[House Hearing, 108 Congress]
[From the U.S. Government Publishing Office]
INFORMATION SECURITY IN THE FEDERAL GOVERNMENT: ONE YEAR INTO THE
FEDERAL INFORMATION SECURITY MANAGEMENT ACT
=======================================================================
HEARING
before the
SUBCOMMITTEE ON TECHNOLOGY, INFORMATION
POLICY, INTERGOVERNMENTAL RELATIONS AND
THE CENSUS
of the
COMMITTEE ON
GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED EIGHTH CONGRESS
SECOND SESSION
__________
MARCH 16, 2004
__________
Serial No. 108-167
__________
Printed for the use of the Committee on Government Reform
Available via the World Wide Web: http://www.gpo.gov/congress/house
http://www.house.gov/reform
______
U.S. GOVERNMENT PRINTING OFFICE
94-838 WASHINGTON : DC
____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; (202) 512�091800
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001
COMMITTEE ON GOVERNMENT REFORM
TOM DAVIS, Virginia, Chairman
DAN BURTON, Indiana HENRY A. WAXMAN, California
CHRISTOPHER SHAYS, Connecticut TOM LANTOS, California
ILEANA ROS-LEHTINEN, Florida MAJOR R. OWENS, New York
JOHN M. McHUGH, New York EDOLPHUS TOWNS, New York
JOHN L. MICA, Florida PAUL E. KANJORSKI, Pennsylvania
MARK E. SOUDER, Indiana CAROLYN B. MALONEY, New York
STEVEN C. LaTOURETTE, Ohio ELIJAH E. CUMMINGS, Maryland
DOUG OSE, California DENNIS J. KUCINICH, Ohio
RON LEWIS, Kentucky DANNY K. DAVIS, Illinois
JO ANN DAVIS, Virginia JOHN F. TIERNEY, Massachusetts
TODD RUSSELL PLATTS, Pennsylvania WM. LACY CLAY, Missouri
CHRIS CANNON, Utah DIANE E. WATSON, California
ADAM H. PUTNAM, Florida STEPHEN F. LYNCH, Massachusetts
EDWARD L. SCHROCK, Virginia CHRIS VAN HOLLEN, Maryland
JOHN J. DUNCAN, Jr., Tennessee LINDA T. SANCHEZ, California
NATHAN DEAL, Georgia C.A. ``DUTCH'' RUPPERSBERGER,
CANDICE S. MILLER, Michigan Maryland
TIM MURPHY, Pennsylvania ELEANOR HOLMES NORTON, District of
MICHAEL R. TURNER, Ohio Columbia
JOHN R. CARTER, Texas JIM COOPER, Tennessee
MARSHA BLACKBURN, Tennessee ------ ------
PATRICK J. TIBERI, Ohio ------
KATHERINE HARRIS, Florida BERNARD SANDERS, Vermont
(Independent)
Melissa Wojciak, Staff Director
David Marin, Deputy Staff Director/Communications Director
Rob Borden, Parliamentarian
Teresa Austin, Chief Clerk
Phil Barnett, Minority Chief of Staff/Chief Counsel
Subcommittee on Technology, Information Policy, Intergovernmental
Relations and the Census
ADAM H. PUTNAM, Florida, Chairman
CANDICE S. MILLER, Michigan WM. LACY CLAY, Missouri
DOUG OSE, California DIANE E. WATSON, California
TIM MURPHY, Pennsylvania STEPHEN F. LYNCH, Massachusetts
MICHAEL R. TURNER, Ohio
Ex Officio
TOM DAVIS, Virginia HENRY A. WAXMAN, California
Bob Dix, Staff Director
Chip Walker, Professional Staff Member
Juliana French, Clerk
Adam Bordes, Minority Professional Staff Member
C O N T E N T S
----------
Page
Hearing held on March 16, 2004................................... 1
Statement of:
Corts, Paul, Assistant Attorney General for Administration,
Department of Justice...................................... 88
Dacey, Robert F., Director, Information Security Issues, U.S.
General Accounting Office.................................. 9
Evans, Karen, Administrator, Electronic Government and
Information Technology, Office of Management and Budget.... 47
Merschoff, Ellis W., Chief Information Officer, Nuclear
Regulatory Commission...................................... 138
Rush, Jeffrey, Jr., Inspector General, Department of the
Treasury................................................... 97
Weems, Kerry, Acting Assistant Secretary for Budget,
Technology and Finance, Department of Health and Human
Services................................................... 150
Wu, Benjamin, Deputy Under Secretary for Technology,
Department of Commerce..................................... 58
Letters, statements, etc., submitted for the record by:
Clay, Hon. Wm. Lacy, a Representative in Congress from the
State of Missouri, prepared statement of................... 190
Corts, Paul, Assistant Attorney General for Administration,
Department of Justice, prepared statement of............... 91
Dacey, Robert F., Director, Information Security Issues, U.S.
General Accounting Office, prepared statement of........... 11
Evans, Karen, Administrator, Electronic Government and
Information Technology, Office of Management and Budget,
prepared statement of...................................... 50
Merschoff, Ellis W., Chief Information Officer, Nuclear
Regulatory Commission, prepared statement of............... 140
Putnam, Hon. Adam H., a Representative in Congress from the
State of Florida, prepared statement of.................... 5
Rush, Jeffrey, Jr., Inspector General, Department of the
Treasury, prepared statement of............................ 99
Weems, Kerry, Acting Assistant Secretary for Budget,
Technology and Finance, Department of Health and Human
Services, prepared statement of............................ 152
Wu, Benjamin, Deputy Under Secretary for Technology,
Department of Commerce, prepared statement of.............. 61
INFORMATION SECURITY IN THE FEDERAL GOVERNMENT: ONE YEAR INTO THE
FEDERAL INFORMATION SECURITY MANAGEMENT ACT
----------
TUESDAY, MARCH 16, 2004
House of Representatives,
Subcommittee on Technology, Information Policy,
Intergovernmental Relations and the Census,
Committee on Government Reform,
Washington, DC.
The subcommittee met, pursuant to notice, at 1:17 p.m., in
room 2247, Rayburn House Office Building, Hon. Adam Putnam
(chairman of the subcommittee) Presiding.
Present: Representative Putnam.
Staff present: Bob Dix, staff director; John Hambel, senior
counsel; Chip Walker and Shannon Weinberg, professional staff
members; Juliana French, clerk; Suzanne Lightman, fellow; Adam
Bordes, minority professional staff member; and Cecelia Morton,
minority office manager.
Mr. Putnam. Good afternoon. A quorum being present on this
rainy Tuesday and the sound system back up and running, the
Subcommittee on Technology, Information Policy,
Intergovermental Relations and the Census will come to order.
Good afternoon and welcome to another important hearing on
cybersecurity. This is the first oversight hearing conducted by
the subcommittee on IT security this year.
Last year, we learned a great deal about threats,
vulnerabilities, new technologies and new strategies for
addressing the important issue of information security. Since
our last hearing on this topic, the only thing that has really
changed is the urgency of the threat.
While I believe that it may be fair to say that there might
be more discussions taking place about these issues, the time
for discussion and debate now yields to a more important
requirement for action. Every month virus and worm attacks are
becoming more prevalent and more malicious. One recent report
placed the worldwide mitigation costs for the month of February
2004, at $83 billion. Some say that number is overinflated. So
let's say that it's off by half. That's still a staggering
number.
The cyber threat poses some very unique and difficult
challenges. Our infrastructure and government systems can be
attacked from anywhere, at any time. We know that various
terrorist groups are very sophisticated and becoming more so
each day, not to mention government-sponsored attacks. Our
government has taken dramatic steps to increase our physical
security, but protecting our information networks has not
progressed commensurately, either in the public or private
sectors. DHS is really just getting its feet on the ground in
this arena. While I acknowledge the efforts of the National
Cyber Security Division, I will reiterate my concern that we
are collectively not moving fast enough to protect the American
people and the U.S. economy from the very real threats that
exist today.
The privacy and security of the public remain at risk. The
economic damage being done to our economy is significant. The
magnitude of this clearly is what makes this hearing so
important, because governmentwide we are still failing to
adequately secure our networks. Government must be the leader.
We must set the standard, and we must do it now. The oversight
by this subcommittee will be commensurate with the threat: ever
increasing and aggressive.
In December of last year, the subcommittee released the
2003 Federal Computer Security Score Card. It was the 4th year
that Federal agencies were graded, following the process begun
by former Congressman Steve Horn. This past scorecard for the
first time based grades on the criteria established by the
Federal Information Security Management Act [FISMA].
Chairman Davis, through his FISMA legislation as part of
the E-Government Act of 2002, laid the groundwork for better
security and better reporting for the governments's computer
systems. This year's grades were based on the FISMA compliance
reports that the agencies provided to Congress and OMB in
September of last year. OMB has worked hard to advance computer
security at all the Federal agencies. I would also like to
thank the GAO for their invaluable help in preparation of these
grades.
This year is an important grading year because, for the
first time, we can accurately compare the agencies to a
previous year because the grading elements provide an apples-
to-apples comparison.
This year overall the Federal Government received a grade
of D. That's a modest increase over the F the government
received last year.
For the first time, two agencies, the Nuclear Regulatory
Commission and the National Science Foundation received A's.
Fourteen agencies have increased their grades this year,
although a couple actually slid backward.
Only five agencies--five agencies--in the Federal
Government have completed reliable inventories of their
critical IT assets, leaving 19 without reliable inventories.
This is troubling considering we are 4 years into this process
and we still have far too many agencies with incomplete
inventories.
How can you secure what you do not know you have? How can
you claim to have completed a certification and accreditation
process absent a reliable inventory of your assets?
The IGs of three agencies--DOD, Veterans Affairs and
Treasury--did not submit reports in a timely manner. This
represents a serious problem. I must stress the IG component of
this equation is critically important. The independent
verification is vital and particularly in light of the fact
that there were significant differences between many of the
agencies and their IG's. Seven agencies had differences of two
grades or more with their IGs.
Fourteen agencies are still below a C, and eight received
failing grades.
As we worked on these grades, there were some overriding
themes that became apparent for the agencies with good grades
versus those with poor grades: a full inventory of their
critical IT assets; they identified critical infrastructure and
mission critical systems; a strong incident identification and
reporting procedure; tight controls over contractors; strong
plans of actions and milestones that serve as guides for
finding and eliminating security weaknesses.
The Nuclear Regulatory Commission and the National Science
Foundation should be commended for their outstanding scores, as
well as the Social Security Administration and the Department
of Labor for their B pluses. And while DHS has a failing grade
this year, we recognize the difficult reorganization that took
place and we expect significant improvement next year.
To assist agencies, I have requested that each of the 24
graded agencies come to meet with staff to discuss their grade.
So far, staff has met with 14; and the results are very
encouraging. We have seen a great deal of enthusiasm and
willingness to do the work necessary. The agencies have also
expressed gratitude for the opportunity to discuss the work
they are doing and the grades with the subcommittee.
I am encouraged that OMB, in the recently released FISMA
report and during Clay Johnson's testimony 2 weeks ago,
stressed that there was an increased determination to hold
agencies accountable for implementing FISMA. There is some
clarification that I will seek today in something that is
written in the OMB report. The report on page 13 says the
following: ``while awareness of IT security requirements and
responsibilities has spread beyond security and IT employees,
more agency program officials must engage and be held
accountable for ensuring that the systems that support their
programs and operations are secure. This issue requires the
Federal Government to think of security in a new manner. The
old thinking of IT security as the responsibility of a single
agency official or the agency's IT security office is out of
date, contrary to law and policy and significantly endangers
the ability of agencies to safeguard their IT investments.''
While I agree that IT security is a collective
responsibility, the language I referred to seems to indicate
that no one person will be held accountable. I disagree. This
chairman and this subcommittee will seek accountability of the
highest agency official responsible for information technology
investments to insure that IT security is baked into the
investment decisionmaking process, consistent with the law as
established in the Clinger-Cohen Act.
I have already initiated a process, working with Chairman
Davis, to amend the Clinger-Cohen Act to explicitly identify
information security as a required element of the IT investment
management oversight and decisionmaking process within every
agency of the Federal Government. The grade of D for the
Federal Government simply is not acceptable.
Frankly, one of the continuing obstacles to progress is
that too many people still view information security as a
technology issue. This is a management and governance issue and
must be accounted for in every business case and in
implementation of a Federal enterprise architecture. This is
the responsibility of all stakeholders, and the silo walls must
come down with this and other transformation efforts to employ
collaborative solutions that will provide increased safety and
protection for the American people and the U.S. economy.
I welcome and applaud the increased oversight being
employed by the Office of Management and Budget through the use
of existing tools and business case evaluation. I particularly
applaud the recent announcement that OMB will not approve
agency expenditures for IT development and modernization
projects until they have sufficiently demonstrated that their
existing information technology assets are secure.
Working together as partners in progress, we will continue
to be vigilant in our efforts to achieve the security of the
information networks that support the mission activities of the
Federal Government and protect the information assets that they
contain.
Many cybersecurity technologies offered in today's
marketplace can serve as safeguards and countermeasures to
protect agencies' IT infrastructures. To assist agencies in
identifying and selecting such technologies, I have asked GAO
to categorize specific technologies according to the
functionality they provide and describe what the technologies
do, how they work, and their reported effectiveness. GAO is
releasing this report today, and I want to thank them for their
work and effort in producing this document. I read it on the
plane up here, and it's outstanding. It is information security
for dummies, Congressmen and bureaucrats; and I found it
extremely helpful. Had I had that GAO report when I first
became chairman, it would have knocked the learning curve down
a bit, but it was very helpful.
I would like to welcome all of our witnesses here today. I
want to thank you for your time, and I look forward to your
testimony.
[The prepared statement of Hon. Adam H. Putnam follows:]
[GRAPHIC] [TIFF OMITTED] T4838.001
[GRAPHIC] [TIFF OMITTED] T4838.002
[GRAPHIC] [TIFF OMITTED] T4838.003
[GRAPHIC] [TIFF OMITTED] T4838.004
Mr. Putnam. I ask unanimous consent to insert in the
record, the statement of my ranking member, the gentleman from
Missouri, Mr. Clay. Without objection, show it done.
We will move directly into testimony.
All of you are old hands at this. You understand the light
process, and we certainly appreciate your summarizing your
statements.
Please rise and raise your right hands.
[Witnesses sworn.]
Mr. Putnam. I indicate for the record that all the
witnesses responded in the affirmative.
I would like to introduce our first witness, Robert Dacey.
Mr. Dacey is currently Director of Information Security Issues
at the U.S. General Accounting Office. I thought that we
changed that. Has that passed the Senate yet? Don't you have a
new name?
Mr. Dacey. I'm not sure quite yet.
Mr. Putnam. Everybody is waiting on the Senate.
His responsibilities include evaluating information
systems, security and Federal agencies and corporations,
assessing the Federal infrastructure for managing information
security, evaluating the Federal Government's efforts to
protect our Nation's private and public critical infrastructure
from cyber threats, and identifying best security practices at
leading organizations and promoting their adoption by Federal
agencies.
You are always a great asset as a witness to this
subcommittee, and you are recognized. Welcome.
STATEMENT OF ROBERT F. DACEY, DIRECTOR, INFORMATION SECURITY
ISSUES, U.S. GENERAL ACCOUNTING OFFICE
Mr. Dacey. Mr. Chairman, I am pleased to be here today to
discuss the Federal Government's efforts to implement FISMA. As
you requested, I will briefly summarize my written statement.
Since 1997, we have identified information security as a
governmentwide high-risk issue. Congress has demonstrated their
concern through ongoing hearings on information security and
enactment of reform legislation. This subcommittee has played a
very active role in addressing Federal information security
challenges, including the grades you referred to in your
opening statement which are based on a broad range of
information included in the FISMA reports.
Based on our recent analysis of audit results and on
reported FISMA information for 24 of the largest agencies, the
Federal Government has made progress but continues to face
significant information security risks to its critical
operations, information and assets.
The first year FISMA reports provide important comparative
data on information security performance measures and certain
new information. The reports identify progress and highlight
several challenges including the following.
No. 1, while reported performance measures generally
increase, there continued to be a wide variance among the
agencies.
No. 2, IG's reported less than half of agencies had
complete system inventories now required by FISMA.
No. 3, reported systems with certification and
accreditations continued to increase to 62 percent and systems
with controls tested to 64 percent. However, both IG
evaluations and our own ongoing review have identified
efficiencies in the CNA processes, such as lack of control
testing and outdated risk assessments. Also, as additional
systems are certified and accredited and controls tested, it is
likely that additional deficiencies will be identified.
No. 4, over half of agency systems do not have tested
contingency plans, an essential step in ensuring that critical
systems can continue to operate in the event of unexpected
interruptions such as a cyber or physical attack.
No. 5, as a result of new OMB reporting requirements, IG's
identified challenges in agencies' processes for remediating
identified deficiencies which are key to ensuring that
significant weaknesses are addressed in a timely manner and
receive appropriate resources.
And, No. 6, we noted opportunities to improve the
usefulness of reported measures included in FISMA reports
included independent validation of reported information to
ensure that such information is reliable.
In its fiscal year 2003 report to Congress, OMB concluded
that the Federal Government has made significant strides in
identifying and addressing longstanding problems, but the
challenging weaknesses remain. In particular, the report notes
several governmentwide findings such as progress against
milestones and lack of clear accountability for ensuring
security of information and systems.
The report also presents a plan of action that OMB is
pursuing with agencies to close the gaps and improve security.
NIST also has taken a number of actions to develop FISMA-
required system risk levels and corresponding minimum security
standards and to improve Federal information security. However,
according to NIST, current and future funding constraints could
negatively impact its work in this area. Further, Mr. Chairman,
as you noted in your opening statement, we released today our
report on current cybersecurity technologies that are available
to Federal agencies.
In summary, through the continued emphasis on information
security by the Congress, the administration, agency management
and the audit community, the Federal Government has seen
improvements in its information security. Achieving significant
and sustainable results will likely require agencies to
institutionalize programs and processes that prioritize and
routinely monitor and manage their information security efforts
and provide information to facilitate day-to-day management of
information security throughout the agency as well as verify
the reliability of reported performance information.
Mr. Chairman, this concludes my statement. I'd be happy to
answer any questions that you have.
Mr. Putnam. Thank you very much.
[The prepared statement of Mr. Dacey follows:]
[GRAPHIC] [TIFF OMITTED] T4838.007
[GRAPHIC] [TIFF OMITTED] T4838.008
[GRAPHIC] [TIFF OMITTED] T4838.009
[GRAPHIC] [TIFF OMITTED] T4838.010
[GRAPHIC] [TIFF OMITTED] T4838.011
[GRAPHIC] [TIFF OMITTED] T4838.012
[GRAPHIC] [TIFF OMITTED] T4838.013
[GRAPHIC] [TIFF OMITTED] T4838.014
[GRAPHIC] [TIFF OMITTED] T4838.015
[GRAPHIC] [TIFF OMITTED] T4838.016
[GRAPHIC] [TIFF OMITTED] T4838.017
[GRAPHIC] [TIFF OMITTED] T4838.018
[GRAPHIC] [TIFF OMITTED] T4838.019
[GRAPHIC] [TIFF OMITTED] T4838.020
[GRAPHIC] [TIFF OMITTED] T4838.021
[GRAPHIC] [TIFF OMITTED] T4838.022
[GRAPHIC] [TIFF OMITTED] T4838.023
[GRAPHIC] [TIFF OMITTED] T4838.024
[GRAPHIC] [TIFF OMITTED] T4838.025
[GRAPHIC] [TIFF OMITTED] T4838.026
[GRAPHIC] [TIFF OMITTED] T4838.027
[GRAPHIC] [TIFF OMITTED] T4838.028
[GRAPHIC] [TIFF OMITTED] T4838.029
[GRAPHIC] [TIFF OMITTED] T4838.030
[GRAPHIC] [TIFF OMITTED] T4838.031
[GRAPHIC] [TIFF OMITTED] T4838.032
[GRAPHIC] [TIFF OMITTED] T4838.033
[GRAPHIC] [TIFF OMITTED] T4838.034
[GRAPHIC] [TIFF OMITTED] T4838.035
[GRAPHIC] [TIFF OMITTED] T4838.036
[GRAPHIC] [TIFF OMITTED] T4838.037
[GRAPHIC] [TIFF OMITTED] T4838.038
[GRAPHIC] [TIFF OMITTED] T4838.039
[GRAPHIC] [TIFF OMITTED] T4838.040
[GRAPHIC] [TIFF OMITTED] T4838.041
[GRAPHIC] [TIFF OMITTED] T4838.042
Mr. Putnam. Our next witness is Karen Evans.
In September 2003, Karen Evans was appointed by President
Bush to be Administrator of the Office of Electronic Government
and Information Technology at the Office of Management and
Budget. Prior to joining OMB, Ms. Evans was Chief Information
Officer at the Department of Energy and served as vice chairman
of the CIO Council, the principal forum for agency CIOs to
develop IT recommendations. Previously, she served at the
Department of Justice as Assistant and Division Director for
Information System Management. She is doing a great job over at
OMB.
We're always delighted to have you join us and share your
expertise with us. You are recognized.
STATEMENT OF KAREN EVANS, ADMINISTRATOR, ELECTRONIC GOVERNMENT
AND INFORMATION TECHNOLOGY, OFFICE OF MANAGEMENT AND BUDGET
Ms. Evans. Thank you.
Good afternoon, Mr. Chairman. Thank you for inviting me to
speak about the status of the Federal Government's efforts to
safeguard our information and systems. My remarks will focus on
the findings of the OMB fiscal year 2003 FISMA report and the
next steps to address our IT security challenges.
Earlier this month, OMB issued our third annual report to
Congress on agency compliance with IT security requirements in
law and policy. FISMA, like its predecessor, the Government
Information Security Reform Act, continues to be a valuable
tool in improving the state of Federal IT security, both the
security of systems and promoting the protection of
information.
The OMB FISMA report identifies IT security progress and
weaknesses in fiscal year 2003. The report summarizes progress
such as Federal performance against three governmentwide goals
identified in the President's fiscal year 2004 budget. Agencies
reported their progress against a key set of IT security
performance measures. These measures reveal areas of the
progress from fiscal year 2001 through 2003 as well as
weaknesses.
Agency IG reports verified some of this progress and, in
other instances, called into question the quality of some of
the work. For example, while there are notable increases in the
percentage of systems with security plans, many Federal systems
still do not have contingency plans in place to ensure
continuity of operations.
IG reports also continue to identify a number of troubling
governmentwide issues and trends such as reoccurring IT
security weaknesses, some of which are repeating material
weaknesses. Far too many systems continue to operate with
serious weaknesses.
Another area highlighted in OMB's report was the need for
improved accountability within agencies. The law is very clear
on this issue. The agency head is ultimately responsible for
the security of their information and systems and is charged
with ensuring agency senior officials and the agency CIO
fulfill their specific IT security responsibilities.
Agency senior officials are responsible for providing
security for the information and the systems which support
their operation and assets. In fact, the majority of IT
spending within agencies is not on IT infrastructure and
networks, traditionally owned and operated by the CIOs, but
rather on mission IT investments. It is within these systems
that many weaknesses reoccur.
To address these problems and others, OMB will continue to
engage management and leverage the budget processes. While IT
security clearly has a technical component, at its core is an
essential management function. Most of the Federal Government's
IT security weaknesses can be resolved through better
management and accountability. Through the budget process, OMB
requires agencies to incorporate IT security through the
lifecycle of all investments. Failure to appropriately
incorporate security puts the investment at considerable risk.
To enforce this requirement, OMB notified those agencies
with significant information and system security weaknesses
through budget guidance to remediate operational systems with
weaknesses prior to spending fiscal year 2004 IT development or
modernization and funds. If additional resources are needed to
resolve those weaknesses, agencies are to use those fiscal year
2004 IT funds originally sought for new development.
Additionally, OMB continues to enforce IT security through
the President's management agenda under the E-Gov scorecard.
Agencies may not get to green under E-Gov unless they fully
meet specified IT security criteria, including 90 percent of
the systems being certified and accredited and that their IG
has verified the agency has a plan of action and milestones
process in place which meets the OMB criteria. The PMA enables
OMB to hold agencies, their senior agency officials and the CIO
accountable for IT security performance.
Finally, as we move into the 4th year of these annual IT
security requirements, our goal is to improve FISMA reporting
instructions so that we more clearly capture results and
performance measures continue to mature to focus on key IT
security areas. NIST is actively working on the development of
new guidelines required under FISMA which will play a
significant role in guiding technical implementation of agency
IT security efforts.
In particular, as part of the development of OMB's fiscal
year 2004 FISMA guidance, we are focusing on the following 3
years: one, evolving the IT security performance measures to
move beyond status reporting to also identify the quality of
work done; two, the independent evaluations by the IGs continue
to be a source of indispensable information, and further
targeting of the IG efforts to assess a development
implementation and performance of key IT security processes are
invaluable; and, three, providing additional clarity to certain
definitions to eliminate interpretation difference within
agencies and between agencies and the IGs.
In conclusion, I would like to acknowledge the significant
work of the agencies and IGs in conducting the annual review
and evaluations. It is this effort which gives OMB and the
Congress much greater visibility into the agency IT security
status and progress.
While notable progress in resolving IT security weaknesses
has been made, problems continue and new threats and
vulnerabilities continue to materialize. Much work remains, and
OMB will continue to work with agencies, GAO and Congress to
promote appropriate risk-based and cost-effective IT security
programs, policies and procedures to adequately secure our
operations and assets.
I would be glad to take any questions at this time.
Mr. Putnam. Thank you, Miss Evans.
[The prepared statement of Ms. Evans follows:]
[GRAPHIC] [TIFF OMITTED] T4838.043
[GRAPHIC] [TIFF OMITTED] T4838.044
[GRAPHIC] [TIFF OMITTED] T4838.045
[GRAPHIC] [TIFF OMITTED] T4838.046
[GRAPHIC] [TIFF OMITTED] T4838.047
[GRAPHIC] [TIFF OMITTED] T4838.048
[GRAPHIC] [TIFF OMITTED] T4838.049
[GRAPHIC] [TIFF OMITTED] T4838.050
Mr. Putnam. Our third witness is Benjamin Wu.
Ben Wu was sworn in as Deputy Under Secretary for
Technology at the U.S. Department of Commerce in November 2001.
In this capacity, he supervises policy development, direction
and management at the Technology Administration, a bureau of
over 4,000 employees that includes the National Institute of
Standards and Technology.
Prior to joining Commerce, Mr. Wu held senior staff
positions in the U.S. Congress where he led on issues affecting
the U.S. technology and competitiveness policy.
You are, I believe, an alumni of this subcommittee.
Mr. Wu. Yes, sir. I did work very closely with the
subcommittee and the Committee on Government Reform, but I
actually was an employee of the Committee on Science.
Mr. Putnam. He worked in Congress from 1988, serving as
counsel to Congresswoman Connie Morella and on the Science
Committee.
Welcome back.
STATEMENT OF BENJAMIN WU, DEPUTY UNDER SECRETARY FOR
TECHNOLOGY, DEPARTMENT OF COMMERCE
Mr. Wu. Thank you, Mr. Chairman. It is a pleasure to be
back. I thank you for the opportunity to appear before you
today again.
As you mentioned, when I worked in the House I also was a
lead committee staff on the House Y2K Task Force, and in that
vain we had an opportunity to work very closely with GAO and
also former Congressman Steve Horn as he developed grades for
assessing the agencies' involvement and participation in Y2K
activities. It has since evolved into computer security, and I
congratulate you for your efforts in continuing that leadership
that is so needed on cyber security. Back then, we partnered
with GAO.
As you talk about this partnership in progress to move
forward on cybersecurity, GAO again is proving to be an
excellent partner; and, also, under Karen's guidance, OMB is as
well. We see NIST also playing a very important partnership
role in that partnership for progress.
I want to thank you for the opportunity to testify about
the NIST contributions that strengthen our information security
in the Federal Government. I want to focus my remarks on the
NIST efforts to implement our assignments under FISMA and some
of the challenges that we are facing and confronting.
FISMA's enactment reinforced our longstanding statutory
responsibilities for security research and for developing
Federal information standards and guidelines. With FISMA,
Congress gave NIST a vote of confidence about its abilities to
work and further this research, and we do appreciate that
recognition.
NIST standards and guidelines form the basis of the Federal
Government's ability to improve cybersecurity. Our security
work at NIST is being done out of our Information Technology
Laboratory, which develops tests, metrics, as well as guidance
for building trust and confidence in IT systems that are now so
pervasive in our Nation's economy.
Behind me is Susan Zevin, who is the leader of our
Information Technology Laboratory, and also Ed Roback, who is
the head of the Computer Security Division at NIST. Those two
and their team at NIST helped build a trust of users of IT
systems by concentrating on techniques and tools to manage, to
use and improve IT security system. NIST's success really
relies on its status as an objective third party working with
private sector vendors, standards development organizations,
and consortia.
Mr. Chairman, I want to give you a status report on where
NIST is in terms of its FISMA responsibilities.
The general responsibilities that were assigned to NIST
under FISMA included developing IT standards, identifying
information security vulnerabilities, assessing private sector
policies, assisting the private sector as well, and also
evaluating security policies.
FISMA also contained a number of specific assignments to
NIST, and they included the development of standards and
guidelines, recommended types of information systems, as well
as minimum information security requirements, an Incident
Handling Guideline, and security performance indicators, as
well as an annual reports to the committee.
To summarize the progress that we have made since FISMA
became the law in December 17, 2002, significant progress has
been made on the specific assignments and many have been
completed. They include the FIPS Publication 199, which was
completed in January 2004; the NIST Special Publication 800-60,
which is to be completed this summer, and a draft is now
available; the NIST SP 800-53 is also ready for completion in
December 2005, and the public draft is available; the NIST SP
800-55 to be completed in July 2003; the NIST SP 800-59 to be
completed in August 2003; and also the NIST SP 800-61, which
was just completed this past January.
But, as Bob mentioned, we are concerned because Congress
was unable to meet the Presidential budget request for the NIST
Cybersecurity Division in the fiscal year 2004 appropriations
and, as a consequences, Mr. Chairman, although we continue to
give FISMA activities priority in our budgeting process, the
guidelines, the standards, and related research in the
following areas may not be able to be accommodated within our
fiscal year 2004 funding level and have to be scaled back.
They include guidelines on archiving and disposal of
information, checklists and guidelines, new security protocols,
operating our Computer Security Expert Assist Team, supporting
the NIAP, minimum security recommended requirements, as well as
some of our implementation for IPv6.
At current levels of funding, we've also had to delay a
number of other activities which I will not list in total.
But, let me be clear, due to prioritization within the
Computer Security Division, none of the specific tasks that are
assigned to us under FISMA are affected. Rather, they're
proceeding as scheduled as best we can within the timeframes
allowed under legislation. But we feel that NIST is so uniquely
poised to do so much more, and we are limited really only by
our budget constraints.
Before Congress now is the President's fiscal year 2005
budget request that includes a proposed increase of $6 million
for NIST to address the key national needs in cybersecurity.
With the proposed increase of $6 million for 2005 with the
current level funding----
Mr. Putnam. Did you say million or billion?
Mr. Wu. Million. We would love for it to be billion, but we
also understand the constraints on the Federal budget.
But coupled with the current $10 million that NIST has for
its efforts, we believe that NIST can work more effectively
with industry and government agencies to accelerate solutions
to critical cybersecurity issues.
Additionally, this would include costs that would allow us
to work together with the Homeland Security Department's
Science and Technology Directorate, as well as the Information,
Analysis and Infrastructure Protection Directorate in the
National Cyber Security Division.
We also would like to see if we can continue to provide
other agency reimbursable work and partner with other Federal
agencies so that we can have people tap into the NIST expertise
and also allow for other agencies to meet their FISMA
responsibilities.
In conclusion, Mr. Chairman, the standards and guidelines
produced by NIST are key to the Federal Government's ability to
improve cybersecurity. NIST's impact reaches far beyond just
the Federal system, since the NIST guidelines are also used by
State and local governments as well as often adopted by the
private sector, domestically as well as internationally.
NIST takes its cybersecurity role very seriously and will
work with the committee to ensure that we are able to carry out
our mandate to work with industry, with academia and standard
development organizations to ensure the secure flow of vital
and sensitive information throughout our society. We applaud
the committee for its leadership and also for detailing a
specific leadership role for NIST to play in supporting that
effort.
In the FISMA activities those already accomplished as well
as those currently under way will lead to a more consistent
risk-based and cost-effective IT security at all Federal
agencies. We look forward to working very closely with you, OMB
as well as GAO.
Thank you, Mr. Chairman.
Mr. Putnam. Thank you very much.
[The prepared statement of Mr. Wu follows:]
[GRAPHIC] [TIFF OMITTED] T4838.051
[GRAPHIC] [TIFF OMITTED] T4838.052
[GRAPHIC] [TIFF OMITTED] T4838.053
[GRAPHIC] [TIFF OMITTED] T4838.054
[GRAPHIC] [TIFF OMITTED] T4838.055
[GRAPHIC] [TIFF OMITTED] T4838.056
[GRAPHIC] [TIFF OMITTED] T4838.057
[GRAPHIC] [TIFF OMITTED] T4838.058
[GRAPHIC] [TIFF OMITTED] T4838.059
[GRAPHIC] [TIFF OMITTED] T4838.060
[GRAPHIC] [TIFF OMITTED] T4838.061
[GRAPHIC] [TIFF OMITTED] T4838.062
[GRAPHIC] [TIFF OMITTED] T4838.063
Mr. Putnam. Ms. Evans, in your 2003 FISMA report you say
that ensuring the security of most agency information and
systems is not the sole responsibility of the agency CIO. While
I can understand where you're coming from, that everybody has a
role to play in their own piece of the agency or department,
there's an old saying that everyone's responsibility is no
one's responsibility. How do you see increasing the awareness
of all employees to their information security responsibilities
while still having some accountability built into the system.
Ms. Evans. I believe that there is accountability built
into the system. The way that is, is that FISMA's very clear
that it holds the agency head responsible for the cybersecurity
posture of the agency. That agency head then manages what risk
do I want to go forward with, and there is a tiered approach
into this where the CIO manages from an enterprise prospective.
So based on policies and guidelines that come out from OMB and
from Congress, the CIO then manages across the enterprise or
through the corporation, so to speak.
But then, as that then goes down, each then program
officer--or in this case the way that we refer to this is
agency senior officials, because it could be staff office, it
could be assistant secretary, is responsible for ensuring their
portion of that cybersecurity posture. The agency head
determines what risk are they willing to live with and then
they move down through the structure to ensure that the
accountability is built into that.
So the point of the report is to say that, although the CIO
puts together the enterprise solutions, so to speak, and the
policies and the procedures, the CIO also then ensures that
investments that are occurring within those program offices
will meet that risk posture that the Secretary wants to have as
a whole.
So we believe it is clear, but we also need to articulate
that it is important that everybody has to do their portion of
what is responsible here, from the very first employee when
they come on board, to being aware that maybe I shouldn't put a
disk into my computer that I brought in from home, to the
agency head, the Secretary, who has to manage all of the
assets.
Mr. Putnam. What negative consequences have there been to
the agencies who received failing grades or even backslid in
their scores and things like that? What action has been taken
to demonstrate accountability?
Ms. Evans. We have been working through a series of
processes that we have in place.
First off, there's the President's management agenda
scorecard. The E-Gov scorecard manages the progress of the
agencies going forward, and cybersecurity is a major portion of
that. There is a quarterly grade that we give to each agency
which clearly holds again the agency head responsible as well
as going down through the agencies because it recognizes within
there everyone has to play a part in the cybersecurity piece.
But also, additionally, through the budget process this
year we went forward, and cybersecurity is an important issue
for this administration, so we gave specific guides to the
agencies through the budget process of how we wanted to ensure
that they were taking and looking at what they needed to do to
secure their assets. So they were given specific guidance
through the budget guidance that said you have to turn in a
plan and that this plan is specifically focused on
certification and accreditation which really deals with the
business process and how you manage cybersecurity across your
enterprise.
They were given specific timeframes to turn those plans in
to us and the costs associated with making that happen so that
we can achieve the goals that we have set out for ourselves
which we didn't achieve that we had laid out in the fiscal year
2004 budget.
So we are now in the process of looking at these plans and
working with the budget side as well as the management side
within OMB and then each of the agencies to make those plans a
reality and to ensure that we go forward and we secure those
systems.
Mr. Putnam. In reading your testimony, you indicate 12
agencies have a remediation process verified by their IGs as
meeting the necessary criteria. Do you know the agencies who
did not have a remediation process? You are only batting 500.
Ms. Evans. Yes, I know. That's not a very good grade. I can
give you the specific agencies. It's in the report. But----
Mr. Putnam. Are they the big boys? That's really what I
want to know.
Ms. Evans. It's a mixture of agencies. But the remediation
process is dealing with--that's an IG verified--we have the IG
verify that process. That deals with that they have a process
in place that ensures that, as they go forward and they
purchase new types of things or that a new vulnerability comes
up, that they have a process in place that allows them to
remediate that weakness. That includes things like
configuration management and those type of processes to go
forward.
We gave 18 agencies additional guidance through the budget
process to deal with certification and accreditation so that
gets to the issue of ensuring that they really have identified
what their system inventory is and that they are going through
and they have a process in place that allows them to certify
and accredit these systems which really then gets the
discipline in place for you to really evaluate as you go
forward.
Mr. Putnam. I'm looking back to my opening statement. Only
five agencies have completed reliable inventories. That's
correct, right?
And we've been doing this for 4 years.
Ms. Evans. Yes, sir.
Mr. Putnam. So you're saying that your budget guidance
language tells them what they needed to do to get it right. But
did anything actually happen? I mean, if only five have done
it, the other 19 are saying, well, we're in pretty good
company.
Ms. Evans. Are you asking what specific actions we have
taken since the budget guidance has been issued to the
agencies?
Mr. Putnam. I guess I'm asking if there's been anything
other than guidance.
Ms. Evans. Oh, sure. As part of that guidance process and
as we go forward and as we've outlined previously, there are
tools that are available to us at OMB such as apportionment of
funds.
The budget guidance is very clear. When a budget guidance
goes out and we tell the agencies you cannot spend new
development dollars in this area because they have been
categorized as new development dollars, that's just not saying
you can't spend it. It's the OMB budget accountants working
with us, that there is a process that we have in place with OMB
that doesn't allow those dollars to be released to the
agencies. So dollars are not moving out until we have these
plans and we feel comfortable that the agencies are really
looking at this.
To get to your issue about inventory, we really believe
that it is tied to the management of the portfolio as well as
investments.
You really have to know what you have to be able to come
forward with a good business case to say, for example, I have a
modernization plan, here is my architecture, here is my as-is
architecture, here is the to-be. Through our efforts on the
architecture as well as managing the portfolio and the business
cases, this will really make the agencies really have a good
process in place, and it really will identify the inventory so
that we can say there are so many servers, there's so many of
these, there's so many of those, this is the cost that it will
take to upgrade that, and here's the benefit associated with
that.
So we think through the combination of all these management
practices it will get to the heart of the issue of what do we
own, how are we going to secure it, how are we moving forward
with a modernization plan. We believe that the Federal
enterprise architecture and the architecture efforts of the
agencies really lend to that and really are assisting the
agencies to really put that discipline in place.
Mr. Putnam. So can you tell me how many dollars and how
many specific modernization or development requests have been
apportioned pending the successful completion of reliable
inventory?
Ms. Evans. Well, I have gone back, based on the previous
hearing; and if you haven't gotten this answer I can give it to
you now. There is $9.97 billion associated with office
automation, telecommunications and infrastructure. That's
total. So that includes development and steady State dollars.
We are working with each agency. I can take that back and
find out specifically if we can release that information to
you, but we have apportioned agencies. We really would like to
work with the agencies in a positive way to be able to move
forward and not necessarily single out one agency over the
other.
I think it's pretty obvious, based on your scorecard of
going through of what agencies we're really working with very
closely, as well as agency IG reports and the FISMA report
itself. You can see the variance in the system, and you can see
how the statistics are, that you know pretty much where the
agencies we're working with.
Mr. Putnam. It just seems to me that the new dollars for
upgrades of systems and purchases of new systems and
development would just come to a screeching halt if you really
had to be compliant with FISMA before you got anything new.
Ms. Evans. Well, it would depend on what your plan is,
also, going forward. Some of the systems--and if you look at
the technologies that are outlined in the GAO report that
they're releasing today, some of those do require a certain
technology solution there which will require a purchase. But it
may not necessarily be the same purchase that you were
intending to do, for example, for a business system upgrade.
You may then say, OK, I am the Assistant Secretary in
charge of this particular office. I have a huge program that
really has a risk that is being imposed over here on all the
rest of the assets within the department, and I'm the one who
doesn't have a good plan in place. I have not certified and
accredited my systems. I am not the one--you know, I'm the one
who is holding the department back.
So then the CIO with their technical staff would talk with
that and work with that Assistant Secretary, but they would
make those decisions based on the priorities of where they want
to be.
So if it's a choice between upgrading a financial
management system, and we're saying this is what you have to
do, they put a plan in place in order to execute what we're
saying you have to do, it's to their advantage to do it in the
most cost-effective way. Because if they really need that
financial system upgraded, which I'm just using as an example
here, then they would do this in an expeditious way so that
they could still use those development dollars.
Mr. Putnam. Well, I think that you're making progress
generally across the board. You've got an 80 percent goal to
integrate security and new investments, and you're up to 78
percent. That's pretty good stuff. That's kind of hard to argue
with.
But it's also hard to get around the fact that only five
agencies know what they own. Everybody's held accountable for
their inventory. Even in a little old congressional office, you
cannot get rid of a VCR that's 12 years old without taking it
off your inventory and all this stuff.
It just seems like it's a very, very basic thing that these
agencies ought to be able to get their arms around and then be
able to say, well, we have 15 systems or 15 desktops that are
unaccounted for and they're, on average, 13 years old. So they
probably got thrown out a long time ago. It is probably a safe
bet that they are unaccountable because they were thrown out.
If it's a secured computer at the Department of Energy, it
might be a different issue. But just knowing what you have
seems to me to be the basic criteria before you do any of the
other stuff. You can't secure what you don't know you have. You
can't certify or accredit what you don't know you have.
It just seems like, above and beyond the scorecard and the
grades and the F's and the A's and all that, the fact that only
five agencies really know what they own is very troubling.
Ms. Evans. I would say that I agree with you, sir, and that
we're going to continue to work with the agencies. We believe
that some of the programs that we've moved forward on, things
such as Smart Buy and those types of initiatives, through
several of these processes will get the agencies really focused
on asset management, software management, inventory control,
those types of things.
Technology continues to evolve; and many times if we make
it very onerous that work can't get done, people have a
tendency to bypass that security as well. There's a lot of
technologies out there that make use of wireless technologies
that they can put their own network in case--because the CIO
becomes so oppressive that they cannot get their work done. So
it is a balance of being able to go forward and have good
security but also, as you said, to have good inventory control
and have good business processes in place so that we're totally
accountable for our dollars.
Mr. Putnam. You said in your testimony as well that it is
important that FISMA reporting instructions mature. What do you
mean by that?
Ms. Evans. Well, pretty much you've hit the issue on the
head. It is that we're going through the process right now
where we have metrics, where the agencies are self-recording.
So when we say we have a goal of 80 percent of the systems
being certified and accredited and then we have a percentage of
62 percent of those systems being certified and accredited,
it's really what is the validity of that number. Because the
basic premise of the inventory is faulted. But we also believe
that, because of the reporting that we have and the oversight
and this is 3 years going into the 4th year, that we can now,
because the baseline is there, really start dealing with more
mature aspects like the quality of certification and
accreditation. What can we do to help the agencies to get good
inventory control and process so that we can then say, what is
a system, and have a clearer definition of what is a system so
that when I put an inventory control process in place I can
give you a clear answer and then you can compare for sure
agency to agency, system to system, inventory to inventory.
Mr. Putnam. So you don't necessarily recommend legislative
changes to the FISMA reporting requirements?
Ms. Evans. I would say at this particular point based on
what we have, no, sir.
Mr. Putnam. You also say that the independent evaluations
by the IGs are indispensable, and I would agree with that.
What do we do about the IGs who don't report, which is
something that we found here, or those who reported late, some
of them almost 3 months late? And the situation where IGs are
commenting or evaluating on an entirely different subsection
than what the agency is reporting on? Is that something that is
problematic for OMB? It was problematic for us in preparing our
scores.
Ms. Evans. We are working with the IGs. There is an IG
Council similar to the CIO Council of which my boss Clay
Johnson also is the chair of. We have started meetings with the
IG to actually deal with a lot of those types of issues about
resolving what are the differences in the interpretations of
the way that certain things are written in there so that when
you get a report again how an IG is evaluating, it would be
consistent, and it gets back to the same issues of their
interpretation of the metrics and the agency's interpretation
of the reporting as well.
Those meetings have begun. We are working to get their
input into this process so that when we issue the FISMA
guidance for this year, we hope to bring clarity to those
issues so that things will be more level, so to speak, between
the IGs.
Mr. Putnam. That would be very helpful.
Mr. Dacey, what are your thoughts on that discrepancy
between the IG reports and the agency reports? Has the GAO made
any recommendations on how we can improve the audit process?
Mr. Dacey. There are a couple of things that I think need
to be considered moving forward; and I would agree, too, that
the measures need to--I'm not saying the measures that are here
but additional information perhaps is a better way to describe
it. It may be helpful to interpret the progress of agencies and
information security.
When FISMA was set up, I think an important part of that
was to have the IGs be an integral part of the process for a
couple of reasons.
First of all, I think they provide a valuable independent
check on the security of the systems. In other words, if we're
looking at a system as we do, GAO, when we look at systems, we
may identify vulnerabilities. The first question we ask is,
well, have these been picked up by the agency's CNA process, if
there was a CNA done. Had they been picked up in the plans of
actions and milestones and things of that nature? If we find
that they haven't, then we know something is broken and
something isn't working right. It's kind of definitive proof
that at the end of the day process was or wasn't working. So I
think that's an important role.
The role that I think needs to evolve, though, is to get
the IGs more involved in looking at the processes by which the
agencies develop these numbers and the way they report them. I
think if they do that and there is a process that is relatively
reliable in bringing those numbers forward--and I focus on
that, too, because oftentimes the numbers aren't available
until the very end, so auditing the numbers themselves may be a
challenge. So I think the IGs can look at the process and match
that up again when they're doing their audits. If they are
auditing a system and it hasn't been CNA'd properly but yet the
agency is counting it in their CNA tally, then that is a
problem.
So I think you need to work to keep that going, but again
kind of increase the IG's roll to look at the processes and
match that up against what they're finding in the individual
systems that they do audit.
Mr. Putnam. Ms. Evans, there is an article in today's
Washington Post where a Federal judge has ordered the Interior
Department to shut down most employees' Internet access and
some of the public Web sites, ``after concluding that the
agency has failed to fix computer security problems that
threaten millions of dollars owed to Native Americans.''
I understand that this is an ongoing issue, but if you
would like to comment on it, I would like to give you that
opportunity.
Ms. Evans. Well, my only comment would be--is that
Interior, just like any other department, is that we continue
to work with them to assist them in addressing what their cyber
security issues are through our processes like the President's
management agenda, the scorecard, as well as the budget process
that we just recently talked about in that guidance.
Mr. Putnam. What did Interior get? What was their score,
their grade?
Ms. Evans. An F.
Mr. Putnam. Is there any other department that--I mean,
when we talk about computer security, sometimes we get off in
the weeds, and it almost becomes this academic discussion. I
mean, I have never heard of a judge ordering somebody to
disconnect from the Web. Has that ever happened before?
Mr. Dacey.
Mr. Dacey. This is actually the third time for Interior, I
believe, that an order has been issued by the court to stop.
That's the only one with which I'm familiar at a Federal agency
where there has actually been a court involvement in the
process.
Mr. Putnam. So it's so bad that three times the judge has
ordered them to disconnect?
Mr. Dacey. Well, not speaking to the individual case, but
there is a legal case in dispute, and the judge, in ruling on
that, in protecting the reliability of certain data that
related to the Indian Affairs that they are concerned about
people being able to get in. In fact, I believe at the first go
around, when they were removed, the court had hired an ethical
hacking group to participate, and they, in fact, had broken
into their systems. And I believe it was reported that they
created fictitious accounts in the Indian Affairs systems. And
that became the concern, that you needed to protect access from
outside into this data and this financial information related
to that.
I would note that Interior, though, even on the measures
that are on OMB's scorecard, pretty much consistently, except
for one area, was below the average of other Federal agencies
and, as you said, got an F in their grade. So there is a
challenge there, I think, in their information security.
Mr. Putnam. I would say so.
Mr. Dacey, you mentioned in your report, the CIO's don't
control mission systems. And I believe I read in Ms. Evans'
testimony that, in fact, 65 percent of IT is mission-related
activities. I thought FISMA put CIOs in the position of
responsibility for all agency systems. Could you clarify that?
Mr. Dacey. I guess--I think our reference was actually to
what OMB had said, so I will let Ms. Evans take care of that.
But at the same time, I think it is important to note that--and
I don't have an exact count, but one of the challenges is also
making sure that authority goes with that responsibility. I
know an increasing number of agencies has clearly given their
CIOs the authority to enforce security standards throughout the
agency. I don't have numbers, but I do believe that some do not
have that authority. And in fact, I know when we have been
doing some of these audits, we found that, in fact, the CIO at
the agency level didn't always have control over what the
individual bureaus did which could endanger security of the
entire agency if not properly controlled. So I think that is
one aspect. But, again, Ms. Evans might want to talk more about
the specific numbers.
Ms. Evans. You want to understand how it works?
Mr. Putnam. Are CIOs responsible for the mission-related
activities or not?
Ms. Evans. They are responsible from a strategic standpoint
and from a corporate standpoint, which means that when an
agency is divided off or a department is divided off and you
have the offices within it, you get the guidance from
headquarters, so to speak. And so the CIO is responsible for
formulating what is that overall guidance, what is that policy,
to ensure the cyber security going forward for that department.
When the program office--and in this case, we are talking
agency senior officials--when they send their investment plans
forward and they have an operational aspect of what they are
doing within their program offices, they have to adhere to
those policies and guidelines. And then the CIO, if they have
an operational aspect, can ensure that they are conforming to
those policies.
Sometimes some CIOs only have a policy aspect. If they have
the policy aspect, then they are involved through the budget
process to ensure all of these other things that we are talking
about--that the investment has adequate cyber security based
into its life cycle, that they do have plans that are in place
that continue to measure what is going on within their program
offices. So they do it from a corporate perspective.
If they have an operational perspective, that is an
additional authority suit because, normally, what they do is
they control infrastructure as well as telecommunications, all
of those types of things. So they control the big network. So
they can put policies in place that say, if you don't meet this
certain threshold of security or if you are not certified and
accredited, you cannot hook up to departmental resources. And
that's usually where most program offices need to go in order
to be able to go out to get onto the Internet to be able to
reach, you know, big financial management types of systems, HR
systems. And so CIOs do have the authority to be able to do
that if they manage the corporate assets.
Mr. Putnam. Have you had an opportunity to read the GAO
report that they released today, Ms. Evans?
Ms. Evans. Well, we were glancing at it today.
Mr. Putnam. The breakdown of all the different information
security measures and their taxonomic chart is pretty darned
good. You came from Energy and from Justice as a CIO, you
understand the challenges both from your current level and from
the agency level perspective. And we are going to photocopy the
key portions of that GAO report. We have to take the blue
binder. Because of the blue binder, nobody is going to read it.
But we have to really kind of break it down into the easy-to-
understand key charts that Mr. Dacey put together.
If you were going to send it to somebody in the agency to
bring about change, who would you send it to, because CIOs
already know that stuff? I mean, they could have written it. I
mean, when you are talking about kind of an easy-to-use, easy-
to-read user's guide, who would you send it to really have an
impact on behavior and understanding of what we are talking
about in making systems more secure?
Ms. Evans. In this particular case, if I put it in easy-to-
read key charts off of here, we work--the initiative owners
through the President's management agenda work very closely
with the President's Management Council. So I would send it out
through the President's Management Council and say, here is a
guide of--here is what you need to look at as technologies are
coming up. Because the CIO advises that person as the chief
operating officer of the agency, most times it is the deputy
secretary of the department that participates in the
President's Management Council.
Mr. Putnam. And that's the person who also makes the
decisions about what budget requests to send to you, about
whether we are going to buy this system or that system and we
are going to have a firewall or a VPN or who gets----
Ms. Evans. They review--deputy secretaries review the
budget as they come up. Most agencies have hearings in the
summer based on the guidance that goes out. And the key
offices, just like a CIO, have input into how a program office
is put together, how the budget is put together,
recommendations. And so if there are issues--say, for example,
based on my days at Energy, if there were issues with a
specific program office who we felt really wasn't pulling their
weight as far as cyber security was concerned, when these
reviews occur, the deputy secretary would get key questions to
ask that assistant secretary during their review.
You know, one question could be, how well are you working
with your CIO? You know, do you have everything in place? Are
you ensuring that cyber security is being adequately addressed
within your program office?
And so something like this, if it was dealing with
investment decisions and these would be key points, those would
be like key questions that you would ask them so that they
could ask to ensure that their portfolio, when it comes
forward, meets those criteria.
Mr. Putnam. Thank you.
Mr. Wu, FISMA made NIST responsible for issuing a fair
amount of guidance, guidance that is essential to the security
of the information systems in the Federal Government. Could you
comment on--and you did somewhat in your opening statement--
could you elaborate on the resources that are necessary to
provide that guidance?
Mr. Wu. Well, certainly at the Department of Commerce and
also at NIST, there is an understanding of the importance of
NIST's role in implementing FISMA in how general standards are
developed and created, and the key role this plays as the
linchpin, the first domino, in a sense, for FISMA to be
implemented very effectively. And so there is a priority placed
within the Computer Security Division and within our
Information Technology Laboratory to make sure that we meet all
of the mandates and requirements of FISMA.
The challenges I alluded to in my testimony and Bob
referenced in his is that, at least for this fiscal year, NIST
did not receive the President's budget request for 2004;
Congress was unable to provide that. And as a consequence,
there is a fear that we may not be able to move forward in some
of the research that would be required for some of the more
emerging technologies.
For example, as we focused on a very real and immediate
near-term need for guidance under FISMA, we are not keeping up
with the rapid advances and technologies like RFIDs, the Radio
Frequency Identification Devices, which is a very key component
to some of these emerging technologies for communications that,
unfortunately, under our funding situation, we may not be able
to put resources in there for--certainly for 2004. We have to
delay it for 2005 depending on how the congressional
appropriations may look.
So there is a fear and a concern within the laboratory
within the Department that we may not be able to be as
aggressive as we'd like to be in our efforts and research. But
in terms of meeting the FISMA responsibilities, NIST is
committed to doing that.
Mr. Putnam. And the guide that you are creating for FISMA,
I would imagine, would be pretty helpful guidance outside the
government as well. Does NIST have an ability or a system to
allow people to download that guide or to have access to that
guide, to request it so that there can be a wider distribution?
Mr. Wu. Well, information dissemination is critical to make
sure that the work that NIST does is brought out to the Federal
agencies as well as to the private sector. But it does have a
cost as well. We hope to work very closely with OMB as well as
with NTIS, which is also part of the Department of Commerce,
for information dissemination so that we can have the
information placed in as many hands as possible. And also NIST
will, of course, make it available on its Web site.
Mr. Putnam. FISMA also requires agencies to develop
policies governing configuration, so if someone sets up a
server, they know what security controls they have to set, and
NIST has developed that guide as well. What is the status of
that?
Mr. Wu. The status of--I believe--I'm not quite sure
which--if you are referring to a specific publication or a
specific--or a publication number. But we can certainly provide
that for you.
Mr. Putnam. Thank you.
Mr. Wu. But as I said, right now, NIST has met its
timeliness requirements for its publications, and we look
forward to completing those if--either in right now or
available in public draft or available in terms of a full
report.
Mr. Putnam. Ms. Evans, is there, for lack of a better term,
a rapid-response team of professionals who can move into a
situation like this Department of the Interior issue and work
to resolve it on an emergency-type basis? I mean, recognizing,
in addition to just being terribly embarrassing, it has cost
people money and defrauded the Government and everything else.
The fact that it has happened three times is--what is OMB's
role in a situation like that?
Ms. Evans. Well, each agency is responsible for having a
computer-assistance-type team, incident-response team. However,
through the new work that is going on now over at DHS--my
office works very closely with DHS, especially in the area of
implementation of the National Cyber Security Strategy. And so
with working with the particular office over there under IAIP
and working with those groups, there are several resources that
they put in place that work very closely in conjunction with
the CIO counsel. So in a particular situation like this, we
could make recommendations as well as DHS could make
recommendations of getting specific assistance through the
resources that are available at DHS.
Mr. Wu. Mr. Chairman, if I may, I was just handed some
information. As Ms. Evans mentioned about DHS, we have also
been working with DHS. And in regard to your question about the
comprehensive security checklist and benchmarks, DHS has been
partnering with NIST in this regard, and we will be able to
maintain a Web-based portal on this listed checklist. And we
hope to have that available in fiscal year 2005, in the years
after as well.
Mr. Putnam. Very good.
Mr. Dacey, would you comment on the 2003 FISMA reports, the
areas that strike you as being the most important improvements,
the most important deficiencies and your evaluation of the
progress overall?
Mr. Dacey. Well, I think in my oral statement I raised some
of the concerns. I know there has been progress. We have seen
evidence of that through increases in the measures. But we have
also seen that through looking at the whole series of audits
that have taken place, both in respect to financial audits and
other audits that the IGs have performed and GAOs performed. So
there are improvements. I would characterize them as kind of
heightened awareness as well or continued heightened awareness
by agencies for a couple of reasons: A, they know we are not
going away. This is an annual event, in fact now quarterly,
reporting to OMB. So I think that is an important issue.
So there is a recognition that things are going to be
watched. And, of course, the involvement of this committee is
an important element in that as well.
In terms of the areas that are the concerns, I guess, or
some of the areas of concern would be trying to make sure that
some of these percentages keep increasing. And the pace of that
is a good question. And how fast they can increase, I can't
tell you. But certainly they have been improving over years.
But the areas that are of concern most in my mind would be the
certification and accreditation and the control testing,
because that's where you are going to identify whether there
are additional weaknesses and vulnerabilities in your system.
If that is done correctly is, I would say, most important and
certainly key, because that may unveil additional weaknesses
that need to be addressed that haven't been identified yet.
In terms of the contingency planning, I have spoken about
that in my statement as well. That is a critical area. And we
have, again, less than half of the agencies with tested plans.
And NASA, actually, has quite a bit of success in their
reporting of that measure. If you exclude NASA, I think it is
around 38 percent/40 percent of agencies that have tested
plans, the rest of the Federal Government. So I think that is
an important area because I think as we have increased
exposures to viruses, worms and other kinds of malicious
attacks, you really need a contingency plan in place, because
I'm not sure you can anticipate everything that might happen to
your system, particularly when we are getting to a time when it
is conceivable that attacks could be launched before
vulnerabilities are notified and identified in the public and
patches are even made available. And that is definitely a
trend.
So I think that is another area of importance. Some of the
agencies are literally, I think, at zero percent on their
contingency plan testing--and some very low. So I think those
are some areas that kind of jump out in my mind when I look at
the FISMA reports.
Again, in the progress area, I think it is important to
keep having OMB managing and monitoring the process, Congress
involved, the IG's involved. There are a lot of players.
I think the other key area would be to have the agencies
make sure they have the processes in place to manage this on an
ongoing basis. Two or 3 years ago, I'm not sure anybody really
had a whole lot of processes in place. When we had the first
GISRA reports, it was extremely ad hoc reporting that was
coming into the agencies, and they were putting it all
together--and Karen can speak to that and how it was at Energy.
But it wasn't a pretty process.
And as time has gone on, some of the agencies have
developed more routine processes to get that information, to
manage it day to day, not just for FISMA reporting purposes or
for GISRA but actually to use it from a management standpoint.
I think that is going to be a critical role in changing this
whole dynamic and moving to a more sustainable progress that
goes forward.
Mr. Putnam. That has been one of the complaints, is that
agencies and their CIOs, in preparing their reports, they are
really only trying to just meet the requirements of FISMA, and
they are not actually improving the overall information
security.
And I suppose that gets to your earlier point, Ms. Evans,
about the next level is making more meaningful, more mature, as
you put it, requirements.
Ms. Evans. Right.
Mr. Putnam. Did you want to add anything in terms of your
evaluation of the scores and progress, deficiencies, thoughts?
Ms. Evans. Well, again, I would just like to say that we
are making progress. I mean, we couldn't even give you--even
though we don't have a real good solid way of doing the
inventory, we couldn't even give you these numbers previously.
I mean, we couldn't even--we would be debating on what is a
system and how to move forward. So I think the government has
made huge progress.
And although we are looking at these reports, I think you
can also demonstrate, based on the results, that the Government
is moving forward. And that is our ability to repel attacks as
they are coming about and to deal with services as viruses are
occurring.
Two or 3 years ago, when you looked at what we were doing
when Corea came out of Melissa, many of the agency systems went
down, and they were offline. And that's why they had to have
contingency plans and everything else. But now, with the
viruses that appear to be coming out, sometimes hourly, the
agencies are being able to sustain business and being able to
go forward because these processes are in place. They are
looking at things. They may not be the best. There is a lot
more that we can do, but we have made progress.
Mr. Putnam. Am I overemphasizing this inventory issue? I
mean, in terms of the big scheme of things and government
information security, am I too hung up on that? I mean, in
terms of the priorities, the problems that are out there?
Mr. Dacey. I don't think you are too hung up on it. I think
there's several reasons. First of all--I mean, not just because
it can affect some of the measures, because denominators are
going to change dramatically, particularly when DOD's numbers
come into play, it will change dramatically.
But the issue is how to manage the systems. I think there
are a lot of cascading effects. I know when we started looking
at some of the patch management practices, one of the
challenges in doing that was even identifying the systems they
had so they can figure out, well, does this patch apply to me?
A lot of agencies defaulted to system administrators
individually having to try to deal with that. And I know we had
the issue with PADC and tried to put out something at a Federal
level to help agencies at least notify them. But the lack of a
real complete inventory was a challenge, because we had several
agencies that said we want PADC for every system administrator
because, otherwise, we don't know collectively at the top what
all our systems are, and you are going to have to deal directly
with them.
It also affects configuration management. I don't know how
you manage your configuration if you don't know what all your
pieces are.
So there is a lot of additional cost and cascading effects.
So, no, I don't think it is a light issue; I think it is a
serious issue, again, mainly because it relates to these other
areas that really can't be performed well or efficiently
without it.
Mr. Putnam. There are a lot of Fs. How much difference is
there within the F category? Are there some that are on their
way out of the F category? I mean, are all the Fs grouped
together, or are there some that are just off-the-chart bad,
like Interior? I mean, three judges' orders to shut down the
Internet is pretty--I would think would be about as bad as it
gets. But maybe it really is worse. I don't know. I'm scared to
know the answer.
Mr. Dacey. One thing that we also tried to look at in our
analysis of the information was across the seven performance
measures that are detailed in OMB's reports is, how are
agencies doing relative to the average for those measures? In
other words, how are they doing? And we found there were--let's
see--seven agencies that were below in all seven measures, or
at least one measure, or maybe one measure was above and six
below. So there are some agencies where there is a pretty
consistent below average score across those measures, and I
think that carries into some of the other things that were
considered in your grades as well.
At the same time, there are people at the top level, too,
that are consistently--we have, let's see, eight agencies that
are above average in all categories or all but one.
So you have a lot of players at both ends, and then you
have a whole bunch of agencies in the middle. So I think it is
a mixed story. And even within some agencies, they might have
several above and several below. So it is not an even kind of
process in bringing them up necessarily.
Mr. Putnam. How many--in that lower category, how many
below average ratings did the Department of Defense have?
Mr. Dacey. The Department of Defense actually, based on the
information I have, was--exceeded the average in five of the
seven categories.
Mr. Putnam. But still received an F?
Mr. Dacey. Yes. There was a general correlation between the
seven measures against the average and the grades. There are a
few anomalies, because the grades the subcommittee gave
included a consideration of a variety of other FISMA indicators
that weren't part of these seven factors. So there are some.
But in general, they tended to be in the same relative range.
Mr. Putnam. And DOD was allowed to report on a subsection
of their systems. Correct?
Mr. Dacey. That is correct.
Mr. Putnam. Is any other agency given that consideration?
Mr. Dacey. Other than the stipulation that a lot of
agencies don't have complete inventories, which is obviously a
problem.
Mr. Putnam. All but five are reporting on a portion of
their systems.
Mr. Dacey. They are the only agency who has reported or
acknowledged that they are only reporting on a subset of their
whole systems. I think they have 3,000 or 4,000 systems in
total.
Mr. Putnam. And next year, they will be required to report
on all.
Mr. Dacey. I will defer to Ms. Evans. That's what was in
their report.
Ms. Evans. Right. And on the scorecard, going forward on
the scorecard, which we are referring back to, they are
required, in order to be able to move, if they want to move to
green, just like all agencies, they are required to report on
all. And we are holding to that criteria.
Mr. Putnam. But, I mean, other than not being a green in
the President's management report.
Ms. Evans. Well, you have to look at this. This is still a
management issue. These are very highly competitive folks. And
this gets back into, you know, when the scorecard gets
published, and it is just like this scorecard here, I mean,
nobody wants to be an F. And so you are either going to
rationalize why you are doing badly, or you are just going to
improve your processes overall and move forward.
The whole purpose of the President's management agenda is
to achieve results, and the President is very committed to
that, and this administration is very committed to that. This
is a piece of that agenda. And so we are committed to achieving
the results, and the results are to ensure that we have a good
cyber security posture going forward. So that is how we intend
to hold the agencies accountable.
Mr. Wu. Mr. Chairman.
Mr. Putnam. I hope you are right.
Mr. Wu. At the Department of Commerce, we, as Ms. Evans has
indicated, are striving to try to reach green. And it is a
competitive process. Secretary Evans has made that a priority,
and I suspect all the other secretaries have as well. We
haven't quite reached it yet, but we are making strides, and we
do want to do that. And so there is a commitment to do that,
and we are following the guidance of OMB and Ms. Evans.
Mr. Putnam. Well, I hope NIST got a good score.
Mr. Wu. Well, NIST is part of the Department of Commerce.
Mr. Putnam. What did Commerce get? I don't have it in front
of me. A gentleman's C?
Mr. Wu. No, I think we did well. I will have to talk to our
Inspector General.
Mr. Putnam. You got a C.
Mr. Wu. I will speak to Johnny Frazier and see how much
better we did.
Mr. Putnam. C for Commerce.
All right. Any other comments from our first panel before
we move into the second half of this hearing? I want to thank
all of you for your participation and your ongoing efforts to
improve this. It is a long, hard struggle, and I know most of
you have been in it for a whole lot longer than I have. And I
tip my hat to you, and I wish you the best as we continue to
move forward. And we certainly offer the resources and the
abilities of this subcommittee to help you help them do a
better job. Thank you very much.
And we will stand in recess for a couple of minutes until
we can set up the second panel.
[Recess.]
Mr. Putnam. The subcommittee will reconvene. We have seated
panel two. As is the custom with this subcommittee and the full
committee, I would ask the witnesses and anyone accompanying
them who will be providing information to please rise and raise
your right hands.
[Witnesses sworn.]
Mr. Putnam. Let the record note that all four witnesses
responded in the affirmative.
We have had a request from the NRC to use a photographer.
Since they are one of only two who got an A, they can have
whatever they want. So come get a picture of this big smile.
We will begin our testimony. The first witness is Paul
Corts. Paul R. Corts was sworn in as Assistant Attorney General
for Administration in November 2002. Prior to entering
government service, he served as president of Palm Beach
Atlantic University for 11.5 years. He also served as president
of Wingate University in North Carolina and has held
administrative and teaching positions at Oklahoma Baptist
University and Western Kentucky University. As Assistant
Attorney General for Administration, Dr. Corts oversees the
Department's Justice Management Division and is the chief
financial officer.
Welcome to the subcommittee. You are recognized for 5
minutes.
STATEMENT OF PAUL CORTS, ASSISTANT ATTORNEY GENERAL FOR
ADMINISTRATION, DEPARTMENT OF JUSTICE
Mr. Corts. Mr. Chairman, I appreciate the opportunity to
appear before you today to discuss the Department's efforts in
the areas of information technology security and the actions
underway within the Department to institutionalize the daily
management of security risks and to implement the requirements
of FISMA. And I want to commend you and the committee for your
past and current efforts to shine the spotlight on Federal
agencies' security performance.
I certainly want to emphasize that the Department of
Justice embraces the importance of IT security. Our senior
management is committed to protecting the Department's IT
assets from attacks and vulnerabilities, and we have clearly
identified responsibility for IT security with the CIO.
IT is key to the Department's success in meeting our
strategic goals. We place a very high value on the availability
and integrity of the information in our systems, along with
confidentiality and privacy concerns. And the nature of our
work in Justice requires a highly robust security for IT.
As reported in the OMB Security Act Report for 2003, we
reported 243 IT systems, 24 programs, 35 contractor operations
and facilities. All of our programs and 206 systems were
reviewed in accordance with FISMA guidance provided by OMB and
NIST. The Department incorporates IT security requirements in
all of our contracts, and we perform security reviews on half
of the contract operations and facilities during the fiscal
year. In addition, over 90 percent of our IT systems have been
assessed for risks, and over 80 percent have been fully
certified and accredited to date.
In the past, the Department operated in an extremely
decentralized fashion, and that really contributed to IT and
the computing environment being highly fragmented. This is a
major concern with our inspector general during the past years,
and since we joined the Department, it is a concern that the
CIO and I share. Furthermore, we are fully aware of your
concerns with our progress in information security, and we take
these very seriously as well.
Since I arrived at Justice 16 months ago, the Department
has taken a number of actions that not only reflect the
commitment of senior management to correcting past deficiencies
but also to establish a solid foundation for sustained future
progress. And many of the IG's recommendations have been
accomplished, or initiatives are underway that will provide for
improved performance in the coming year.
Through the AG's leadership and vision, I think we have
come a long way toward a more centrally coordinated department,
and this has made a lot of progress and a very positive impact
on our IT efforts.
Specifically, we have clarified our CIO position in terms
of the Clinger-Cohen Act responsibilities, we have implemented
a Web-based security awareness training tool. We have trained
77 percent of our employees so far on that with a goal of 95 by
summer, implemented a computer emergency response team and
integrated IT security with a capital investment process and
some other actions that are underway to remedy deficiencies.
The Department's senior management team is committed to
ensuring that these activities are under way, and we have them
planned to correct both past deficiencies and be sure that we
integrate these into an institutionalized kind of an
environment.
We have reorganized the office of the CIO and named a chief
information security officer. We've developed a Department-wide
IT security program. We have established IT security program
goals. We have approved a policy for 17 information security
standards; chartered an IT Security Council and six project
teams; integrated IT security with enterprise architecture and
the investment management process, developed system risk
assessment and a test plan tool; provided for CIO collaboration
and review of component corrective action plans; continued
development of a public key infrastructure capability;
continued development of a unified financial management system
throughout the Department; provided resources to assist
components in assessing their systems; implemented a monthly
report card, which you see here.
This is the age of the report card. So we've come up with a
report card, a sample there, that is done on a monthly basis to
let the individual components know how they are doing in the
area of IT security.
So the accomplishments and initiatives we have underway
address many of the IG's recommendations and will provide for
improved performance in the coming year. We acknowledge the
need to do more. It is a matter of continuous improvement that
we are committed to while at the same time we are working to
reduce risks associated with our IT assets. And I want to thank
you and the committee for the focus that you are giving to
this, and we pledge to you our cooperation and support.
[The prepared statement of Mr. Corts follows:]
[GRAPHIC] [TIFF OMITTED] T4838.064
[GRAPHIC] [TIFF OMITTED] T4838.065
[GRAPHIC] [TIFF OMITTED] T4838.066
[GRAPHIC] [TIFF OMITTED] T4838.067
[GRAPHIC] [TIFF OMITTED] T4838.068
[GRAPHIC] [TIFF OMITTED] T4838.069
Mr. Putnam. Thank you very much, Mr. Corts.
Our next witness is Jeffrey Rush, Jr. Mr. Rush was sworn in
as the Inspector General for the Department of Treasury in July
1999. Prior to that, he served as the Inspector General of the
U.S. Agency for International Development and is the acting
Inspector General of the Peace Corps. Mr. Rush also served for
23 years in the U.S. Department of Agriculture.
Welcome to the subcommittee. You are recognized for 5
minutes.
STATEMENT OF JEFFREY RUSH, JR., INSPECTOR GENERAL, DEPARTMENT
OF THE TREASURY
Mr. Rush. Thank you, Mr. Chairman.
In your letter of February 26, you asked me to address
three points in my statement: One, a summary of the state of
information security at Treasury; two, the methodology used to
audit Treasury and the resources available to my office; and,
finally, the circumstances that led to the delay in our
reporting of results under FISMA.
First, although we have been reporting on serious
information security weaknesses since 1998, I will limit my
testimony only to the work done in the last 3 years. Our
reporting in fiscal years 2001 and 2002 was under the
Government Information Security Reform Act [GISRA]. This most
recent job was done under FISMA. All three assessments as well
as management's own have identified serious deficiencies in
information security throughout the Department.
Let me summarize just what we consider the important
deficiencies to be. First, most of the systems have not been
certified or accredited. Second, Treasury has been unable to
provide an accurate inventory year to year of systems to be
certified and accredited. Third, Treasury's plans of action and
milestones and for fixing security--serious security
weaknesses--are not complete and are inconsistent. Four,
Treasury does not fully comply with the reporting of security
incidents. Fifth, Treasury did not use the National Institute
of Standards and Technology guidance for all of its programs.
Sixth, interdependencies and relationships of critical
operations have not been fully identified. And, finally,
Treasury has not provided sufficient information technology and
security training to the majority of its employees.
Second, in conducting our fiscal year 2003 evaluation of
Treasury's information security program and practices, we
follow the guidance issued by the Office of Management and
Budget on August 6, 2003. I have attached a copy of that
guidance to the statement. The guidance prescribed a set of
questions to be answered by both agency management and by the
Offices of Inspectors General. In this regard, OIGs were to
evaluate a representative sample of all of the types of agency
systems. One area that was to be emphasized this year was--in
OIG's assessment--was against specific criteria which the
agency developed, implemented or was managing in agency-wide
plans of actions and milestones process. The plans of actions
and milestones process is key to effective remediation of IT
security weaknesses and instrumented for the agency to get
green under the expanding government scorecard of the
President's management agenda.
Finally, as background for the reason for our delay in
FISMA reporting, during March 2003, we divested approximately
70 percent of our staff to the Department of Homeland Security
Office of Inspector General pursuant to the Homeland Security
Act. Our audit staff was reduced from 165 to 62 during the last
6 months of a fiscal year. Our annual audit plan had to be
completely revised. Thus, this divestiture and subsequent
attrition reduced our IT audit group from 14 to 5.
With our much reduced staffing, we determined we could not
complete FISMA on schedule and sustain an accelerated audit of
the Department's fiscal year 2003 financial statements. In
consultation with the Department and the Office of Management
and Budget, priority was given to the audit of the Department's
fiscal year 2003 performance and accountability report, and we
committed to issue the FISMA report within 30 days of that
date. And, accordingly, the financial statement audit was
completed on an accelerated basis on November 14, 2003, and we
issued our FISMA report on December 15, 2003.
But let me stop and make clear to you that I probably owe
you an apology. If not, I will give you one anyway. As early as
July 2003, apparently everyone but this committee was informed
of the decision to concentrate on completing the accelerated
financial statement, clearly putting FISMA at a second
priority; thus, the late report that was due in September.
Considering our current staffing levels and looking
forward, we have not been able to and do not anticipate being
able to hire additional IT auditors in the near future. Thus,
we plan to contract for the FISMA evaluation for the non-
national-security systems for fiscal year 2004. We will perform
the fiscal year 2004 FISMA evaluation for Treasury's national
security systems with our own staff.
That concludes my statement.
[The prepared statement of Mr. Rush follows:]
[GRAPHIC] [TIFF OMITTED] T4838.070
[GRAPHIC] [TIFF OMITTED] T4838.071
[GRAPHIC] [TIFF OMITTED] T4838.072
[GRAPHIC] [TIFF OMITTED] T4838.073
[GRAPHIC] [TIFF OMITTED] T4838.074
[GRAPHIC] [TIFF OMITTED] T4838.075
[GRAPHIC] [TIFF OMITTED] T4838.076
[GRAPHIC] [TIFF OMITTED] T4838.077
[GRAPHIC] [TIFF OMITTED] T4838.078
[GRAPHIC] [TIFF OMITTED] T4838.079
[GRAPHIC] [TIFF OMITTED] T4838.080
[GRAPHIC] [TIFF OMITTED] T4838.081
[GRAPHIC] [TIFF OMITTED] T4838.082
[GRAPHIC] [TIFF OMITTED] T4838.083
[GRAPHIC] [TIFF OMITTED] T4838.084
[GRAPHIC] [TIFF OMITTED] T4838.085
[GRAPHIC] [TIFF OMITTED] T4838.086
[GRAPHIC] [TIFF OMITTED] T4838.087
[GRAPHIC] [TIFF OMITTED] T4838.088
[GRAPHIC] [TIFF OMITTED] T4838.089
[GRAPHIC] [TIFF OMITTED] T4838.090
[GRAPHIC] [TIFF OMITTED] T4838.091
[GRAPHIC] [TIFF OMITTED] T4838.092
[GRAPHIC] [TIFF OMITTED] T4838.093
[GRAPHIC] [TIFF OMITTED] T4838.094
[GRAPHIC] [TIFF OMITTED] T4838.095
[GRAPHIC] [TIFF OMITTED] T4838.096
[GRAPHIC] [TIFF OMITTED] T4838.097
[GRAPHIC] [TIFF OMITTED] T4838.098
[GRAPHIC] [TIFF OMITTED] T4838.099
[GRAPHIC] [TIFF OMITTED] T4838.100
[GRAPHIC] [TIFF OMITTED] T4838.101
[GRAPHIC] [TIFF OMITTED] T4838.102
[GRAPHIC] [TIFF OMITTED] T4838.103
[GRAPHIC] [TIFF OMITTED] T4838.104
[GRAPHIC] [TIFF OMITTED] T4838.105
[GRAPHIC] [TIFF OMITTED] T4838.106
[GRAPHIC] [TIFF OMITTED] T4838.107
[GRAPHIC] [TIFF OMITTED] T4838.108
Mr. Putnam. Thank you very much, Mr. Rush.
Our next witness is Ellis Merschoff. Mr. Merschoff is the
Chief Information Officer for the Nuclear Regulatory
Commission. Prior to serving as CIO, Mr. Merschoff was the
Director of the Western Region for NRC. He had worked at NRC in
various capacities since leaving the U.S. Navy in 1980. He was
awarded the Presidential Distinguished Executive Award in 2000
and is a licensed professional engineer.
Welcome to the subcommittee. You are recognized for 5
minutes.
STATEMENT OF ELLIS W. MERSCHOFF, CHIEF INFORMATION OFFICER,
NUCLEAR REGULATORY COMMISSION
Mr. Merschoff. Thank you, Mr. Chairman. I appreciate this
opportunity to testify with regard to the activities of the
U.S. Nuclear Regulatory Commission as they relate to the
Federal Information Security Management Act.
The mission of the NRC is to regulate the Nation's civilian
use of byproduct, source, and special nuclear materials to
ensure protection of public health and safety, to promote the
common defense and security, and to protect the environment.
Our headquarters is located in Rockville, MD, with regional
offices located in Pennsylvania, Georgia, Illinois, and Texas.
We have a technical training center located in Tennessee and
resident inspector sites located at 70 nuclear power plants and
fuel-cycle facilities around the country.
Although I have been the NRC's chief information officer
for only 9 months, I have been with the NRC, as you stated, for
24 years. Of those 24 years, I was an NRC line manager for 18
years and served as a regional administrator for 6 years. I
understand the operational and business needs of the NRC which
allows me to contribute a perspective that enables the agency
to effectively apply information technology to meet the
business needs of the NRC while achieving the appropriate level
of computer security for the agency.
As an agency, we have 4,000 interconnected computers that
exchange approximately 100,000 e-mail messages and receive
another 40,000 e-mail messages from the Internet every day. On
a daily basis, we experience 500 attempts at reconnaissance of
our systems, strip out 300 suspicious e-mail attachments,
identify 100 attempts at denial-of-service attacks and isolate
10 virus occurrences.
The NRC has identified all major operational applications
and support systems, each of which has been certified and
accredited. Outstanding findings from risk assessments and
other evaluations are entered into a tracking system, monitored
and closed out when resolved. We review the security controls
for each of these systems on an annual basis, using the self-
assessment process provided by NIST and benefit from a strong
working relationship with NRC's Office of the Inspector
General.
The NRC emphasizes computer security awareness at all
levels of the organization, from senior management to the
individual employee and contractor. We require that each
employee take an annual computer security awareness course
which is available online to ensure accessibility at the
employee's desktop.
The NRC holds an annual observance of International
Computer Security Awareness Day, which has grown in
participation over the past 10 years. In November 2003, close
to half of our headquarter's population attended this event.
Like all Federal agencies, the NRC must contend with
viruses and other malicious software. We download new virus
definitions to all desktops and deploy relevant computer
security patches as soon as testing ensures compatibility with
the NRC's mission-related software. The NRC also utilizes
announcements to notify staff about viruses, hoax, spam, and
scams that might affect our staff. Ask Cyber Tiger is a regular
column in the NRC's newsletter that seeks to answer employees'
computer security questions. Our computer security staff
created Cyber Tiger about 8 years ago to act as a spokesman and
a logo character to convey our computer security messages.
The NRC is the only Federal agency with a comprehensive
electronic document management system known as ADAMS for which
the agency received the Archivist of the U.S. Achievement
Award. ADAMS supports the creation, storage, retrieval and
management of documents and records related to the NRC's core
business functions. The system stores the agency's record copy
in electronic form for efficient transfer to the National
Archives and Records Administration. Users can search for, view
the image of and print documents at their work stations
regardless of geographic location. ADAMS software identifies
and authenticates users and applies access controls to ensure
that each document is viewed or modified only by appropriate
individuals.
In summary, the NRC operates with offices across the
Nation. We take computer security requirements very seriously
and work toward a seamless integration of computer security in
our day-to-day operations. The NRC's computer security
challenges continue to evolve, and we continue to revise our
program to address these new requirements. I appreciate the
opportunity to appear before you today, and would be pleased to
answer any questions you may have.
[The prepared statement of Mr. Merschoff follows:]
[GRAPHIC] [TIFF OMITTED] T4838.109
[GRAPHIC] [TIFF OMITTED] T4838.110
[GRAPHIC] [TIFF OMITTED] T4838.111
[GRAPHIC] [TIFF OMITTED] T4838.112
[GRAPHIC] [TIFF OMITTED] T4838.113
[GRAPHIC] [TIFF OMITTED] T4838.114
[GRAPHIC] [TIFF OMITTED] T4838.115
[GRAPHIC] [TIFF OMITTED] T4838.116
[GRAPHIC] [TIFF OMITTED] T4838.117
[GRAPHIC] [TIFF OMITTED] T4838.118
Mr. Putnam. Thank you very much, Mr. Merschoff.
Our fourth witness for the second panel is Kerry Weems. Mr.
Weems is in his 23rd year of Federal employment, 21 of those
being at the Department of Health and Human Services. In 1988,
Mr. Weems left the Social Security Administration and began
work for the budget office in the Office of the Secretary,
Department of Health and Human Services. Since then, he has
served in a variety of capacities ranging from senior analyst
to branch chief and division director. In June 2002, he became
Deputy Assistant Secretary for Budget and, since January 2003,
has served as Acting Assistant Secretary for Budget,
Technology, and Finance.
You are recognized for 5 minutes. Welcome to the
subcommittee.
STATEMENT OF KERRY WEEMS, ACTING ASSISTANT SECRETARY FOR
BUDGET, TECHNOLOGY AND FINANCE, DEPARTMENT OF HEALTH AND HUMAN
SERVICES
Mr. Weems. Thank you, Mr. Chairman. It is a pleasure to be
here. And thank you for inviting me today.
Today, I would like to describe to you the existing efforts
HHS has undertaken to improve the security posture of our
agency and to comply with Federal legislative and regulatory
directives.
In its most recent FISMA report, HHS reported 222 systems,
13 programs and 77 contractor operations and facilities, all of
which require information technology protection. I would first
like to summarize the current state of information technology
security within HHS and the actions underway to address
identified weaknesses and improvements that are currently
underway.
I am pleased to report that improvements are being made in
the management of information security at HHS. We have built a
solid foundation and policy and procedures for IT security
operations and management, including a series of supporting
guides to assist personnel throughout HHS in understanding and
implementing security policies and guidance. These policies and
guides form a common baseline for standard IT security
throughout the Department, which our operating divisions can
exceed if their business operations require stronger
protections.
Updates were also made on previous policies to meet new
guidance from OMB, specifically in the areas of privacy impact
assessments, plan of actions and milestone, security
performance, measures and metrics, security program reviews,
and self assessments. Additional updates were made to address
newly emerging technologies.
In addition to these efforts, the Secretary launched Secure
One HHS, a comprehensive program that blends targeted IT
security, technical support and assistance with managerial and
operational changes designed to improve the methods and
practices of all personnel with IT security responsibilities
throughout the Department. This program provides the framework
for adequately securing our information systems.
In fulfilling this initiative, HHS has demonstrated its
commitment to protect the health and welfare of the American
public. Key focus areas of Secure One HHS currently include
critical infrastructure protection, system and program level
security development, FISMA compliance, which includes numerous
subcomponents such as certification and accreditation and
incorporation of plans of actions and milestones as a
management tool.
In less than a year, HHS has made major progress in
employing an extensive security program and increasing the
level of security throughout HHS. We have taken decisive steps
to remediate the weaknesses identified in the FISMA report,
drafted new policies and issued new guidance considering
integration of security into the system development lifecycle.
We have linked IT security with capital budgeting by improving
and integrating IT security elements into the exhibit 53 and
300 submissions required by OMB, and we have augmented our
procedures for the IT investment review board to ensure that IT
security is addressed before new investments are made. We have
implemented a streamlined yet very intensive support structure
that provides our operating division with automated tools that
improve and centralize data collection and reporting of FISMA
plans of action milestones.
HHS has also licensed an automated NIST self-assessment
tool to standardize and facilitate the department-wide
utilization of NIST guidance. These tools are supplemented by
extensive support and monthly plan of action and milestone
review meetings with the information security officer of each
operating division.
HHS has also drafted guidance concerning security
certification and accreditation and developed remediation plans
for ensuring certification and accreditation of all appropriate
systems.
CNA compliance has increased in the last 6 months and is
well on its way to exceeding its goal of 90 percent by June
30th of this year. As of today, we have achieved nearly 60
percent with a goal of 70 percent for the end of this month.
For systems that have not completed CNA, each system has a
specific remediation plan targeting their path toward
certification. Recently, security remediation plans have been
expanded to track privacy impact assessments as well as
linkages between system security and capital planning
relationships. The chief information security officer has
conducted reviews of the training and awareness policies and
practices currently in place and issued guidance regarding the
management of mandatory annual user security-awareness
training.
Last, HHS is developing a departmental security operations
center that will significantly improve our incident response
capabilities and institutionalize a more rigorous defense
against malicious hackers and other threats.
Thank you. That ends my testimony.
[The prepared statement of Mr. Weems follows:]
[GRAPHIC] [TIFF OMITTED] T4838.119
[GRAPHIC] [TIFF OMITTED] T4838.120
[GRAPHIC] [TIFF OMITTED] T4838.121
[GRAPHIC] [TIFF OMITTED] T4838.122
[GRAPHIC] [TIFF OMITTED] T4838.123
[GRAPHIC] [TIFF OMITTED] T4838.124
[GRAPHIC] [TIFF OMITTED] T4838.125
[GRAPHIC] [TIFF OMITTED] T4838.126
[GRAPHIC] [TIFF OMITTED] T4838.127
[GRAPHIC] [TIFF OMITTED] T4838.128
[GRAPHIC] [TIFF OMITTED] T4838.129
[GRAPHIC] [TIFF OMITTED] T4838.130
[GRAPHIC] [TIFF OMITTED] T4838.131
[GRAPHIC] [TIFF OMITTED] T4838.132
[GRAPHIC] [TIFF OMITTED] T4838.133
[GRAPHIC] [TIFF OMITTED] T4838.134
[GRAPHIC] [TIFF OMITTED] T4838.135
[GRAPHIC] [TIFF OMITTED] T4838.136
[GRAPHIC] [TIFF OMITTED] T4838.137
[GRAPHIC] [TIFF OMITTED] T4838.138
[GRAPHIC] [TIFF OMITTED] T4838.139
[GRAPHIC] [TIFF OMITTED] T4838.140
[GRAPHIC] [TIFF OMITTED] T4838.141
[GRAPHIC] [TIFF OMITTED] T4838.142
[GRAPHIC] [TIFF OMITTED] T4838.143
[GRAPHIC] [TIFF OMITTED] T4838.144
[GRAPHIC] [TIFF OMITTED] T4838.145
Mr. Putnam. If you have a wrap-up statement, you are
welcome to make it.
Mr. Weems. OK. I will be happy to do that.
We have made significant progress toward implementing an IT
security program. We recognize that a program and a strategy
call for the institutionalization of sound IT security
practices that are essential for safeguarding information
entrusted to HHS by the citizens of the country. We remain
committed to this goal as we continue to implement the Secure
One HHS program. Thank you.
Mr. Putnam. Thank you. I thank you for your sensitivity to
the little red light. Some people just keep right on going.
Mr. Weems. Mr. Chairman, I have sat behind many secretaries
who have had to watch the red light.
Mr. Putnam. It can be intimidating. When I was in the State
legislature, I had to testify before my first subcommittee, and
it freaked me out when I went yellow much less red.
Mr. Merschoff, you are the teacher's pet of the panel. Your
agency received an A, so we are going to give you all the first
questions and then sort of let you off the hook, I guess.
You know, relative to some of the other agencies and
departments, the NRC is relatively small. How much of your
success was determined by your size and how much of your
success is scalable in that it could be easily replicated in a
larger organization?
Mr. Merschoff. I would say size is a function of the
timeliness of accomplishment and not the accomplishment itself.
We are a full scope agency. We develop new IT applications. The
ADAMS that I discussed is the first in the Government in terms
of an electronic records management system. We are developing
another one for an electronic courtroom for the high-level
waste hearing.
So what we do is difficult, but being smaller allows us to
proceed at a pace that is easier to maintain than the large
agencies. In terms of scalable, I believe it probably is.
Mr. Putnam. Now that you are on top, how institutional are
your changes? I mean, do you foresee remaining an A virtually
indefinitely? What types of changes do you have to make on an
ongoing basis to continue to meet those top standards for your
A rating?
Mr. Merschoff. Well, as Lewis Carroll said in Alice Through
the Looking Glass, you have to run really fast in this world to
just stay where you are, or words to that effect. The bar is
being raised continuously by OMB, so it will be harder this
year to be an A than it was last year. We have areas to
continue to work on, two that you have addressed already in
terms of contingency plans and inventories are areas we have
work to do in. So there is important work that remains to be
done relative to our agency.
I have an outstanding staff, and I have the support of the
senior management within the agency to maintain computer
security, so I anticipate we will be able to meet the new
challenges.
Mr. Putnam. How have you implemented the accountability
within all of your managers and program directors? How is that
effective, and how have you helped them make it, make
information and security a priority of their everyday life?
Mr. Merschoff. We have established the corporate level
procedures that govern the IT systems, chief of which is the
capital planning and investment control process. We have
integrated security into the development of new systems, so a
business line can't develop a new system without the approval
of the Office of the CIO, and embedded in that approval is
working hand in hand with us with security. So we have
confidence that each new security system we bring on line is
robust in a security sense. And being a peer to the other
business line managers, they seek our help, and we provide it
in terms of current operating systems.
Mr. Putnam. Your background is not technical in nature as
it relates to IT; you are an engineer, I believe. Do you think
that has helped you in understanding the importance of this and
sharing it with others? Do you think that you have more
credibility with your peers as an engineer as opposed to being
an IT specialist?
Mr. Merschoff. I would take issue with my background not
being technical. I'm an aerospace engineer and a mechanical
engineer.
Mr. Putnam. Information technical.
Mr. Merschoff. I'm not an IT professional. I believe that
has helped a lot. What I believe agencies need at the CIO level
is an executive that can hold people and programs accountable
to achieve certain goals. Engineering as a discipline is one
that IT in general can benefit from. Engineers look at
redundancy and reliability and bring a rigorous, disciplined
thought process to systems development that matches nicely with
IT development and CPIC development.
So the direct answer to your question, in terms of
credibility, I believe it helps a great deal. Having been a
peer to the senior business line managers in the agency, there
is a trust in the budgeting process and there is a trust in
terms of the service delivery process that I think helps us
progress.
Mr. Putnam. Thank you.
Mr. Rush, could you please elaborate on the additional
financial reporting requirements that took priority and pushed
FISMA into a secondary position that you referred to in your
opening statement?
Mr. Rush. Yes, sir. In fiscal year 2002, we were the first
Cabinet-level agency at Treasury to accelerate our financial
reports to the shortened deadline of November 15th. Under
Secretary Paul O'Neill, much effort was expended to demonstrate
that financial reports had to be timely to be useful to
managers. As we approached 2003, it was clear to OMB that was
an important goal for all of the CFO agencies. Thus, by late
spring, early summer and immediately following the divestiture
of a lot of our resources, I met with the assistant for
management and we consulted with the Comptroller of the United
States Linda Springer and made clear that we couldn't meet the
accelerated deadline for 2003 and meet our other requirements
given the resources that we had lost. We were clearly able to
produce one of those jobs but not both of them by the
deadlines.
So the decision was that the IRS, the Bureaus, the Treasury
IG for tax administration and the Department would prepare
their report and send it to OMB on time and that the IG work
that my office does to bring FISMA to conclusion would be
followed within 30 days of any successful accelerated financial
statement report.
Now, those discussions went on for a couple of weeks, and
as I indicated to you in my letter, when I distributed the
report to you I apologized for the first time, we did not think
to notify this subcommittee because we assumed that having
coordinated with OMB that information might have been
available. I regret that. That was my responsibly, and I am
here to accept that responsibility.
But as between the two important jobs that we were facing
as we went into the fall, it was clear that the accelerated
financial report was the priority for Secretary John Snow and
for the administration.
Mr. Putnam. Is contracting out an option? I assume it will
be, based on your earlier remarks. Is it going to be your
option in the future to contract out the preparation of the
FISMA reports?
Mr. Rush. It will have to be for the foreseeable future,
because, again, we are not moving our resources up. The
President's budget request for 2005 gives us a substantial plus
up over 2004. It almost helps us recover from some of the
divestiture. But the problem here is timing. As we found last
summer as we faced the decision of financial statement
reporting, FISMA reporting, if you can't make those decisions
early enough in the audit cycle, you can't get a contract out
there. Our problem was that we were going into this audit
period anticipating using our own resources to do the work, and
when we had this tradeoff decision, we found ourselves in the
position where it was too late to bring a contractor in because
you still have to supervise the contractor.
This year we're starting off with better understanding of
our resources, we're going to do more contract work for--our
financial reporting, and we intend to use a contractor for most
of our FISMA work. We'll not do it for the national security
systems that we report on to you and others as classified
reports.
Mr. Putnam. You went from 165 to 62 staff in the IG's
office?
Mr. Rush. No, that's just the audit staff.
Mr. Putnam. Audit staff. Is that proportional to the amount
of the department that was transferred to the Department of
Homeland Security?
Mr. Rush. Well, after a careful study of our audit program
for the 3 years prior to divestiture, we identified a need to
transfer somewhere between 30 and 35 percent of our staff to
Homeland to accompany the work that was associated with the
Customs Service, the Secret Service, the Federal Law
Enforcement Training Center and that part of the Bureau of
Alcohol, Tobacco and Firearms that went to the Justice
Department. But for reasons still not clear to me, we were cut
70 percent rather than 35 percent and we've been playing catch-
up.
That decision was made, and clearly people were trying to
do the right thing to establish the Department of Homeland. And
I don't doubt that the people that we contributed to that IG
office over there have made a difference in the Department of
Homeland Security, but we had to actually go out and pick up
about 12 people for the financial statement audit cycle and
detail them into our office to get that audit done. And we are
struggling.
Mr. Putnam. The IRS and Bureau of Public Debt, those audits
are conducted by you or by the GAO?
Mr. Rush. The IRS is done entirely by GAO and part of the
public debt is done by GAO. We rely on those reports to prepare
the consolidated. We're responsible for the consolidated audit
and the bureau-level audits and special audits.
As you know, Treasury right now has eight different stand-
alone audits, everything from the gold and silver reserve to
special accounts. The recovery in D.C. pushed the pension funds
from D.C. into Treasury, so we have to manage an account from
those funds and do a financial statement on the retirement for
judges and teachers and police officers.
We do stand-alone audits for the Office of the Comptroller
of the Currency, the supervisor of national banks; the Office
of Thrift Supervision, the supervisor of the savings and loan
industry. We do stand-alone audits for other entities including
the Financial Management Service, the check writer and the cash
manager for government.
Mr. Putnam. And I hear where you're coming from on the
reasons for the delay.
At the end of the day, the score was a D, and I'm told
probably with the input of the IG's report, had it been on
time, would have remained an F, the same scores received in
2002.
In your testimony, you attribute a fair amount of that to
the IRS. Could you elaborate on that?
Mr. Rush. Well, the IRS is the largest bureau of Treasury.
Treasury right now is about 115,000 116,000 people; 100,000 are
in IRS.
IRS has gone through major systems modernization for the
last 4 or 5 years and into the foreseeable future. Their
inability to accurately identify the number of systems that
they had really changes all the numbers for Treasury because of
the miscount or undercount of systems and the failure to
develop plans consistent with all of those systems.
But I do not want to make that solely an IRS problem.
Treasury in every level, in every bureau, has very serious
information security problems.
Mr. Putnam. Well, to your credit, you're very blunt and
candid in your opening statement and your submitted testimony
to that fact. And it is, considering the nature of Treasury and
the information it handles and the privacy issues surrounding
it, people are sensitive about what they pay in taxes and what
they have, I would think that you would be on the short list of
folks that we would really want to get it right. And so it is
important that Treasury can prove.
Mr. Weems and Mr. Corts, both of you are responsible both
for financial management and budget, as well as technology of
your agencies, I believe; is that correct?
Mr. Corts. That is correct.
Mr. Putnam. One of the most common complaints that we hear
is that the components level of departments don't follow
department-wide policy on information technology and don't feel
compelled to do so.
Do you find the same resistance when you direct budget or
fiscal policy for the Department? And why is there a lesser
standard of accountability or responsiveness on issues related
to information technology? Mr. Weems and then Mr. Corts.
Mr. Weems. The hammer of the budget produces, usually, the
quickest results; if nothing else, it quickly gets the
attention of the component head and produces an appeal to the
Secretary, to me, to somebody else, who then can have a
reasonable discussion about it.
Many times, things in other areas seem a bit too esoteric
to be able to have that kind of discussion. That's why we have
undertaken in HHS to link these things together. Investments in
our budget process that do not have proper security simply
won't go forward, and the agency head or agency official will
be in the posture of having to appeal, having to have a
discussion, and also having to explain why they're trying to
move an information and technology investment that does not
have security sufficient to the standard.
Mr. Putnam. Mr. Corts.
Mr. Corts. There's always a certain amount of push-back.
I think that the Department of Justice was really--the
decentralization of the Department caused the bureaus,
especially the large bureaus, to really take on kind of a
persona of their own and perhaps push back in both budget and
IT is stronger in those kinds of situations. But I believe,
over the last couple of years, with the emphasis on unity as a
department, we're seeing a great deal of lessening of that.
The CIO Council that operates within the Department and I
occasionally will drop in on their meetings. There seems to be
a good spirit there and a real desire to try to work together.
The way that we're organized, it does allow the CIO to be very
involved in the budget process, and I believe it is becoming
well recognized throughout the Department that the CIO has a
significant role with respect to budgetary issues.
So the point that Mr. Weems was making where the budget is
such a readily identifiable hammer, if you can tie that to IT,
I think you have an additional kind of hammer to use. So I
believe that the role that the CIO is playing in budget
decisions, the CIO's involvement in our management team, is
giving the CIO additional strengths and a way to deal with this
push-back issue.
Mr. Putnam. This is the 4th year in a row that Justice has
had an F score. What are some things that you can identify as
barriers to breaking into that D category or something better
than 4 years of an F?
Mr. Corts. Well, frankly, we had a lot of organizational
problems, as I described in the testimony, not the least of
which was a clear identification of who was in charge of IT
security. Again, I came to the Department about 16 months ago,
and quite frankly, I was quite surprised with what I found with
regard to IT and IT security.
But I think that we're making big strides, and one of those
issues was a clear identification of who was going to have IT
security, because it had previously, in the Department, been
kind of jerry-rigged, I guess somewhat split between the
Department security officer and the CIO. And there was a lot of
struggle over the issue of naming one single person the
ultimate person responsible for it, but we've crossed that
bridge and that's really helping us to move forward; and very
quickly on the heels of that, the appointment of a chief
information security officer, a person who came with a lot of
skill and background and is just really making giant strides
for us in the last months, that aren't showing up on scorecards
yet because the scoring took place before some of these things
were happening.
This is a very dynamic thing for us, and it's on the move,
and I think it is on the move in the right direction.
Mr. Putnam. I am glad to hear it is on the move now, and I
hope that it stays true. I was on the Horn subcommittee and
we've heard from a lot of folks about changes in personnel,
changes in priority, changes in leadership, changes in
policies; and we have to institutionalize something that will
outlast you, that will outlast me and your attorney general and
this President and everything else to get serious about this.
Mr. Weems, your testimony indicated a number of excellent
sounding initiatives, secure one among others, yet your
department actually slid backward from a D to an F. What
happened and what can we expect to see happen next year?
Mr. Weems. Well, Mr. Chairman, I work for Secretary
Thompson, and on this scale, there's only one passing grade,
and NRC has it.
Yes, we did slide backward, and our goal is an A, and the
Secretary has made that very clear to me. Last year we were
scored before Secure One HHS was launched. In looking back over
that report and what happened, I certainly don't want to sound
like ``the dog ate my homework'' sort of excuse here. We do
have deficiencies in HHS, but one of those deficiencies is
documentation. If we had sufficient documentation for some of
our procedures, our grade would have been higher. So there may
have been a difference between the way that we are evaluated
and the way that security works in the real world.
Having said that, we are striving to do as you have said,
which is to institutionalize security into HHS, largely through
the budget process, but also through clear lines of
responsibility emanating from my office through our various
operating divisions, so we'll make it clear who is responsible
for what and along what time lines.
Mr. Putnam. Your budget has, I believe, increased
substantially since the creation of the Department of Homeland
Security; is that correct?
Mr. Weems. Yes, just a few items went to the Department of
Homeland Security, but our budget for bioterrorism, which is a
substantial piece, has gone from about $300 million to about
$4.1 billion in the fiscal 2005 budget.
Mr. Putnam. Since your profile has been raised as a result
of the Department's role in the anthrax investigation and
ricin, and your Secretary's launch of his war room, as well as
just the increased awareness in the nature of biothreats, have
the attempted hacks and attacks on your information systems
increased as your profile has been raised?
Mr. Weems. We have noticed some increase there.
One of the things that I think would be helpful, and I
believe that this subcommittee has pointed out, would be a
uniform standard for reporting those. As you know, HHS reported
a substantial number of incidents, but since they're measured
inconsistently across all departments, it's difficult for us to
be able to determine our posture with respect to other agencies
which may report one, for instance, over a year.
With the growth of our bioterrorism efforts, that is a
place where we have been very careful to make sure that we have
sufficient security, and not just cybersecurity but also
physical security. You can see that at the NIH campus in
Bethesda and the CDC campus down in Atlanta.
Mr. Putnam. Mr. Rush, now that FISMA is permanent and we're
working on our second year, using the same scoring standards,
do you anticipate a change in resources allocation either for
the purpose of contracting, or a shift in staffing similar to
that, that was caused by the CFO Act that would allow you to
have the tools you need to be in compliance with FISMA?
Mr. Rush. We're going to have the tools that we need this
year because the Deputy Secretary is taking over supervision of
the CIO operations and there's going to be a concerted effort
to see some improved performance from management. It has to be
matched by what we do not only in the content of that work, but
in the timeliness of the work. So I think we're in good shape
for 2004.
We're going to be meeting as early as next week to try to
bring that to conclusion. But long term, I think we have to
come to grips with jobs that are process jobs for IGs. These
are compliance-type jobs for IGs. And while I'm not here to
speak on behalf of that community, as one who's been in that
community a long time, we can meet the deadline, but we need to
begin to rationalize some things.
I, for one, complained to OMB that the timing didn't make a
lot of sense. Notwithstanding our resources, it made no sense
to me to be reporting in September on FISMA when we operate on
a fiscal year that ends September 30 and we have financial
reporting that started as early as November 15. Trying to bring
some of these deadlines and due dates into sync makes a lot
more sense to folks like me, who have to audit.
Second, the act didn't have a date; it merely said that OMB
could establish a date. So we thought it fair for them in the
future to consider a different reporting date than September
15. That's not a date that's particularly useful for
management, by the way. It's completely out of context with
their own mission and performance reporting.
So there's a lot to be done as we look out at FISMA 2005-
2006. But for 2004, I think we're just going to knock along and
get the job done.
At Treasury, I think you'll see some improved performance.
I'm very impressed with Deputy Secretary Sam Bodman. He's only
been in the Department about 2 months. He comes to us from the
Commerce Department where he had real impact on the
Department's operation, and we hope that he'll bring that to
Treasury.
Mr. Putnam. Those are very interesting suggestions, yours
on the reporting deadlines and Mr. Weems's suggestion on the
consistent measurements of incidents.
Mr. Merschoff, do you have any thoughts on ways that we can
improve what is measured, how it is measured, is it relevant,
is the benchmark appropriate? Your thoughts?
Mr. Merschoff. I agree with Mr. Weems. It's important to be
able to compare your organization to other organizations to
benchmark to understand if you're doing something substantially
different that needs to be addressed. In our case, we reported
67,000 incidents last year to FedCirc. Some report one or two
or three, and so it's absolutely impossible----
Mr. Putnam. Do you know who? HUD had only one attempted--
only one incident. So I guess nobody's interested in breaking
into HUD's information security or something. It would be quite
remarkable.
Mr. Merschoff. But if we're to get better, the CIO Council,
working together with benchmarking across the entire spectrum
of what we do, will help us realize where we're performing at a
level less than the rest of the government on the way to seek
help and also to provide that help to others.
Mr. Putnam. Mr. Corts, you're relatively new to this ball
game. You came from the academic world. What are your thoughts
on the benchmark and the appropriateness of the standards.
Mr. Corts. Well, I would certainly agree with the
consistency issue and, I think, the definitional issue. You
have to get a clear understanding that everybody is talking the
same language and comparing apples to apples. And I think--you
know, I do think this is still a pretty nascent operation, and
as it matures--and I think it was the language that Karen Evans
was using--we're going to see things will coalesce better in
terms of agreement about terms and manners of reporting and so
forth, which will be to the benefit of all of us from the point
of view of benchmarking. And in the accreditation work that I'm
familiar with from academe, those are crucial, just a crucial
part of the accreditation process.
Mr. Putnam. What's your deadline for your budget
submission--I guess Mr. Rush, since you raise the issue of
deadlines. My understanding is that OMB set the date for FISMA
reporting to coincide with your budget submissions; is that
correct?
Mr. Rush. That may have been their judgment. It did not
match with the submission. The submission process for the
fiscal year actually spilled over into late October. We had
reclama as late as November. The appeals to the President did
not occur until December, as I recall, this past year and the
President submitted his budget on February 1st.
Mr. Putnam. So what----
Mr. Rush. So I do not see a connection between the budget
process and FISMA reporting, if there's supposed to be one, and
I'm not going to object to that. It does not give September 15
a particular value as a day.
Mr. Putnam. What date would be more appropriate in your
view?
Mr. Rush. We invest so much in financial systems reporting
because of the Chief Financial Officers Act and GMRA, that it
would be useful, if we were able to tie our FISMA reporting,
which often relies on the EDP control audit work in the big
financial systems, to do it at about the same time or within 30
days.
And I'm not making that recommendation for all IGs. I can
say from Treasury's standpoint, if we could rely on the
important IT audit work that is part of our consolidated
financial statement audit, we would be able to get that report
out and I think you'd get a better product. It's late, but I
think you will get a better product.
Mr. Weems. Mr. Chairman, perhaps I can answer that at least
from the standpoint of the HHS. Our budget deliberations,
internally at least, inside the Office of the Secretary,
typically are in July. So if we were in possession of the FISMA
report in advance of July, we certainly could consider that as
part of our budget deliberations.
Typically, August is spent trying to complete the necessary
documentation to send in a budget to OMB, which is due usually
right after Labor Day. So, in fact, I believe this year we had
submitted our budget document to OMB before the FISMA report
was complete.
Also, as Mr. Rush has noted, we were in similar throes of
trying to complete our own audit, which took an awful lot of my
time and the time of other departmental officials, especially
the last quarter of the fiscal year and the foregoing 45 days,
to get to the November 15 audit report date consumes an awful
lot of time on the financial side and a tremendous amount of
the leadership's time as well.
So I would say, from our standpoint, the FISMA report being
available on a contemporaneous basis in June or May would be
really important to our budget process.
Mr. Putnam. Well, that's very helpful and I appreciate your
suggestions on ways that we can perhaps make FISMA even more
meaningful, the information from the report more actionable.
But three of the four of you don't have a whole lot of
credibility on making recommendations for changes to this
thing, and some folks have figured out how to do it. It's
really kind of a unique thing to government that there is this
kind of flexibility. There are a lot of things going on in
February and March, but you still have to pay your taxes on
April 15. You can get the extension, you get the extension, but
you've still got to pay the man. And people have to file all
kind of reports to be in compliance with the government.
And your agencies, your departments and all the other ones,
are not nearly as understanding as OMB has been and, frankly,
even as Congress has been about people who just don't do it, or
they do it 3 months late or they do it whenever they get around
to it. So we'll take these under advisement.
But the last thing I want to do, I do not want to cutoff my
nose to spite my face and avoid making solid, common-sense
changes that you guys recommend that might make sense; I do not
want to ignore good suggestions. But what I do not want is for
there to be yet another reason why people are not scoring
particularly well because we've changed the rules on them, and
we have once again given them a whole new set on the standards
by which they're supposed to play ball.
The one thing about this year's score is that it is the
first time that we have back-to-back years that actually are
comparable, apples-to-apples comparisons to really measure
progress. And all the frustrations and all the timing issues
and the inconsistent reporting issues, particularly, that
relate to incidents affect everyone the same way. So, you know,
the A guys are dealing with the same lack of clarity as the F
guys. And so if it's off, it's consistently off throughout the
government, and it's still relatively correct.
So we'll take your points under advisement as we review
there.
But the last thing I want to do is provide another reason
why people can come back and say, well, you know, we were all
geared up for the 2004 structure, but then in 2006 you guys
moved the yardsticks on us. So we would have been there, but we
were prepared for the old standard.
I would give all of you the opportunity to provide any
closing remarks and then we will adjourn the hearings. So, Mr.
Weems, if you would like to offer any thoughts, things that you
would wish had come out, suggestions, we'll move on down the
line.
Mr. Weems. Nothing else, Mr. Chairman, except we look for a
better grade, and if you're looking for a responsible official
in HHS, that's me. Thank you.
Mr. Putnam. Thank you.
Mr. Merschoff. Yes, Mr. Chairman, I would like to recognize
two reasons for our success. One is the computer security
staff. They're dedicated, they're motivated, they're competent,
they're capable and they're the engine behind our success.
The second is the Office of Inspector General. We have a
good and productive partnership, a dynamic tension with that
group where we can disagree with them, they can criticize us,
we listen to each other and recognize that sometimes we're
wrong and sometimes we're right; and I think that's helped us a
lot in terms of improving.
That concludes my remarks.
Mr. Putnam. Thank you very much.
Mr. Rush.
Mr. Rush. I just want to be sure that I close by making
clear to you that the problem with timeliness was the problem
of the Office of Inspector General. It was not the Treasury
Department. It was not IRS. It was not my partner, the Treasury
Inspector General for Tax Administration. Each of those three
partners of mine did their work on time, met the standard and
got their work product to OMB. The only delinquency at Treasury
came out of my office, and I regret that.
Mr. Putnam. Thank you for your candor and for your
suggestions as well. They were good.
Mr. Corts.
Mr. Corts. Back to your point about the time that you do
this and the consistency and so forth, there is a lot of value,
I think, in being able to, even if the date might not be where
everybody wants it, you keep that date, you keep the standard
so you've got the measurement.
Going forward 2 years in a row now, it would be great to
see another year. What's the right time? I'm sure we could
debate that around, because it could serve all of us; different
times would serve all of us, maybe any one of us better than
another date. But I do think there's a lot of value in
consistency, and I know we look for that in terms of
benchmarking.
Finally, Mr. Chairman, we just want you to know that the
Department of Justice considers this to be of the highest
priority to us, and we fully intend to improve our mark. And we
intend to be here and look forward to being here and giving you
a better report in the future.
Mr. Putnam. Thank you very much.
I want to thank all of our witnesses from both panels for
their contribution to our oversight efforts. As we face almost
daily reports of the IT vulnerabilities, the Federal Government
really must be a shining example of IT security.
I also want to mention that I will be meeting with the
Federal CIO Council again to express my commitment to this
issue as well as to hear their feedback on why so many agencies
have not produced better progress, and perhaps to solicit more
suggestions, as you have provided, on ways that we can improve
the process.
In the event that there may be additional questions we did
not have time for today, the record will remain open for 2
weeks for submitted questions and answers.
Thank you very much. The subcommittee is adjourned.
[Whereupon, at 3:42 p.m., the subcommittee was adjourned.]
[The prepared statement of Hon. Wm. Lacy Clay and
additional information submitted for the hearing record
follow:]
[GRAPHIC] [TIFF OMITTED] T4838.005
[GRAPHIC] [TIFF OMITTED] T4838.006
[GRAPHIC] [TIFF OMITTED] T4838.146
[GRAPHIC] [TIFF OMITTED] T4838.147
[GRAPHIC] [TIFF OMITTED] T4838.148
[GRAPHIC] [TIFF OMITTED] T4838.149
[GRAPHIC] [TIFF OMITTED] T4838.150
[GRAPHIC] [TIFF OMITTED] T4838.151
[GRAPHIC] [TIFF OMITTED] T4838.152
[GRAPHIC] [TIFF OMITTED] T4838.153