[Senate Hearing 114-181]
[From the U.S. Government Publishing Office]
FINANCIAL SERVICES AND GENERAL GOVERNMENT APPROPRIATIONS FOR FISCAL
YEAR 2016
----------
TUESDAY, JUNE 23, 2015
U.S. Senate,
Subcommittee of the Committee on Appropriations,
Washington, DC.
The subcommittee met, pursuant to notice, at 10:33 a.m., in
room SD-124, Dirksen Senate Office Building, Hon. John Boozman
(chairman) presiding.
Present: Senators Boozman, Lankford, Coons, Mikulski, and
Moran.
OFFICE OF PERSONNEL MANAGEMENT
STATEMENT OF KATHERINE L. ARCHULETA, DIRECTOR
ACCOMPANIED BY:
MICHAEL R. ESSER, ASSISTANT INSPECTOR GENERAL FOR AUDITS
RICHARD A. SPIRES, CHIEF EXECUTIVE OFFICER, RESILIENT NETWORK
SYSTEMS, INC.
OPENING STATEMENT OF SENATOR JOHN BOOZMAN
Senator Boozman. The hearing will come to order.
The massive breach of the Office of Personnel Management
(OPM) systems may be the most devastating cybersecurity attack
in our Nation's history. Unfortunately, while the news reports
about these incidents have been shocking, they should not be
surprising. The OPM incident follows several across Government
and is only the latest example of the Federal Government's
inability to protect itself from cybersecurity threats.
Today's hearing before the Subcommittee on Financial
Services and General Government is intended to elicit further
information about the recent OPM data breaches. It is also a
time to discuss the enormous challenges facing the Federal
Government as it attempts to ensure this does not happen again.
The Government spends approximately $82 billion a year on
information technology. Given the cost of these projects and
their impact on our economy and national security, members of
the subcommittee have an ongoing commitment to conduct
oversight. We must ensure that hard-earned tax dollars of
millions of Americans are being spent wisely and effectively.
Just last year, the subcommittee held a hearing with OPM
Director Archuleta, former Chief Information Officer (CIO)
Steve VanRoekel, former General Services Administration (GSA)
Administrator Dan Tangherlini, and the Director of Information
Technology (IT) Management Issues at the Government
Accountability Office (GAO) David Powner. Given the enormous
resources and important security issues at stake, the
subcommittee considered it imperative that the Office of
Management and Budget (OMB) and Federal agencies appropriately
managed these projects.
We're all well aware of examples of projects that ended in
spectacular failure, as with the initial rollout of
healthcare.gov. While that kind of crisis makes news, we should
also be troubled by the accounts that don't grab headlines,
including initiatives with ongoing costs that grow each year
after year without demonstrating effective results or
sufficient security.
We must have safeguards in place to ensure that oversight
of these projects are consistent, that problems are anticipated
before they occur, and, most importantly, that someone is
actually accountable and responsible. All too often, large
complex IT projects drag on for years, outlasting the
administration that initiated them and the employees
responsible for managing them.
In the Financial Services and General Government bill
alone, billions have been spent over the years on tax system
modernization at the Internal Revenue Service (IRS), work that
has been continuing for decades and is still incomplete. Even
for projects now on track, past problems generate millions in
additional costs and years of delay.
And as we have seen recently at IRS and once again with the
OPM breach, both of which have compromised the personal data of
millions of Americans, billions of Federal dollars spent are no
guarantee of security. Across the Government, IT projects too
frequently go over budget, fall behind schedule, and do not
deliver value to taxpayers.
Responsibility for oversight is often fragmented throughout
the agency owning the project, and OMB does not conduct
appropriate review and management. Whether issues related to
program requirements, performance, spending, or security, lots
of people are involved, but often no clear lines of
accountability are drawn.
What has happened at OPM is devastating. Millions of
Americans and their families and friends have been affected.
Giving those impacted limited free credit monitoring and
identity theft insurance will not be enough to address the
long-term consequences that we may see for years to come.
But also troubling is the knowledge that OPM is just the
most recent example of the Government's systemic failure to
protect itself. According to GAO, we should have serious
concerns for the future. The number of information security
incidents reported by Federal agencies has exploded in recent
years.
Constant vigilance is required, and GAO has found that
Government systems may not be prepared for the job. Nineteen of
24 major Federal agencies have reported deficiencies in
information security controls. The Inspector General (IG) at 23
of those agencies cited information security as a major
management challenge.
How many headlines of serious data breaches will it take to
implement the steps necessary to protect ourselves? And at what
point do some in Washington recognize that growing the
bureaucracy without actually governing is a recipe for this
type of disaster.
The Obama administration views the Federal Government as
capable of tackling almost every problem that the Nation faces.
Yet while attempting to grow the size and scope of the Federal
Government at every turn, the administration fails to follow
through on the tasks it is already responsible for. If you
bounce from one bigger Government solution to another without
carrying out your basic responsibilities, this is what happens.
It's easy to suggest more money is the solution. That seems
to be the response the administration leans on every time
there's a problem. But it is often the wrong choice, especially
in situations like this where it appears that the problem is
something much greater than a lack of resources.
The American people have lost faith in their institutions.
The last thing they will do is trust Washington to solve a
problem when it can't even protect the personal information of
those it employs.
There needs to be a dramatic change in the status quo.
What I hope to hear from our witnesses today is not the
same stale line that more money is needed, but an explanation
as to why the Federal Government failed to do the basic job of
protecting personal data of millions of employees with the vast
resources it already has in hand, what it's doing right now to
resolve this problem, and what is being done to ensure that we
are prepared for the next attack.
I hope with your help we can learn from this incident and
identify ways to improve and protect our security. I appreciate
the interest of all my colleagues and our shared commitment to
doing what we can to work together to try and address this so
important issue. We cannot afford not to.
Senator Coons.
STATEMENT OF SENATOR CHRISTOPHER A. COONS
Senator Coons. Thank you, Chairman Boozman.
I'd like to welcome our witnesses, OPM Director Katherine
Archuleta, Assistant OPM Inspector General Michael Esser, and
former Department of Homeland Security (DHS) and the Internal
Revenue Service (IRS) Chief Information Officer Richard Spires.
We are here today, as the chairman has laid out, to review
information technology spending and data security at the Office
of Personnel Management. As part of that review, we need to
discuss recent cybersecurity attacks that have put Federal
employee information and our national security at real risk.
We also need to address the late-breaking inspector general
audit that expresses concerns about OPM's IT modernization
project. But while we conduct this subcommittee oversight of
OPM and its spending and response, I also urge us to put this
in the context of larger cybersecurity challenges that face our
Government and our society as a whole, and progress, or lack
thereof, by Congress in strengthening our Nation's cyber
defenses and in providing needed funding for Federal
cybersecurity and IT initiatives.
Regarding the cyber incidents at OPM, one breach involved
personnel data of roughly 4 million Federal employees stored on
Interior Department networks. During the breach, investigators
found another intrusion where information from background
investigations was allegedly stolen.
I understand OPM only recently became aware of the security
clearance theft and that the investigation is still underway.
So while we may be limited in exactly what we can discuss in
this context, I'm very hopeful we can have a productive and
ongoing conversation.
The fact these security breaches happened is, frankly,
terrible. They force us to grapple with the reality that in our
interconnected world, we're more vulnerable than ever, and we
need to do more to protect our public employees' vital personal
information from foreign attackers.
After we've investigated why these cyber attacks were able
to break through, we need to be willing to do what's necessary
to ensure they don't happen again. These attacks don't just
compromise the information of millions of Federal employees,
but our Nation's security, as well.
It's further troubling the IG's office has found that OPM
has not fully complied with the Federal Information Security
Management Act, which mandates information security
requirements for all Federal agencies. While OPM has made
recent improvements, we need to remain vigilant.
Both Director Archuleta and the OPM CIO have only been on
the job roughly a year and a half. And to their credit, they
have made IT security a priority. But they need to clearly
understand that the job is not done.
OPM has indicated to the subcommittee most of its IT
security systems are aged and at the end of their useful life.
For some, security patches are no longer provided by the
original vendor. In fiscal year 2014, OPM began a 3-year IT
system modernization and is seeking a third installment of $21
million to complete that project this year. And we have to
understand that without that funding, the investment of the two
previous years can't be meaningfully completed.
I was alarmed by the IG's allegations about mismanagement
of the modernization projects to date and hope that OPM's
representatives will speak to these assertions directly here
today.
Last, I just wanted to emphasize, I think we need to
prevent another round of sequestration. OPM's fiscal year 2016
budget request includes a $32 million increase over last year's
enacted level, virtually all of which would address IT
infrastructure improvements. Sequestration could critically
threaten those investments and even the livelihoods of our
employees.
While some of these cuts might be weathered in the short
term, they can have serious long-term impacts. And I think we
need to work together to ensure Federal agencies are prepared
as best they can be to protect against cyber threats.
The Federal Government is at constant threat of cyber
attacks. It successfully wards off millions of attempted
attacks a year. And I think we need to work together to protect
the Nation's economic and national security interests by coming
together to deal with these vital cybersecurity issues.
Chairman Boozman, thank you for holding this hearing, and
I'm eager to continue to work together as we consider the needs
of our Federal agencies in combating cyber threats.
Senator Boozman. Thank you, Senator.
Senator Mikulski. Mr. Chairman, may I just make a few
comments and observations?
Senator Boozman. You sure can. You can comment all you
like.
Senator Mikulski. First of all, Mr. Chairman, I really want
to thank you for your leadership in convening this hearing. I
think America wants to know, certainly our Federal employees
want to know, what happened and what is the impact on them, and
what is the impact on the Nation.
I would strongly recommend to the chair that, after this
hearing and then also the briefing we'll receive this
afternoon, the chair and the ranking consider having a
classified briefing, because as a member of both the Intel
Committee and someone who has been involved on this, there are
things that are best discussed that you need to know for your
responsibilities in a setting. And Senator Cochran and I would
be happy to cooperate with you in establishing that. You'll
know more this afternoon.
The second point is, what has happened at OPM, and also
what happened to the breaches at the Army, shows that this is a
serious national issue. It affects not only OPM, but every
agency, and also shows that national security and its impact is
not limited to the Department of Defense (DOD).
Mr. Chairman, I also want to remind the committee or bring
to their attention, we tried to deal with this in 2012. Under
the leadership of Senators Lieberman and Collins, there was a
bipartisan effort to have a cybersecurity bill that dealt with
new authorities for key agencies to establish standards for
critical infrastructure, create an info-sharing regime to
protect both dot-gov and dot-com, and giving DHS authority to
unite Federal resources across all levels of Government to have
both the authorities to make sure they have the resources to
know how to do the right job.
Exactly what you're saying, sir. Let's not just throw money
at it. Let's get value and security for the dollar.
That was stopped because the Chamber of Commerce
established a massive lobbying campaign, because they were
worried that we would overregulate. Well, we are where we are.
So we need to do a lot of work. We had a bipartisan study
group. They had people like Blunt, Coats, Collins, those of us
on Intel and Approps. So maybe we need to resurrect that
because it's OPM today, it'll be another agency tomorrow. We've
got to make sure our cyber shields are up, we're fit for duty,
and we're fit to protect our people.
So I just wanted to refresh everybody of that. And of
course, my Federal employees need to know what happened, how do
they protect themselves. And we need to know how to protect
America.
So thank you, Mr. Chair.
Senator Boozman. Thank you, Senator. And I think the
suggestion of the classified briefing is an excellent one.
And also, this is, certainly, not a partisan issue. This is
something that's been going on for a long, long time through
successive administrations.
We have three witnesses appearing before us today:
Katherine Archuleta, director of the Office of Personnel
Management; Michael Esser, Assistant IG for Audits at OPM; and
Richard Spires, CEO of Resilient Network Systems and former
Chief Information Officer at DHS and IRS.
Director Archuleta, I invite you to present your testimony.
SUMMARY STATEMENT OF KATHERINE L. ARCHULETA
Ms. Archuleta. Chairman Boozman, Ranking Member Coons, and
members of the subcommittee, Government and nongovernment
entities are under constant attack by evolving and advanced
persistent threats and criminal actors. These adversaries are
sophisticated, well-funded, and focused.
Unfortunately, these attacks will not stop. If anything,
they will increase.
Although OPM has taken significant steps to meet our
responsibility to secure personnel data, it is clear that OPM
needs to accelerate these efforts, not only for those
individuals personally, but also as a matter of national
security.
My goal as director is to leverage cybersecurity best
practices and protect the sensitive information entrusted to
the agency, modernizing our IT infrastructure to better
confront emerging threats, and to meet our mission and our
customer service expectations.
OPM has undertaken an aggressive effort to update its
cybersecurity. For fiscal year 2014 and 2015, we committed
nearly $67 million toward shoring up our IT infrastructure. In
June of 2014, we began to completely redesign our current
network while also protecting our legacy network.
These projects are ongoing, on schedule, and on budget. We
implemented state-of-the-art practices, such as additional
firewalls, two-factor authentication for remote access, and
limited privilege access rights. We are also increasing the
types of methods utilized to encrypt our data.
As a result of these efforts, in April 2015, an intrusion
that predated the adoption of these security controls affecting
OPM's IT systems and data was detected by our new cybersecurity
tools. OPM immediately contacted DHS and the FBI. And together,
we initiated an investigation to determine the scope and the
impact of the intrusion.
In early May, the interagency incident response team shared
with relevant agencies that the exposure of personnel records
had occurred.
In early June, OPM informed Congress and the public that
notification actions would be sent to affected individuals
beginning on June 8 through June 19.
We are continuing to learn more about the systems that
contributed to individuals' data potentially being compromised.
For example, we have now confirmed that any Federal
employee from across all branches of Government whose
organization submitted service history records to OPM may have
been compromised, even if their full personnel file is not
stored in OPM's system. These individuals were included in the
previously identified population of approximately 4 million
current and former Federal employees, and have been included in
the notification.
Later in May, the interagency incident response team
concluded that additional systems were likely compromised. This
separate incident, which also predated the development of our
new security tools and capabilities, continues to be
investigated by OPM and our interagency partners.
Based on this continuing investigation in early June, the
interagency response team shared with relevant agencies that
there was a high degree of confidence that OPM systems related
to background investigations of current, former, and
prospective Federal Government employees, and for those for
whom a Federal background investigation was conducted, may have
been compromised.
While we have not yet determined its scope and its impact,
we are committed to notifying those individuals whose
information may have been compromised as soon as practicable.
But for the fact that OPM implemented new, more stringent
security tools in its environment, we would never have known
that malicious activity had previously existed in the network.
In response to these incidents, OPM, working with our
partners at DHS, has immediately implemented additional
security measures to protect the sensitive information we
manage. We continue to execute our aggressive plan to modernize
OPM's platform and bolster security tools. We are on target to
finish a completely new modern and secure datacenter
environment by the end of fiscal year 2015, which will
eventually replace our legacy network.
OPM's 2016 budget request included an additional $21
million above 2015 funding levels to further support the
modernization of our IT infrastructure, which is critical to
protecting data from persistent adversaries that we face. This
funding will help sustain the network security upgrades and
maintenance initiated in fiscal years 2014 and 2015 to improve
OPM's cyber posture, including advanced tools, such as database
encryption and stronger firewalls and storage devices.
We discovered these intrusions because of our increased
efforts in the last 18 months to improve cybersecurity at OPM,
not despite them.
PREPARED STATEMENT
I am dedicated to ensuring that OPM does everything in its
power to protect the Federal workforce and to ensure that our
systems will have the best security posture the Government can
provide.
Thank you and I appreciate the opportunity to testify
today. I am happy to address any questions you may have.
[The statement follows:]
Prepared Statement of Katherine L. Archuleta
a review of it spending and data security at opm
Chairman Boozman, Ranking Member Coons, and members of the
subcommittee:
Government and non-government entities are under constant attack by
evolving and advanced persistent threats and criminal actors. These
adversaries are sophisticated, well-funded, and focused. Unfortunately,
these attacks will not stop--if anything, they will increase. Although
OPM has taken significant steps to meet our responsibility to secure
the personal data of those we serve, it is clear that OPM needs to
dramatically accelerate these efforts, not only for those individuals
personally, but also as a matter of national security. When I was sworn
in as the Director of the U.S. Office of Personnel Management (OPM) 18
months ago, I immediately became aware of security vulnerabilities in
the agency's aging legacy systems and I made the modernization and
security of our network and its systems one of my top priorities. My
goal as Director of OPM, as laid out in OPM's February 2014 Strategic
Information Technology (IT) Plan, has been to leverage cybersecurity
best practices to protect the sensitive information entrusted to the
agency, while modernizing our IT infrastructure to better confront
emerging threats and meeting our mission and customer service
expectations.
Strengthening and Enhancing OPM's Data Security
Over the last 18 months, OPM has undertaken an aggressive effort to
update its cybersecurity posture, adding numerous tools and
capabilities to its networks. For fiscal years 2014 and 2015 we have
committed nearly $70 million towards shoring up our IT infrastructure.
In June 2014, we began to completely redesign our current network,
while also protecting our legacy network to the maximum extent possible
in the interim. These projects are ongoing, on schedule, and on budget.
The first phase of this project was to deploy the tools required to
address critical vulnerabilities on the existing network. As part of
this effort, in January 2015 we implemented state of the art practices,
such as additional firewalls, two-factor authentication for remote
access, and limited privileged access rights. Currently, we are also
increasing the types of methods utilized to encrypt our data. These
methods cover not only data at rest, but data in transit, and data
displayed through masking or redaction.
As a result of these efforts to improve our security posture, in
April 2015, an intrusion that predated the adoption of these security
controls affecting OPM's IT systems and data was detected by our new
cybersecurity tools. OPM immediately contacted the Department of
Homeland Security (DHS) and the Federal Bureau of Investigation (FBI)
and, together with these partners, initiated an investigation and
forensic analysis to determine the scope and impact of the intrusion.
Shortly thereafter, OPM notified congressional leadership and select
committees of this incident. In early May, the interagency incident
response team shared with relevant agencies that the exposure of
personnel records had occurred. That very same day, we worked to brief
congressional leadership and select committees. In early June, OPM
informed Congress and the public that notifications would be sent to
affected individuals beginning on June 8 through June 19. We refer to
this incident as the intrusion affecting personnel records.
As part of the ongoing investigation and analysis, we are
continuing to learn more about the systems that contributed to
individuals' data potentially being compromised. For example, we have
now confirmed that any Federal employee from across all branches of
Government whose organization submitted service history records to OPM
may have been compromised--even if their full personnel file is not
stored on OPM's system. These individuals were included in the
previously identified population of approximately four million current
and former Federal employees and are being appropriately notified.
During the course of the ongoing investigation, the interagency
incident response team concluded--later in May--that additional systems
were likely compromised, also at an earlier date. In late May, OPM and
the interagency notified Congressional leadership and select committees
of this separate intrusion. This separate incident--which also predated
deployment of our new security tools and capabilities--continues to be
investigated by OPM and our interagency partners. Based on this
continuing investigation, in early June, the interagency response team
shared with relevant agencies that there was a high degree of
confidence that OPM systems related to background investigations of
current, former, and prospective Federal Government employees, and
those for whom a Federal background investigation was conducted, may
have been compromised. We are currently working with our interagency
partners to continue to offer classified briefings for members and
staff on the status of this investigation. While we have not yet
determined its scope and impact, we are committed to notifying those
individuals whose information may have been compromised as soon as
practicable. This separate incident is one that we refer to as the
intrusion affecting background investigations.
But for the fact that OPM implemented new, more stringent security
tools in its environment, we would have never known that malicious
activity had previously existed on the network, and would not have been
able to share that information for the protection of the rest of the
Federal Government. In response to these incidents, OPM, working with
our partners at DHS has immediately implemented additional security
measures to protect the sensitive information it manages and to take
steps toward building a simplified, modern, and flexible network
infrastructure.
Driving Continued Progress on IT Modernization
We continue to execute on our aggressive plan to modernize OPM's
platform and bolster security tools. We are on target to finish a
completely new modern and secure data center environment by the end of
fiscal year 2015 which will eventually replace our legacy network.
OPM's 2016 budget request included an additional $21 million above 2015
funding levels to further support the modernization of our IT
infrastructure, which is critical to protecting data from the
persistent adversaries we face. This funding will help us sustain the
network security upgrades and maintenance initiated in fiscal year 2014
and fiscal year 2015 to improve OPM's cyber posture, including advanced
tools such as database encryption and stronger firewalls and storage
devices.
Conclusion
As we are all aware, Government and non-government entities are
under constant attack by evolving and advanced persistent threats and
criminal actors. Again--we recognize that these attacks will increase.
We are working with an interagency team to identify and rapidly
implement protections that will decrease our risk; however, as we
address critical immediate needs we also need to continue our work to
address long-term strategic challenges that affect our ability to
ensure the security of our networks in light of this persistent threat.
As our OIG has noted, OPM has been challenged for several years in
building and maintaining a strong management structure and the
processes needed for a successful information technology security
program. OPM agrees with this assessment which is why I prioritized
development of the agency's Strategic IT Plan and have prioritized its
implementation.
We discovered these intrusions because of our increased efforts in
the last 18 months to improve cyber security at OPM, not despite them.
I am dedicated to ensuring that OPM does everything in its power to
protect the Federal workforce, and to ensure that our systems will have
the best cyber security posture the Government can provide.
We thank you for your support of our ongoing efforts to strengthen
our IT security and I appreciate the opportunity to testify today. I am
happy to address any questions you may have.
Senator Boozman. Mr. Esser.
SUMMARY STATEMENT OF MICHAEL R. ESSER
Mr. Esser. Chairman Boozman, Ranking Member Coons, and
members of the committee, good morning. My name is Michael
Esser, and I am the Assistant Inspector General for Audits at
the U.S. Office of Personnel Management. Thank you for inviting
me to testify at today's hearing on the IT audit work performed
by the OPM Office of the Inspector General.
Senator Boozman. Can you put your microphone on? It's on?
Just pull it closer then.
Mr. Esser. Today I will be discussing OPM's long history of
systemic failures to properly manage its IT infrastructure,
which we believe may have ultimately led to the breaches we are
discussing today, as well as issues related to OPM's current IT
modernization project.
There are three primary areas of concern that we have
identified through our Federal Information Security Management
Act (FISMA) audits during the past several years: information
security governance, security assessment and authorization, and
technical security controls.
Information security governance is the management structure
and processes that form the foundation of a successful security
program. For many years, OPM operated in a decentralized manner
with the agency's program officers managing their IT systems.
This decentralized structure had a negative impact upon OPM's
IT security posture, and all of our FISMA audits between 2007
and 2013 identified this as a serious concern.
By 2014, steps taken by OPM to centralize IT security
responsibility with the CIO had resulted in many improvements.
However, it is apparent the OCIO is still negatively impacted
by the many years of decentralization.
The second concern is security assessments and
authorization. This process includes a comprehensive assessment
of each IT system to ensure that it meets the applicable
security standards before allowing the system to operate. We
identified problems related to system authorizations in 2010
and 2011, but removed it as an audit concern in 2012. However,
problems with OPM system authorizations have reappeared. In
2014, 21 OPM systems were due to receive a new authorization
but 11 were not authorized by year-end.
In addition, the Office of the Chief Information Officer
(OCIO) has recently put authorization efforts on hold until it
completes the current modernization project. This action to
extend authorizations is contrary to OMB guidance, which
specifically states that an extended or interim authorization
is not valid. It is also worth noting that OMB no longer
requires systems to be authorized every 3 years, but that is
assuming that agencies have implemented a mature continuous
monitoring program.
Our FISMA auditing determined that OPM does not have a
mature program. Therefore, we still expect OPM systems to have
current authorizations.
The third concern relates to OPM's use of technical
security controls. OPM has implemented a variety of controls
and tools to make the agency's IT systems more secure. While
this is obviously a positive step, we are concerned these tools
are not being implemented properly and did not cover the entire
technical infrastructure as we found that OPM does not have an
accurate centralized inventory of all servers and databases.
Even if all the security tools were being used properly,
OPM cannot fully defend its network without a comprehensive
list of assets.
Also, there has been much discussion of the difficulty in
securing OPM systems as they are old legacy systems. While this
is true in many cases and many OPM systems are mainframe based,
it is our understanding that some of the systems impacted by
the breaches are, in fact, modern systems for which most of the
technical improvements necessary to secure them could be
accomplished.
In addition to the issues identified in our FISMA audits, I
would also like to briefly address OPM's IT modernization
project, which will overhaul its entire infrastructure and
migrate all systems to a new data center environment. We
recently issued a flash audit alert discussing this project and
our concerns related to project management and the use of a
sole source contract for the duration of the effort.
One area of significant concern that we identified is that
OPM does not have a dedicated funding source for the entire
project. Its estimate of $93 million includes only the initial
phases of the project, which covers tightening up the security
controls and building a new shell environment. The $93 million
estimate does not include the cost of migrating approximately
50 major IT systems to this new shell environment. The cost of
this work is likely to be substantial, and the lack of a
dedicated funding source increases the risk that the project
will fail to meet its objectives.
PREPARED STATEMENT
In closing, it is clear that OPM has a great deal of work
to do to strengthen its IT security posture. We fully support
the concept of OPM's IT modernization project. However,
especially for a task of this magnitude, it is imperative that
OPM follow solid IT project management best practices to
provide the project the best chance for success.
Thank you for your time. I'm happy to answer any questions
you may have.
[The statement follows:]
Prepared Statement of Michael R. Esser
it spending and data security at opm june 23, 2015
Chairman Boozman, Ranking Member Coons, and members of the
subcommittee:
Good morning. My name is Michael R. Esser. I am the Assistant
Inspector General for Audits at the U.S. Office of Personnel Management
(OPM). Thank you for inviting me to testify at today's hearing
discussing the information technology (IT) spending and data security
at OPM. Specifically, today I will be discussing the audits that the
Office of the Inspector General (OIG) conducts in accordance with the
Federal Information Security Management Act, commonly known as
``FISMA.'' Although OPM has made progress in certain areas, some of the
current problems and weaknesses were identified as far back as fiscal
year 2007. We believe this long history of systemic failures to
properly manage its IT infrastructure may have ultimately led to the
breaches we are discussing today.
OIG's FISMA Work
FISMA requires that OIGs perform annual audits of their agencies'
IT security programs and practices. These audits are conducted in
accordance with guidance issued each year by the U.S. Department of
Homeland Security (DHS) Office of Cybersecurity and Communications.
Today I will talk about three of the most significant concerns
highlighted in our fiscal year 2014 FISMA report. However, it is
important to note that our report contained a total of 29
recommendations covering a wide variety of IT security topics. Only 3
of these 29 recommendations have been closed to date, and 9 of the open
recommendations are long-standing issues that were rolled-forward from
prior year FISMA audits.
1. Information Security Governance
Information security governance is the management structure and
processes that form the foundation of a successful information
technology security program. Although the DHS FISMA reporting metrics
do not directly address security governance, it is an overarching issue
that impacts how the agency handles IT security and its ability to meet
FISMA requirements, and therefore we have always addressed the matter
in our annual FISMA audit reports.
This is an area where OPM has seen significant improvement.
However, some of the past weaknesses still haunt the agency today.
In the fiscal year 2007 FISMA report, we identified a material
weakness \1\ related to the lack of IT security policies and
procedures. In fiscal year 2009, we expanded the material weakness to
include the lack of a centralized security management structure
necessary to implement and enforce IT security policies. OPM's Office
of the Chief Information Officer (OCIO) was responsible for the
agency's overall technical infrastructure and provided boundary-level
security controls for the systems residing on this infrastructure.
However, each OPM program office had primary responsibility for
managing security controls specific to its own IT systems. There was
often confusion and disagreement as to which controls were the
responsibility of the OCIO, and which were the responsibility of the
program offices.
---------------------------------------------------------------------------
\1\ An IT material weakness is a severe control deficiency that
prohibits the organization from adequately protecting its data.
---------------------------------------------------------------------------
Further, the program office personnel responsible for IT security
frequently had no IT security background and were performing this
function in addition to another full-time role. For example, this meant
that an employee whose job was processing retirement applications may
have been given the additional responsibility of monitoring and
managing the IT security needs of the system used to process those
applications.
As a result of this decentralized governance structure, many
security controls went unimplemented and/or remained untested, and OPM
routinely failed a variety of FISMA metrics year after year. Therefore,
we continued to identify this security governance issue as a material
weakness in all subsequent FISMA audits through fiscal year 2013.
However, in fiscal year 2014, we changed the classification of this
issue to a significant deficiency, which is less serious than a
material weakness. This change was prompted by important improvements
that were the result of changes instituted in recent years by OPM.
Specifically, in fiscal year 2012, the OPM Director issued a memorandum
mandating the centralization of IT security duties to a team of
Information System Security Officers (ISSO) that report to the OCIO. In
fiscal year 2014, the OPM Director approved a plan to further
restructure the OCIO that included funding for additional ISSO
positions. The OCIO also established a 24/7 security operations center
responsible for monitoring IT security events for the entire agency;
however, OPM has not yet implemented a mature continuous monitoring
program.
This new governance structure has resulted in improvement in the
consistency and quality of security practices for the various IT
systems owned by the agency. Although we are optimistic that these
improvements will continue, it is apparent that the OCIO continues to
be negatively impacted by years of decentralized security governance,
as the technical infrastructure remains fragmented and therefore
inherently difficult to protect.
2. Security Assessment and Authorization
A Security Assessment and Authorization (Authorization) is a
comprehensive process under which the IT security controls of an
information system are thoroughly assessed against applicable security
standards. After the assessment is complete, a formal Authorization
memorandum is signed indicating that the system is cleared to operate
in the agency's technical environment.
The Office of Management and Budget (OMB) mandates that all major
Federal information systems have a valid Authorization (that is, that
they have all been subjected to this process) every 3 years unless a
mature continuous monitoring system is in place (which OPM does not yet
have). Although, as mentioned, IT security responsibility is being
centralized under the OCIO, it is still the responsibility of OPM
program offices to facilitate and pay for the Authorization process for
the IT systems that they own.
OPM has a long history of issues related to system Authorizations.
Our fiscal year 2010 FISMA audit report contained a material weakness
related to incomplete, inconsistent, and poor quality Authorization
packages. This issue improved over the next 2 years, and was removed as
an audit concern in fiscal year 2012.
However, problems with OPM's system Authorizations have recently
resurfaced. In fiscal year 2014, 21 OPM systems were due for
Authorization, but 11 of those were not completed on time and were
therefore operating without a valid Authorization.\2\ This is a drastic
increase from prior years, and represents a systemic issue of
inadequate planning by OPM program offices to assess and authorize the
information systems that they own.
---------------------------------------------------------------------------
\2\ The OIG is the co-owner of one of these IT systems, the Audit
Reports and Receivables Tracking System. This system has been
reclassified as a minor system on the OPM general support system (GSS),
and cannot be Authorized until the OCIO Authorizes the GSS.
---------------------------------------------------------------------------
Although the majority of our FISMA audit work is performed towards
the end of the fiscal year, it already appears that there will be a
greater number of systems this year operating without a valid
Authorization. In April, the CIO issued a memorandum that granted an
extension of the previous Authorizations for all systems whose
Authorization had already expired, and for those scheduled to expire
through September 2016. Should this moratorium on Authorizations
continue, the agency will have up to 23 systems that have not been
subject to a thorough security controls assessment. The justification
for this action was that OPM is in the process of modernizing its IT
infrastructure and once this modernization is complete, all systems
would have to receive new Authorizations anyway.
While we support the OCIO's effort to modernize its systems, this
action to extend Authorizations is contrary to OMB guidance, which
specifically states that an ``extended'' or ``interim'' Authorization
is not valid. Consequently, these systems are still operating without a
current Authorization, as they have not been subject to the complete
security assessment process that the Authorization memorandum is
intended to represent.
There are currently no consequences for failure to meet FISMA
standards, or operate systems without Authorizations, at either the
agency level or the program office level. The OIG simply reports our
findings in our annual FISMA audit, which is delivered to OPM and then
posted on our Web site. OMB receives the results of all FISMA audits,
and produces an annual report to Congress. There are no directives or
laws that provide for penalties for agencies that fail to meet FISMA
requirements.
However, at the program office level, OPM has the authority to
institute administrative sanctions. This could be an effective way to
reduce non-compliance with FISMA requirements. We recommended that the
performance standards of all OPM major system owners include a
requirement related to FISMA compliance for the systems they own. Since
OMB requires a valid Authorization for all Federal IT systems, we also
recommended that the OPM Director consider shutting down systems that
were in violation. None of the systems in violation were shut down.
Not only was a large volume (11 out of 47 systems) of OPM's IT
systems operating without a valid Authorization, but several of these
systems are among the most critical and sensitive applications owned by
the agency.
Two of the OCIO systems without an Authorization are general
support systems that host a variety of other major applications. Over
65 percent of all systems operated by OPM (not including contractor-
operated systems) reside on one of these two support systems, and are
therefore subject to any security risks that exist on the support
systems.
Furthermore, two additional systems without Authorizations are
owned by OPM's Federal Investigative Services, which is responsible for
facilitating background investigations for suitability and security
clearance determinations. Any weaknesses in the IT systems supporting
this program office could potentially have national security
implications.
As I explained, maintaining active Authorizations for all IT
systems is a critical element of a Federal information security
program, and failure to thoroughly assess and address a system's
security weaknesses increases the risk of a security breach. We believe
that the volume and sensitivity of OPM systems that are operating
without an active Authorization represents a material weakness in the
internal control structure of the agency's IT security program.
3. Technical Security Controls
As previously stated, our fiscal year 2014 FISMA report contained a
total of 29 audit recommendations, but two of the most critical areas
in which OPM needs to improve its technical security controls relate to
configuration management and authentication to IT systems using
personal identity verification (PIV) credentials.
Configuration management refers to the policies, procedures, and
technical controls used to ensure that IT systems are securely
deployed.
OPM has implemented a variety of new controls and tools designed to
strengthen the agency's technical infrastructure by ensuring that its
network devices are configured securely. However, our fiscal year 2014
FISMA audit determined that all of these tools are not being utilized
to their fullest capacity. For example, we were told in an interview
with OPM personnel that OPM performs monthly vulnerability scans on all
computer servers using its automated scanning tools. While we confirmed
that OPM does indeed own these tools and that regular scan activity was
occurring, our audit also determined that some of the scans were not
working correctly because the tools did not have the proper
credentials, and that some servers were not scanned at all.
OPM has also implemented a comprehensive security information and
event management tool designed to automatically correlate potential
security incidents by analyzing a variety of devices simultaneously.
However, at the time of our fiscal year 2014 FISMA report, this tool
was receiving data from only 80 percent of OPM's major IT systems.
During this audit we also determined that OPM does not maintain an
accurate centralized inventory of all servers and databases that reside
within the network. Even if the tools I just referenced were being used
appropriately, OPM cannot fully defend its network without a
comprehensive list of assets that need to be protected and monitored.
This issue ties back to the centralized governance issue I
discussed earlier. Each OPM program office historically managed its own
inventory of devices supporting their respective information systems.
Even though the OCIO is now responsible for all of OPM's IT systems, it
still has significant work ahead in identifying all of the assets and
data that it is tasked with protecting.
With respect to PIV authentication, OMB required all Federal IT
systems to be upgraded to use PIV for multi-factor authentication by
the beginning of fiscal year 2012. In addition, OMB guidance also
mandates that all new systems under development must be PIV-compliant
prior to being made operational.
In fiscal year 2012, the OCIO began an initiative to require PIV
authentication to access the agency's network. As of the end of fiscal
year 2014, over 95 percent of OPM workstations required PIV
authentication to access the OPM network. However, none of the agency's
47 major applications required PIV authentication. Full implementation
of PIV authentication would go a long way in protecting an agency from
security breaches, as an attacker would need to compromise more than a
username and password to gain unauthorized access to a system.
Consequently, we believe that PIV authentication for all systems should
be a top priority for OPM.
Some of the other areas where we identified technical control
weaknesses include:
--Operating system baseline configurations;
--Configuration change control;
--Tracking the status of known security vulnerabilities;
--Patch management;
--Termination of idle VPN connections, and;
--Continuous monitoring of security controls.
Finally, there has been much discussion of the problems with
securing OPM's systems, as they are old, ``legacy'' systems. While this
is true in many cases, and many of OPM's systems are mainframe-based,
some systems that were impacted by the breaches are in fact more modern
systems for which most of the technical improvements necessary to
secure them could be accomplished.
OPM's Modernization Project
In April 2014, the agency began a full overhaul and modernization
of its technical infrastructure, which will involve implementing
additional IT security controls and then migrating the entire
infrastructure to a completely new environment (referred to as the
Shell). The OIG did not become aware of this project until nearly a
year later, in March 2015, when we met with officials from the OPM's
Office of the Chief Financial Officer and the OCIO to discuss questions
related to the special $21 million funding request for this project
contained in the President's fiscal year 2016 budget.
On June 17, 2015, we issued a Flash Audit Alert detailing concerns
related to project management as well as the use of a sole source
contract for the entire project. One specific issue discussed in the
Flash Audit Alert was funding for the project.
OPM informed us that the current estimate for this project was
approximately $93 million. However, after our auditors began their
review, we learned that this cost estimate did not include the costs
for migrating existing applications to the new Shell. That work is
likely to be, by far, the most expensive part of the project. Migrating
applications involves modifying all of the current systems--including
all of the legacy systems that are frequently mentioned--so that they
can operate in the new Shell environment. In 2009, OPM undertook a
similar effort with its financial system application, and it cost $30
million and took 2 years. There are approximately 50 major systems that
have to be migrated to the Shell, and many smaller ones.
Moreover, I am very concerned with the lack of an adequate funding
plan for this project. Although there is a $21 million special request
in the President's fiscal year 2016 budget, and DHS has committed $5
million to the project, there is no comprehensive plan to fund the
remaining costs of the project. Instead, we were told, in essence, that
the OCFO would find the remaining funds somewhere, meaning a very heavy
burden will fall upon program offices that are already stretched thin.
The annual appropriations of program offices are meant to fund their
core mission responsibilities, not subsidize a major agency-wide IT
infrastructure project.
This last issue has also become significantly problematic for our
own office. Because we were unaware that OPM had undertaken this
immense project, we were unable to include the related costs in our
fiscal year 2016 budget request. The project will impose three types of
costs upon us: (1) increased oversight costs, (2) the payment of the
special assessment since we are a user of OPM IT services, and (3) the
costs of modifying OIG-owned systems that reside on OPM's network so
that they are compatible with the new IT environment.
Conclusion
As discussed above, OPM has a history of struggling to comply with
FISMA requirements. Although some areas have improved, such as the
centralization of IT security responsibility within the OCIO, other
problems persist. Until OPM's security weaknesses are resolved, OPM
systems will continue to be an inviting target for attackers.
If OPM's new modernization project is implemented appropriately, we
believe that it will significantly improve OPM's IT operations,
including its IT security posture. However, there are several issues,
including significant budgetary concerns, which must be addressed. If
they are not, we fear that there is a high risk this project will fail
to meet its stated objectives.
Thank you for your time and I am happy to answer any questions you
may have.
Senator Boozman. Thank you, Mr. Esser.
Mr. Spires.
SUMMARY STATEMENT OF RICHARD A. SPIRES
Mr. Spires. Good morning, Chairman Boozman, Ranking Member
Coons, and members of the subcommittee.
I'm honored to testify today. And since I served as the
Chief Information Officer of the Internal Revenue Service (IRS)
and later the Department of Homeland Security (DHS), I hope my
in-the-trenches experience is of value regarding
recommendations I will make on how the Federal Government can
more effectively safeguard data and improve its cybersecurity
posture.
Most Federal Government agencies find themselves
susceptible to data breaches and compromises of core mission IT
systems because of three primary root causes.
First, lack of IT management best practices. The very best
cybersecurity defense is the result of managing your IT
infrastructure and software applications well. But beginning in
the 1990s and up to the present, the Federal Government has not
properly managed IT, having failed to effectively adapt with
the changes in IT technology and the evolving cybersecurity
threat.
As examples of these failures, when I served in Government,
we would all too routinely discover IT systems outside of the
IT organization's purview that have been deployed without the
proper IT security testing and accreditation. The highly
distributed approach to IT management across Government, and I
would point out that Mr. Esser in his testimony already
referred to decentralization within the OPM environment itself,
has led to the deployment of thousands of data centers. Federal
agencies struggle with managing and maintaining this dispersed
infrastructure and disparate systems.
The resulting complexity of vastly different systems and
underlying IT infrastructures makes it virtually impossible to
properly secure such an environment.
Second, lack of IT security best practices. While well
intentioned and appropriate for the time, the 2002 Federal
Information Security Management Act (FISMA) skewed the approach
for Government IT information security. The law forced the
Chief Information Security Officers (CISOs) to look at the
controls for individual systems, when in reality viewing
systems in isolation hid the impact of larger enterprise
security posture.
Further, until very recently, systems would be certified
and accredited based on a 3-year cycle, which is a significant
issue when looking at the rapid evolution of technology in the
cyber threat environments.
Third, a slow and cumbersome acquisition process. When I
was at DHS, I was a proponent of continuous diagnostics and
mitigation, or the continuous diagnostics and mitigation (CDM)
program. But it is dismaying to see how long it took, 2-plus
years, just to implement phase one. That does not include the
additional competitive process for an agency to obtain
capabilities. Sophisticated adversaries will exploit any and
all vulnerabilities. The Government is even more vulnerable
when it takes months, not years, to be able to deploy new IT
security capabilities.
My recommendations to address these root causes: First,
effectively implement the Federal IT Acquisition Reform Act, or
FITARA. This law is meant to address the systemic problems in
managing IT effectively, and the main intent of the law is to
empower the agency CIO to address these issues.
So far, I am pleased with the approach of the OMB and the
new CIO Tony Scott are taking to support FITARA's rollout.
Congress can support these efforts by demanding aggressive
implementation of FITARA by agencies, development of measures
for assessing FITARA's impact, and transparency in reporting
ongoing progress.
Effective implementation of FITARA is the Government's best
hope to address decades of IT mismanagement.
Second, drive adoption of IT security best practices. There
has been positive movement with the updated FISMA law and the
move to continuous monitoring. Yet I recommend the Government
rethink how it is measuring success, with focus along three
lines.
There is a continuing need to pursue cybersecurity tools to
prevent intrusion, but even more importantly, detect them
quickly when intrusions do occur. Yet the Government needs to
assume that sophisticated adversaries will still gain access.
The root of all trust is verified identity, and the
Government needs to step back and rethink how it is rapidly
implementing ubiquitous use of multi-factor identity
authentication, along with the behavioral detection systems to
identify insider threats or compromise credentials.
Finally, the Government needs to target additional
protection of an agency's most sensitive information. Through
focused effort and the use of available data protection
technologies, the Government can attain high assurance that
only the trusted parties have access to an agency's most
sensitive information. This would go a long way toward
thwarting additional major and damaging data breaches.
Certainly, the data breaches at OPM are terrible for the
Government and for those millions of us who may be negatively
impacted in the future. However, this episode and the need to
implement FITARA and the new FISMA law can be the impetus for
much-needed and sustained change.
PREPARED STATEMENT
It is critical to make enough progress during the next 18
months to ensure that leadership commitment to needed changes
in IT management and security are sustained into the next
Congress and administration.
Thank you for the opportunity to testify today.
[The statement follows:]
Prepared Statement of Richard A. Spires
Good morning Chairman Boozman, Ranking Member Coons, and members of
the subcommittee. I am honored to testify today in regards to the
recent Office of Personnel Management (OPM) data breaches, while
addressing issues and making recommendations regarding approaches on
how the Federal Government can more effectively safeguard data and
improve its cybersecurity posture.
Serving as the CIO of a major department (DHS) as well as the CIO
for a large bureau (IRS) in the Department of Treasury, I had ample
opportunity to understand the dynamics inherent in Federal Government
information technology (IT), including how Government agencies
generally dealt with their IT security vulnerabilities. While at the
IRS and DHS, I worked closely with the Chief Information Security
Officers (CISOs) at both organizations to implement approaches that
would address these security vulnerabilities. I also worked across the
Federal Government on these issues, serving for a period as the Vice
Chair of the Federal CIO Council and also as the Co-Chair of the
Committee for National Security Systems. Given the gravity of this
issue, I hope that my testimony is of value to Congress and the
administration in helping to address systemic weaknesses in how the
Federal Government protects data and its IT systems from compromise.
Please note that I never worked at OPM and while I will allude to
some of the alleged details of the recent OPM data breaches, my
testimony describes broader systemic issues that must be addressed if
we are to better protect our Government's data and IT systems. In fact,
I would urge Congress and the administration to avoid a tactical
approach that addresses narrow technical fixes based on these latest
breaches--the weaknesses that led to these types of breaches are deeply
rooted and require sweeping changes in our approach to IT and
cybersecurity management and practices. Further, the weaknesses in the
Federal Government's IT security posture are almost always based on IT
practices that have been in place over many years. I served in the Bush
and Obama administrations and saw the same systemic problems in both.
This should not be viewed as a political issue, but a call to action to
fix a set of issues that can not only have a beneficial impact on
securing data and systems, but improve IT management and delivery of
systems as well.
My testimony will first focus on identifying the root causes that
have led to a situation allowing massive data breaches of sensitive
data and personally identifiable information (PII) to occur in
Government. I will then provide a set of recommendations to address
these root causes that can, based on my experience, be implemented over
a 2-to-3 year timeframe. As I describe below however, there is a window
of opportunity to drive these changes that Congress and the
administration cannot afford to miss.
root causes of it security and data protection vulnerabilities
The situation in which most Federal Government agencies find
themselves susceptible to data breaches and compromises of core mission
IT systems, are the result of three primary root causes, which include:
1. Lack of IT Management Best Practices
The very best cybersecurity defense is the result of managing your
IT infrastructure and software applications well. During the decades of
the 1970s and 1980s, agencies could build and deploy IT systems with
little regard to security issues. This was not necessarily a management
failure since there were very few security issues to be concerned with
prior to the broad use of the Internet and the rise of the ubiquitous
data networks. However, beginning in the 1990s and up to the present,
the Federal Government has not properly managed its IT. The Government
has failed to effectively adapt with the changes in IT and the evolving
cybersecurity threat.
As example of these failures, when I served at IRS and then at DHS,
we would all-too-routinely discover IT systems outside of the IT
organizations purview that had been developed and deployed without the
proper IT security testing and accreditation. This highly distributed
approach to IT management has led to the deployment of thousands of
data centers across the Federal Government. Federal agencies today
struggle with managing and maintaining this dispersed infrastructure
and disparate systems. In far too many instances, hardware and software
assets are not systematically tracked, software is not routinely
updated and patched, and critical hardware and software has reached
end-of-life and, in some cases, is no longer even supported by the
vendors. And while I am big proponent of cloud technology, I am
concerned that many agencies are not necessarily using cloud
capabilities to streamline and simplify their infrastructure, but
rather creating new IT ``stovepipe'' infrastructures. This complexity
of maintaining a sea of vastly different systems in an ocean of
differing underlying IT infrastructures makes it increasingly
impossible to properly secure such a complex IT environment.
Worse, when the Government did realize it had these issues and
attempted to fix them, entrenched interests made it exceptionally
difficult to effect the necessary changes. For instance, a number of
laws have been passed that attempted to address IT management
practices, most notably the Clinger-Cohen Act of 1996, which mandated a
strong agency CIO that could begin to rationalize IT within an agency.
Yet Clinger-Cohen is viewed as failed legislation in the Federal IT
community since in reality, none of the agency CIOs have the authority
granted by Clinger-Cohen. Components, Bureaus, and program offices have
generally resisted efforts to bring more oversight and discipline to IT
management and operations under the theory that it impedes mission and
business progress for agencies. Unfortunately, we are paying a huge
economic cost for those decisions resulting in inefficiency,
duplication and unsecure IT systems and infrastructure. And what is now
worse; we will likely pay a greater cost in the exposure of PII of
millions of current and former Government employees, and potentially a
cost to our national security.
2. Lack of IT Security Best Practices
While well intentioned and appropriate for its time, the Federal
Information Security Management Act (FISMA) skewed the approach for
Government IT information security. Originally passed in 2002, it set a
course for how IT security effectiveness has been measured in
Government. While there are some good components of the law, the
unintended consequence is that it forced CISOs to look at the controls
for individual systems when in reality, IT systems across the
Government were already becoming more interconnected and viewing
systems in isolation hid the impact on the larger enterprise security
posture. Further, based on OMB guidance, FISMA was implemented during a
period when the cyber-threat was still emerging and the evolution of
technology hadn't yet recognized the necessity of a security
development lifecycle. In fact, until very recently, systems would be
certified and accredited based on a 3-year cycle, which, while perhaps
manageable, is comical when looking at the rapid evolution of
technology and the cyber-threat environment. And furthermore, the law
required the generation of paper-based reports, which diverted time,
resources and personnel from effective security efforts. At both IRS
and then DHS, I was consistently reluctant to put my confidence in the
yearly FISMA report since it did not reflect the reality of the true
security posture of our overall IT environment. That can only be done
by proper use of tools that continuously monitor the IT environment and
are able to react and mitigate threats in near-real time.
3. Slow and Cumbersome Acquisition Process
The problem is exacerbated for Government when funds are available
to invest in IT security, yet it is ponderously slow and difficult to
buy commercial solutions to help address vulnerabilities. When I was at
DHS, I was a proponent of the continuous diagnostics and mitigation
(CDM) program, but it was dismaying to see how long it took (2 plus
years) just to implement Phase 1, and then for agencies to go through
an additional competitive process within the CDM program itself to
obtain capabilities. I am all for fair competition, but with
sophisticated adversaries that will exploit any and all
vulnerabilities, the Government is even more vulnerable when it takes
many months (if not years) to be able to deploy new IT security
capabilities.
recommendations for addressing it security and data protection
vulnerabilities
Clearly the Federal Government's overall IT security posture is
poor, yet there is some momentum building that can result in
fundamental changes that greatly improve that posture over a couple of
years. While it is disappointing to have such large and damaging data
breaches occur at OPM, I hope that the Congress and the administration
use this opportunity as a call to action for needed IT and IT
procurement reform. Below are four recommendations to address the root
causes for the IT security and data protection vulnerabilities outlined
above.
1. Effectively Implement the Federal IT Acquisition Reform Act (FITARA)
In December 2014 Congress passed and the President signed FITARA,
which was included in the 2015 National Defense Authority Act (NDAA).
FITARA is meant to address the systemic problems in managing IT
effectively in an agency and while there are a number of provisions,
the main intent of the bill is to empower the agency CIO to address
these problems. Foremost of these problems include duplication of IT
infrastructure and systems, lack of the use of best practices in IT
acquisition, and the implementation of proper procedures to ensure IT
security is properly addressed throughout an agency's IT organization
and infrastructure.
To ensure that FITARA does not suffer the same fate as Clinger-
Cohen, a successful roll-out within agencies is critical. I am very
pleased to see the approach OMB and the new Federal CIO, Tony Scott,
are taking to support this roll-out. OMB just issued its final guidance
to agencies for implementation of FITARA. In developing this guidance,
OMB sought significant outside input, including guidance from former
Government CIOs, CFO, CAOs, CHCOs, and COOs and importantly, OMB asked
for public comment on this draft guidance, which will improve content,
understanding, and buy-in over the longer term.
I recently testified at a hearing on FITARA and its role in
improving IT acquisitions to the subcommittees for Information
Technology and Government Operations of the House Committee on
Oversight and Government Reform.\1\ I am not going to repeat much of
that testimony, but I want to highlight the following:
---------------------------------------------------------------------------
\1\ Richard Spires written testimony for that hearing is available
at https://oversight.house.gov/wp-content/uploads/2015/06/Spires-
Statement-6-10-FITARA.pdf.
``In terms of accountability, it has to start with the
Administration and rests with OMB and the agencies. In
particular, OMB must help ensure that the agency CIOs have the
capability to perform their job and have the support from
agency leadership to give them the chance to drive the required
change to effectively implement FITARA. Further, the agency
leadership must be supportive of the agency CIO, having the
individual's back, particularly in agencies that are operating
in a federated environment
(this is particularly an issue in the cabinet-level
departments). Congress . . . can support these efforts by
demanding aggressive implementation of FITARA by agencies,
development of measures for assessing FITARA's impact, and
transparency in reporting of ongoing progress, while also
---------------------------------------------------------------------------
highlighting obstacles in agencies to be overcome.''
There is much confusion regarding IT security and the best way to
protect data and systems. There is no single product or service that
offers complete protection, and in my experience, without IT management
best practices implemented across an agency, many of the security tools
are simply ineffective. IT management best practices are foundational
to success, and effective implementation of FITARA is the Government's
best hope to address decades of mismanagement.
2. Drive Adoption of IT Security Best Practices
To the Government's credit, there has been a fairly aggressive
shift in thinking from the traditional FISMA reporting approach to
continuous monitoring of IT systems and the overall IT environment. I
was also pleased to see that Congress passed much needed reform in the
FISMA Modernization Act of 2014 last December, and I hope Congress will
closely work with the executive branch to ensure that implementation
delivers enhanced security.
That being said, when I look at the current Cross-Agency Priority
(CAP) cyber-security goals,\2\ I feel the Government is still behind
current IT security best practices. For example, if you look at the
overall objectives, the CAP goals will typically consider objectives of
less than 100 percent as success, such as 95 percent for automated
asset management or 75 percent for strong authentication. Higher
numbers are certainly better than lower ones in these metrics, but we
are dealing with adversaries that are advanced and persistent, that
will almost certainly find the holes and exploit them--it is simply a
matter of time. Likewise the Einstein system can aid agencies in
detecting threats, and the promise of Einstein 3A is the proactive
blocking of malicious traffic. However, Einstein is only helpful if the
traffic is actually going through the system--in many agencies today,
there are Internet connections that are not monitored by Einstein and I
posit that this is another example of poor IT management. The
Government has invested hundreds of millions of dollars in the Einstein
program yet agencies continue to posture and delay implementation. In
effect, these approaches have led the Federal Government to establish a
virtual ``Maginot Line'' as its key IT security strategy.
---------------------------------------------------------------------------
\2\ A description of the CAP cybersecurity goals and the status can
be found at http://www.performance.gov/node/3401/
view?view=public#overview.
---------------------------------------------------------------------------
Based on the current situation and what I see evolving in the
cybersecurity industry, I recommend a rethinking of how we are
measuring success, with focus along three lines:
--There is without a doubt a continuing need to pursue cybersecurity
tools to prevent intrusions, but perhaps even more importantly,
detect them quickly when intrusions do occur. The Einstein
program identifies and protects against known ``signatures'' or
characteristics of malicious activities, thereby preventing
those intrusions. However, more advanced protective
capabilities are required to prevent intrusions that the
Government is not yet aware of, thereby further reducing the
Government's attack surface. With enhanced automated
protection, network defenders can then focus on detecting and
remediating only the most sophisticated and potentially
dangerous attacks--rather than trying to decide which of the
seemingly endless alerts to pursue today. The cybersecurity
industry has made great strides in these areas in the last few
years, and Government should be using the most advanced tools
for prevention and detection that leverage threat intelligence
from users all over the world.
--Even with the most advanced prevention tools, the Government needs
to assume that sophisticated adversaries will still gain
access. So alternative approaches are needed, and in
particular, ones that relies on creating more trust in online
interactions. The root of all trust is verified identity. I
must know that it is who I believe it to be, and in the online
world, multi-factor authentication methods are key to doing
that. There are a plethora of newly available technologies to
enable multi-factor authentication for both internal
(Government) as well as external users. And some of these
solutions can integrate with antiquated systems. The Government
needs to step back and rethink how it very rapidly implements
ubiquitous use of multi-factor identity authentication. Even
though the root of trust is identity, there is more to the
trust equation. In the ``physical'' world, I trust another
because I have high confidence they will act in a manner that I
expect. Some of the most damaging data breaches have come from
individuals that where properly authenticated and authorized to
use systems and access data. Their behavior, however, was not
in keeping with what was expected. This is commonly called the
insider-threat problem. There are new technologies and
capabilities today that can bring in other context, such as an
audit log or behavioral analysis systems to assess someone's
trustworthiness on a regular basis. These additional factors,
beyond those used to assess authenticity, are key to fully
establishing and monitoring trust.
--Finally, the Government needs to target additional protection of an
agency's most sensitive information, whether it be data sets or
documents. Tools and products exist that enable agencies to
protect information, independent of the likely insecure
environment in which they operate. Agencies should focus on
their most valuable information. I do recognize that there are
limitations given some of the antiquated systems in which such
information resides, but by focusing efforts on the most
sensitive information, the Government could ensure, within two
to 3 years, that only trusted parties have access to an
agency's most sensitive information. This would go a long way
toward thwarting additional major and damaging data breaches.
3. Attract, Train, and Retain Talented Cybersecurity Professionals
Even the best cybersecurity tools in the world require talented
people who know how to use them. The shortage of cybersecurity
professionals across the country continues to be significant problem.
This is particularly an acute problem for the Federal Government. While
the mission is very attractive to many cyber professionals, the hiring
process and compensation models are not competitive with what
individuals can make in the private sector. Even with direct hiring
authority, the Government is not getting the talent it needs. The
Government needs more investment in training for current staff and the
flexibility to hire that is competitive with the private sector. I do
commend Congress for incorporating new flexibility for DHS to hire and
pay cyber professionals into S.1691 also passed last December. Congress
should monitor how DHS uses this authority, and consider expanding the
authorities to other departments and agencies to help address the
Government's cybersecurity personnel shortage.
4. Develop a Streamlined IT Cybersecurity Acquisition Process
It is difficult to implement state-of-the-art IT cyber security
solutions if you have no way to rapidly evaluate them before
purchasing. The CDM and Einstein programs could potentially serve as
governmentwide vehicles for this process, but it has taken significant
time to put them in place and I recommend an approach that enables
individual agencies to rapidly bring in solutions and try them in a
test-bed environment. After thorough testing and based on what works
best, agencies should be able to roll security solutions into
production. This approach would ideally encompass traditional
cybersecurity vendors, but also new vendors that have little to no
Government experience--they are an incredible source of technical
innovation. The Government is simply not getting the best solutions
through the existing acquisition process. I recommend that Office of
Federal Procurement Policy (OFPP) work with the General Services
Administration (GSA) and DHS to put a more streamlined CDM in place--
one that would enable rapid addition of new capabilities as they become
available in the commercial market.
conclusion
Certainly the data breaches at OPM are terrible for the Government
and for those millions of us that may be negatively impacted in the
future. Viewed through the right lens however, this episode can be the
impetus for much needed and sustained change. And given the need to
implement FITARA, the current administration has a golden opportunity
to set the correct foundation for success moving forward. This should
not be viewed as a political issue but rather requires sustained
leadership focus and commitment, and I am pleased to see such
leadership currently coming from both Congress and the administration.
It is critical to make enough progress during the next 18 months to
ensure that leadership commitment to FITARA, FISMA Modernization and to
other needed changes in IT security are sustained into the next
Congress and administration.
Thank you for the opportunity to testify today.
Senator Boozman. Thank you, Mr. Spires, for your testimony.
At this time, we had planned on proceeding with our
questioning. Each Senator will have 7 minutes. I hope we have
time to accommodate two rounds of questioning.
We have a vote called right now. It is only one vote. So
what we would like to do is suspend, allow members to vote, and
then come back and start immediately with the question period.
With that, we will adjourn.
[Recess.]
Senator Boozman. The committee will come to order. Again, I
apologize for the delay. The only thing we have to do around
here is vote, and so there is just no way of knowing. You
schedule these things and, certainly, that trumps everything,
which it should.
Director Archuleta, according to news reports about the
second OPM breach pertaining to OPM's security clearance
system, hackers had access to sensitive data for a year. These
systems contain extensive personal and family financial
information for current, former, and perspective Federal
employees and contractors.
Will a notification be provided to individuals whose
information was potentially compromised in the latest breach?
NOTIFICATION
Ms. Archuleta. Yes, sir. We are working on determining the
scope of that breach, even as we speak. And as we determine
that, at the same time, we are developing a notification
process to reach those individuals.
We are taking into account what we have learned from the
first notification and looking at the wide range of options we
would have in that notification process.
Senator Boozman. Will notifications be provided to family
members and other individuals whose information was contained
in the security clearance system solely due to their
relationship with the security applicant?
Ms. Archuleta. Sir, I can say that we are taking into
consideration all of the individuals that were affected by this
breach. As that notification plan is developed, I would welcome
the opportunity to come up and detail it for you.
Senator Boozman. How did you decide that 18 months of
credit monitoring and identity theft insurance is sufficient
protection for affected Federal employees?
Ms. Archuleta. This is an industry best practice. We are,
again, in the second notification really examining that to see
what the range of options may be.
Senator Boozman. Will OPM offer the same protection to
individuals whose information was stored on security clearance
databases, or does this heightened level of compromised
information warrant additional protections?
Ms. Archuleta. Again, sir, this is what we are looking at
with our partners across Government to make sure that we
examine the wide range of options that we need to consider.
Senator Boozman. What additional steps do you plan to take
to protect the victims, given the long-term effects these
breaches pose?
Ms. Archuleta. We are looking at steps we can take to
protect their data including the notification process. I am as
upset as they are about what has happened and what these
perpetrators have done with our data. So we are examining not
only the notifications that we must do, but also the
protections and the remedies we must put in place.
Senator Boozman. Those are important questions. Those are
the kinds of things we are getting from our Federal workers. I
know you will have a lot more other questions related to that.
But it is so important that we try to get information to those
that have been affected.
Ms. Archuleta. I understand.
Senator Boozman. Mr. Spires, the administration has ordered
a 30-day sprint to perform vulnerability testing and to patch
security holes. Is 30 days sufficient time to correct more than
a decade of negligence of outdated systems and failed attempts
at modernization?
Mr. Spires. I'm sure you would not be surprised for me to
say no, it is not sufficient time to fix the systems and the
situation we find ourselves in.
I think it is a good thing, though, to put in place a
process by which planning should take place, so that we can
start to get our arms around what should be done agency by
agency to put us in a much better posture.
Senator Boozman. As we get into these things, Mr. Spires
and Mr. Esser, do you expect us to find significant problems as
far as breaches with the other agencies?
Mr. Spires. First, I should say you will find significant
problems with them not following IT security best practices,
including FISMA, and not that that alone would necessarily
indicate breaches. But given the situation we find ourselves in
across most Federal agencies, I would expect you to find
significant breaches, yes.
Senator Boozman. Mr. Esser.
Mr. Esser. I would concur with Mr. Spires.
We have been seeing breach after breach this year, health
insurance companies, background investigations, contractors,
and Government entities, so it would not surprise me to see
more.
Senator Boozman. Mr. Spires, again, looking at the scope of
the problem, how long do you feel like it will take the
Government to actually do things we need to do to protect
ourselves from these outside threats?
Mr. Spires. Well, let me say, I think we should take an
ordered approach to this problem. So in my mind, what agencies
should first be doing is identifying the sensitive datasets
they have and putting those in some type of bucketed priority
order, and coming up with plans to protect those sensitive data
sets.
The reason I say it that way is to think that we can go
into these large agencies that have, as I said, decades of
mismanagement and essentially decentralized IT and fix that
quickly I think is just naive. So this notion of doing it by
protecting sensitive data sets, then there is data technology
today and encryption and the like, to do that at the data set
or document level. And then also, you have to worry about the
identity problem. It does no good if you have encrypted the
data, but then the credentials of someone that can get to the
data have been compromised. So you also need to work on the
identity problem.
That is where things like multi-factor authentication
models come in, which, by the way, there are many new
technologies that make this much faster and easier to roll out
than it was 4 or 5 years ago.
Also, this notion that says even if someone has been
authenticated and authorized, that doesn't necessarily mean
their behavior is correct, right? The insider threat problem,
we have to watch that.
So this notion of starting to bring in behavioral detection
systems or ways in which we can monitor the behavior of,
particularly, privileged users. Those that have root access to
the systems and data are the ones that, frankly, we need to
monitor.
Senator Boozman. Very good.
Director Archuleta, we have heard numerous accounts of
frustration with CSIdentity Corporation (CSID), including long
wait times, repeated Web site crashes, and inaccurate
information reported to victims. What steps are you taking to
oversee the services provided by the contractor?
CONTRACTOR OVERSIGHT
Ms. Archuleta. CSID has tremendous experience in these
types of notifications. The served Sony, as you know, with
their large breach. We believe they have the capability and
capacity to handle this.
Senator Boozman. But when you call in now, the wait times
are very, very long. I don't know that they have experienced
anything of this magnitude.
Ms. Archuleta. Thank you, sir. I am as angry as you are
about that. I want to be sure they are doing everything they
can to reduce wait times. That is why I have instructed my CIO
and her team to work with that contractor to improve daily the
services they are giving to our employees.
An employee should not have to experience that. That is why
we are demanding from our contractor that they improve their
services.
I do believe, sir, because of the conflation of two
incidences, that we have had an unusual high number of phone
calls. But that is not an excuse. Our contractor should be able
to perform to that number, and we are demanding that it do so.
Senator Boozman. Thank you.
Senator Coons. Thank you, Chairman Boozman.
Ms. Archuleta, if I might, if OPM had completed its planned
IT upgrades, would this breach have been prevented? Would these
consequences have been prevented?
And if OPM had been in full compliance with FISMA, would
any of the breaches in 2014 or 2015 still have occurred?
IT UPGRADES
Ms. Archuleta. My CIO has advised me that even if there had
been 100 percent FISMA compliance, there is no guarantee that
systems won't get breached. That is why an IT strategic plan
and the implementation of an IT plan is so important. Risk
management is the answer to what we need to do. We need to be
able to detect and mitigate. That is what our plan is designed
to do, as we move from a legacy system to the new shell system.
Yes, I believe we need to act very rapidly to move from
this decades-old system to a new system. We need to make sure
that we are tracking, documenting, and justifying all we do.
But we also need to be sure we are acting as quickly as we can
to protect the records that have been entrusted to us.
Senator Coons. Ms. Archuleta, of all of the Federal
employees who have been affected, as the co-chair of the Senate
Law Enforcement Caucus, I am particularly concerned about
Federal law enforcement officers and their families, because
they have credible reasons to be concerned. The criminals they
previously apprehended or investigated might have motivation to
seek out their homes or their families.
What are you doing specifically to promptly respond to
their concerns or inquiries? Not to suggest they're the only
folks with real concerns, but in some ways they are one of the
subsets of Federal employees who I think have very real, very
legitimate and pressing concerns.
Ms. Archuleta. On the top line, what I can assure you,
Senator, is that we are working across Government to analyze
the scope of this breach. We will be able to discuss more with
you in the classified session.
But I can tell you that we are working very closely with
our law enforcement partners.
Senator Coons. I am eager to follow up with you on that and
to get some reassurance about the swiftness with which gravely
concerned Federal employees of all backgrounds are able to get
updates and more information about their path forward.
Your fiscal year 2016 budget request was submitted before
the discovery of the most recent incident and before we had any
sense of the scope. Are there additional tools or enhancements
that you need in order to deal with the critical issues that
are now well and widely known? And how might you seek an
amendment to the budget request?
IT FUNDING
Ms. Archuleta. Thank you, Senator, for that question.
We are analyzing right now with OMB and my CFO to determine
what the request might look like. I hope to be able to get back
to you by the end of the week.
Senator Coons. Thank you.
Last question for you, if I might: If you had actually
encrypted Federal employees' Social Security numbers or their
personally identifying information, would that have prevented
the disclosure of their personally identifiable information to
hackers once they compromised the system?
ENCRYPTION
Ms. Archuleta. This is a question that has been asked of my
colleagues who are experts in cybersecurity. They have informed
me that in this particular case, the encryption would not have
prevented the breach.
Encryption is an important tool, and that is why we
continue to build the encryption methods within our system. But
in this particular case, it would not have prevented it.
Senator Coons. My question was not whether it would have
prevented the breach. It was whether it would have prevented
the accessibility and use of personally identifying information
once the system was breached.
Ms. Archuleta. No. It would not have in this case.
Senator Coons. In response to the question about FISMA
compliance and if IT upgrades had been completed and
encryption, Mr. Spires, Mr. Esser, any difference of opinion or
any insights you might offer for us about FISMA and whether
FISMA compliance would have produced a different outcome here?
Mr. Spires. As I stated in my verbal testimony, sir, the
issue with FISMA, the old FISMA 2002 law, was that it was
really around a set of technical controls that would be checked
every 3 years. Given the environment we live in, that is just
not even close to being appropriate.
We are moving toward a continuous diagnostics model, which
is the correct model, where you are monitoring all of your
systems and monitoring your complete environment, looking for
intrusions, looking for improper behavior.
But I would even echo the point that even that is not
enough in today's environment. You need to bring in the data
protection, like encryption capabilities, and you need to
upgrade the capabilities to better understand who is actually
accessing your system.
Those are all critical necessities in order to protect data
today.
Senator Coons. Would it be reasonable for us to have
expected that OPM could achieve data security given the
resources they currently have available to them?
Mr. Spires. I am not sure I'm in a good position to answer
that question. I will go back to my point of a focused effort
on protecting sensitive data with the right encryption and the
right access control capabilities. If you put the focus there,
I think most Federal agencies would have the funds, have the
resources to be able to accomplish that.
Senator Coons. We have seen significant data breaches for
Home Depot, JPMorgan, Target, Sony, Neiman Marcus, just to name
a few. Many of them have invested in cutting-edge cybersecurity
and systems.
Is the private sector having any more success in mitigating
cyber breaches than the public sector is?
Mr. Spires. I don't know if I would make a sweeping comment
on that. I think it depends a lot on the actual company, and it
varies greatly. I would make another point here.
I think one of the big differences between the Government
and the private sector is that the private sector has the
ability to very rapidly acquire the newest capabilities that
are being offered by the cybersecurity, if you will, product
companies or industry.
One of the things I would like to see is the Government
agencies being able to bring in, in a test-bed environment, be
able to pilot new capabilities as they come to market. That
would really help Government agencies to adopt the newest
capabilities.
Senator Coons. You referenced in your previous testimony
the Federal IT Acquisition Reform Act (FITARA) and your
concerns about slow and cumbersome procurement, and I look
forward to exploring that further with you in the next round of
questions.
Thank you, Mr. Chairman.
Senator Boozman. Senator Lankford.
Senator Lankford. Thank you all for being here. We have a
lot to cover to be able to help not only resolve things for the
future, but also be able to unpack fully what has happened in
the past.
Mr. Esser, there are several comments that you made on it.
What is the most pressing issue that you have discovered in the
flash report you have done, based on the vulnerabilities that
still exist and what needs to be finished?
I am not asking you to expose publicly vulnerabilities that
still exist, but on the list, how many things still need to be
addressed and need to be addressed immediately?
Mr. Esser. Senator, I think one of the most important
things that needs to be addressed is the two-factor
authentication to access systems. This has been a longstanding
problem at OPM. They have made improvements. They have
implemented this to affect workstation access. But the actual
systems that are being used by employees need to be implemented
also and require two-factor authentication.
Senator Lankford. I saw from your report and, quite
frankly, the Chief Information Officer had also listed the same
thing in 2012.
Let me just read this real quickly. The initiative to
require personal identity credential authentication to access
the agency network, as of the end of 2014, 95 percent of OPM
workstations required personal identity verification access for
the network. However, none of the agency's 47 major
applications require personal identity verification
authentication.
Is that still correct?
Mr. Esser. To the best of our knowledge, it still is.
Senator Lankford. Ms. Archuleta, tell me about that and
just the process of transition.
IG RECOMMENDATIONS
Ms. Archuleta. Yes, two points there. The multifactor
authentication for remote users, we are 100 percent at that
point now. With regard to all other users, we are working very
rapidly to increase that. I have asked my CIO to increase that
effort. I'm sorry I don't have the percentages in my mind right
now, but I would be glad to get back to you where we stand as
of this date.
But I do know we are working rapidly to do that.
Senator Lankford. A 95 percent figure you think is pretty
close as far as the workstations, 100 percent for those working
remote, 95 percent of workstations, but it is still these 47
major applications that are still exposed, I guess?
Ms. Archuleta. I would like to get back to you, Senator, on
that, to give you the full details on that.
Senator Lankford. Okay. Then there is a question on the
issue of security assessment and authorization.
Obviously, that is a requirement from OMB. This ongoing
issue of these 47 different groups that are here, it says 11
were not completed or time or were operating without a valid
authorization.
What can you tell me about that?
Ms. Archuleta. I can tell you that all but one of those
systems has been authorized or extended. They are operating
with authorization, and we are working on the final one that
was with the contractor.
Senator Lankford. There is a systemic problem there,
obviously, of trying to find out why they weren't already
through the authorization, to make sure that authorization is
done on time and on schedule. Has that issue been fixed?
I know rapidly people stepped in and said, okay, let's try
to fix this, where the authorizations haven't been done. What
about the process for future, to make sure those continue to be
done on time?
Ms. Archuleta. I would like to have my CIO get that
information so I could give it back to you, sir.
Senator Lankford. I'll be glad to have that. Give me a
timeframe when I can get that back.
Ms. Archuleta. By the end of the week, sir.
Senator Lankford. That would be great.
There is also an outstanding letter that I sent to your
office June 10. I am the chairman of the Committee on Homeland
Security Governmental Affairs that has the Federal workforce in
it, as you and I have discussed in the past.
On June 10, I sent a letter that has yet to be acknowledged
from your staff that they have received that letter, much less
get an answer to it. There were some very basic questions that
are still unanswered on it, none of them that would require a
classified setting. But there are some basic responsive
answers.
I have letters already on the record from the Federal
Aviation Administration (FAA), for instance, and a tremendous
number of employees that live in my district that have asked
just some very basic questions. The folks from GE have asked
some very basic questions. They have yet to get a response even
to say it has been acknowledged. They just want to know some
timing.
I know the letters have gone out nationwide. But people
want to know there is actually somebody working on some of
these other issues because there will be many for a while.
Ms. Archuleta. Senator, I apologize to you if you have not
received that response. I know that I have asked my staff to
respond to that, and I know that it is forthcoming. But I will
make sure you have that letter today.
Senator Lankford. Great. Thank you.
Let's talk a little bit about cost issues dealing with the
appropriations side.
Do we have a ballpark cost to OPM yet, the letter that has
gone out to contact everyone to let them know, hey, possibly
your information has been breached?
There are really two cost factors sitting out here that our
committee has to consider. One is the cost of distributing that
letter out to all those individuals. The second one is the cost
for the credit report, credit screening and protection that is
happening, that has been extended.
Do you have a cost estimate for those two?
CONTRACT COST
Ms. Archuleta. I have a general cost as we take a look at
the take-up rate on credit monitoring, that will adjust it, but
it is approximately anywhere from $19 million to $21 million.
Senator Lankford. Okay, so $19 million to $21 million.
And then what is the estimated cost on just the letter
going out?
Ms. Archuleta. That is the total cost, sir, between emails
and letters, so I do not have the breakdown. I would be glad to
get that for you.
Senator Lankford. Are you aware that some agencies,
actually the Web site you link people to to get more
information, some agencies have actually blocked that
internally. So those individuals when they try to go are
blocked for fear there may be phishing scams that are going on.
So have you started working with other agencies on that?
Ms. Archuleta. Yes, we worked closely with departments and
agencies because of some security protocols they might have. So
we worked closely with them and their CIOs and other top
officials.
Senator Lankford. Finally, this issue of the inventory of
servers and databases and different workstations that are out
there, the central control issue is important, obviously, for
keeping up security and technology upgrades, and making sure
software is continually upgraded, and everyone has a consistent
security presence there.
When there is a server there, it creates tremendous
vulnerabilities. They just have to find one of those.
How is that going with unifying that structure, because
that is not a legacy issue. That is more just an inventory
issue.
Ms. Archuleta. I respect the inspector general's opinion on
this, but my CIO has told me that we have indeed have an
inventory of system and data, and I would welcome the
opportunity to discuss this with you and with him further.
Senator Lankford. Great. We will look forward to getting
that report and getting a chance to find out more about that.
Ms. Archuleta. Thank you, Senator.
Senator Lankford. That is one of those significant
vulnerabilities.
Ms. Archuleta. Thank you, sir.
Senator Moran. Mr. Chairman, thank you and Senator Coons
for conducting this hearing.
Welcome to our three witnesses.
Ms. Archuleta, I am going to begin with you. I just have a
series of questions that I hope are relatively short responses.
I will work my way through them as quickly as I can.
What is the current estimate of the total number of files
or employees breached?
OPM DATA
Ms. Archuleta. In the employee personnel files, we estimate
that to be a little over 4 million.
Senator Moran. At least according to press reports, those
numbers may grow. What else may occur? What may you discover?
Ms. Archuleta. It is an ongoing investigation. We will
continue that investigation with our partners. At this point,
we know it is a little over 4 million.
Senator Moran. Are those words interchangeable, 4 million
employees and 4 million files? Does that mean the same thing?
Ms. Archuleta. That is approximately 4 million people who
have been affected by it.
Senator Moran. What is the total possible for the number of
employees affected? You say we estimate it today to be 4
million and it may grow. What is the maximum number of files
that could have been breached?
Ms. Archuleta. I want to separate incident one and incident
two. So incident one is the one I am describing, the employee
personnel files. We have estimated that to be a little over 4
million, as I have described.
Senator Moran. But what is the total number of employees
that could be affected by that?
Ms. Archuleta. That is the number.
Senator Moran. That is the number?
Ms. Archuleta. That is the number.
Senator Moran. All right.
Ms. Archuleta. So as we look at the second incident, we
have not determined the scope of that. I don't have a number
for you on that.
Senator Moran. How many files do you have management over?
Ms. Archuleta. As you know, a Federal background
investigation file may have a number of different names and
Personally Identifiable Information (PII) within it. That is
why I cannot give you a specific number on that one.
We are working, as I said, to get that number. I will bring
it to you as soon as I have it.
Senator Moran. Let me ask this one more time to make sure
that you and I are on the same page.
Ms. Archuleta. Okay, I apologize if I am not fully
understanding.
Senator Moran. No, it may be inarticulation on my part.
You have a certain number of files within your agency
subject to this kind of breach. What is the total number of
files that potentially could be breached?
Ms. Archuleta. That is what we are investigating right now,
sir.
Senator Moran. Let me ask it this way, how many files are
there at OPM?
Ms. Archuleta. Well, there are millions of files. We are a
data center, so there are millions of files. The forms SF-86 or
the background investigations contain numerous names. That is
why I want to be careful to make sure the number I do give to
you I'm confident about.
Senator Moran. All right.
You indicated you have taken significant steps. I wrote
that down as part of your testimony. ``We have taken
significant steps.'' Yet the OIG says that only three of 29
recommendations have been closed. Let me look at his testimony.
``Only three of these 29 recommendations have been closed to
date. Nine of these open recommendations are longstanding
issues that were rolled forward from prior year FISMA audits.''
How do you reconcile, ``We have taken significant steps,''
and yet the OIG report says there are longstanding problems and
only three of 29 have been addressed?
IG RECOMMENDATIONS
Ms. Archuleta. We work very closely with our IG. As I said
before, we work with him to make sure that we have complete and
open transparency with him. We meet on a regular basis. He
continues to assist us in identifying the areas of improvement.
And the issues he has brought to us, we are working through.
The 2014 audit that he performed for us and provided to us,
we are working through the steps that he has outlined for us. I
know we are not in agreement with all of them, but we do
believe that the conversation and the transparency that we have
between us will be helpful for resolving all of them.
Senator Moran. Mr. Esser, do you agree with Ms. Archuleta
that the agency has taken significant steps to correct its
problems?
Mr. Esser. Yes, I do. I think that they have made great
strides over the years to improve some of the issues we have
reported.
For example, the decentralization issue, which went back to
2007, in this past year's FISMA audit, we decreased the
severity of that finding from a material weakness to a
significant deficiency.
In addition, there are a number of other areas where they
put in tools and made strides to improve security.
With that said, there are a number of longstanding issues
in our FISMA reports that are open and that we hope to see
movement on.
Senator Moran. Mr. Spires, let me give you an opportunity.
If you were still in the former capacity at this agency instead
of the IRS or Homeland Security, let me first start with a
broader question. Based upon your understanding of the facts
involved here and your best judgment, was the breach or
breaches that have occurred at OPM, were they predictable,
based upon what we knew, looking at, for example, the OIG
report? If you saw those reports, is this an outcome that could
be expected?
Mr. Spires. I think it is an outcome that could be
expected, sir.
Senator Moran. Do you have a sense based upon either Ms.
Archuleta's testimony or your independent knowledge and what
you have heard of Mr. Esser and their reports, would you say
that the OPM officials have taken significant steps to solve
their problems?
Mr. Spires. It does sound like they are doing a number of
the things correctly. I think the centralization of IT is a
very good step. They're talking about a modernization program
that would upgrade their IT infrastructure.
That being said, I go back to my earlier point that if I
had walked in there as a CIO--and again, I am speculating a
bit--and I saw the kinds of lack of protections on very
sensitive data, the first thing that we would have been working
on is how to protect that data, not even talking about
necessarily the systems. How is it we get better protections
and then control access to that data better?
I think that is probably where the focus needs to shift
here, based on what I am hearing.
Senator Moran. Meaning that out to be a priority, the first
effort.
Mr. Spires. Yes.
Senator Moran. Ms. Archuleta, does anyone at OPM take
personal responsibility for these breaches, or is this just
considered a problem with the system?
Is this a problem with individuals not performing their
duties? Or it is just that this is the system we inherited,
we're working on it, and no one, in particular, is responsible
for the outcome?
STATE OF FEDERAL IT
Ms. Archuleta. I think Mr. Esser and Mr. Spires said it
very correctly. This is decades of lack of investment in the
systems that we inherited when I came in. From the very
beginning of my tenure, I have been focused on this.
We are working to install not only the architectural
strategies, but also to install the detection systems and be
able to remediate.
But as both of my colleagues have mentioned, we have legacy
systems that are very old. Oftentimes, we have to test to be
sure we can even add those protection systems into the legacy
system.
If there is anyone to blame, it is the perpetrators. Their
concentrated, very well-funded, focused, aggressive efforts to
come into our systems not just at OPM, but as both of my
colleagues have said, across the whole enterprise, is one we
are concerned about and one we are working with our colleagues.
We are going to take every step we possibly can at OPM to
continue to protect. That is why we are trying to move out of
the legacy system.
Senator Moran. To date, you don't consider anyone at OPM,
any of your staff or employees or people responsible for IT and
security to be personally responsible? It is a problem with the
system that has been inherited?
Ms. Archuleta. This is an enterprise-wide problem, and
cybersecurity is the responsibility of all of us who head
organizations. That is why, with the Tony Scott's assistance
and with his efforts, we are going to address this on an
enterprise-wide basis as well as OPM.
Senator Moran. So no one is personally responsible?
Ms. Archuleta. I don't believe anyone is personally
responsible. I believe that we are working as hard as we can to
protect the data of our employees, because that is the most
important thing we can do.
I take it very seriously. I'm angry, as you are, that this
has happened to OPM. I'm doing everything I can to move as
quickly as I can to protect the systems.
Senator Moran. Thank you very much.
Ms. Archuleta. Thank you, sir.
Senator Boozman. Mr. Esser, Ms. Archuleta mentioned that
the problem is with the legacy systems, which I think we would
all understand. However, isn't it true that several of the
breaches were not to legacy systems, and with the right tools
in place they would not have been breached?
Mr. Esser. Yes, sir. Based on our audit work.
Senator Boozman. So the idea that this is all legacy
systems is really not the case.
Mr. Esser. Well, there are many legacy systems at OPM. I
don't want to give the wrong impression. I mean, that is a
fact. But based on the work that we have done in our audits and
ongoing work that we are doing, it is our understanding that a
few of the systems that were breached are not legacy systems.
They are modern systems that current tools could be implemented
on.
Senator Boozman. Okay, very good. I think that is really
important.
Concerns are being raised about the contract secured to
provide credit-monitoring services to the victims of the first
breach. We don't know the scope of the second breach and what
services will be provided for additional victims.
Mr. Esser, in your flash audit, you raised concerns about
OPM's sole-sourced contract to manage OPM's infrastructure
improvement project related to subsequent phases of the
project. Do you have additional work planned to oversee OPM's
contracting and procurement practices?
Mr. Esser. It is, certainly, something that we are
monitoring and following the reports and gathering information.
We haven't planned any audits of that at this time, but it is
something we may do.
Senator Boozman. Very good.
Mr. Spires, you describe a number of root causes that have
led to the current issues the Government faces in IT security,
and you have offered a number of recommendations.
Can you just tell us again a couple of key recommendations
that would make a difference over the next year or two?
Mr. Spires. Yes, I would really like to reemphasize FITARA.
I thank Congress for passing it for the good of the Nation. We
need to figure how to manage our IT more effectively.
I would say that is the single root cause that has led to
these kind of situations we find ourselves in with these data
breaches. It's not that I'm just one to say we need to have all
the power reside with the CIO. But what we need are CIOs that
have the authority to really bring best practices and not allow
systems or practices to continue that jeopardize the security
of our data and our systems.
That has been the problem for decades. We still have real
cultural problems. I mean, I am out of Government now for 2
years, but based on many discussions I have had with brethren
that are still CIOs and still in Government, the cultural
issues loom large here.
We need to take this incredibly seriously. And I would urge
you as a subcommittee to provide your own oversight of the
implementation of FITARA.
Senator Boozman. Do we need additional legislation?
Mr. Spires. I am not convinced. I think we do need the
general cyber legislation about how we better share information
between the Government and the private sector. I think that is
something that Congress should continue to work on.
I think we have, between the FITARA act and between the
updated FISMA act, I think we have enough tools on the
legislative side. I think it is now a leadership and management
set of issues within the administration, with the proper
oversight of Congress.
Senator Boozman. Very good.
Mr. Esser, along the same line, what would you identify as
the most significant weaknesses or the underlying causes? What
do you see as the priority we need to do in the next 2 or 3
years?
Mr. Esser. Specific to OPM, I think the project they are
undertaking to modernize the IT systems is the right way to go.
That definitely needs to be done. We fully support that
project.
We do have some concerns, as expressed in our flash audit
alert, regarding some of the project management issues related
to it, and the sole-source contracting. But in general, we
think it is definitely the right path to follow.
Senator Boozman. So how will you all be involved? Mr.
Spires talked about oversight. Certainly, that is something we
will do in this committee. How will you be involved in that
process?
Mr. Esser. We are continuing our oversight of the
modernization project. The flash audit alert was issued this
week. It was just an interim report, so to speak. We are going
to continue our audit work throughout the length of this
project.
Senator Boozman. Mr. Spires, the administration's cyber
goals are an effort to drive significant and rapid improvement
and changes, yet that is not working. Do you recommend any
changes to the goals?
Mr. Spires. Yes, I would first comment that I think having
goals is, certainly, appropriate, but let's take one example,
this notion we all talked about, this need for multifactor
authentication, to be able to much better protect the
credentials of those who use these systems that are legitimate.
Yet when you look at the cyber goal and you look at the use of,
for instance, the Homeland Security Presidential Directive 12
(HSPD-12) Personal Identity Verification (PIV) card and trying
to get the 75 percent usage within the civilian Federal agency
as the goal, let's go back to the adversaries. They only need
one way in, right? And 75 percent just doesn't cut it in this
world anymore.
So we need to rethink, I think, the objectives there. Go
back to the prioritization of protecting data, doing the
multifactor authentication. Those should be the highest goals.
That does not mean we shouldn't be working to continue to
bring in the right kind of capabilities to better protect our
systems. We need to do that as well. But I think it is time to
rethink those goals and to reset them along those sets of
priorities.
Senator Boozman. Mr. Esser, you mentioned that one of your
findings was that OPM didn't exactly know what inventory they
have. Is that being corrected? Or do we still not know the
number of units, servers, hardware components, etc.?
Mr. Esser. Based on our latest work, that is still our
understanding. Director Archuleta commented a little while ago
that they do have a complete inventory of systems, so we would
be more than happy to work with them and look at that and do
our audit work related to that.
Senator Boozman. But if that is a case, that has just
recently happened?
Mr. Esser. Yes, sir.
Senator Boozman. Okay, thank you very much.
Senator Coons. Mr. Chairman, I will defer to the vice chair
of the full committee.
Senator Boozman. Senator Mikulski.
Senator Mikulski. Thank you very much.
Mr. Spires, could you tell me, has Kaspersky been
penetrated? I understand even top-notch security firms
themselves sometimes have a cyber shield that can be
penetrated.
Mr. Spires. I do not have any more information than what I
read in the news, Senator, but I read that as well.
Senator Mikulski. Which indicates that this is an
international problem.
Mr. Spires. It certainly is.
Senator Mikulski. It really shows that, despite best
efforts of highly skilled professionals--that is not to excuse
where we are--but your advice to us is to get with it, and get
with it pretty quick.
Mr. Spires. You summed it up very well.
Senator Mikulski. Would you recommend that this be across
all Government agencies that OPM was hit, et cetera.
Mr. Spires. My experience having served on the Federal CIO
council and worked with many of the agencies is that OPM is not
some kind of outlier here. Many Federal agencies have similar
issues to what OPM faces, as far as their IT management and
cybersecurity posture.
Senator Mikulski. Thank you very much.
Ms. Archuleta, the Federal employees, Maryland is the home
to 130,000 Federal employees, and they work at everything from
the National Institutes of Health to the National Security
Agency. Most people at the National Security Agency are
civilian employees.
What do I tell my employees, because they are quite
apprehensive? What is the impact of this on them? Can you talk
about this? What is the impact on them? How are you in
communication? Should they be afraid that another shoe will
drop, and it could drop on them and their credit ratings or
whatever?
NOTIFICATION
Ms. Archuleta. Yes, and I do want to say I care very much,
as you do, Vice Chairwoman, about our Federal employees. What
this breach has done is exposed their data, as you know. And
I'm very concerned about that.
That is why, in terms of the first incident, we have been
working hard to not only begin, but also to improve our
notification system and to provide both identity theft and
credit monitoring for them.
We have received much feedback from our employees. We are
using that feedback.
Senator Mikulski. So have I. They are pretty apprehensive
and agitated.
Ms. Archuleta. I know. I'm angry, too. I'm angry that this
has even happened. I have worked very hard toward correcting
decades of inattention, and I will continue to do so.
I will tell you that I'm very concerned about protecting
the data of our employees, and that as we move into incident
two, I am going to use their feedback, their concerns, to
inform us so we can look at the wide range of options we will
have available to us with these notifications.
Senator Mikulski. Do you have kind of a council of Federal
employee organizations that you meet with that could tell you
the view from the employee up, so that you really hear what
they are saying?
People like myself, Senator Cardin, Senator Kaine, Senator
Warner, we are very proud of the fact that the capital region
is the home to so much talent that works on so many pressing
national interests, from the cure for cancer to protect our
country against predatory attacks. Now they are worried about
predatory attacks against them.
Do you meet with them and get this advice, while we are
trying to sort out the best way to have cyber shields on our
dot-gov?
Ms. Archuleta. We are doing several things, Vice Chairwoman
Mikulski. Thank you for that question.
We are working with our Chief Human Capital Officers (CHCO)
Council, which are our Human Capital Officers.
Senator Mikulski. I don't know what Chico is. That's where
I bought some of my jackets.
Ms. Archuleta. Mine, too.
The human capital officers for each of the agencies, as
well as all of the department heads and leaders. And we have
tried to adjust the notification system so it is customized to
the employees.
We are also listening to our unions, our union
representatives, and seeking their input, and other stakeholder
groups, to see how we can better improve our notification
system, not just in the long term, but during this period from
June 8 to June 19, to take their feedback every day around call
centers, about how we can provide Frequently Asked Questions
(FAQs) on Web sites, and we could work directly with department
heads and agencies, so they are assisting us in the
notification process.
We take very, very seriously what we owe to our employees.
I will continue to do that and to make sure that, in the second
incident, we are using their input.
Senator Mikulski. I think that is absolutely crucial.
Mr. Chairman, I would like to really thank you also for
having the IG at the table. When I chaired the committee, it
was administrative procedure that all my subcommittees either
had an IG come on what were the hotspots for agencies or at
least submit written testimony. The fact that you are utilizing
that is really crucial.
We will have a lot to talk about this afternoon. Better
talk privately.
Mr. Esser, thank you so much for your service. We so value
the work of our inspectors general. They have been enormously
helpful to me both as chair and vice chair of the committee to
really get value for our dollar, to identify management
hotspots.
And we really want to thank you for the identification not
only of the problem but also the recommendation for the
solutions. So thank you very much, and all of the IGs.
Mr. Esser. You are very welcome, Senator.
Senator Boozman. Thank you, Senator.
Senator Lankford.
Senator Lankford. Thank you.
Mr. Spires, let me ask you a follow-up question. You said
that, coming from the CIO council before, that many Federal
agencies have similar issues.
I have a twofold question. One is define what issues mean
on this. And second, give me a percentage when you say ``many''
other agencies. Again, I'm not asking you to articulate what
are the security issues and specifically where are
vulnerabilities. I am not asking you to do that. Give me a
guess here of how many agencies we are dealing with and what
those issues are.
Mr. Spires. I would say many agencies of the Federal
agencies have a similar kind of problem that Mr. Esser alluded
to about decentralization of IT.
In and of itself, it is not necessarily a bad thing. But it
has been very, very difficult for many of these agencies as
they rolled out systems, and then have to support these
systems, the complexity factors have grown so significantly
that it is just very, very difficult for them to get their arms
around systems.
I mean, at DHS, to call out DHS specifically, we would do
inventories and try to, if you will, find all of the systems
that we had. I think that we did a relatively good job at that.
But every year, we would find more. Well, try to secure that.
I say that is the first thing, that most agencies, I
believe, have that problem. I don't want to put a percentage on
it, because I don't know how to measure that as far as a
percentage. But I would say most of the major agencies have
this problem that the CIO would not be able to sit here and say
that they have a good handle on their true inventory of IT
systems.
Senator Lankford. What about use of credentials?
Mr. Spires. I give a world of credit to DOD for having
rolled out that Common Access Card (CAC) card years ago and
having the leadership and wherewithal to make that happen. Most
Government agencies are still struggling to roll out what we
call the Homeland Security Presidential Directive 12 (HSPD-12)
program, or the Personal Identity Verification (PIV) card, the
smart card, and then use it for logical access control.
It is still an issue. If you go to the cap goals and look
at where we are at, it is still an issue at most of the
agencies on the civilian side.
Senator Lankford. Authorizations?
Mr. Spires. Again, I think you're hitting the hotspots
here. Many systems we would find, they wouldn't have
authorizations because they were out in the field and they were
not under the CIO's control. Or what I also didn't like, which
is kind of hiding the ball a little bit here, is you could do
an interim authority to operate, and some of those would last
way too long. There would be weaknesses in the systems, and it
would be difficult to clear those weaknesses.
So again, I cannot put numbers on that, sir. But,
hopefully, I have given you a sense of where I feel many
agencies are today.
Senator Lankford. My question to that related to
appropriations. None of those seem like big dollar items. Those
are more management or current inventory, structure, process,
the wonderful term of hygiene for our systems. Am I hitting
that?
Mr. Spires. I want to be a little careful here.
Senator Lankford. If we have a monitor with an orange
screen on it, I get it. We have some old systems out there. But
I'm asking, the initial security side of this, the first rung
seems to be how we are handling the information in the
inventory.
Mr. Spires. I would agree with your sentiment that says we
could manage this a lot more effectively, and we do not
necessarily need new dollars to do that.
Some of the issues, though, that go to true modernization,
you do need investment.
Senator Lankford. Sure.
Ms. Archuleta, let me ask you a question. You had in your
written testimony, and in your oral testimony as well, you kind
of talked through the timeline of how things went. In some
areas, you were very specific of how things moved and in what
order. There are a couple of terms that jumped out to me there.
Let me read this back to you. It says, ``As a result of
these efforts to improve our security posture, in April 2015,
an intrusion that predated the adoption of these security
controls affecting OPM's IT systems and data was detected by
our new cybersecurity tools. OPM immediately contacted the
Department of Homeland Security and Federal Bureau of
Investigation.''
INTERAGENCY NOTIFICATION
Could you give me definition of ``immediately''? Is it that
same day, week, month?
Ms. Archuleta. That same day.
Senator Lankford. Same day. Great.
Then you had the same issue there. You talked about the
scope and impact of the intrusion. Shortly thereafter, OPM
notified congressional leadership.
What is our timeframe?
Ms. Archuleta. We have a 7-day requirement, which we met.
Senator Lankford. Okay, so met it within that 7 days.
Ms. Archuleta. Yes.
Senator Lankford. Terrific. Thank you.
The contractor that was involved in this, that had
responsibility for strategic IT in the security plan, who was
that contractor? What were the assurances that they gave early
on during the conversation in the contracting process to say we
will provide security structure, management? I'm looking for
what they said they would do and what they actually did.
Who was the contractor, first?
CONTRACTOR SECURITY
Ms. Archuleta. I want to be very clear that while the
adversary leveraged a compromised KeyPoint user credential to
gain access to OPM's network, we don't have any evidence that
would suggest that KeyPoint as a company was responsible or
directly involved in the intrusion. We have not identified a
pattern or material deficiency that resulted in the compromise
of the credentials.
Since last year, we have been working with KeyPoint and
they have taken strides in securing its network and have been
proactive in meeting additional security controls that we have
asked them to use to protect all of the background data.
Senator Lankford. So the question is then with KeyPoint,
the security controls they put in now, were these security
controls that were discussed earlier that were just not
fulfilled, or were these things that weren't considered?
Ms. Archuleta. I think I understand, but let me be sure.
Our detection in April discovered an intrusion into our system
in late 2014. The detection was in 2015; we discovered an
intrusion into our system in late 2014.
Senator Lankford. What I am trying to drive at is, then
there were changes in security protocols. Were those changes
recommended before, or are these entirely new?
Ms. Archuleta. They were ones we had planned and were
installing as we progressed through our improvements.
Unfortunately, we didn't have them in place soon enough. We are
working, as I said, with a legacy system. We were testing many
of our security tools. And as a result of actually being able
to install this particular security tool, we were able to
detect it.
Senator Lankford. And that plan had been in place how long?
Ms. Archuleta. It is part of our IT security plan, which we
developed in----
Senator Lankford. The 2012 plan?
Ms. Archuleta. It is 2014.
Senator Lankford. Okay. Thank you.
Ms. Archuleta. Thank you, sir.
Senator Boozman. Senator Coons.
Senator Coons. Thank you, Chairman Boozman.
Ms. Archuleta, you're in the midst of a major IT
modernization project. How much do you expect that total
project to cost? What elements are included in that amount?
OPM IT MODERNIZATION
Ms. Archuleta. There are four steps that we are using for
that plan.
The tactical--that is, what are the tools we are going to
need to protect our systems even as we move forward? We are
building a new shell. It will be the platform. The third and
fourth are the migration and then the disposal of the legacy
system.
We are at the tactical step right now. In June of 2014, we
hired a contractor to assist us in the development of the
shell. We are moving toward that.
We, as I said, have identified $67 million in 2014 and 2015
that would enable us to move toward that. We're asking for an
additional $21 million in the 2016 budget to aid us.
We are working closely with OMB to determine if another
request should be made.
Senator Coons. Has a major IT business case been prepared
as OMB requires for IT projects?
Ms. Archuleta. Yes, it has. We worked very close with OMB.
This is one of the points that the IG brought out in his flash
audit. I can assure the IG that we, in fact, have been working
very, very closely with OMB.
This is an urgent issue. We are moving as fast as we can,
making sure that we track, we justify and document all that we
are doing consistent with the OMB standards that have been
given to us.
We have a budget that we worked very closely with OMB to
deliver.
Senator Coons. In response to the IG audit, one of the
concerns was why you would give a sole-source contract, if I
understand correctly, to a single contractor to manage all four
phases of this very large project.
What type of contract is it? Is it a fixed-cost project?
What steps are you considering in light of the audit?
OPM CONTRACTING
Ms. Archuleta. As I said before, there are oftentimes
places where we have areas of agreement and areas where we
would like to have further consideration with the auditor.
In his flash audit, the inspector general encouraged the
use of either existing contracts or the use of full and open
competition. I would like to assure you and the inspector
general that the processes followed in awarding the already
existing contracts have been perfectly legal, and that we will
continue to ensure that any further contracts and processes
entered into will also be perfectly legal.
He also expressed concern that the sole source contract
used in the tactical and shell phases should not be used for
migration and the cleanup phases that I described earlier. I
understand his concerns. I would like to remind the inspector
general that the contracts for migration and cleanup have not
yet been awarded.
Where we would like to have further discussion with the
inspector general is the timeline, the practical timeline, for
our major IT business case. He is suggesting that we move that
out to fiscal year 2017. I would like to move that much
quicker, given what we have already experienced.
I assure the inspector general and everyone here that all
of our decisions are being tracked, documented, and justified.
He has made a number of recommendations regarding
contracting and standards that rely on external sources for
assistance, and I believe the Federal Government and through
the good work that Tony Scott is providing to us and all of our
partners in Government have strong solutions to offer. I am
going to look forward to talking more to him about his
suggestion.
Senator Coons. Have you had a chance to look at other
agencies that have had successful IT projects to use as a
model? As you mentioned, have you some sources of valuable
insight into how to manage multi or multiphase expensive and
time-critical IT projects.
Have you looked at whether having an outsider contractor
managing the project or breaking it into more bite-size pieces
might achieve some of your goals?
Ms. Archuleta. Well, we are looking at all of our options,
certainly. This is a very serious issue. I am taking it very
seriously and looking to all of the resources I have available
to me. I will, certainly, do that.
I believe that the Federal CIO is an important asset to us,
as are our partners at the Department of Homeland Security,
National Security Agency, and the Federal Bureau of
Investigation. So we are looking to those. And I welcome the
Inspector General's suggestions. And as I move forward through
this process, I will be listening to him carefully, as well as
my partners across the Government.
Senator Coons. I appreciate that response.
Mr. Spires, you were the former CIO at DHS and IRS, both of
which have had very cumbersome, difficult, and often challenged
IT projects. Were you able to do turnaround on some of the
legacy IT failures there? What advice do you have for OPM, as
they engage in another expensive, complex, multiyear
modernization effort?
Mr. Spires. Sure. First, I would make the note that it is
always about a team effort, in order to deliver these kinds of
programs. I actually joined IRS and took over the modernization
program. At the time, it was on the GAO high-risk list, and I
am pleased to say that, as a team effort, it took a long time,
but we were able to improve our processes to the point where
recently that program was removed from the high-risk list,
which is quite an accomplishment.
Let me just say that I have reviewed many programs. We
could have a long discussion about how to appropriately manage
IT programs. I will make a couple of points very quickly.
One thing that is very critical is the overall governance
framework that you put in place. You need to get the right
stakeholders in the room to work together to make this happen.
All too often in Government, I have seen issues where that does
not happen.
The other thing I would say is don't over-rely on
contractors. You need to have a program management office of
Government officials that have the requisite experience and
skill set to be able to run these programs.
And I'm not picking on OPM. I don't know much about their
modernizations at all. But I have found the smaller agencies, I
think, struggle more with this because they do not have the
heritage of having learned those lessons within the agencies
themselves.
Senator Coons. Thank you. I see my time has expired.
Mr. Spires, Mr. Esser, Ms. Archuleta, thank you for your
testimony today.
I'm grateful for the input of the IG and for your offer to
continue to work with us and consult with us as we move forward
to try to offer critically needed reassurances, particularly to
law enforcement, but all Federal employees, and to find timely
and cost-effective solutions to this and other cyber
challenges.
Senator Boozman. Senator Moran.
Senator Moran. Chairman, thank you very much.
Mr. Spires, based upon what you heard today, your knowledge
of Government agencies and their cybersecurity issues, is this
a management issue or is this a resource issue?
Mr. Spires. It is more of a management issue, sir.
Senator Moran. Why do you say that?
Mr. Spires. Because of the dispersed nature of the way IT
has been run in a lot of agencies, there are so many let's say
inefficiencies that have crept into the system that I don't
believe we effectively spend the IT dollars we receive.
So I believe with the proper drive towards management, you
can actually drive a lot of savings from the existing budgets.
But caveat that. When you are talking about new modernization
programs, sometimes with the right business case, it does make
sense to invest in those.
Senator Moran. Based on your response to Senator Coons, I
assume there is a natural inclination when these issues arise
that the easy thing to do is to hire a contractor. Within the
agency, we do not know this stuff, it is not our primary
mission, let's just get somebody in here who takes care of
this.
This committee, when Senator Udall was its chairman, we
worked on FITARA and issues related to how to improve the role
CIOs play in an agency, in part trying to compensate for, I
think, an attitude that we are not tech folks, somebody else is
responsible for that.
Ms. Archuleta, describe to me how you work with your CIO.
Let me ask a question first about this.
The first breach I think you were aware of goes back to
June 2014. As I recall, you and others testified in front of
this committee in May of 2014, and the following month, June,
OPM became aware of a breach.
TIMELINE OF BREACHES
Ms. Archuleta. Yes. The first breach that we discussed with
you was----
Senator Moran. I don't think you discussed this in May. If
you knew about it, I do not think we knew about it.
Ms. Archuleta. Okay. I'm sorry, sir.
I want to look and make sure I have my months right. March
2014 was when we identified some adversarial activity. But
there was no PII that was lost in that.
In June 2014, which is what you may be referring to, USIS
was breached. There was OPM data that was compromised. It
impacted about 2,600 individuals.
In August of 2014, KeyPoint Government solutions, was
breached. That breach compromised approximately 49,000
individuals.
In April of 2015 was the breach that I described earlier,
as well as the one in May.
Senator Moran. So let me make sure I understand what you
just said. There were three breaches that occurred prior to the
two that we are now talking about.
Ms. Archuleta. There was the OPM network in March, June of
2014 USIS, in August KeyPoint.
Senator Moran. What changed at OPM? You obviously then
became aware on three occasions somebody is trying to intrude
on our system. What then did OPM do after realizing that?
OPM IT MODERNIZATION
Ms. Archuleta. If I could just go back a little bit,
because I want to reassure you, to my colleague's point, that
one of the first actions I took as OPM director was to hire
Donna Seymour. The second action I took was to develop an IT
strategic plan that had exactly the pillars my colleagues
describe.
So for IT leadership, look to OPM's CIO. IT governance is
my whole leadership team we must buy into the design and the
structure of the IT plan and its development. And for IT
architecture, what was it going to take for us to build out the
systems that we needed, in view of our legacy system?
Regarding IT data, we needed to be informed. We needed to
know that what we were doing was right and that we were doing
this in a way that was analytical. We also had as an important
pillar IT security, obviously very, very important. As we were
building out, even as we were working on our strategic plan,
one of the most important pillars was IT security.
Since Donna Seymour came in as CIO, and because of her
experience, and as Mr. Spires says, the experience we have in
Government, we brought her from the Department of Defense and
the Department of Transportation, that she was able to apply
those skills and that talent to identifying not only what our
strategic steps are but how we could begin to develop them.
The first thing we needed to look at was what we could
place on that legacy system, and what would it take to do that?
That is where she has begun and what she continues to do
throughout her tenure.
Senator Moran. Your point is, not necessarily following the
three breaches that we just talked about, but from your
arrival, your priority was to get a CIO and begin
implementation of a plan?
OPM IT STRATEGIC PLAN
Ms. Archuleta. I will tell you, Senator, that from the
first time I was briefed on our IT infrastructure during my
confirmation preparation, I knew that there was a problem. And
that is why, in my confirmation hearing, I said it would be a
top priority, and I promised your colleagues that I would
develop an IT strategic plan, which I did, and produce within
the first 100 days. I was also wise enough to hire Donna
Seymour.
Senator Moran. The IT strategic plan that you just
mentioned, is that something we could see?
Ms. Archuleta. Absolutely, sir. It is on our Web site. I
will make sure you get a hard copy as soon as possible.
Senator Moran. Mr. Chairman, let me see if I have
additional follow-up.
Following that IT strategic plan, is there a new plan as a
result? It is just implementing this one?
Ms. Archuleta. As you know, a plan is dynamic, and as we
learn things, that plan changes. But we are following it. We
are making sure every component--governance, leadership--making
sure that we're making sound decisions on the architecture,
that we are building and making sure it is based on clear
analytics, and that cybersecurity is an important component of
all of that.
Senator Moran. Are there benchmarks that are now in place
within that plan so that we see whether we are making progress,
benchmark by benchmark?
Ms. Archuleta. I would like to come back to you and show
you what those benchmarks are, sir.
Senator Moran. Okay.
Let me ask about notification. You indicated in your
testimony, and I wrote this down as well, ``as soon as
practicable.'' And I understand the value of that phrase.
The President's proposed legislation for notification to
occur within 30 days of a breach, how do you think practicable
fits with the 30-day requirement?
Ms. Archuleta. Within the proposed legislation,
``practicable'' is included in there. I can assure you we are
trying to do everything we can to come as close to that date as
we possibly can.
Senator Moran. All right.
Is there anyone who oversees IT security outside of OPM?
What is the relationship with OMB?
Ms. Archuleta. It is a very close relationship. We work
very closely with the Federal CIO who has responsibility for
this, Tony Scott. He has been at OMB for about 90 days now. He
has been engaged with us from the very beginning. He and Donna
have a strong relationship, and he has a strong adviser role to
us.
Senator Moran. Prior to his arrival 90 days ago, was there
someone filling that responsibility as well?
Ms. Archuleta. I don't know that, sir, but I would be glad
to get that information back to you.
Senator Moran. Okay. Thank you very much.
Ms. Archuleta. Thank you, sir.
Senator Boozman. Thank you, Senator Moran.
Thank you all for being here. Again, I apologize for the
earlier delay. This is such an important hearing. I think this
is one of the most important hearings we will have this year.
We will be following up in the not-too-distant future, again
making sure things are moving in the right direction.
I want to thank you all for participating. I also want to
thank my staff and Senator Coons' staff for the excellent job
they have done in preparing for the hearing.
At this time, I ask unanimous consent that statements by
the National Treasury Employees Union and the Government
Employees AFL-CIO be included in the hearing record.
[The information follows:]
Prepared Statement of the National Treasury Employees Union
Colleen M. Kelley, National President
Chairman Boozman, Ranking Member Coons and distinguished members of
the subcommittee, I would like to thank you for the opportunity to
share our members' perspectives on the recent announcements of agency
data breaches impacting Federal employees. I commend you for holding
this hearing on an extremely urgent issue for the Federal workforce. As
President of the National Treasury Employees Union (NTEU), I have the
honor of representing over 150,000 Federal workers in 31 agencies.
Mr. Chairman, as you can imagine, there is great fear and outrage
on the part of Federal employees and retirees in the wake of the U.S.
Office of Personnel Management's (OPM) announcements on June 4, and
more recently on June 12, that millions of current and former Federal
employees may have had personally identifiable information (PII)
compromised owing to breaches in databases containing various personnel
records. Federal employees have had a difficult few years, facing
multi-year pay freezes, furloughs, sequestration, and this type of
exposure of personal information is the final straw. Such exposure is
simply unacceptable.
It is important to note that these breaches follow wide-scale
breaches of health insurance carriers earlier this year that included
Federal employees enrolled in several Federal Employees Health Benefits
Program (FEHBP) plans, and multiple announcements of agency breaches in
2014 affecting background investigation and suitability records.
Federal employees are required to provide significant amounts of
personal data to their employing agencies, for general employment
purposes, as well as for suitability and security clearance purposes.
NTEU asks that this subcommittee act to ensure that agencies have the
ability to immediately safeguard Federal employees' information going
forward. It should come as no surprise that employees are questioning
the idea of submitting this type of detailed personal information to
their agencies in the future, and are particularly pointing to the
suitability and security clearance process, forms, and storage as areas
that need to be immediately changed. We also ask the subcommittee to
keep these breaches in mind as serious consideration of so-called
``Continuous Evaluation'' (CE) policies move forward in the security
clearance and suitability reform areas, as well as for oversight
purposes of the Administration's Insider Threat program.
At the moment, a principal outstanding concern for Federal
employees and retirees is the confusion about what exact type of
individual data and information was in fact compromised, and of whom.
In its first statements, OPM confirmed that a breach had potentially
compromised names, dates and places of birth, Social Security numbers,
and addresses. However, a multitude of media and other public
statements followed maintaining that the exposure was far greater in
number and the information even more intrusive--that the type of
information that may have been accessed by outsiders involved
information about family members, beneficiary information from employee
benefit programs, bank accounts, data submitted and stored from
Declarations of Federal Employment and Standard Forms 85 and 86 \1\
(among others) as part of routine background investigations, including
detailed financial information and medical history, home addresses and
other PII and data for annuitants. Late on June 12, OPM informed NTEU
that this was indeed the case--that the worst case scenario for
individuals' privacy--be they Federal civilians, military personnel,
contractors or other individuals simply appearing in various documents,
and our Nation's national security has occurred. However, NTEU wants to
be clear that which employees have been affected by this apparent
wider, and more serious breach, is still unknown to us and most
importantly to the affected individuals.
---------------------------------------------------------------------------
\1\ Questionnaires for Public Trust, Non-Sensitive, and National
Security Positions.
---------------------------------------------------------------------------
OPM's statements issued to us and to agency heads still do not
contain any information about whether individuals who do not possess
security clearances, but who provide detailed information for
suitability determinations and Standard Form 85 for critical non-
sensitive positions, are also included in this breach. Not knowing
whose data, and what exactly has been accessed and compromised, is
creating widespread confusion and anxiety, on top of the general
frustration of having one's personal information compromised be it from
a foreign power, a thief, or otherwise ill-intended individual.
Employees deserve to know what exact databases and information was
hacked, and they need to be in a position to act, given the high level
of risk they and their families are facing. It will also be important
to address whether spouses, siblings, and other relatives, as well as
former non-Federal coworkers and acquaintances whose PII and contact
information is provided, also had their information compromised, and
whether there are plans to notify these members of the public, and to
provide them with credit and identity protection services. We do not
currently have any notification details to share with our members
concerning the latest news from OPM, which again is unacceptable. I ask
this subcommittee to ensure that the notification plan for all of these
affected individuals is made public, and that it is put into action
immediately.
Given that more than a week has passed since this wider breach was
announced, NTEU believes it is time to immediately extend blanket
credit monitoring and identity theft protection services to the entire
Federal workforce. We understand that the forensic investigation may
take time, and that there are serious national security implications to
this breach, so in order to best protect employees going forward, a
blanket extension is needed. Since large numbers of employees (OPM
estimates 2.1 million) have just received these services as part of the
first OPM reported breach, it should be a relatively small number of
additional employees who need this coverage extended to them.
OPM responded positively to NTEU's initial request that Federal
employees be allowed to use Government computers in order to be able to
contact CSID, the OPM-selected contractor, for credit monitoring
purposes and to enroll in the identify theft protection services.
Additionally, OPM also acted on NTEU's request to ensure access to
Government computers for those employees who do not regularly use
computers on the job. While OPM has encouraged agencies to do these
things, NTEU urges agency heads and this subcommittee to ensure that
this access is indeed granted.
It is critically important for employees and retirees to be able to
access and enroll in protection services as soon as possible. While
NTEU is aware that OPM's contractor-provided notifications have begun
to be emailed and mailed directly to active employees for the first
breach, we are aware of various difficulties that may exist in reaching
affected annuitants and former employees, whose mailing addresses are
not actively maintained by employing agencies or OPM. Additionally,
many of our members are reporting extensive problems when attempting to
enroll in the CSID-provided services--ranging from not being able to
reach an operator on the toll-free line, to the Web site crashing or
freezing when they are attempting to enter the required enrollment
information, to the rejection of assigned pin numbers and passwords, to
the inability to establish required connectivity to the CSID Web site,
to official email notifications going into spam filters, and to family
members receiving the employee's notification letter, at an address
that the employee has never lived at, or used for any purpose. In
short, the CSID notification and enrollment process has been a disaster
for many NTEU members.
A major concern for employees is the delay in notification from the
time of the actual discovery of the breaches. It is imperative that
affected individuals receive swift notification of any type of breach
compromising PII and other information. Any delay in notification only
increases the likelihood of individuals experiencing identity theft and
suffering financially. As you know, Mr. Chairman, NTEU represents
employees at U.S. Customs and Border Protection (CBP), and in September
2014, the Department of Homeland Security (DHS) became aware of a
breach involving KeyPoint, a contractor providing background
investigations and support. The overall volume and sensitive type of
information that is provided by employees undergoing a background
investigation--either as a new hire or for a periodic reinvestigation--
is significant, and includes extremely personal details of employees,
their family members, and of their friends, and even of their coworkers
and acquaintances. However, it was not until June 4, 2015 that DHS
began providing and notifying CBP employees of their ability to enroll
in credit monitoring and identity theft protection services. A nine
month delay is simply unacceptable for all individuals involved.
Moreover, two simultaneous, ongoing employee notification processes of
compromised employee personnel records at CBP is leading, not
surprisingly, to major confusion in the workplace.
Mr. Chairman, I also want to share that I have requested that, as
we move forward, serious consideration be given by the administration
to providing both the credit monitoring services and the identity theft
protection services for a significantly extended period of time beyond
the current 18 months. Given how long these breaches may have gone
undetected, and since the exact identities and data compromised is not
yet known, NTEU believes these items to be prudent courses of action.
As an example, following this year's Blue Cross Blue Shield healthcare
breaches, carriers provided 24 months of protective services to
affected enrollees. Additionally, we ask that blanket coverage be
provided now to those individuals affected in the second breach.
Serious compromises of data and personal information demand serious
responses from the U.S. Government for the protection of its most
valuable asset, its people.
I again thank the subcommittee for the opportunity to provide
NTEU's views on these alarming employee data breaches, and for your
work to identify the source of these intrusions, as well as to identify
the compromised employee records and personal information. And, most
importantly to help ensure that this does not happen again. However,
for the information already compromised, time is of the essence, and
clear guidance and immediate notification, with adequate levels of
protection, is warranted. Ultimately, NTEU members want to be assured
that their information, and their family members' information, is not
at risk because of their profession. Our members deserve to be able to
trust that the Government can properly secure their private
information.
______
Prepared Statement of the American Federation of Government Employees,
AFL-CIO
opm information technology spending and data security
Chairman Boozman, Ranking Member Coons, the American Federation of
Government Employees, AFL-CIO (AFGE) which represents more than 670,000
Federal employees, would like to thank the subcommittee for holding
this important hearing on the recent data breaches to the Office of
Personnel Management's electronic employee data systems. Unfortunately,
in the days since the breach was originally announced, the number of
individuals who are or have been employed by the Federal Government,
and potentially had their personal data hacked continues to increase.
Very little substantive information has been shared with Federal
employees, despite AFGE's numerous requests for specific information in
an effort to help those affected by the data breach. All individuals
affected by the OPM data breach deserve nothing less than a clear path
forward that allows them to take immediate action to protect themselves
from the misuse of their stolen personal information, successfully
monitor their credit, and continue their work as Federal employees with
confidence that the necessary precautions will finally be taken to
protect their personal data.
OPM must commit to answering the most basic of questions regarding
the breach. The fact that OPM continues to refuse to answer simple
questions about the dimensions of the breach have made the Federal and
DC Government employees and retirees that AFGE represents deeply
skeptical of any information coming from OPM. AFGE understands the
sensitive nature of the current criminal investigation that is
underway, however, there are some questions and issues that the agency
has a moral responsibility to answer. For example, one question that
still has not been adequately addressed by OPM is whether or not the
data that was stolen can be linked to Federal employees' bank accounts
or direct deposit information. Federal employees deserve answers to all
of their questions so they can take appropriate action.
Based on the information that OPM has provided, AFGE believes that
the Central Personnel Data File was the targeted database, and the
hackers are now in possession of all personnel data for every Federal
employee, every Federal retiree, up to one million former Federal
employees, as well as similar data for their family members. We believe
that hackers have every affected person's Social Security number(s),
military records and veterans' status information, address, birth date,
job and pay history, health insurance, life insurance, and pension
information; age, gender, race, union status, and more. In fact, at the
House of Representatives Oversight and Government Reform hearing held
on June 16, 2015, OPM Director Katherine Archuleta testified that
Federal employees' Social Security numbers were not encrypted, and thus
were compromised. This is a cyber-security failure that is absolutely
indefensible and outrageous. While OPM has informed Federal employees
that they will provide 18 months of credit monitoring and $1 million in
liability insurance, AFGE believes that a mere 18 months of credit
monitoring is entirely inadequate, either as compensation or protection
from harm. Federal employees will suffer the consequences of the OPM
data breach far longer than 18 months. In order to protect the personal
data of the millions of individuals affected by the data breach from
this point forward, OPM owes employees and their family members free
lifetime credit monitoring and liability insurance that covers the
entirety of any loss attributable to the breach. With the personal
information of millions of people stolen, we cannot underestimate the
long-term threats to Federal employees' personal finances, credit, and
physical safety.
AFGE also requests that OPM reconsider the decision to enter into
contact with Winvale/CSID, a contractor given responsibility for
answering affected employees' questions involving their stolen personal
information. Based on our membership feedback, Federal employees have
not been able to speak with an actual person when they have questions.
At the very least, the terms of the contract should have included
guaranteed access to points of contact that can answer specific,
personal questions that affected Federal employees may have regarding
the data breach. Federal employees who have been victimized by this
breach deserve more than a Web site that is difficult to navigate and
call center contractors who do not know the answers to questions that
go beyond a Frequently Asked Questions (FAQ) template. Those affected
should have access to OPM employees who can respond to questions that
are unique to their individual situations.
AFGE has also received numerous complaints from Federal employees
who describe their horrendous experience trying to access assistance
from the contractor hired to perform credit monitoring. These
complaints range from reports of the Web site constantly crashing to
the information the contractor produces being inaccurate and out of
date. A recent report on Federal News Radio noted, CSID is ``. . .
thought of as a company that helps others get on the General Services
Administration (GSA) schedules, prepare proposals and the like, and
their GSA schedules are for things such as lab equipment and IT
software services, but there is nothing about credit monitoring,
insurance or similar offerings . . . interestingly enough Winvales's
Web site now says they provide credit monitoring services, but their
profile on Bloomberg does not mention it at all.'' \1\
---------------------------------------------------------------------------
\1\ Federal News Radio, OPM Contract for Credit Monitoring Services
Called Into Question; http://www.Federalnewsradio.com/520/3875508/OPM-
contract-for-credit-monitoring-services-called-into-question.
---------------------------------------------------------------------------
Accuracy and accessibility are the entirety of the service that
Winvale/CSID is supposed to be providing. Thus far, Federal employees
have not been able to rely on the accuracy and accessibility of the
credit monitoring services that have been provided. Yet, OPM gave
Winvale/CSID what appears to be a sole-source $20 million contract with
four 1 year renewal options. These issues need to be addressed and
Federal employees must have reliable credit monitoring services
immediately.
AFGE has received disturbing reports that agencies are denying
Federal employees the time to deal with the impact of the data breach.
At numerous agencies, employees are forbidden to use their government
computers for any purpose other than a work assignment. They are
forbidden from using their government computers to access personal
emails or any non-work related Web sites for any reason. Federal
employees dealing with this breach need to be able to visit their
banks, Social Security offices, mortgage holder's offices, the
management offices of their apartment complexes, and other creditors in
order to deal with the fallout of having to change credit card and bank
account information. Many agencies' computer firewalls prevent
employees from being able to handle these kids of transactions online.
Therefore, agencies should grant employees time during normal business
hours to take preventive measures such as contacting their financial
institutions and businesses as notification of their current situation.
Additionally, it is extremely important that OPM ensure that agencies
are meeting all of their collective bargaining obligations on
procedures for accommodating employees trying to deal with the breach.
Federal employees trusted OPM with their personal information and
the agency failed them. Their personal information was not properly
guarded, and as a result, Federal Government workers and their families
must now live with the threat of having the most intimate details of
their lives exposed, and illegally used against them. The Government
must now earn back the trust of these employees and future public
servants. AFGE thanks the subcommittee for holding this hearing.
ADDITIONAL COMMITTEE QUESTIONS
Senator Boozman. If there are no further questions, the
hearing record will remain open until next Tuesday, June 30, at
noon, for subcommittee members to submit any statements or
questions to the witnesses for the record.
[The following questions were not asked at the hearing, but
were submitted to the Agency for response subsequent to the
hearing:]
Questions Submitted to Katherine L. Archuleta
Questions Submitted by Senator Jerry Moran
data breach
Question. At last week's hearing, you indicated that OPM estimated
the total number of individual impacted by this most recent data breach
to be approximately 4 million. Media reports suggest that an internal
memo from OPM suggests that as many as 18 to 30 million individuals
could be impacted by the series of breaches dating from March 2014
until present. Can you please provide the most up-to-date information
regarding the number of individuals impacted directly by this breach?
What percentage of the total number of OPM's records are considered to
contain national security information or sensitive information
necessary for identity theft or fraud? Of that, what percentage of
those records were included in this breach? In addition, please provide
any information you see fit that can be helpful to quantify the
severity of this breach.
Answer. In April 2015, OPM discovered that the personnel data of
4.2 million current and former Federal Government employees had been
stolen. This means information such as full name, birth date, home
address, and Social Security Numbers were affected. This number has not
changed since it was announced by OPM in early June, and individuals
who were affected should have already received a notification.
While investigating this incident, in early June 2015 OPM
discovered a separate but related incident where additional information
had been compromised, including background investigation records of
current, former, and prospective Federal employees and contractors. OPM
and the interagency incident response team have concluded with high
confidence that sensitive information, including the Social Security
Numbers (SSNs) of 21.5 million individuals, was stolen from the
background investigation databases. This includes 19.7 million
individuals that applied for a background investigation, and 1.8
million non-applicants, primarily spouses or co-habitants of
applicants. Some records also include findings from interviews
conducted by background investigators and approximately 1.1 million
include fingerprints. Usernames and passwords that background
investigation applicants used to fill out their background
investigation forms were also stolen. Notifications for this incident
have not yet begun.
Question. You indicated in your testimony last Tuesday that there
were three separate breach incidences that caught the attention of OPM
last year. In March 2014, you explained that OPM successfully detected
a breach attempt but that no personal information had been obtained.
Later that summer, two government security clearance contractors were
breached. In June 2014, 25,000 records, which included highly-sensitive
security clearance information, were obtained from security contractor
U.S. Investigations Services (USIS). Two months later, another security
clearance contractor, KeyPoint Government Solutions, suffered an even
greater breach. This time over 48,000 records were obtained. In each
successful breach incidence, OPM was required to issue notification
letters to affected individuals. OPM clearly knew that this sensitive
security clearance information was a target of hackers. It was later
revealed that this sensitive information may have been used to
infiltrate the OPM network. Was this security clearance information
used to gain access to the OPM network? Please offer a detailed
description of your response to these serious breaches. What security
procedures and improvements were put in place? How often did you meet
with your CIO and other top security officials within OPM to discuss
these breaches and develop a response strategy? Please provide a
calendar of those meetings and the topics discussed. Please describe
any new policies OPM required to access the OPM network following the
breaches.
Answer. The adversary gained access to OPM systems through the
agency's Local Area Network by employing stolen user credentials from a
contractor. OPM has already taken a series of 23 concrete steps to
improve information security, as outlined in its recent Cybersecurity
Action Report. These include:
--Implementing two factor strong authentication for all privileged
users, and increasing the percentage of unprivileged users with
two factor Strong Authentication;
--Restricting remote access for network administrators and
restricting network administration functions that can be
performed remotely;
--Reviewing all Internet connections to ensure that only legitimate
business activities have access to the Internet;
--Deploying new hardware and software tools, including 14 essential
tools to secure the network;
--Deploying anti-malware software tools across the environment to
protect against cybercrime activities that could compromise the
agency's networks;
--Establishing a 24/7 Security Operations Center, staffed by
certified professionals, to monitor the network for security
alerts;
--Implementing continuous monitoring to enhance the ability to
identify and respond, in real time or near real time, to cyber
threats;
--Installing more firewalls that allow the agency to filter network
traffic more effectively;
--Working with the intelligence community and other stakeholders to
identify high value cyber targets within the OPM network where
bulk PII data are present, and mitigate the vulnerabilities of
those targets to the extent practicable;
--Modernizing OPM's IT network technology and architecture; and
--Tightening policies and practices for privileged users.
These actions have put OPM in a much stronger and more secure
posture than it was when then-Director Archuleta assumed her role. OPM
systems currently thwart millions of intrusion attempts that target its
networks every month. In addition to these past and ongoing activities,
OPM has recently identified several additional actions to bolster its
security and modernize IT systems. These include:
--Deploying two factor Strong Authentication for all unprivileged
users (Complete);
--Expanding continuous monitoring and completing implementation of
the Continuous Diagnostics and Mitigation program by March
2016;
--Establishing requirements for future contracts, as appropriate, to
ensure access to contractor systems in the event of an incident
(Complete);
--Completing a review of encryption of databases (Complete);
--Hiring a new cybersecurity advisor (In progress);
--Consulting with outside technology and cybersecurity experts to
identify further steps the agency can take to protect its
systems and information Complete);
--Migrating to a new IT environment capable of significantly
increased security controls (In progress); and
--Establishing regular employee and contractor training on
appropriate cyber hygiene and practices (In progress).
Question. In December 2014, one of the breached security
contractors, U.S. Investigations Services (USIS) has accused the OPM of
neglecting to share information that might have helped the contractor
detect the breach that occurred in June 2014. Did OPM reveal to its
contractor, USIS, that it had recently suffered a cyberattack? If not,
why did OPM not share this information? To what extent did OPM's
continued refusal to adopt IT best practices and OMB-required IT
procedures contribute to these potential security vulnerabilities at
the contractor level? Was it required that OPM share critical
information about the March 2014 attack?
Answer. OPM did not disclose to USIS that OPM systems had been
breached in March 2014. In our opinion, there was no clear requirement
that OPM notify USIS of the breach.
Question. One significant factor that may have led to this breach
is the repeatedly ignorance of OMB policies and IT best practices. As
Assistant Inspector General Esser indicated in testimony, the fiscal
year 2014 FISMA report offered OPM 29 recommendations covering a wide
variety of IT security topics; however, OPM has only adopted 3 of those
29 recommendations to date. The fiscal year 2014 audit also revealed
that 11 of 47 OPM IT systems were operating without a valid
Authorization, including some of the most critical and sensitive
applications owned by the agency. One tool available to OPM is the
ability to institute administrative sanctions to correct this gross
negligence. The OIG explains this could be an effective way to reduce
non-compliance with FISMA requirements.
Answer. Within the past year OPM has taken great strides in
improving the enterprise. Much of the recommendations issued by DHS in
2014 have been achieved and OPM is on track to meet or exceed all
Federal mandates including leading in the FISMA Cyberstat, DHS TIC v2,
and HSPD-12.
The following are some of the accomplishments:
--Implemented Level 4 two factor authentication for all privileged
and non-privileged users. The requirement of utilizing PIV for
all users has made OPM a leader in complying with the HSPD-12
mandate and significantly reduces the attack surface of the
network.
--Restricted remote access for network administrators and restricted
network administration functions that can be performed
remotely.
--Reviewed all connections and associated Access Control Lists (ACLs)
to ensure only legitimate business connections have access to
the Internet. This includes blocking privileged users' access
to the Internet.
--Required administrators to authenticate through a privileged user
management appliance in order to perform all administrative
functions. Direct access to servers or databases cannot be
achieved by users or administrators.
--Deployed new hardware and software tools to secure the network.
Including:
--Endpoint protection to detect and prevent malicious and
unauthorized software from installing and running on
endpoints and servers.
--Web Application Firewalls to monitor traffic to and from Web
applications and prevent common attacks such as DDOS,
cross-site scripting, SQL injection, and session hijacking.
--Endpoint anti-virus/malware scanning to quickly detect and block
viruses and malware.
--Automated threat response to unify, automate, and orchestrate
incident responses to ensure speed and decisiveness.
--Network Access Control to detect and limit unauthorized access
from devices that do not meet OPM policy.
--Business critical data and database compliance by providing
visibility into data access and tracking users' activity
and data sets.
--Advanced firewall services to better protect and filter network
traffic on the internal and external perimeter.
--Network risk and vulnerability monitoring and assessments to
identify areas of weakness in the network architecture.
--Inbound and outbound SSL inspection to audit and monitor
encrypted malicious traffic.
--Deployed network and email data loss prevention solution to
detect data exfiltration.
--Implemented anti-phishing and anti-malware inspection and
prevention of email traffic.
--Deployed additional firewalls to segment and monitor internal
traffic.
--Implemented continuous monitoring to enhance the ability to
identify and respond, in real time or near real time, to cyber
threats.
--Centralized security management and accountability into the Office
of the CIO and staffed it with security professionals who are
fully trained and dedicated to information security on a full-
time basis.
--Conducted a comprehensive review of IT security clauses in
contracts to ensure that the appropriate oversight and
protocols are in place.
Question. A number of current and former Federal employees have
expressed confusion and concern about the credit monitoring process,
which requires the input of sensitive information online. These workers
have also complained about frustrating multi-hour wait times to speak
with CSID representatives on the phone. Many are unfamiliar with the
vender, CSID, and the process to enroll in credit monitoring services.
What assurances can you provide that the information submitted by
impacted individuals will be safe and secure with this contractor? Does
this contractor use secure technologies, such as encryption, to protect
sensitive information? Are you aware of any phishing attacks or other
scams to obtain sensitive information from impacted individuals? Has
the contractor made a commitment to improve wait times or increase
their ability to address claims being made by impacted individuals?
Answer. CSID is the engine behind eight of the top 10 identity
theft protection companies. CSID fully encrypts critical values in
production databases to prevent the exposure of sensitive information
stored in the database to unauthorized persons. CSID employs policies,
procedures, and protection standards meeting or exceeding those in the
industry for securing Personal Identifiable Information (PII). CSID is
required to comply with standards around data, systems, process, and
personnel resources consistent with the same standards held for all
three credit bureaus. The contract provides that OPM may conduct onsite
inspections--see clause 15.31 1752.239-86 Contractor System Oversight/
Compliance (Sep 2014). CSID is subjected to regular vulnerability
scans, penetration tests, annual PCI audits, credit bureau audits, and
other security related exercises that allow CSID to meet these
compliance standards. OPM's contract with Winvale includes additional
clauses regarding the Privacy Act and other matters involving sensitive
information processing and storage. With any publicly announced data
breach there are attempts by bad actors to exploit the situation. OPM
has gone to extensive lengths via our Web site and guidelines issued to
agencies to provide tools for affected individuals to validate
communications. CSID, in communication with OPM, has added significant
numbers of trained staff to their call centers, and the average wait
time is now less than one minute.
Question. Earlier this year, an American healthcare company
suffered a massive breach that involved roughly 80 million records. In
that instance, the company decided to provide 24 months of credit
monitoring services. Why did OPM choose to offer 18 months of credit
monitoring services to impacted individuals? What is the total
estimated cost to provide both breach notification and credit
monitoring services to 4 million figure you provided as the number of
impacted individuals? What would be the cost to provide breach
notification and credit monitoring services to 18 million impacted
individuals, as has been the number suggested in media reports this
week?
Answer. A careful and thoughtful analysis of the risks presented by
the personnel records incident as well as a review of the services
available, precedent, and industry best practices led OPM to conclude
that 18 months is the appropriate duration for the comprehensive suite
of services offered to help Federal employees.
Question. During your testimony, you mentioned the development of
an OPM IT plan that was drafted within the first 100 days of your
tenure at the agency. Will you please share that plan? What elements of
the plan outlined OPM's timeline for securing sensitive personnel data?
Answer. A copy of the OPM Strategic IT Plan was sent to your
subcommittee. The Information Security section (page 17) details three
phases that ensure our information security policies are rigorous and
cost effective based on a risk assessment methodology that considers
both current and potential threats.
Question. One of the witnesses at last Tuesday's hearing testified
that the most important thing OPM could do is secure sensitive
information immediately. How does OPM plan to develop this capability?
Does OPM plan to build its own security tools? To what extent has OPM
either requested proposals for commercially available security software
or tools?
Answer. OPM continues to take aggressive action to strengthen its
broader cyber defenses and IT systems. As outlined in its recent
Cybersecurity Action Report, in June, OPM identified 15 new steps to
improve security, work with outside experts, modernize its system, and
ensure accountability. OPM is currently completing a comprehensive
review of its IT systems to find and address any potential
vulnerabilities. It is bringing in experts from in and outside of the
Government to help with these efforts, including a new cybersecurity
advisor. OPM is also working with interagency partners on a review of
key questions related to information technology governance, policy,
security, and other aspects of the security clearance process,
including where such data should be housed in the future.
information technology governance
Question. Describe the role of your agency's Chief Information
Officer (CIO) in the development and oversight of the IT budget for
your agency. How is the CIO involved in the decision to make an IT
investment, determine its scope, oversee its contract, and oversee
continued operation and maintenance? How often do you meet with your
CIO and other top IT security professionals within your agency? Please
provide a detailed summary of meetings you have had with your CIO and
her team since you entered the agency in November 2013.
Answer. The CIO is involved in every aspect the IT budget
development process at OPM. The OPM CIO is responsible for all major IT
investments from scoping to oversight of the delivery of services on a
contract. The CIO discusses these decisions through standing weekly,
and sometimes daily, meetings with the OPM Director.
Question. What formal or informal mechanisms exist in your agency
to ensure coordination and alignment within the CXO community (i.e.,
the Chief Information Officer, the Chief Acquisition Officer, the Chief
Finance Officer, the Chief Human Capital Officer, and so on)?
Answer. The Chief Operating Officer serves as a leader in OPM to
focus the efforts of the CXO positions. Each of these interests is
represented in OPM's strategic plan as a supporting function to the
primary business missions of OPM. The OPM strategic plan addresses the
priorities of the agency and ensures alignment of resources toward the
stated goals. The COO hosts a weekly staff meeting so CXO executives
can share ideas, work through challenges, and determine the best way
forward for OPM.
Question. According to the statistics from your office, 46 percent
of the more than 80,000 Federal IT workers are 50 years of age or older
and more than 10 percent are 60 or older. Just 4 percent of the Federal
IT workforce is under 30 years of age. Does the makeup of your agency
reflect such demographic imbalances? How is OPM addressing this talent
issue?
Answer. Our objective, given the current fiscal environment, is to
raise and leverage awareness of the Federal cybersecurity workforce
across Government. This includes ensuring that the public knows these
positions are available and how to apply for them.
--This awareness is being done primarily by working with technology
departments at colleges and universities to educate students
and staff about the Pathways Program and the hiring
flexibilities available to agencies to recruit and onboard STEM
graduates.
--The Presidential Management Fellowship (PMF) program and the new
PMF-STEM portfolio attract applicants with cybersecurity skills
in disciplines such as computer science, computer engineering
and computational analytics.
--Our outreach guidance provides Federal agencies with up-to date
information on how to message their opportunities, encourages
them to work within their communities to strengthen the local
talent pipeline in their communities, and provides workforce
planning tools that enable them to plan for and get the
workforce they need.
OPM also has the leadership role for the Administration's
Initiative to Close Cybersecurity Skill Gaps.
--This collaborative governmentwide strategy involves partnering with
the Office of Management and Budget and the Office of Science
and Technology in the Executive Office of the President as well
as interagency councils and the Federal agencies.
--Currently, we are mapping the existing Federal cybersecurity
workforce using OPM's new Cybersecurity Data Element Standard
that recognizes the value of the NICE Framework.
--Our goal is that this new dataset in fiscal year 2015 and beyond
will be a driving force that aids Federal agencies in getting
the workforce they need.
--The re-categorizing of Federal positions with cybersecurity work
will tell us what skills are in demand and what skills need to
be refreshed or developed.
--Our job announcements will be designed to get the candidate quality
desired by our hiring managers.
--Our training and development opportunities will be better designed
to attract and retain the workforce we need.
Question. One theme you mentioned in your testimony was related to
OPM's legacy IT system. How much of the OPM budget goes to
Demonstration, Modernization, and Enhancement of IT systems as opposed
to supporting existing and ongoing programs and infrastructure? How has
this changed in the last 5 years?
Answer. OPM's annual IT Spend from fiscal year 2012 to fiscal year
2016 for Development, Modernization and Maintenance (DME) and
Operations and Maintenance (O&M) as reported to OMB is outlined below.
--Fiscal Year 2012: DME: $63,724,442; O&M: $201,539,995;
Total: $265,264,437;
--Fiscal Year 2013: DME: $97,273,199; O&M: $211,815,787;
Total: $309,088,986;
--Fiscal Year 2014: DME: $69,299,462; O&M: $281,880,002;
Total: $351,179,464;
--Fiscal Year 2015: DME: $110,724,682; O&M: $257,968,435;
Total: $368,693,117;
--Fiscal Year 2016: DME: $61,670,770; O&M: $310,075,505;
Total: $371,746,275
Question. What are the 10 highest priority IT investment projects
that are under development in your agency? Of these, which ones are
being developed using an ``agile'' or incremental approach, such as
delivering working functionality in smaller increments and completing
initial deployment to end-users in short, 6-month timeframes? Please
describe how the OPM IT plan developed in your first 100 days at the
agency reflects this encouraged development method.
Answer. The table below shows the high priority IT projects that
are currently under development at OPM. The IT Strategic Plan has
served as a catalyst for the Investment Teams to make the transition to
Agile and/or incremental development a top priority. Ultimately, moving
development from a waterfall to agile methodology allows for more
efficient and effective project management and is paramount to the
long-term success of projects at OPM.
------------------------------------------------------------------------
Using Agile
# Project Investment Development?
------------------------------------------------------------------------
1 USAJOBS............. USAJOBS............ Yes
2 Enterprise Case ECMS............... Yes, it is a
Management System contract
(ECMS). requirement for
the implementation
of the software
which is currently
in the acquisition
stage.
3 Shell--Infrastructur Enterprise Yes, the migration
e Improvement Infrastructure of existing
Project. Operations (EIO). applications to
Shell will be done
using an agile
methodology.
4 Legacy Migration.... EPIC Transformation No. Project is on
hold.
5 Electronic Official eOPF............... Yes
Personnel Folder
(eOPF).
6 EHRI Data Warehouse. EHRI Data Warehouse Yes
7 Retirement Data eOPF............... Yes
Repository.
8 New USA Staffing.... USA Staffing System Yes
9 Legacy USA Staffing USA Staffing System Yes
to include core USA
Staffing,
Application
Manager, On
Boarding Manager
and Selection
Manager.
10 USA Performance..... USA Performance.... Yes
------------------------------------------------------------------------
Question. To ensure that steady State investments continue to meet
agency needs, OMB has a longstanding policy for agencies to annually
review, evaluate, and report on their legacy IT infrastructure through
Operational Assessments. What Operational Assessments have you
conducted and what were the results?
Answer. As per OMB's requirement, the major investments listed
below are in the O&M stage and have conducted an Operational Analysis
(OA) or Post-Implementation Review (PIR). All of the OAs and PIRs touch
on number issues and are many pages long (10+). Hence forth, it is
difficult to summarize in a few sentences as to whether all aspects of
the investment are performing well.
--USAJOBS
--USA Staffing System
--Enterprise Infrastructure Operations (EIO)
--EHRI electronic Official Personnel Folder (eOPF)
--EHRI Data Warehouse
--Consolidated Business Information System (CBIS)
Question. What are the 10 oldest IT systems or infrastructures
maintained by the Office of Personnel management? How old are they?
Would it be cost-effective to replace them with newer IT investments?
Answer. The applications that are the oldest are in OPM's
Retirement Services and Federal Investigative Services. Retirement
Services has more than 60 applications dating back to the mid-1980's.
OPM's modernization plan is replacing these applications with newer IT.
Our goal is to move into a more modern infrastructure environment and
to move off of the main frame.
Question. How does OPM's IT governance process allow for your
agency to terminate or ``off ramp'' IT investments that are critically
over budget, over schedule, or failing to meet performance goals?
Similarly, how does your agency's IT governance process allow for your
department/agency to replace or ``on-ramp'' new solutions after
terminating a failing IT investment?
Answer. OPM established an Investment Review Board (IRB) as the
authoritative body to review and recommend investment priorities to the
OPM Director for IT spending. The current IRB charter States that one
of the IRB functions is to: ``Monitor ongoing information technology
investments against their projected costs, schedules, and benefits, and
take action to recommend continuation, modification, or termination.''
The IRB is comprised of senior management of all OPM offices which meet
on a quarterly or as-needed basis to receive IT Investment assessment
briefings. If a new solution or replacement is required, the IRB would
receive a Business Case from the IT Investment. The IRB would review
and provide disapproval or approval of the Business Case.
Question. What IT projects has your agency decommissioned in the
last year? What are your agency's plans to decommission legacy IT
projects this year?
Answer. OPM has not decommissioned any IT projects in the last
year. However, OPM has initiated multiple IT projects to replace
numerous legacy IT projects. These include the Shell project which will
incorporate numerous technology upgrades to the OPM IT infrastructure;
and the Enterprise Case Management System (ECMS) project which will
replace legacy case management systems.
Question. The newly-enacted Federal Information Technology and
Acquisition Reform Act of 2014 (FITARA, Public Law 113-291) directs
CIOs to conduct annual reviews of their department's IT portfolio.
While OPM is not subject to FITARA, does OPM conduct these types of IT
portfolio reviews? If so, please describe your agency's efforts to
identify and reduce wasteful, low-value or duplicative information
technology (IT) investments as part of these portfolio reviews.
Answer. OPM is subject to FITARA and agrees with its efforts to
centralize the oversight process for IT investments. The required
elements of FITARA will position OPM to address previous issued IG
findings and recommendations. OPM believes this shift will greatly
strengthen its efforts to ensure effective and efficient spending on IT
investments.
Through improved governance and oversight of IT investments and
initiative development, OPM is reducing the redundancy of systems and
capabilities across the enterprise. For example, an enterprise case
management system has been put into place, which will remove
duplication and assist in fulfilling mission critical needs for FIS and
Retirement Services.
Question. In 2011, the Office of Management and Budget (OMB) issued
a ``Cloud First'' policy that required agency Chief Information
Officers to implement a cloud-based service whenever there was a
secure, reliable, and cost-effective option. How many of the agency's
IT investments are cloud-based services (Infrastructure as a Service,
Platform as a Service, Software as a Service, etc.)? What percentage of
the agency's overall IT investments are cloud-based services? How has
this changed since 2011?
Answer. OPM's new infrastructure is essentially a cloud based
service. It will be infrastructure as a service to our program offices,
including software, storage, and security as a service. We are moving
to a total cloud based methodology. As OPM in its modernization plan is
collapsing the five data centers that it currently operates into two
commercial data centers, we are building our cloud service as a high
security center.
Question. Provide short summaries of three recent IT program
successes--projects that were delivered on time, within budget, and
delivered the promised functionality and benefits to the end user. How
does your agency define ``success'' in IT program management? What
``best practices'' have emerged and been adopted from these recent IT
program successes? What have proven to be the most significant barriers
encountered to more common or frequent IT program successes?
Answer. USAJOBS utilizes modern user-centered design practices,
agile software development, data analytics, and DevOps to deliver high-
value features and enhancements every 9-12 weeks. Leveraging human-
centered design methodology, USAJOBS engages users early and often in
the design process to ensure that features are designed and developed
to provide the best possible user experience. USAJOBS employs Agile
software development practices to rapidly adjust to changing customer
priorities, allowing the program office to always be working on the top
user priority and deliver completed software features after every three
week sprint.
USAJOBS creates a measurement plan for all new features, defining
measurable goals that can be captured in real-time. Gone are
spreadsheets, static PowerPoints, and manual performance monitoring--
USAJOBS monitors all key performance indicators via a real-time
analytics dashboard that is populated by our data warehouse. Since 2013
USAJOBS has taken methodical steps to increase the efficiency of our
development pipeline by employing DevOps best practices. Practices like
continuous integration, automated testing, and automated security
scanning have decreased the technical overhead surrounding software
deployments and increased our security posture. These best practices
have increased customer satisfaction, changed user behaviors and
reduced support costs while gaining efficiencies in delivering value to
the customer. The following three IT programs are examples of how OPM
has successfully applied IT best practices to deliver systems that
reflect Federal agencies business needs and priorities:
--USA Staffing is OPM's Talent Acquisition System for Federal
agencies. Created by OPM and informed by the experience of more
than 50 agencies, USA Staffing helps agencies acquire, assess,
certify, select, and onboard qualified candidates in alignment
with Merit System Principles and Veterans Preference. USA
Staffing is tightly integrated with USAJOBS and compliant with
Federal hiring regulations and Federal Information Technology
(IT) requirements. Through Agile IT, USA Staffing and USAJOBS
share technical solutions, such as user authentication and
document upload processes, and collaborate to carry out joint
research on governmentwide priorities, including encryption
solutions.
--OPM's HR Solutions (HRS) and Chief Information Officer (CIO)
completed a multi-year project (launched in September 2012) to
upgrade USA Staffing. OPM initiated the Upgrade to: (1) ensure
modern technologies are in place to support capacity demands;
(2) improve speed to mission by enabling USA Staffing to be
more responsive to customer requirements and OPM initiatives;
and (3) expand data analytics that can be used by management to
improve the hiring process. Of note, USA Staffing accounted for
78 percent of Federal job postings on USAJOBS in fiscal year
2014.
Barriers to success include the lengthy hiring process which often
delays necessary hires, and the Federal contracting process
which inhibits the Agile System Development Life Cycle.
--USA Performance (USAP) was developed in direct response to the
overwhelming need across Government for an automated
performance management tool. USAP addresses a critical gap in
available technology to appropriately automate this fundamental
human resources function in all Federal agencies. USAP uses the
latest IT development principles (Agile) and technology to
build a cost-effective and desirable system. These principles
include focusing on the most valuable functionality with
constant stakeholder input and engaging in frequent planning to
ensure successful software delivery. USAP operates in 4 week
sprints to develop and test new functionality. As such, the
system (initially released in July 2014) was developed on
schedule (less than 16 months) and under budget estimates.
Since the initial release, USAP has had six subsequent releases
to enhance functionality. In the first 6 months of planning,
USAP convened key representatives from 10 Federal agencies to
capture requirements for designing USAP and gain better
understanding of their business needs. USAP also facilitates
frequent usability testing with potential end users from a
variety of agencies on system features as the features are
being developed. This results in faster approval, increased
satisfaction, and easier adoption by pilot agencies. Through
continuous stakeholder involvement, the development team and
the programmers can focus on developing the highest value
functions in the tool. OPM continues to facilitate monthly
advisory board meetings for agencies to provide input and
feedback on USAP enhancements and other changes now that
agencies are using the tool. USAP is an evolving, growing
system. As a result of these development principles, USAP
anticipates continued program success. USAP has been
acknowledged outside of OPM for its innovation and efforts to
revolutionize performance management. In 2014, USAP won the
Nextgov Bold Award, the People's Choice Award, and received
third place from HCMG for ``Best Implementation of an
Enterprise Technology System.''
______
Questions Submitted by Senator Christopher A. Coons
Question. Do you know exactly what your requirements are for the IT
modernization project so that the contractor is not in the driver's
seat to determine your requirements for you (which has led other
agencies' IT projects to their downfall)?
Answer. Yes. OPM's Federal employees created the requirements for
Shell and the phased approach that would be used to implement the plan
before hiring contractor assistance with execution of the plan.
Question. Have you reviewed other agencies' successful IT projects
to use as a model?
Answer. Yes. OPM consulted with other Federal agencies to hear of
lessons learned and leading practices prior to full development of
requirements, scope and budget.
Question. GAO has recommended that for IT projects to be
successful, they should be broken down into smaller segments, which
allows for better oversight of the project, increasing odds of avoiding
schedule delays and cost overruns. Do you feel that this project is
designed in that manner or are there improvements that can be made in
that regard?
Answer. Yes. OPM's IT Modernization Plan was broken down into 4
phases to better manage requirements, budgets and execution. The four
phases are:
--Phase 1--Tactical: Deployment of expanded security tools to
strengthen existing OPM network.
--Phase 2--Shell: Design and deploy new data center infrastructure.
--Phase 3--Migration: Re-architect OPM applications to make best use
of Shell and current technologies and to find efficiencies
across applications through reuse.
--Phase 4--Decommission: Remove hardware from existing network as
applications move to Shell.
Question. Has the Chief Information Officer had experience handling
projects of this dimension?
Answer. Yes. Mrs. Seymour served as the Executive Director,
Enterprise Human Resource Information Systems where she was responsible
for providing Department of Defense wide information technology
solutions to meet the needs of 35,000 HR specialists, DOD civilian
employees, and military and civilian managers and leaders. She began
her Federal career in 1978 and has concentrated primarily in the area
of information technology, especially its ability to transform the
workforce and business of the Federal Government, acquisition,
financial management, and human resources management.
Question. Do you expect this project to be on OMB's IT Dashboard?
Answer. Yes, the 10 highest priority projects currently are or are
expected to be on OMB's IT Dashboard.
CONCLUSION OF HEARINGS
Senator Boozman. With that, the subcommittee hearing is
adjourned.
[Whereupon, at 12:44 p.m., Tuesday, June 23, the hearings
were concluded, and the subcommittee was recessed, to reconvene
subject to the call of the Chair.]