a submission from Michigan.
▶ 0:37:34How pervasive is this across the entire enterprise? How common is this practice? And making sure that we buy once and we do an enterprise approach to a solution. I think that's really where the challenge is for this program uh stem from is the historical legacy of the way VA was organized. That hospital in in Michigan, for example, 5 or 10 years ago was an independent operating unit within the Department of VA.
▶ 0:37:58Um and they made their own local procurement decisions on software like that if it was related to the care of of veterans. And so, now we're trying to get business side to look at an enterprise approach as IT has been centralized over the last 5 or 6 years and taking those independent uh titles that are out there. We have a lot of our software catalog titles are comprised of those individual titles and rationalizing them down into a a subset of um of softwares. Okay.
▶ 0:38:29Thank you. Uh ranking member Ms. Kiley for 5 minutes. Thank you, Mr. Chairman. Um Mr. Van Bemmel, um the VA's software access management policy VA directive 6403 outlines the roles and responsibilities of VA leadership, OIT leadership, IT acquisition professionals, and service legal agreements SLA concerning VA OIT operations. This policy was initially issued back in July of 2015. Um has the policy been updated since then?
▶ 0:38:59We are staffing um changes that we are we have really learned a lot over the last year. This GAO report, as you mentioned in January of 2024, prioritized software asset management for the for OIT. We put a lot of effort into it um and we're learning a lot of things. So, we think that policy, along with 6008 and some of our other policies, um and and the processes that stem from policy need um some updating.
▶ 0:39:24So, it's So, it's not updated yet, but it sounds like you're you're working That is part of the overall plan of establishing this program, updating that that document as well as others. Okay, great. And then maybe just a follow up a little bit on what you were just discussing about kind of the tracking system for um the current user licenses.
▶ 0:39:43Um so, what I think from what I understood, you're saying that currently it's kind of tracked at the local level, but that you're trying to move it more toward the enterprise, where the enterprise is tracking it, moving it out of the local kind of jurisdiction. Is that accurate? Yes. And and for the most part, I would say that we have good visibility now across the entire enterprise.
▶ 0:40:04Um the the real challenge is putting all that into a central repository and tying it to acquisition data, so that we don't have to do a manual reconciliation across different systems. And that was going to lead to my next question. What offices um within the VA are going to be responsible if they're not already fully responsible for the enterprise, you know, view of this work? What offices will be or are in charge of understanding and storing the list of user licenses currently?
▶ 0:40:34And user operations is the lead for this effort, but where we're doing it in partnership with several different groups within OIT, Don's office, office of strategic sourcing, which does a lot of acquisition work is another partner in that. And then we have a team that does a lot of the cloud software development, platform management, those those those types of product offerings. So, SaaS is largely in their footprint. And that's why we have these these different repositories because different groups had different responsibilities.
▶ 0:41:04We're going to pull all of that into a central system. My organization will be the lead for that aggregation of data and then pulling all of that together as a corporate process. So, am I understanding this correctly or are like three entities within the VA that All of them, yes. And then eventually that's all going to be consolidated into your kind of purview. Right. Okay.
▶ 0:41:25And who has currently access to all of this different these different sets of Can you clarify what you mean? Like if people in OIT Well, are there people in OIT, who in the VA outside of the VA might have access to this type of data? Okay. So, all of these repositories are internal really for the IT staff.
▶ 0:41:49Our intention when we get into the central repository is to be able to expose the software catalog to our population of supported users. And to your point about the user in Michigan, when they have a software request, they can look it up and say, "Hey, we already bought this thing." And they could see, "Oh, we do have this. We we have 10 licenses we've purchased. We have five available." And so, that's the that's the overarching intent is that it's Mhm. internal for VA use.
▶ 0:42:17Right now, that data is really just the IT operators, but we would like to be able to share that in a in a request type way with our end users. So my understanding is correctly using the Michigan example, currently they kind of make that decision locally, but eventually what's going to happen is they're going to go to the VA to your office specifically and kind of inquire whether there's a license or a contract so they don't duplicate basically a contract or recreate a license
▶ 0:42:47that exists. Okay. Thank you. Miss Harris, my question, your recent reports identified the need for clear roles and responsibilities for effective software license management. What steps has the VA taken to create kind of speaking I think a little bit to these earlier questions, better ownership around these processes? What does VA still need to accomplish in this space from GAO's perspective?
▶ 0:43:12So we're still waiting for information from VA in terms of what steps they're going to take to implement our recommendations, but you know, to Mr. Van Bemmel's point, you know, I think he did a really good job of laying down the the groundwork for the culture at VA of the decentralization of the software licenses. And so now this movement to centralize is a very positive step that's that's essential to effective software license management.
▶ 0:43:38And then having you know, a single point of of accountability is also something that's going to be important. It sounds like it's going to be funneled through through his office, the buck will stop with him. So it sounds like all the key, you know, the key things that they're doing all sounds good. We're going to, you know, have more more dialogue with VA and verify those activities and then come back to you with with what we Looks like. Okay, thank you and I will yield back. Thank you. Mr. Luttrell. Thank you.
▶ 0:44:08Just for absolute clarification for myself, Mr. Van Bemmel, off the chair and the ranking member. I have DeBakey in my district or in my area, excuse me, Michigan. of the 170 plus VA facilities will now have to come directly to your office to get a software update, upgrade, or enhancement for their facility instead of going to Microsoft or Oracle or Adobe or ServiceNow
▶ 0:44:38or Splunk. Is that a fair statement? All of those procurements already come through OIT. The difference that we're is is that we're going to start having a requirements discussion instead of, you know, we we talked about this one software for this one local hospital. We'll be looking at that as an enterprise approach. But all of all in in terms of the large titles, the the Microsoft, the Oracles, all of those kinds of things, um those are already under enterprise license agreements.
▶ 0:45:05We already have a process in place by which they request those licenses. We manage all of that software inventory for them. So, when that when that request comes into your office, how many people are responsible for making the decision And and this one person?
▶ 0:45:22Is there like a a representative inside your office that's speaking directly to me and proverbial me and saying, "Hey, you got the green light on this?" This is the part we talked about governance processes and updating policies, establishing a a a the correct mix of stakeholders that can do those software reviews and make those decisions. It will not be me all by myself, and we want to have representation from the business. Um where we, you know, this is relatively new construct in VA.
▶ 0:45:50Oftentimes we took, you know, the VAMC directors uh request and we fulfilled that request. If we had the software dollars available. If we didn't have the software dollars available, we worked uh you know, the tradeoffs there. Um but in the future, what we really want to do is have a collective conversation. And so, that also means that on the on the stakeholder side of the house, from for BHA, VBA, those those uh sorts of entities, that they have representation on these uh titles.
▶ 0:46:17Um, the first thing we want to be able to do in this central repository is expose the total the totality of licenses in use today. Is this something I've forgive me. Go ahead. I need to inject on it. Is this something that we're going to have to purchase more software to do? If we're going to have to build out an internal VA enclave infrastructure or something to process what we're asking. Is that more money that we're going to have to spend or does something like this already currently exist? Currently exists. And how are we in this problem?
▶ 0:46:48How do we get in this problem? we here? If this already exists, how are we here? I mean, it So, it's With 33 million on Oracle, 438 annually, 438 million for Microsoft every year. Yes. 12 million on Adobe. And Splunk, I've never even heard of that, but it it's apparently search and makes sense of large amounts of data. Obviously, it's not doing a very good I mean, where what are what are we missing here? If it already exists currently inside the VA Yeah.
▶ 0:47:17and we have this problem. How long have you been How long have you been in this position? 2 and 1/2 years. The investment that I'm talking about was made very recently. In the last year, we made two major investments that are improving our visibility. One is a piece of software that gives us visibility across all 600,000 endpoints for VA, so I can see real-time uses of a software. That's a different the name? We we have already done that. no, what's the name of it? The vendor? Yes. The product is called Tachyon. It's from a company called 1E.
▶ 0:47:48How much did that cost us? Uh, it's about 12 million dollars for the entire fleet. So, we need to add that onto this list. It was already paid for last year. Um, now, the other piece that we're we're bought is a repository software asset management module that goes onto our existing IT ERP that we use for all of our incident and problem management. This is a place where we're going to where we also have a module for hardware asset management. We'll now have a software asset management. Again, it's a place to store inventory.
▶ 0:48:14It's a place to um register in every single VA or specifically in the VA No, it's it's managed at the OIT centrally. And so, all those endpoints now will report back to the central repository and be able to do reconciliations against that repository. I still understand why if that's the case we would and why can't our hospitals talk to each I I I'm I'm I'm I'm not sure I understand I I know you're not. I'm just kind of throwing that out there.
▶ 0:48:43I just It seems if the the with the the a large amount of money that we're spending on all these different software profiles, uh you would think like one could do it I'm assuming that's just not the case. I mean, I yield back, Mr. Chairman. Thank you, Mr. Bergman. Thank you, Ms. uh Sherfey-List-McCormick, 5 minutes. Thank you so much, Mr. Chairman. Um, I think both sides would agree that there's a lot of money being wasted based on the mismanagement of the software.
▶ 0:49:13And I do have some concerns on how we're going through and streamlining the process. So, please indulge me as we go through these questions. So, Mr. Harris, how much money is wasted because VA doesn't aggressively manage its We don't know that figure because we because VA does not have the information available in terms of what they're tracking because they're just unable to track the full inventory at this time. Now, Mr. Van Bommel, um who is the executive in charge of the software assis- assets management?
▶ 0:49:43That's me. You So, you're responsible for it? Okay, and this is a $7 billion a year management system, correct? Uh no. no. Are you talking about this the service asset I mean the software asset management module in in our ERP? Yes. ServiceNow? Yes. Uh no. How much is it? Oh, I'd have to take that back for the record. I don't know, to be honest with you.
▶ 0:50:09Now, how much would it cost to catalog and maintain the catalog of all the assets to include staff and other costs? How much would it cost to maintain this entire program? Let me take that back for the record. It's probably a an evolving picture. And are you engaging in any use of AI to help manage? Yes. And how many are you actually using at this current moment? Again, let me take that back for the record.
▶ 0:50:36There's there are potential for AI involved in this process. Now, how long have you been using any of these AI? Um so, in in terms of the software asset management system, that is a relatively new investment and we have not finished the work on fully fielding that. It won't be done until the end of this year. Our intention is to be able to get real-time feeds from the field and then reconcile that data against other data feeds.
▶ 0:51:05And we do see an opportunity on the platform to introduce AI to help with that work, but we are not today integrated AI because we have not fully deployed the system. And so, have you find any promising information showing that it's actually going to identify any costs or help you with cost management? Yes, we've already made we've already had some significant cost avoidance just in the top 15 To date, I think it's the number is somewhere about $136 million that we've we've had in terms of getting better visibility.
▶ 0:51:36And have they done a good job in identifying any redundancy or idle contracts and licensing? I think the the bigger issue that we have in terms of redundancy is not uh duplicative software, but in a software category, we have four or five titles that do the same types of things um just in a different way. And then the question would be what is the best value for VA in terms of reducing those four or five titles to say one or two uh different options.
▶ 0:52:06And that's the work that we have ahead of us even after we get the asset uh management system in place. That is a long-term effort to try to go through all of those those titles today. So my concern and the reason I'm asking these questions is cuz I'm wondering if we would be better suited by having an actual executive like people in place to go through, or is AI a better way for us to actually find these um and identify these redundancies, especially since we're limiting how much money you're going to have access to and the impact of those cuts into making sure that we can identify.
▶ 0:52:36And so that's why I was asking you to see what is actually promising, or should the funding actually be put towards having individuals there to actually map out how we can actually find those costs and have you found any um AI programs that actually are working? And so to that extent, could you also provide us at a later time a full list of all the AIs you have been using, so we can actually be watching that to see what's working and what's not? Yeah, let me clarify. We are not in full operation today, so we're not currently. We do have our eye on some opportunities in this space.
▶ 0:53:07Um AI will help us with the aggregation of large data sets and help us understand what's in use and what what um are the most likely choices. But ultimately, conversations with the business is people conversation and then actually doing the work to migrate to do an acquisition for say one to two titles versus the four or five that we have in that product category, and then migrating people from one set of softwares to those one and two titles instead of the three or four that they may have. That's a people led issue.
▶ 0:53:37So um I would say that the investment in at least the near term is going to be a people-led issue. And so if you don't have that investment with people-led issues, how do you think the whole process in really bringing down the cost that we're seeing? Do you think that's going to be successful or will we have another year where we're fighting the same problem? Well, I also think that there there's a lot of opportunity here for us to do more with less.
▶ 0:54:01When you start to get the information coming back from all of the endpoints and you put it into a great repository there, right now that process is very manual. We have to do manual reconciliations on some of the some of these products and so that's much more labor intensive. So I think the automation piece and the ability then to see data in one place is going to really reduce the overall manpower requirements. Thank you so much. I yield back. Thank you. Appreciate it. I'll recognize myself again for 5 more minutes. So we have Mr.
▶ 0:54:31Van Bommel, we have 170 independent VA hospital facilities, is that correct? I manage by areas and there are 137 areas and within that we have a couple of hospitals. There are a few areas that have more than one hospital in it, but yes, it's 137 Well over 100. Yes. You know, more than 150 even. Correct.
▶ 0:54:53Prior to this establishment of the office that you described, they were all kind of independent autonomous agencies within VA almost as if they were their own department to a degree and more or less purchasing their own software and all of those things on their own. Through the formation of your office, that IT purchasing should be consolidated through your efforts. Is that correct? That's correct. And we're not quite a year and a half into this now.
▶ 0:55:24Well, so centralization in IT has been an ongoing for more than 6 or 7 years. We wrote VA directive 6008 to help clarify what they could spend their non-IT acquisition appropriations on and what we would spend the IT appropriation on. That regulation is evolving as we move forward.
▶ 0:55:46But yes, essentially in you know, in the past they were all operating as independent units and now we're managing IT centrally and software is one of those. I see a little parallel to a degree between this electronic health record rollout we've been dealing with on this committee as well as some of this other stuff where we had independent systems and to Mr. Luttrell's point they couldn't even then send files directly to one another because they had evolved separately over time.
▶ 0:56:13Then you have IT systems that are procured in different ways and you may not know if the agency across town or across the state or across the country is purchasing that same IT equipment. There's not currently a catalog that you could go to to see if another agency is already purchasing software through this particular vendor that you could then add on to. Is that correct? Correct. From a user perspective there is not. then do you manage the contracts themselves or just the purchasing of them? Just the purchasing of them.
▶ 0:56:43Of the license? Yep. Don's team does a lot of the acquisition work. We have another team that does the soft the software as a service, this cloud-based software. So Mr. Carter then perhaps this question is best to you. Is there anything that is standard boilerplate in our contracts as we're going out for large-scale acquisition, not a ones and twos kind of acquisition of very you know, something irregular but a large portfolio that would require feedback to the VA as to actual license usage so we would know if we're over
▶ 0:57:14purchasing or Thank you Congresswoman for that question. We actually do look at that when we develop the vehicle. A lot of times and I think there's a All software purchased has to be reviewed. They have to use a correct product service code. So that's what we've been harping on through the FY 12 process since 2015. So, when the product is requested, has to be uh go through the process, reviewed, and then it's tracked from that point on.
▶ 0:57:43The issue we've had is that at times some of the medical folks purchase this, it might be for a medical device, and they focus on it as a medical device, not letting us know that or using the correct product service code. And that's when you get that IT purchase that we miss. So, the CIO doesn't have the opportunity to review it or add it to the catalog only till after the maintenance time comes up.
▶ 0:58:08medical device like the the program where people have a a pacemaker that relays information to their cardiologist, and there's an interfacing on the cardiologist side, a piece of equipment that receives that information? Yes, sir. Okay. And then, would it be also the case that sometimes there's a projection made where we buy, you know, a a bulk number of licenses expecting them to get filled out over time.
▶ 0:58:37Like we're not just going to buy for the 10 people that want it. Now, we're maybe going to buy more than that expecting it to be a greater need, and that thing goes under utilized. Are we over time calibrating that to the appropriate usage? Well, sir, I can only speak to the ones that we've done. A great example is our award of the Microsoft contract recently.
▶ 0:58:56In the contract, what we've added in that contract is a clause that allows us if the amount goes below 10%, if we see an adjustment, then we're allowed to go back and readjust that contract. That was something that we didn't have in before. Below 10%, so if 90% are going unused, No, I mean, sir, 10% usage. Okay. Uh below 10% usage of the total. We have over 570,000 license.
▶ 0:59:23So, if 10% is not being used, we can go back and readjust that contract. Okay. During that contract, when we awarded that contract this past year, over the life cycle that contract for 5 we avoided $136 million. So, we saved By calibrating it more precisely. Overall, cost avoidance on that contract. Okay. Thank you. Um, I will have a few more questions, but I'm going to yield to Ranking Member Bozinski for 5 minutes. Okay, thank you, Mr. Chairman.
▶ 0:59:51I think picking up on um questions that some of my colleagues have had, Mr. Van Bemmel, if I could ask you um we're talking about how we're dealing with what is a largely decentralized um licensing process. And so, how do we eliminate duplications? And how do we coordinate a local coordinate with the VA enterprise?
▶ 1:00:11I am curious, the VA's business integration and outcome service, B BIOS, how what role would they play in in getting at these questions and issues? The BIOS office was an office within OIT that essentially does that stakeholder engagement and management and and has representatives from the business on the other side of that conversation.
▶ 1:00:34So, they are useful to this process as far as eliminating redundancies, being a resource to the local VAs that are looking for additional software support. In some way, we need to manage those conversations with our business And that makes sense to me. I mean, it's they seem like an important they play an important role. I do you want to ask um ask you, what is the current status of BIOS?
▶ 1:00:59Um we have heard that BIOS the BIOS team has been told that their work is not mission critical. Um that they are expecting to be a part of the reduction in force plan. Do you know of any Are Are they included in the in the riff planning? I am not managing that for larger OIT. I'd have to take that back for the record. Okay, would Mr. Carter know? No, ma'am. We'd have to take that back to further record. Okay.
▶ 1:01:25I would be very interested to know because I think there has been a lot of conversation around who's helping um local VAs and how were they they seem to be a entity that could be helpful moving forward. Um Mr. Van Bommel, can I also ask so going back to your testimony, you stated that um when centralized data repository is completed at the end of the year, OIT will be able to establish clear key performance indicators to measure the effectiveness of the SAM program.
▶ 1:01:55Um have those key performance indicators already been established? They have not. Um I we are learning a whole lot over the course of this install and as we uh get visibility on the software and we want to start setting some goals and and one of those questions is to your point um what opportunities do we have for consolidation?
▶ 1:02:15Um and so we're looking at the totality now that we can see the totality of the endpoints and the software breaking those down into the software product categories and then saying is it reasonable to expect that we could get down to one or two titles per software category and then what does that timeline look like? So those would be the kinds of metrics that we're looking for. You're looking for. Okay, thank you. Um I'd like to switch gears um Mr.
▶ 1:02:37Van Bommel and and ask you I've read um President Trump's executive order calling for the consolidation of common goods and services acquisition under the General Services Administration. I do have some concerns about how that would impact software purchasing at VA. How does the VA plan to respond to President Trump's executive order requiring GSA to take over IT procurement for the entire federal government? I'm going to defer to Don since he does acquisitions.
▶ 1:03:08Yes, Congresswoman. Well, we work with GSA. We've been involved in their category management as well as uh conversations for the past year. Obviously, we still use the vehicles that are available and when they come with a plan, we'll be ready to support, but we still go for the best value for the government when we're looking at Um do you think that GSA is equipped and capable of taking over all of VA's IT purchasing in addition to the rest of the
▶ 1:03:38federal governments? And my second follow-up would be where would you draw the line between what GSA is allowed to take over versus what VA should I I think I would have to agree with what plan they come with and we have to work through it, but again, it goes to the best value to the government. I think we've all used GSA vehicles before, but we've also gone with other vehicles that show the best value and we prove with a business case, so we're allowed to work that way.
▶ 1:04:07So, have you already started to engage in conversations then with the GSA over what this what this would potentially look like? No, ma'am. We have not gone that road Okay. Um I'd love to to keep um in touch on that. I just, you know, want to make sure that the VA's um you know, ability I think to procure IT isn't hurt in that process taking over such a big endeavor as GSA taking over all federal government's procurement.
▶ 1:04:35Um how would GSA's goal of cutting its budget in half impact their abilities to carry out the VA's IT purchasing? I I cannot answer that question, ma'am. Um I just remain concerned that there that this administration seems poised to move forward with this plan to restructure federal IT acquisitions, but it's not clear how the impact um how that's going to impact, as I said, the VA's acquisition process.
▶ 1:05:03Um several articles have noted that they are losing too many key people um including some SES in the federal acquisition service, so um I just wanted to note that. Mr. Van Bommel, well actually I'm going to I'll I'll yield since I only have 20 some seconds left. Go ahead. All right. Mr. Luttrell. Thank you, Mr. Chairman. This this may a question for you, Mr. Carter. Mr.
▶ 1:05:33Van Bommel, you said some software plat they we may have three or four the same software profiles inside of an organization that so we're we're duplicating efforts, correct? So in a product software product category, I'll give you a good example. Zoom and Teams. They both do video conferencing. Okay. But they're different and and our legal community very much uses Zoom, not a lot of Teams. Across federal government, we use a lot of Teams.
▶ 1:06:01And so the question becomes do we support one or both? And there's probably two or three other titles in that same product category. And that's I'm sure every single VA facility has a different argument. Correct, sir. Mr. Carter, can we when we're dealing with our business partner can do we have the opportunity to to I'm assuming this is like bundling. What do you say?
▶ 1:06:22Can we put this together the VA put this together themselves or does Microsoft or Adobe say, "Hey, this is what we offer you and this is what you have to go with?" Uh so we work with the third-party So at times we do have an opportunity to speak to Microsoft. So we tell them what our priorities are, what we're looking for, and then the price that we get back is what they offer the third-party resellers to sell to us.
▶ 1:06:48How do we How do we This may seem this seems like may turn into a a larger problem. Teams and Zoom's a great great point. So when when we start to upgrade software and the expansion of the technology starts to run, but our smaller facilities stay with Zoom and everyone else goes something different, we'll always have to purchase Zoom for that smaller facility because that's what they want.
▶ 1:07:14So, as this starts to play itself out, even antiquated or dated software will continue to remain Correct me or I may be wrong in this. I'm just I'm I'm talking out loud to It it seems to be that once the software at any any any particular level is inside the VA, it's going to have to and we're just going to start stacking things on top of it. Or am I No, I think our strategy is the we're probably the opposite direction.
▶ 1:07:40There were there were a lot of local choices that were made that were maybe appropriate to their budget at the time. We are managing the IT software spend for VA now. Um and so they it's it's really more about requirements. And then as to your point, as we bundle those requirements together, we do better um and we pick better products. So, if each facility makes the argument, "Hey, we're we're a Teams facility or we're a Zoom facility." Is there going to be a point in which the VA says, "Hey, look, we're we're going with a clean slate." Correct, sir.
▶ 1:08:07Yeah, we're going to have to choose in every product category the best of of that best value for for VA. And then we would reduce and there's a lot of hidden costs in supporting so many titles per product category. And so reducing that really does not only make a standardized VA, which reduces operational costs, it also reduces our IT costs. That's the challenging part with what we're dealing with with the electronic health record.
▶ 1:08:31Each facility is different and they're making a different argument whether or not, "Hey, look, we don't have we don't have the body count or we don't have the expertise to implement this system. So, it's a challenge because every single institution is its own institution underneath the VA umbrella. I would say that that if you ran this as a business, you would not want to have every one of your hospitals to be totally different. It is not cost-effective in the True statement. Yes, sir. Okay. Um I Thank you, Mr. Chairman. I'll yield back. Sure, I'll recognize myself for a minute.
▶ 1:08:59I would say that while that may be how we would have designed it from the beginning. We also woke up in the America of today this morning. So, we have to confront what we have, and I find myself saying that more often as I'm here longer.
▶ 1:09:14But, to the ranking member's point about the GSA consolidating some of the large-scale purchasing, I know that there was a report with Adobe where we achieved a discounted procurement based on the overall bundled nature of the software license, and I'm pretty sure Adobe doesn't care whether you're doing work at the VA or whether you're doing work in the IRS.
▶ 1:09:41Like, their software is going to operate the same in both. And that license holder is insignificant to them. And if we're achieving a much more bundled, you know, the Costco model of buying software licenses versus the one-off retail model that you would otherwise get. Should we expect to see more of that cost savings as this effort is continued? Again, it's more of an acquisition question for Don. I would only say that we we definitely and Don and I spoke about this before.
▶ 1:10:12We agree that there is better buying power in consolidating requirements. In commodity software, there is an opportunity to do that. It really is devil's in the details. What does GSA get as a price versus what we've negotiated on previous agreements. And so, we really want to look at that. And And to the congresswoman's point, um that's really brings true in the commodity space. But, as you start to get into specialized software for the mission that VA does, that is probably not true.
▶ 1:10:38cardiologist program not the same as There's a lot of specialized software for medical and benefits delivery that is unique to the VA. Sure. Okay. Mr. Carter, I don't know if you have anything you want to add to that or Oh, yes, sir. Yes, Congressman. This past year, even about eight of our contracts, our larger contracts. We had a cost savings really cost avoidance of over $230 million. Was that through GSA or was that through your own negotiating? Through our own negotiating. Okay.
▶ 1:11:09And I think the biggest thing of that was looking at what we're buying and really going down to where the need is, even lot pricing on some of the software, but also looking at the usage level of that And we've been working toward that the past year and a half of looking a lot closer when we come in. Also to understand that when we purchase software, when it comes over to requirement, it goes to a governance board.
▶ 1:11:32So all users get an opportunity to review and have comments before it gets to to the futar area and we look at it to ensure that we're getting the best value before Excuse me, it goes out for solicitation. Thank you. Uh Mr. Van Bemmel, uh I mentioned in my opening remarks that the federal CIO asked VA to submit software inventories for the five vendors that GAO identified in their report.
▶ 1:11:56Um now, for nearly $30 million worth of licenses, VA said it was unknown whether the licenses were being used. Does that mean that we didn't know if part of that was being spent on licenses or we didn't know that the licenses being procured were actually being used by the by the end user that's assigned to that computer that it was installed on? Okay.
▶ 1:12:23I don't have that data called for me, so I'd have to take that back for the record, but we can certainly help with that. We uh look forward to your response and appreciate you looking into that. Um Ms. Harris, in Michigan, I spent time in the state legislature before coming here and there was kind of a department that managed a lot of this procurement for a lot of different things, whether it was hardware, software, a lot of different um aspects of that. Not unlike it it seems to me a lot like what the GSA is looking to do with software licensing on a bigger scale in the federal government.
▶ 1:12:53Um, do we have anything like this through the VA or is really this um GSA model the the closest thing that would sort of what resemble that? I mean the GSA model is probably the closest for the federal government. Mhm. I I think within VA, I I would say that probably OIT purchasing software on behalf of the enterprise is probably the closest next closest at the department level.
▶ 1:13:22And do you look at all at the best practices of other governmental agencies like, you know, how states do it? I understand that's obviously a much smaller scale than federal government would be, but maybe some lessons learned can come from whether or not you have autonomous agencies buying their own and then from there sub-autonomous agencies like the VA has had through the medical, you know, hospitals for so long to where you're really kind of diminishing your purchasing power through that whole chain of of uh of you know, chain of command
▶ 1:13:53basically. We've not done any work at the state level to identify best practices at least as it relates to managing software licenses. We do it in other areas of work like in unemployment insurance systems for example, but uh but we've we've not done that. That would be a very interesting review for Um but we do intend to evaluate GSA's work to consolidate that the buying power across the federal government. We do intend to start that work towards the end of the year.
▶ 1:14:22Um so that that is something that we do that I think the results of that will be very interesting um in terms of how they intend to implement that executive order. Thank you. Appreciate it. Member Brzezinski. Thank you, Mr. Chairman. Um Ms. Harris, actually can I just follow up on on my questioning around um GSA kind of taking over VA's IT procurement? Could you give just from GAO's perspective, any kind of concerns or opportunities you see in that?
▶ 1:14:51Just any reflections on that happening? I mean, I think that um certainly we we've done a lot of work in the telecommunication space as it relates to, you know, um GSA um having this this large government vehicle for the government to to to utilize. Um and typically what we've seen are are, you know, cost overruns and delays in agencies implementing um you know, and and moving off of one legacy contract to to the the new contract.
▶ 1:15:21And so, I think that, you know, in terms of how GSA implements this um I I think Mr. Van Bemmel was very correct that, you know, when it comes to the commodity IT, Microsoft, Adobe, Salesforce, those are probably the areas where you can get that economies of scale. But it the the devil's going to be in the details, as he said. I I I agree with that. Okay, that's helpful. Thank you. Um Mr. Van Bemmel, can I I've heard some concerning stories about DoD's impact at the VA?
▶ 1:15:50Um for example, we've heard that a DoD employee, Sahil uh Lavinia, has been using AI to write code and has been integrating that code into some of VA's existing systems. What government structures are in place to ensure that any code added to VA system isn't going to have unintended I'd have to take that one back for the record. That's a complicated uh software engineering question.
▶ 1:16:19I wouldn't be able to answer off right Okay. Um has DoD been required to abide by any governing structures that you govern in structures that you have as it relates to IT? I'd have to take that one back for the record, ma'am. Okay. do you know what qualifications Mr. Lavinia has and has um have have to be modifying VA systems any qualifications he has to be dealing with the system is the question. I'm not aware but I have to take that one back.
▶ 1:16:51I just have obviously some grave concerns about these special government employees who have no experience working in government or the programs that they're toying with having unfettered access into the VA's IT systems. The committee has sent several RFIs about this and we've really received zero response. So while you while you take it back I appreciate that. We really would like to see responses to these questions. Mr.
▶ 1:17:21Van Bemmel I'm going to switch gears. It's my understanding that the software used by VA employees is only a portion of the software VA purchases. Does your office also monitor IT resources provided to veterans by the office of connected care? No ma'am. Do you know how OCC tracks the software that they provide to veterans? I do not. Ms.
▶ 1:17:47Harris when GAO did its evaluation of software licenses at VA did it include software provided to veterans as well as a software purchased for employee usage? My understanding that it was just employee usage the inventory so I don't believe it included that universe of software. Okay.
▶ 1:18:06If we're going to focus on all this effort on centralizing software license management as discussed why would we create a whole separate software separate process for software provided to veterans? Yeah.
▶ 1:18:20I mean I think that to your earlier point about shadow IT it's important for VA to have full visibility into all the software that's being purchased for the department whether it's for the the the VA users or for My last question Mr. Van Bemmel, um, what would it take for the VA to adopt a more enterprise-like approach to assistive tech procurement for veterans? Can you help me with assistive tech, what you mean?
▶ 1:18:48Um, that's Blinded? Oh, blind and low-vision veterans, excuse me. Yes. Oh, okay. Yes. So, we we do procure uh software for our employees. Mhm. Um, and and a distinction on that question there, our appropriation is for VA uh to provide for VA employees on the VA network. So, not to provide services or software to veterans directly. This is the corporate internal VA usage.
▶ 1:19:18The soft The Office of Connected Care, for example, that software is procured through a different appropriation, and it is not on the VA network. Um, and so, it's separate. And so, any of those assistive technologies for veterans that are not on the VA network, uh I do not manage that. Um, but if you are a VA employee, and you need assistive technology, um we do manage that, and we have uh uh responsibility for procurement. Okay. Great, thank you. I yield back. Thank you.
▶ 1:19:48I'll now recognize myself again. Um, Mr. Van Bemmel, uh what is the breakdown in spending between VA's 15 largest software titles and the uh rest of the VA's software Um, can I take that one back? Sure. Yep. We manage um I know there's quite a few, but I know the top several account for the largest share of the total pie. Um, but then there's a a smattering of many others beyond that. Yep.
▶ 1:20:16Um, does the department know exactly how many total software licenses they have purchased, and what they are using currently, or is that inventory still being done? We We now have 100% visibility. I could tell you that we're managing about 4,400 titles, 4,433 uh commercial off-the-shelf titles and about another 224 SaaS offerings. Hey, sorry. So, 300 and some off-the-shelf, you're talking like Microsoft Word, something like that.
▶ 1:20:48and those are all commercial off-the-shelf offerings and so it goes you know, it's everything that runs that gamut. Now, Microsoft Office 365 would be a SaaS offering and that's in our other titles of two What is Sorry, so I can go get Microsoft 365 at Best Buy right now or I could go online and download it. How is that not a commercial off-the-shelf product? Yes. And the distinction is if you install it locally on the machine, commercial off-the-shelf product, that's a different category of management.
▶ 1:21:18SaaS is a cloud-based offering and so if you get Office 365, it's not actually installed on your machine. And what does SaaS stand for? Software as a service. Okay, so that is the cloud-based Yes. the shift from what you used to get Microsoft on a disk, you know, office products on a disk to now getting it where you pay a subscription per year or something and it stores your information on the cloud. Yes. Okay.
▶ 1:21:43Now, that commercial off-the-shelf, that is still basically downloaded or disk installed on a on a actual individual device. Yes, for the most part. Okay. And we have thousands of those and hundreds of SaaS. Correct, sir. Okay. Um, all right. Um, and then the federal CIO asked for that information by the end of April. Have you provided that to them already?
▶ 1:22:10Um, so we are largely I'd say 90 95% through with that entire inventory. The gaps we have in the inventory are not on the identification of the software or even the licenses in use, but it's really down to who owns the software in VA. Who is the person accountable for that that license?
▶ 1:22:30And that really is the work that we have going forward to identify the accountable person for every software Um and then you know, manage working with that requirements owner on the way ahead for their product. Okay. And then um from there, how many different organizations within VA are currently purchasing software licenses? Is it all now consolidated through your office?
▶ 1:22:52Yes, it all comes through our the Battle Creek VA, you know, 40 minutes from my house, they want to download or install something, it's got to go through your office now. And we're reviewing every one of those acquisitions. Okay. Um and then how many different vendors is VA currently buying software licenses from? I assume in that thousands and hundreds, some of those are the same vendor with different products. Correct, sir. I'd have to take that one back to get you the correct answer. Okay. Thank you.
▶ 1:23:20Then I believe I had a question for Ms. Harris, if I'm not mistaken. actually, Mr. Carter. Um apologize. GAO's recommendation on comparing data on software license usage to purchase records is still open. Um what is VA currently doing to compare what they are buying to what they are We are actually looking at what we buy.
▶ 1:23:45A couple software titles like Oracle and Oracle Java, those are unlimited license agreements that we have. Okay. But also what we're doing is we're kind of trying to measure out what we have. You know, it wasn't for the best value. On Oracle Java, which is a strictly for development, we can do that and we check that. Is it a better value to go with unlimited license? Mhm. We were able to prove that. Oracle's a little bit different only because Oracle has about 190 products.
▶ 1:24:13So, we're that's an ongoing effort. It's not everything Oracle, it's just that product you can buy on an unlimited basis, and then if you want to buy something else, it's a different contract. Correct. Okay. And Microsoft, we're down to who's using what on all that license. Okay, so with Microsoft, we're not buying a all you can eat buffet of Microsoft like we are with Java. It's a different system that we have. Correct. And when just like when you buy 365, you also have to buy a virus protection.
▶ 1:24:43That's included as well and that's per per software per individual user. And it goes as well on machines and everything. this will be my last question before I yield again. What would you say is it common or uncommon to have the as many as you want enterprise-wide unlimited license versus a per user license? It feels to me like the per user is more common. Yes, sir. Okay. It's common so per user is more common. Okay. Thank you.
▶ 1:25:14Ranking member Mrs. Kim, do you have any further questions? Okay, I just have a couple more that I'll run through and then we can close out. Um Mr. Card, once VA has a complete inventory in one system and is able to compare data on whether a license is being used purchase to purchase records, how long will it take VA to go through each software title to figure out if they are I'll have to let Mr.
▶ 1:25:38Van Berman answer that, but for the Microsoft for our new agreement, we used to do reclamation every 90 days. We now have a written where we do it every 30. Okay. We go back and review if it's not being used, we can pull it back to the inventory. Okay. Thank you. any other We're good. All right. I think we are good. Appreciate both of you being here today. Um and before I close out, I'll yield to the ranking member if you want to give your closing. Thank you, Mr.
▶ 1:26:08Chairman, and thank you again to the witnesses for being here. I'm glad to hear that the VA is making progress in getting its software asset management systems in order. Um I agree that it is important to be able to track what the department owns and what it is being used to minimize waste and unnecessary costs. I am concerned though that the department isn't looking strategically at ways this program can be expanded to cover all assets purchased by the department.
▶ 1:26:34Until the department is tracking all its assets to include those utilized by veterans as well as employees, we can never be totally sure that it is preventing waste. I'm also seriously concerned about the potential of moving, especially the specialized software, um of VA's IT acquisition to what I believe will be a gutted GSA. If the Trump administration were serious about this executive order, they would be fortifying GSA to handle the onslaught of requirements from across the federal government.
▶ 1:27:04Instead, they're bleeding it dry, just like other agencies. There is no other way um there's no way that an anemic GSA is prepared for this. VA employees and veterans should not have to wait in line behind other agencies to get the resources they need, especially when they have fully functional processes to get these resources Also, I want to be real clear that we cannot allow the department to continue to obscure the activities of Dodge in the VA.
▶ 1:27:34It is unacceptable that these people are given unfettered access to VA, its access to contracts, and its IT systems with zero transparency and zero oversight. If these actions are in the best interest of veterans, then then I ask, why is the department hiding them? I am terrified of what kind of damage they're doing and what the lasting impacts will be for our veterans. We must do better, and I look forward to working with the chairman um to do the necessary over oversight to ensure that our veterans are protected.
▶ 1:28:04Thank you, Mr. Chairman. I yield back. Thank you, ranking member Bergman. And I want to thank our witnesses again for appearing today to discuss VA software licensing and management practices. Thank you for uh your candor with your uh answering of questions and for those that are being taken back, we look forward to your response. I've made this point before, but information technology is the backbone of every service and benefit that VA delivers to veterans.
▶ 1:28:27Whether you're filing a claim, whether you're going in for an exam, whether you're receiving your health benefits or your disability claim uh payment, everything runs on information technology right now and we all understand that. This isn't the VA of 40 years ago and software is an essential aspect of VA operations and Mr. Van Bavel, to your point, you know, a generation ago each of these VA facilities were very autonomously operated and run and now we're trying to do the hard work of having some standardization.
▶ 1:28:56We're seeing that with electronic health record roll out. We're seeing it with other uh software licensing as well. So, I'm encouraged by that desire to get that done. Uh but as VA and the federal government's technology footprint has grown over the years, it has clearly led to inefficiencies and waste of over purchasing and under utilization and not right sizing what every uh product would be designed for. You'd be hard-pressed to find any expert on software licensing that would disagree with this.
▶ 1:29:23As I said, I know this isn't unique to the VA, but this is the committee that you know, has oversight of the VA and that's why I want to lead this effort VA employees need software to do their job, but there is no good reason why VA can't do better at cutting waste and negotiating prices. Part of House Republicans mission and why the American people gave us the majority is to root out inefficiencies and waste where they exist in government to make it work better. Software licensing is a clear example of this that has been acknowledged for years by both sides of the aisle.
▶ 1:29:53Uh to the VA witnesses, as I said, I appreciate your candor today, but now this subcommittee needs a commitment, a commitment to transparency, timelines and accountability. We're ready to support you, but we'll also hold you accountable as well. Let's clean up the mess and stop the waste and keep our focus where it belongs, providing good forward-thinking care and services to veterans who've earned them.
▶ 1:30:16Uh, I ask unanimous consent that all members have five legislative days to revise and extend their remarks and exclude extraneous material include extraneous material. Without objection, so ordered and this hearing is