OMB snaps purse closed for new IT

The Bush administration is pulling in the IT security reins on 18 agencies, requiring them to fix weaknesses in existing systems before developing new ones or upgrading old ones.In rolling out the president's fiscal 2005 budget proposal, the Office of Management and Budget told the agencies they would have to tap 2004 and 2005 funds allotted for development and enhancement efforts to do the security fixes.That makes perfect sense on paper. But what appears to be a smart idea doesn't always translate well in reality. Why? Because reprogramming funding is a long, arduous process, several CIOs said. It involves approval up and down the command chain within an agency, as well as the OK of OMB and Congress.'The process takes weeks to months depending on the situation,' Veterans Affairs Department deputy CIO Ed Meagher said. 'This is the right thing to do, but the mechanism to do it is not very good.'Karen Evans, OMB's administrator for IT and e-government, said the 18 agencies were allocated $8.5 billion in all this year for development, modernization and enhancement efforts (see chart). If problems continue into next year, she said, agencies will need to again shift funds to security fixes from the $8 billion requested for new projects and upgrades for 2005.'We don't want agencies to layer a new system on top of an infrastructure that is not secure,' Evans said. 'Agencies need to secure what they have, and if they do it efficiently, they will have remaining dollars to meet other priorities for modernization efforts.'Eight agencies got high marks, and OMB has exempted them from this stricture: the Commerce, Defense and Energy departments, the Environmental Protection Agency, NASA, the National Science Foundation, the Nuclear Regulatory Commission and the Office of Personnel Management.The requirement dovetails with the administration's and Congress' renewed emphasis on IT security. In turn, agencies failed to meet OMB's December goal that at least 80 percent of systems be certified as secure by third parties or their inspectors general.Rep. Adam Putnam (R-Fla.), chairman of the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Affairs and the Census, gave the federal government a 'D' on its overall cybersecurity in his annual report card.The subcommittee has scheduled a March 10 hearing on the report card and implementation of the Federal Information Security Management Act. Later in the spring, Putnam plans to hold hearings on patch management, IT security and information sharing as well.'OMB understands the chairman's concerns, and they are stepping up in a meaningful way and utilizing the tools they have available,' said Bob Dix, the subcommittee's chief of staff. 'Clearly the outcome of the report card demonstrates agencies need to invest more funds and resources. It is not a high enough priority in many agencies.'Although some lawmakers are behind the effort, others might not be, which is another possible complication when it comes to shifting funds, Meagher and other CIOs said.Agencies must ask permission from Congress to reprogram funds. VA, for instance, must receive consent for all transfers of more than $500,000.The key to moving money, he said, is to have control of your IT portfolio. 'You must show how the cuts in spending will affect your mission,' Meagher said. 'It is rare for Congress to overrule a request to move money, but you have to do your homework and make a good case.'Evans also said good IT portfolio management plays an important role in bolstering security. 'The whole premise of this is to look at your IT portfolio, don't just look at things in segments and pieces,' he said. 'You have to look at what your IT program is. If you are a CIO at department level, what are you doing, how are you managing this throughout the entire department, what are the priorities of the department and how to go forward?'Vance Hitch, Justice Department CIO and chairman of the CIO Council's Security and Privacy Committee, said moving funds could disrupt some programs.But Hitch said he doesn't expect too many problems at his department because Justice has built up its internal cybersecurity controls over the last 18 months. He said his staff will concentrate on ensuring the security standards are being applied adequately across all programs and systems.'We have 17 IT security standards and 250 specific risk-control requirements in the agency's operational, management and technical IT security controls,' said Dennis Heretick, Justice's chief information security officer. 'We have to make sure each of these security standards and requirements is being used for each program and system.'