NASA’s software asset management practices have left the agency exposed to cybersecurity risks and other major operational and financial concerns, according to a new inspector general’s report. 

The IG report, published on Thursday, said NASA lacks an enterprise-wide software asset management program and detailed a series of operational breakdowns and other software management issues, from misaligned offices to “wasteful” spending on unused licenses. 

“NASA has not implemented a centralized software asset management tool to discover, inventory and track license data as required by federal policy,” the IG report said, noting the agency spent nearly $15 million on unused software licenses over the last five years. “NASA’s software asset management policy is not comprehensive or standardized, leaving roles, responsibilities and processes unclear.”

According to the report, NASA’s software management issues begin at the early stages of the acquisition process: the agency apparently lacks a procedure to adequately approve and track its software purchases. The problems continue throughout the software lifecycle and have forced the agency to unnecessarily spend approximately $35 million over the last five years – including $20 million in software fines, penalties and overpayments. 

At the current rate, the IG predicted that NASA is “years away” from achieving the goal of transitioning to a centralized and consolidated enterprise computing model that would successfully oversee its software asset management operations and ensure the implementation of federal cybersecurity best practices. 

“Efforts to implement an enterprise-wide software asset management program have been hindered by both budget and staffing issues and the complexity and volume of the agency’s software licensing agreements,” the report continued. 

The IG recommended a series of actions to strengthen NASA’s software management processes, including implementing a single tool across the agency to oversee its software management operations, as well as a centralized repository of the agency’s internally developed software applications.

It also called for expanding software license awareness training and developing an agency-wide process to limit privileged access to certain software. The IG also recommended NASA align its agency software management manager position to report to its chief information officer. 

The IG has issued multiple other reports over the last five years pointing to “pervasive weaknesses” in NASA’s internal controls and supply chain risk management practices, as well as “insufficient progress” on the agency’s path to improve its overall IT governance. 

NASA largely concurred with the IG’s findings, but said it was in the process of piloting an enterprise-wide software asset management tool that would take until 2027 to scale to enterprise. 

The agency otherwise agreed to implement most recommendations in full by the end of 2023, including centralizing software spending insights and new classifications to track license infractions and true-up payouts, developing agency-wide processes to limit access to certain computer resources and further enhancing its software management practices. 

NASA faced another moon shot.

This time, the civilian space ­agency’s monumental task was to help reduce government spending on software. For NASA, that meant eliminating duplicate software licenses and negotiating better prices for the software it already buys.

In 2008, NASA created the Enterprise License Management Team (ELMT) to inventory its software assets and to centrally manage software purchases.

Since then, NASA has leveraged its buying power to take advantage of volume pricing. It also has identified unused software licenses in some locations and is reusing those licenses elsewhere in the organization, says Darryl A. Smith, NASA’s agency software manager. Those efforts have led to $103 million in cost avoidance since 2011.

“By getting better insight into what we’re spending, who is buying it and where the assets are located, we can then look to see if there are better ways to procure software and whether there are existing assets in the ­environment that we can reutilize,” Smith says.

In 2014, the last time the Government Accountability Office studied the issue, investigators found the vast majority of federal agencies did not have adequate policies for managing software licenses. But because the government spends roughly $6 billion each year on commercial software, agencies see a strong incentive to improve software license management and to cut costs.

With that in mind, the Office of Management and Budget began requiring each agency to appoint a software manager to oversee software licenses and to maintain an accurate inventory of those licenses by using automated software asset management tools.

OMB also asked agencies to analyze that inventory, so they can consolidate redundant applications and find other cost-saving opportunities. The guidance calls for a team of senior federal IT and acquisition leaders — called the Enterprise Software Category Team — to negotiate government wide ­software license agreements with vendors.

Amy Konary, vice president of software business models at IDC, says using technology and new processes to better manage software licenses should lead to savings across government.

“Centralization can help with volume discounts, but it can also help organizations avoid buying duplicate licenses,” she says. “It gives you an accurate picture of what everyone needs.”