OMB preparing to open shop for IT security LOB
Connecting state and local government leaders
The Office of Management and Budget hopes to begin setting up several lines of business for IT security in the next fiscal year, with the selection of the first centers of excellence.
The Office of Management and Budget hopes to begin setting up several lines of business for IT security in the next fiscal year, with the selection of the first centers of excellence.
The task force established to develop the new line of business expects that at least a dozen agencies will be named centers of excellence for various security functions, allowing them to market their expertise to other agencies, said task force member George Bonina, the Environmental Protection Agency's chief information security officer (CISO).
'If you are not a center of excellence for a particular function, you will have to be a customer of a center and your business case will have to reflect that in each of the areas,' Bonina said Tuesday at the Federal Information Assurance Conference being held at the University of Maryland.
A line of business is a necessary business function that typically is outside of agencies' primary missions, such as financial management or, in this case, cybersecurity. Rather than have each agency duplicate non-essential functions, OMB designates agencies that have shown expertise in these areas to provide them to other agencies on a fee-for-service basis.
Improving performance in IT security is becoming more important. Despite a growing awareness of the need to improve security of the government's information systems, federal spending on security has been static, at about $4.2 billion a year for the last three years, while total IT spending has been slowly growing, according to OMB estimates.
In March, OMB set up a multi-agency task force with a goal of establishing a security line of business during the fiscal 2007 budget process. The task force has representatives from 34 agencies, most of them at the CISO level, Bonina said. The task force has recommended establishing a governance board that would oversee a line of business project office. The project office would set criteria and establish performance measures for those agencies designated centers of excellence. Multiple centers would be designated for each of four problem areas identified by the task force:
- Security training, to standardize security processes, develop common criteria and help provide a career path for information security professionals in government.
- FISMA reporting, to standardize reporting processes and help ensure consistent and effective IT program management.
- Situational awareness and incident response, to improve the sharing of information about IT vulnerabilities and threats and provide resources for responding to security incidents.
- Lifecycle security solutions, to provide a common methodology for evaluating security tools, so each agency does not have to go through the process from scratch each time it acquires security products or services.