Summary: The Federal Aviation Administration (FAA) is spending billions of dollars to modernize software-intensive air traffic control systems. GAO examined the processes used to acquire software, using models developed by Carnegie Mellon University's Software Engineering Institute to define and determine an organization's software process maturity. FAA did not fully meet any of the criteria to achieve a "repeatable" level of maturity, the second of a five-level maturity scale. FAA's processes for acquiring costly and complex software are ad hoc, sometimes chaotic, and not repeatable across projects. Moreover, serious process weaknesses have prevented FAA from satisfying the one criterion for the third level of maturity, called "defined." FAA is committed to increasing process maturity in its air traffic control modernization effort, but despite four years of effort it still lacks an effective management approach for improving software processes. In addition, FAA lacks an effective plan to prioritize improvements and measure progress. As a result, it has launched a "hodge podge" of software acquisition improvement efforts without any analytical justification.
