GSA puts HSPD-12 on a tight timeline

The first large-scale test of the technology that will put Homeland Security Presidential Directive-12 into practice is slated to be in place by Oct. 20.The General Services Administration set the timeline for a vendor to test and deploy an enrollment and card production system over the next three months, then install the system at multitenant federal buildings in Atlanta, New York, Seattle and Washington.GSA was expected to modify the solicitation to include options for expanding beyond the four sites. Officials have said that there are about 400 cities that would need the service, though the modification, which had not been released at press time, was not expected to specify how many cities GSA might include.Some industry experts warn that, while the technology is not complicated, putting the pieces all together in one place for the first time raises some red flags'one of them being the inevitable kinks that come with doing something for the first time.Still, GSA expects vendors to be ready to meet the three milestones outlined in a recent request for proposals issued on FedBizOpps.gov late last month (see chart). Proposals are due July 19.'Through conversations with vendors, the government is convinced that industry is prepared to deliver an integrated HSPD-12 enabling system,' the RFP said. 'Additionally, the government accepts industry's assertion that compliant systems' are ready.GSA is basing its belief that industry is ready to provide a 'soup-to-nuts' system that complies with Federal Information Processing Standard 201-1 on the responses it received from a request for information late last year.The agency also approved three systems integrators last month to provide end-to-end services'General Dynamics Corp., Lockheed Martin Corp. and XTec Inc. of Miami.'We are qualifying vendors on the basis of their past experience with government or commercial biometric and identity management systems,' said David Temoshok, GSA's director of identity policy and management. 'We are not performing a system review.'The fact that GSA is not reviewing systems worries some industry experts.'Vendors who will be able to get all the pieces put together and working deserve a lot of credit,' said Randy Vanderhoof, executive director of the SmartCard Alliance, an industry association in Princeton Junction, N.J. 'There are a lot of pieces that haven't been put together in one system and operating under the new specification. This is going to be a challenge for anyone.'He added that because agencies and vendors have not put together this type of system before, contractors will very likely find a number of things that have been overlooked.'There will be a significant amount of validation of a lot of assumptions,' Vanderhoof said. 'The timelines are tight, but vendors who did Registered Traveler [for the Transportation Security Administration] got the first airports up in a matter of weeks.'The National Institute of Standards and Technology tested end-to-end systems earlier this year. Temoshok said those tests proved the systems will work.Jeremy Grant, a senior vice president and emerging technologies analyst for the Stanford Washington Research Group of Washington and a former executive at Maximus Inc. of Reston, Va., said the challenge is not so much the technology or the processes, but any one system's ability to interface with other agency systems.Grant said the difficulty will come when the HSPD-12 system has to trade data with systems at the Office of Personnel Management for vetting employees, which includes the FBI's fingerprint check, as well as agency human resources systems.In questions and answers from vendors at a recent industry day on the RFP, GSA officials said users must access the front end of the system via a browser using Web services and Simple Object Access Protocol interfaces. The back end, GSA said, must also be accessible via the Web.Scott Price, a group senior vice president of the technology solutions group for General Dynamics IT, said meeting GSA's milestones shouldn't be too difficult. 'Essentially, the government is saying to industry: Put your money where your mouth is,' Price said. 'There is some risk involved and it will take a good bit of collaboration between the vendor and agencies. But this is doable.'General Dynamics plans to bid on the RFP, as do EDS Corp. and Lockheed Martin, according to company officials.Price said storage is another challenge. The system will have to connect to a variety of different databases, and pull and push information to those repositories.Grant said it could be a major sticking point for agencies considering a shared-services provider. 'From what I've heard, a lot of agencies said the shared-services concept sounds nice, but they are not sure it reflects what they are doing,' Grant said.But with the Office of Management and Budget requiring agencies to use shared services or justify why they would not, many agencies will have no choice.OMB also is touting the savings of using shared-services providers.'The government estimate of savings by doing a large-scale shared service versus agencies doing it independently is 3 to 1,' said Chris Niedermayer, chairman of OMB's HSPD-12 Executive Steering Committee. 'The savings come from each agency not having to buy an identity management system and the volume discounts when you buy 1 million public-key infrastructure certificates.'Niedermayer said the RFP is designed to let GSA figure out who is qualified and to run a test in the four cities.'If all goes well, we would look to expand it and make it a key model for shared-services providers,' he said. 'Nonmandatory shared services have great cost and overhead benefits, and we will prove it.'