NASA’s software asset management practices have left the agency exposed to cybersecurity risks and other major operational and financial concerns, according to a new inspector general’s report. 

The IG report, published on Thursday, said NASA lacks an enterprise-wide software asset management program and detailed a series of operational breakdowns and other software management issues, from misaligned offices to “wasteful” spending on unused licenses. 

“NASA has not implemented a centralized software asset management tool to discover, inventory and track license data as required by federal policy,” the IG report said, noting the agency spent nearly $15 million on unused software licenses over the last five years. “NASA’s software asset management policy is not comprehensive or standardized, leaving roles, responsibilities and processes unclear.”

According to the report, NASA’s software management issues begin at the early stages of the acquisition process: the agency apparently lacks a procedure to adequately approve and track its software purchases. The problems continue throughout the software lifecycle and have forced the agency to unnecessarily spend approximately $35 million over the last five years – including $20 million in software fines, penalties and overpayments. 

At the current rate, the IG predicted that NASA is “years away” from achieving the goal of transitioning to a centralized and consolidated enterprise computing model that would successfully oversee its software asset management operations and ensure the implementation of federal cybersecurity best practices. 

“Efforts to implement an enterprise-wide software asset management program have been hindered by both budget and staffing issues and the complexity and volume of the agency’s software licensing agreements,” the report continued. 

The IG recommended a series of actions to strengthen NASA’s software management processes, including implementing a single tool across the agency to oversee its software management operations, as well as a centralized repository of the agency’s internally developed software applications.

It also called for expanding software license awareness training and developing an agency-wide process to limit privileged access to certain software. The IG also recommended NASA align its agency software management manager position to report to its chief information officer. 

The IG has issued multiple other reports over the last five years pointing to “pervasive weaknesses” in NASA’s internal controls and supply chain risk management practices, as well as “insufficient progress” on the agency’s path to improve its overall IT governance. 

NASA largely concurred with the IG’s findings, but said it was in the process of piloting an enterprise-wide software asset management tool that would take until 2027 to scale to enterprise. 

The agency otherwise agreed to implement most recommendations in full by the end of 2023, including centralizing software spending insights and new classifications to track license infractions and true-up payouts, developing agency-wide processes to limit access to certain computer resources and further enhancing its software management practices.