Agencies take inventory of IT assets
Connecting state and local government leaders
How can you secure what you don't know you have?
How can you secure what you don't know you have?Few agencies had satisfactory answers when Rep. Adam Putnam routinely posed this question at congressional hearings over the past two years.Putnam, former chairman of the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, found in his November 2003 cybersecurity report that only five of the 24 largest federal agencies had completed inventories of their IT hardware and software.And although the Florida Republican has moved on to a new congressional committee, the question still looms over many agencies.The government's emphasis on enterprise architecture and better overall IT management practices is prompting CIOs to improve the way they manage their hardware and software assets.'Asset management often is the trigger to make better use of consolidated information,' said Gene Leganza, vice president for government research at Forrester Re- search Inc. of Cambridge, Mass. 'The Office of Management and Budget is forcing agencies to have better business cases, and to do that you have to know what you have.'Several government and industry experts predict that over the next year, agencies will increase their efforts to track IT assets more accurately and use that information more strategically.'There is more of a focus on property and managing it than in the past,' said John Saracco, project manager for the Labor Department's E-Property initiative. 'In the past, the General Services Administration was concerned about the disposal of government property, but there is an increasing emphasis on managing property more efficiently.'GSA's continued push with the SmartBuy initiative, a program to establish a series of enterprise software licenses for use governmentwide, is one example of the administration's emphasis on asset man- agement. The White House has also added federal property asset management to the President's Management Agenda scorecard.OMB and the Homeland Security Department are leading an interagency working group on cybersecurity that looks at a variety of factors, including IT inventories, said Karen Evans, OMB's administrator for e-government and IT.'Agencies have to develop a manageable way to handle their inventories,' Evans said. 'We have added specific reporting requirements under the Federal Information Security Management Act that deal with configuration management. We want agencies to accurately say they have secured 100 percent of their systems.'OMB is taking a three-step approach to making asset management a priority:
Labor uses bar codes and readers to keep track of its IT assets, the department's John Saracco says.
Rick Steele
- GSA will continue to award SmartBuy contracts to consolidate software licenses.
- Agency enterprise architectures will provide the road map of future hardware and software needs, and those needs could be rolled into SmartBuy.
- The interagency working group may develop governmentwide recommendations for asset management standards.
'We are seeing more agencies look at lifecycle asset management,' said Robert Kaehler, general manager of Sunflower Systems of San Ramon, Calif., an asset management software vendor. 'The goal is total asset visibility, so you know at a moment's notice what you have and where it is.'
GSA's Office of Governmentwide Policy is forming an interagency team to develop best practices for managing IT assets. The objective is to create a database of IT assets so agencies can make unused hardware and software available for use by other federal offices.
Officials also said agencies' attention to inventories will improve their patch and configuration management. Robert McNeil, a senior analyst for management services with Forrester, said organizations buy 5 percent to 10 percent more software licenses than they need. But with better asset management, agencies should have a better handle on their IT work, human resources and finances'and therefore be able to better target their buys, he said.
Although many agencies are falling short on their inventories, a handful of agencies, such as the Labor Department and Social Security Administration, have IT asset efforts well under way.
No codes'radio
At SSA, for instance, officials are testing radio frequency identification tags to track IT assets on 128 desktop systems and 15 servers at the Office of Property Management in Baltimore.
Gary Orem, an SSA IT specialist, said RFID tags are replacing the bar codes employees previously used to mark hardware and software.
Using an RFID scanner, SSA employees can collect in a matter of seconds 128 to 200 characters of information about each device, including manufacturer, serial number and name of the user.
'This will save us at least 40 percent just in the time it used to take to read the bar codes,' Orem said.
Labor's asset management system, like SSA's, is saving time and improving accuracy. The department's CIO Office has installed Oracle Assets software, which more than 400 employees use. The application relies on bar codes, which are scanned or manually typed into the database. Labor IT workers finished installing the system in June, replacing 25 separate systems.
NEXT STORY: OMB issues new marching orders