    [House Hearing, 115 Congress]
    [From the U.S. Government Publishing Office]

                       STATE OF PLAY: FEDERAL IT IN 2018

    =======================================================================

                                 JOINT HEARING

                                   BEFORE THE

                                SUBCOMMITTEE ON
                             INFORMATION TECHNOLOGY

                                    AND THE

                                SUBCOMMITTEE ON
                             GOVERNMENT OPERATIONS

                                     OF THE

                             COMMITTEE ON OVERSIGHT
                             AND GOVERNMENT REFORM
                            HOUSE OF REPRESENTATIVES

                         ONE HUNDRED FIFTEENTH CONGRESS

                                 SECOND SESSION

                                   __________

                                 MARCH 14, 2018

                                   __________

                               Serial No. 115-75

                                   __________

    Printed for the use of the Committee on Oversight and Government Reform

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

             Available via the World Wide Web: http://www.fdsys.gov
                           http://oversight.house.gov
                                       ______

                         U.S. GOVERNMENT PUBLISHING OFFICE

    31-105 PDF                WASHINGTON : 2018

                  Committee on Oversight and Government Reform

                      Trey Gowdy, South Carolina, Chairman
    John J. Duncan, Jr., Tennessee       Elijah E. Cummings, Maryland,
    Darrell E. Issa, California              Ranking Minority Member
    Jim Jordan, Ohio                     Carolyn B. Maloney, New York
    Mark Sanford, South Carolina         Eleanor Holmes Norton, District of
    Justin Amash, Michigan                   Columbia
    Paul A. Gosar, Arizona               Wm. Lacy Clay, Missouri
    Scott DesJarlais, Tennessee          Stephen F. Lynch, Massachusetts
    Blake Farenthold, Texas              Jim Cooper, Tennessee
    Virginia Foxx, North Carolina        Gerald E. Connolly, Virginia
    Thomas Massie, Kentucky              Robin L. Kelly, Illinois
    Mark Meadows, North Carolina         Brenda L. Lawrence, Michigan
    Ron DeSantis, Florida                Bonnie Watson Coleman, New Jersey
    Dennis A. Ross, Florida              Raja Krishnamoorthi, Illinois
    Mark Walker, North Carolina          Jamie Raskin, Maryland
    Rod Blum, Iowa                       Jimmy Gomez, Maryland
    Jody B. Hice, Georgia                Peter Welch, Vermont
    Steve Russell, Oklahoma              Matt Cartwright, Pennsylvania
    Glenn Grothman, Wisconsin            Mark DeSaulnier, California
    Will Hurd, Texas                     Stacey E. Plaskett, Virgin Islands
    Gary J. Palmer, Alabama              John P. Sarbanes, Maryland
    James Comer, Kentucky
    Paul Mitchell, Michigan
    Greg Gianforte, Montana

                         Sheria Clarke, Staff Director
                        William McKenna, General Counsel
                             Meghan Green, Counsel
         Troy Stock, Information Technology Subcommittee Staff Director
         Julie Dunne, Government Operations Subcommittee Staff Director
                        Sharon Casey, Deputy Chief Clerk
                     David Rapallo, Minority Staff Director
                     Subcommittee on Information Technology

                           Will Hurd, Texas, Chairman
    Paul Mitchell, Michigan, Vice Chair  Robin L. Kelly, Illinois, Ranking
    Darrell E. Issa, California              Minority Member
    Justin Amash, Michigan               Jamie Raskin, Maryland
    Steve Russell, Oklahoma              Stephen F. Lynch, Massachusetts
    Blake Farenthold, Texas              Gerald E. Connolly, Virginia
    Greg Gianforte, Montana              Raja Krishnamoorthi, Illinois
                                     ------

                     Subcommittee on Government Operations

                     Mark Meadows, North Carolina, Chairman
    Jody B. Hice, Georgia, Vice Chair    Gerald E. Connolly, Virginia,
    Jim Jordan, Ohio                         Ranking Minority Member
    Mark Sanford, South Carolina         Carolyn B. Maloney, New York
    Thomas Massie, Kentucky              Eleanor Holmes Norton, District of
    Ron DeSantis, Florida                    Columbia
    Dennis A. Ross, Florida              Wm. Lacy Clay, Missouri
    Rod Blum, Iowa                       Brenda L. Lawrence, Michigan
                                         Bonnie Watson Coleman, New Jersey
                                C O N T E N T S

                                  ----------
                                                                       Page
    Hearing held on March 14, 2018...................................     1

                                   WITNESSES

    Mr. David Powner, Director of IT Management Issues, U.S.
      Government Accountability Office
        Oral Statement...............................................     3
        Written Statement............................................     6
    The Honorable Margaret Weichert, Deputy Director for Management,
      Office of Management and Budget
        Oral Statement...............................................    47
        Written Statement............................................    49
    Mr. Bill Zielinski, Deputy Assistant Commissioner of the IT
      Category, U.S. General Services Administration
        Oral Statement...............................................    59
        Written Statement............................................    61
    The Honorable Jeanette Manfra, Assistant Secretary for the Office
      of Cybersecurity and Communications, U.S. Department of
      Homeland Security
        Oral Statement...............................................    66
        Written Statement............................................    68

                                    APPENDIX

    Response from Ms. Weichert, OMB, to Questions for the Record.....    92
    Response from Mr. Zielinski, GSA, to Questions for the Record....    94

                       STATE OF PLAY: FEDERAL IT IN 2018

                                  ----------

                           Wednesday, March 14, 2018

                      House of Representatives,
    Subcommittee on Information Technology, joint with
             the Subcommittee on Government Operations,
                  Committee on Oversight and Government Reform,
                                                       Washington, D.C.
        The subcommittees met, pursuant to call, at 3:16 p.m., in
    Room 2154, Rayburn House Office Building, Hon. Will Hurd
    [chairman of the Subcommittee on Information Technology]
    presiding.
        Present from the Subcommittee on Information Technology:
    Representatives Hurd, Gianforte, Kelly, and Krishnamoorthi.
        Present from the Subcommittee on Government Operations:
    Representatives Hice, Blum, Connolly, and Maloney.
        Mr. Hurd. The Subcommittee on Information Technology and
    the Subcommittee on Government Operations will come to order.
        And, without objection, the presiding member is authorized
    to declare a recess at any time.
        Good afternoon. Sorry for the wait, but it is Washington,
    D.C. And the House of Congress is the people's House, but
    sometimes we get a little delayed.
        We have had momentum over the last couple years. I think
    this year, or this Congress, with the Federal IT modernization
    effort through the passage of the MGT Act, the Modernizing
    Government Technology Act, we have gained strength and force.
    This, now a law, is bipartisan legislation that will, for the
    first time, reward and incentivize Federal agencies and CIOs to
    cut costs and invest in cutting-edge technology.
        The effort, also, of modernization has gained momentum from
    Trump administration initiatives like establishing the Office
    of American Innovation, releasing an IT modernization report,
    and retaining good ideas from the previous administration,
    including the U.S. Digital Service.
        I am concerned, however, that in some areas we have lost
    momentum. We went too long without a Federal CIO. I am glad Ms.
    Kent is now in the position and look forward to having her up
    here before the committee within the next few months.
        I am also pleased that Ms. Weichert is in place as the
    Deputy Director for Management at OMB.
        I have spoken to my former colleague, Director Mulvaney,
    about our efforts here in the subcommittee and how we can work
    together to modernize government. He is an enthusiastic
    supporter of using emerging technologies to make government
    more efficient and accountable.
        We need to rethink how we structure the Federal workforce,
    to ensure the Federal Government has access to smart, well-
    trained IT and cybersecurity professionals, and be working in a
    bipartisan fashion, as always, in introducing a bill in the
    coming months to establish the U.S. cyber reserves, a public/
    private-sector rotational workforce. I look forward to the
    witnesses' thoughts on how to best organize and structure this
    kind of workforce.
        I also continue to have concerns about longstanding GAO
    recommendations that remain unaddressed, oftentimes year after
    year after year. These open, lingering vulnerabilities put us
    at incredible risk, as we saw with the devastating data breach
    at OPM, which it is crazy to think was almost 3 years ago.
        I want to hear from GAO their most critical open
    recommendations and, from the rest of the witnesses, concrete
    plans to close them. Let's use this hearing to ensure IT
    modernization across the Federal Government continues, even
    with more force and strength, in 2018. Let's not lose the
    momentum.
        And, as always, it is an honor to be exploring these very
    important issues in a bipartisan fashion with my friend, the
    ranking member, the one and only, the Honorable Robin Kelly
    from Illinois.
        Ms. Kelly. Thank you, Mr. Chairman. Thank you for calling
    today's hearing on the Federal Government's information
    technology.
        These two subcommittees have prioritized holding agencies
    accountable for their compliance with the Federal Information
    Technology Acquisition Reform Act in the effort to modernize
    our legacy IT systems. We have managed to work in a bipartisan
    manner not only to conduct oversight but to introduce
    legislation seeking to address the Nation's IT and
    cybersecurity problems.
        Improving the efficiency and security of the Federal
    Government's IT system is essential to our Nation's security.
    In order to improve the efficiency and security, we must
    modernize legacy IT systems across every Federal agency.
        The Federal Government spends nearly $60 billion just to
    sustain its existing outdated IT. When agencies must spend 75
    percent of their IT budgets merely to maintain legacy systems,
    they predictably fall behind in the effort to modernize.
        That is why the Modernizing Government Technology Act of
    2017 is critical to shoring up our Nation's cybersecurity and
    moving us forward. MGT is now law. It creates a working capital
    fund called the Technology Modernization Fund that will have
    money for efforts like cloud migration for agency CIOs to think
    creatively about modernization.
        The next couple of months will determine whether the MGT
    Act is allowed to spur that type of innovation. I was pleased
    to see that the President's proposal budget called for $228
    million for the modernization fund. OMB Director Mulvaney
    recently released a memo to agencies with guidance on MGT's
    implementation.
        The board overseeing the modernization fund is in place. It
    is now up to Congress to fund this important effort. Our
    government technology is too outdated to allow this opportunity
    to pass us by.
        By allocating these funds, we further our goals under
    FITARA to fully empower agency CIOs. I view the MGT Act as a
    natural complement of FITARA. We cannot speak about important
    efforts, like moving to the cloud and data center
    consolidations, without providing the funding necessary to make
    that happen.
        In addition to modernizing our technology, we must
    modernize our Federal workforce to make sure they have the
    tools and skills necessary to address the problems of not only
    today but tomorrow.
        In 2016, GAO found that the evolving array of cyber-based
    threats continue to pose a risk to our national security. The
    government's inability to attract and retain qualified cyber
    professionals throughout the government threatens our ability
    to address these cyber threats. Therefore, attracting IT and
    cybersecurity talent is critical to the safety of every
    American and the security of our country.
        I hope that our witnesses can update us on the state of the
    Federal IT and how each agency plans to address the
    opportunities and challenges facing the Federal Government.
        Thank you, Mr. Chairman.
        Mr. Hurd. Thank you, Ranking Member Kelly.
        And when the ranking member and chair of Government
    Operations get here, we will allow them to have opening
    remarks, if they do. But now it is a pleasure to introduce our
    witnesses.
        Mr. David Powner, probably our most visits to this
    committee of anybody in government. Thanks for being here. And
    he is the Director of IT Management Issues at GAO.
        The Honorable Margaret Weichert, Deputy Director for
    Management at the Office of Management and Budget. Thank you
    for being here.
        Mr. Bill Zielinski, Deputy Assistant Commissioner of the IT
    Category at the General Services Administration.
        And last but not least, the Honorable Jeanette Manfra,
    Assistant Secretary for the Office of Cybersecurity and
    Communications at the Department of Homeland Security.
        Welcome to you all. And pursuant to committee rules, all
    witnesses will be sworn in before you testify, so please stand
    and raise your right hand.
        Do you solemnly swear or affirm the testimony you are about
    to give is the truth, the whole truth, and nothing but the
    truth, so help you God?
        Thank you.
        Please let the record reflect that the witnesses answered
    in the affirmative.
        In order to allow time for discussion, please limit your
    opening remarks to 4 minutes. Your entire written statement
    will be part of the record.
        And as a reminder, the clock in front of you shows the
    remaining time during your opening statement. The light will
    turn yellow when you have 30 seconds left and red when your
    time is up. Please also remember to press the button for the
    speaker.
        So, with that, Mr. Powner, welcome back.

                           WITNESS STATEMENTS

                       STATEMENT OF DAVID POWNER

        Mr. Powner. Chairman Hurd, Ranking Member Kelly, and
    members of the subcommittee, I would like to commend your
    subcommittee for your consistent and thorough oversight of IT
    and cybersecurity issues, in particular with FITARA and with
    recently moving the FITARA Enhancement Act and MGT.
        This afternoon, I will highlight top priorities for OMB and
    agencies. My comments will address three broad areas: human
    capital, acquisitions, and operations.
        CIO authorities still need to be strengthened, despite
    significant improvements from FITARA. Your push to elevate
    these positions at departments and agencies is still needed.
    Currently, 13 of the 24 CIOs report to the DEPSEC or higher.
    OMB plays a critical role here, especially with the recent
    focus on agency reorganizations.
        Also, cybersecurity and IT workforce needs to be further
    strengthened. Specifically, we still need to properly identify
    and tackle our workforce gaps. Properly addressing many of
    these needs with contractors is a critical part of the solution
    here. GAO has ongoing government-wide reviews looking at both
    the cybersecurity and IT workforce needs.
        Turning to improvements on major acquisitions, we still
    need to stay the course with major provisions in FITARA. This
    starts with incremental development. Your scorecard shows major
    progress in this area, but we still have too many projects not
    tackling this in manageable segments.
        We also need to have IT shops aware of IT contracts so that
    we can avoid duplication and to ensure the right governance
    over these acquisitions. A recent contracting review was
    discouraging, as only one-third of the agencies had a process
    to approve IT contracts consistent with FITARA and OMB
    guidance.
        And of our sample of almost 100 contracts, only 10 percent
    were approved by CIOs or their designee. Strengthening the
    relationship between CIOs and chief acquisition officers is
    needed.
        We also believe the Nation's top Federal IT acquisitions
    should have OMB governance over them in addition to agency
    governance. The top acquisitions should include VA and DOD's
    EHR acquisitions, IRS's K-2 project, SSA's disability case
    processing system, and FAA's NextGen acquisitions.
        The reason these acquisitions need OMB's attention is
    because these agencies, left alone, haven't managed them well.
    The administration's attention to VA's EHR solution is spot-on;
    we just need more of this. We have a review underway where we
    are identifying and profiling these most critical acquisitions.
        Regarding operational systems, again, we need to stay the
    course with FITARA. Data center optimization metrics provide
    great transparency on where agencies are at with their
    optimization metrics. And extending the sunset date from 2018
    to 2020 will give agencies more time to both optimize and save.
        A couple key points here: Savings still can be significant
    as we optimize space and equipment. And the MGT working capital
    funds can be used to invest in unfunded priorities.
        Also, these agencies who can't optimize by 2020 need to get
    out of the data center business. We plan to report annually
    through 2020 on agencies' data center progress.
        We also believe that the Nation's most mission-critical
    legacy systems that are costly to maintain and pose significant
    cyber risk due to unsupported software need to be replaced with
    modern, secure technologies and ultimately decommissioned.
        OMB needs to have an active role here to ensure that these
    old systems, like VA's VistA system and IRS's Individual Master
    File, have plans to replace and decommission.
        The administration's recent modernization strategy was
    solid on network modernization, shared services, and cyber but
    light on tackling these most challenging modernization efforts.
    CIOs with average tenures of 2 years don't always focus on
    these longer-term, challenging legacy systems, which is even
    more reason for OMB to drive this. We have a review underway
    where we are identifying and profiling these legacy systems
    most in need of modernization.
        In conclusion, the American Tech Council, the Office of
    Innovation, and the modernization strategy are all positive
    developments. Now we need more action and implementation from
    OMB and agencies.
        Key focus areas should be on fixing CIO authorities in the
    IT workforce; regarding acquisitions: incremental development,
    CIO alignment with acquisitions, and the focus on our Nation's
    top acquisitions is needed. On the operations side, data center
    optimization and mission-critical legacy modernization need
    continued attention.
        Finally, the Comptroller General held a forum with prior
    Federal and agency CIOs from previous administrations in late
    2016 to explore what has worked over the years in Federal IT.
    The results of this forum, summarized on page 10 of my written
    statement, are consistent with the comments here this afternoon
    and highlight the critical role OMB leadership plays.
        Mr. Chairman, again, thank you for your oversight of
    Federal IT.
        [Prepared statement of Mr. Powner follows:]

        [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thanks for being an important partner on this.
        And I misspoke. I apologize. Everybody has 5 minutes.
        So, Ms. Weichert, you are now up for your 5 minutes.

              STATEMENT OF THE HONORABLE MARGARET WEICHERT

        Ms. Weichert. Thank you very much. It's great to be here on
    Pi Day to talk about this important subject.
        So, Chairman Hurd, Ranking Member Kelly, and members of the
    subcommittees, thank you for the opportunity to appear before
    you today to discuss the state of Federal information
    technology in 2018.
        In December, in testifying before the Senate Committee on
    Homeland Security and Governmental Affairs, I discussed the
    range of disciplines that the Deputy Director for Management is
    charged with overseeing, including IT, information security,
    human capital management, finance, accounting, performance
    management, and procurement.
        Today, as the newly sworn-in Deputy Director for
    Management, I'm working with our agency partners to drive
    necessary improvement in those disciplines. And I'm excited to
    talk about one of those areas, IT modernization, in depth.
        Improving our technology infrastructure is fundamental to
    aligning the executive branch to the mission, service, and
    stewardship needs of the 21st century. To that end, next week,
    we will release the President's Management Agenda, the PMA, an
    agenda which places IT modernization at its core.
        The PMA sets out a long-term vision for more effective
    government that better achieves missions and enhances the key
    services upon which the American people depend. IT
    modernization must provide the essential backbone of the
    government service delivery while keeping sensitive data and
    systems secure. And the President's Management Agenda also
    links to related critical issues associated with data
    accountability and transparency as well as the people and
    workforce for the 21st century.
        Since the establishment of the Office of E-Government and
    Information Technology in 2002, OMB has played a pivotal role
    in formulation of IT policy and strategic direction across the
    Federal Government. The Office of the Federal CIO, the Chief
    Information Security Office of the U.S., and the United States
    Digital Service are all in my organization. And, together,
    these groups leverage the convening authorities of OMB,
    including the CIO Council and the CISO Council, to coordinate
    executive-branch IT modernization activities.
        In addition, since 2014, U.S. Digital Service has been
    focused on improving and transforming the experience of
    Americans who interact with government online. This means that
    more citizens can easily and seamlessly access government
    services online due to more secure identity-proofing. It means
    veterans are receiving appeals responses in a more timely
    manner. It has enhanced Medicare claims processing, allowing
    citizens to access health data online. And USDS has also helped
    made it easier for small businesses to compete for government
    contracts and for acquisition officers to be better positioned
    to acquire commercial technology. Ultimately, all this work is
    part of a broader strategy to help rebuild Americans' trust in
    government.
        Today, I look forward to talking with you about a range of
    IT modernization initiatives, including the IT modernization
    report, the Modernizing Government Technology Act, Federal
    cybersecurity policy, agency IT transformation activities,
    including the work of U.S. Digital Service, and the IT
    workforce of the future, to name a few areas. More detailed
    background on many of these topics is included in my written
    testimony for the record.
        And, in closing, OMB looks forward to working with the
    Oversight and Government Reform Committee and with Congress
    broadly on IT modernization. Over the years, this oversight
    committee has been instrumental in driving Federal IT
    modernization through its role in developing legislation such
    as FITARA, the DATA Act, and the MGT Act. Through our
    collaborative efforts, I know we will be able to improve
    government services and cybersecurity.
        I thank the subcommittees for holding this hearing and for
    your commitment to IT modernization. I will be pleased to
    answer any questions you have.
        [Prepared statement of Ms. Weichert follows:]

     [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thank you.
        Mr. Zielinski, you are now recognized for 5 minutes.

                      STATEMENT OF BILL ZIELINSKI

        Mr. Zielinski. Great. Good afternoon, Chairman Hurd,
    Ranking Member Kelly, and members of the subcommittee. My name
    is Bill Zielinski, and I am the Deputy Assistant Commissioner
    for the Office of Information Technology Category in GSA's
    Federal Acquisition Service. In addition, I also serve as the
    Office of Management and Budget-appointed government-wide IT
    category manager.
        I am pleased to be here today to discuss the important role
    GSA plays in Federal information technology efforts government-
    wide.
        The IT Category at GSA enables agencies in the acquisition
    of $50 billion in goods and services annually from more than
    20,000 industry partners. ITC's top priority is to maximize
    customer value and mission productivity.
        And while GSA brings significant capabilities to the table
    in facilitating the modernization of the Federal Government's
    IT infrastructure and applications, it's through the strategic
    partnerships with other agencies and our industry partners
    where we will make the greatest progress.
        For instance, I work closely with OMB's Office of Federal
    Procurement Policy and administrator of the Office of
    Electronic Government to review the Federal IT spend, determine
    where opportunities exist to collaborate on the acquisition of
    IT products and services, and implement strategies to get more
    value from IT dollars.
        In that vein, I would now like to discuss four key ways in
    which GSA is supporting the modernization of the Federal
    Government's IT infrastructure and applications.
        First, in December, the American Technology Council issued
    its final report to the President on Federal IT modernization.
    The report is the culmination of a months-long process to
    develop a strategic plan that approves the security posture of
    Federal IT and incorporates feedback from industry and members
    of the public.
        The report has three key objectives that will inform future
    efforts: to reduce the Federal attack surface through enhanced
    application and data-level protections; to improve visibility
    beyond the network level; and to ensure that policy, resource
    allocation, acquisition, and operational approaches to security
    enable the use of new technology without sacrificing
    reliability or performance.
        GSA is directly tasked, in whole or in part, with half of
    the 50 action items recommended by the report and is actively
    working on these deliverables in accordance with report
    timelines.
        Second, the MGT Act is another critical tool for
    modernizing Federal IT. GSA thanks the members of these
    subcommittees for their dedication to getting this legislation
    passed.
        GSA is tasked with several key actions related to the MGT's
    Technology Modernization Fund. Chief among them is providing
    broad support for the Technology Modernization Board's
    activities, including technical support and the monitoring of
    agencies that receive funds from the TMF. Subject to
    appropriations, the GSA is prepared to help administer this
    critically important fund.
        Third, in partnership with the White House Office of
    American Innovation, GSA is working to establish five new
    centers of excellence. The COEs will house centralized
    function-specific talent, products, and acquisition vehicles.
    These teams will provide expert advice, development resources,
    and support solution implementation in the areas of cloud
    adoption, IT infrastructure optimization, customer experience,
    service delivery analytics, and contact centers. The first
    client agency for the COEs is the United States Department of
    Agriculture.
        Finally, GSA is helping agencies adopt new approaches for
    buying commercial off-the-shelf and as-a-service solutions. By
    leading in the development of modular contracting approaches to
    enable agile and efficient development of complex, new
    requirements, we are able to assist agencies through the entire
    lifecycle of procurement and system development.
        GSA's unique mix of talent and expertise in acquisition
    technology and service delivery, combined with our government-
    wide scope and scale, makes our agency an agent of
    transformation in how agencies will buy, build, and use
    technology.
        I want to thank you for the opportunity to appear before
    you today to discuss GSA's role, and I look forward to
    answering your questions.
        [Prepared statement of Mr. Zielinksi follows:]

     [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thank you.
        And, Ms. Manfra, you are now recognized for 5 minutes for
    your opening remarks.

               STATEMENT OF THE HONORABLE JEANETTE MANFRA

        Ms. Manfra. Thank you.
        Chairman Hurd, Ranking Member Kelly, members of the
    committee, thank you for today's opportunity to discuss the
    Department of Homeland Security's efforts to secure Federal
    networks.
        I would like to begin my testimony by thanking Congress for
    its work on the Cybersecurity and Infrastructure Security
    Agency Act of 2017. If enacted, this legislation will
    streamline the National Protection and Programs Directorate, or
    NPPD, and rename our organization to more clearly reflect our
    central role in government and private-sector critical
    infrastructure security. Much progress has been made, but we
    must stay focused until this work is complete. The Department
    strongly supports this effort and encourages swift action by
    Congress.
        Cyber threats remain one of the most significant strategic
    risks for the United States, threatening our national security,
    economic prosperity, and public health and safety. Over the
    past year, Federal network defenders saw the threat landscape
    grow more crowded, active, and dangerous. While in many cases
    our defenses have been successful in mitigating these threats,
    we must do more to ensure our cyber defenses keep pace of
    technological change and evolving risk.
        In my role at DHS, I head the Office of Cybersecurity and
    Communications. A core part of my role is protecting and
    managing the overall information security of Federal civilian
    networks. To do this, we must first gain visibility to
    understand the exposure that the Federal enterprise faces. Then
    we need to use our authorities to reduce this risk, whether
    that's through directives, guidance, or direct support to
    agencies. And, finally, we must build capacity within agencies
    to implement our guidance, act on threat information, and fully
    leverage the capabilities and services that DHS has to offer.
        Programs like the National Cybersecurity Protection System,
    or EINSTEIN, and the Continuous Diagnostics and Mitigation
    Program directly serve and enable these three lines of effort.
        Last year, the President signed an executive order on
    strengthening the cybersecurity of Federal networks and
    critical infrastructure, which set in motion a series of
    assessments and deliverables to improve our defenses and lower
    our risk to cyber threats.
        Across the Federal Government, agencies have been
    implementing the NIST Cybersecurity Framework. Agencies have
    been reporting to DHS and OMB on their cybersecurity risk
    mitigation and acceptance choices. DHS and OMB have evaluated
    the totality of these agencies' reports in order to
    comprehensively assess the Federal Government's cybersecurity
    risk management posture.
        The assessment found the Federal enterprise to be at risk.
    The choices we make to reduce this risk, in both cybersecurity
    budget and operational priorities, must be informed by a data-
    driven, risk-based assessment of Federal cybersecurity and the
    threat environment.
        As part of the executive order, my office has been working
    with OMB, GSA, and Federal agencies to modernize the Federal
    Government's IT infrastructure. We are exploring opportunities
    to consolidate network architectures, embrace shared IT
    services, all the while emphasizing cybersecurity as a
    foundational element to all new IT services.
        We recognize that legacy IT systems present considerable
    challenges in efforts to secure Federal networks. The risks
    posed by these antiquated, end-of-life systems has perhaps best
    been demonstrated by the difficulties agencies face in
    complying with DHS's binding operational directives which
    govern vulnerability patching. Some legacy systems can no
    longer be patched, others are not supported by vendors, and
    some experience significant performance issues if not
    reconfigured during the security upgrade process.
        While in most cases DHS and the agencies have been able to
    address these issues and either upgrade, transition, or
    mitigate the problem entirely, this complicates and adds cost
    to agency efforts to patch their own systems--an exercise that
    does need to be as painless as possible.
        While the use of more modern IT has efficiencies and
    convenience of its own, the benefits it brings to cybersecurity
    efforts are also significant.
        My organization works with departments and agencies to
    identify and prioritize high-value assets or those systems for
    which a cyber incident could cause significant impact to the
    United States. We conduct security architecture reviews to
    assess network architectures and configurations and conduct in-
    depth vulnerability assets, which determine how an adversary
    could compromise these systems, persist in their networks, and
    gain access to sensitive data.
        These assessments provide system owners with
    recommendations to address identified vulnerabilities and
    assist them in prioritizing their limited resources to fix the
    worst things first.
        In closing, I want to assure this committee that DHS is
    embracing our statutory responsibility to administer the
    implementation of Federal agency cybersecurity policies and
    practices by leading the effort to secure the Federal
    enterprise, in coordination with my partners on the panel,
    following a risk-based approach.
        This committee played a key role in championing the passage
    of FISMA 2014 and clarifying these important authorities for
    DHS, and we thank you for those.
        The overarching goal of Federal cybersecurity is to ensure
    that every agency maintains an adequate level of cybersecurity
    commensurate with its own risk and with those of the Federal
    enterprise.
        Thank you for the opportunity to testify, and I look
    forward to any questions you may have.
        [Prepared statement of Ms. Manfra follows:]

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        Mr. Hurd. Thank you.
        And now it's a pleasure to recognize the gentleman from
    Montana for 5 minutes.
        Mr. Gianforte. Thank you, Mr. Chairman.
        And thank you to the panel.
        Mr. Powner, it's good to see you again. It seems like
    you're here monthly. And I appreciate your help in moving
    forward the IT procurement.
        Mr. Zielinski, I would like to dive in a little bit into
    GSA's role in procurement, particularly as it relates to shared
    services. Could you talk a little bit about, to help the
    committee, what are shared services and what do you see as the
    benefits of mandating those for agencies where appropriate?
        Mr. Zielinski. So, in the broadest sense, shared services
    is an opportunity for us to, rather than having each agency
    independently build out a capability set, to be able to build
    those out in a centralized way.
        It could be that it is a government-operated, government-
    built shared service, or it could be that it is a commercially
    offered solution. In working with the Office of Management and
    Budget, as well as with our own Unified Shared Services
    Management office, we are working to develop a series of shared
    services along the lines of business.
        There's a lot of opportunities and benefits to this
    approach. First of all, there's significant cost savings.
    Secondly, as we talked about, the security posture, that
    ability for us to protect the shared service and be able to
    make changes to that individual or that one shared service and
    have all of the participants benefit across the government is
    significant.
        Mr. Gianforte. Okay. And what IT services are already being
    procured under a shared services model?
        Mr. Zielinski. Oh, sir, there are a number. What I would
    like to offer is to be able to bring the full list, but I'll
    give you some examples here today.
        Mr. Gianforte. Please.
        Mr. Zielinski. For one, we have a shared service offering
    that's in and around the implementation or the issuance of the
    PIV credentials, the HSPD-12 PIV credentials. That is operated
    out of GSA. There are 110 customer agencies with more than
    750,000 credentials under active management.
        That's an example of a very mature shared service that is
    utilized across government. There's shared infrastructure for
    agencies to be able to go to, common issuance sites. In
    addition, there are shared services for payroll, shared
    services for financial services. And we continue to build out
    other shared services.
        And, again, I will bring back a more complete list of what
    those shared service offerings are.
        Mr. Gianforte. Okay. So it sounds like shared services
    allow us to standardize procurement in such a way that various
    agencies don't have to roll their own, so to speak?
        Mr. Zielinski. Correct.
        Mr. Gianforte. Yeah.
        So there's cost savings. You mentioned earlier $50 billion
    of annual procurement. If shared services were fully
    implemented where appropriate, how big is the size of the prize
    in terms of savings?
        Mr. Zielinski. Yeah, I don't have an answer for that. You
    know, I think that as we are now going through the different
    lines of business and identifying those opportunities for
    shared services, we'll have a much better or more complete
    picture of what those savings opportunities are.
        Mr. Gianforte. In instances where you have used shared
    services, how much savings resulted?
        Mr. Zielinski. It differs based upon the service itself.
    And, again, what I can do is bring back some more explicit
    information for each of these shared services as to where that
    is.
        Mr. Gianforte. Okay.
        So cost savings are one benefit. What impact does it have
    on security when a service is shared versus implemented
    individually by the agencies?
        Mr. Zielinski. So I would like to start, and I would also
    like to ask my partner, Ms. Manfra, to also add in as well.
        One of the things that we're able to do is that, as each
    individual agency is building out a capability, that means that
    those individual agencies are also responsible for ensuring
    that they are patching and kind of doing the basic blocking and
    tackling that's necessary to secure the capability, and that if
    there is something that happens within the overall system that
    they have to respond to, that also means that they each
    individually would have to do that.
        In a shared services instantiation, we have where there is
    a central group who is managing that security posture of the
    shared service. And that means that, when there is something
    that occurs or there is a need for us to make a change or to
    address a vulnerability, we are able to do that once and it is
    addressed for all of the customers of that.
        Mr. Gianforte. And, again, I want to go back to my prior
    question. I realize you want to go collect more data, and I do
    want an accurate answer. But it seems like shared services
    presents an opportunity to standardize procurement, limit
    variability, increase security, and lower cost, all of which
    are good objectives.
        Where is shared services on your priority list as you're
    working with agencies on procurement?
        Mr. Zielinski. So I will say that, going back to the IT
    modernization report, this is one of the core principles within
    the President's IT modernization report, is for us to look for
    those opportunities to build out shared services to be able to
    both speed the modernization but also to increase the
    protection. So it is one of the core priorities in moving
    forward with modernization.
        Mr. Gianforte. And final question: Who should be managing
    these shared services within the government?
        Mr. Zielinski. The plan, as it stands today, is to look for
    managing partners based upon the capability areas. So,
    dependent upon what the business function or area is, that
    there is a role for the appropriate agency. So, in the case of
    HR shared services, OPM would have a significant role, as an
    example.
        Mr. Gianforte. So, then, they could be a service provider
    to other agencies, if necessary?
        Mr. Zielinski. Correct.
        Mr. Gianforte. Okay. Thank you.
        I yield back, Mr. Chairman.
        Mr. Hurd. Ranking Member Kelly.
        Ms. Kelly. Thank you.
        The growing rate of sophisticated data breaches and cyber
    attacks in the private and public sector have heightened
    concerns over the security and strength of Federal IT systems.
        And some of these devastating attacks succeed because
    Federal systems are dangerously outdated and obsolete. And I
    mentioned in my opening statement that nearly 75 percent of the
    Federal Government's IT budget is dedicated toward maintaining
    legacy computer systems.
        Mr. Powner, why does it take such a large share to maintain
    those systems?
        Mr. Powner. Well, I think, historically, operational
    systems in the Federal Government get a pass. So when you look
    at that's something the lights are on and it's running and
    we're serving the mission, we might not be serving the mission
    efficiently, we might not be serving the mission securely, but
    it's gotten a pass over the years. That's been the biggest
    problem.
        I think this committee, you know, going back to 2016, when
    we did the big report with the 8-inch floppy disk at DOD,
    helped raise the issue of how old and insecure and costly these
    systems are.
        We are starting to make progress. The problem is that we
    still need firm dates to replace these systems where we
    actually turn them off. I mean, I agree with all the comments,
    that it's difficult to maintain and patch, there's unsupported
    software. But, ultimately, the security solution is turning
    them off and decommissioning them.
        Ms. Kelly. I'm not trying to be comical, but because the
    systems are so old, do we even have the staff--we talk about
    the staff for the new systems and the workforce, but what about
    the staff to maintain these systems?
        Mr. Powner. Well, that--so it's very difficult. I know,
    personally, I do a lot of detailed work at IRS, and when you
    start looking at assembly programmers there, we're losing them
    left and right. We pay a premium to contractors to maintain. We
    pay other younger programmers who know modern language as a
    retention. It costs money to maintain these systems. And each
    year we go on, it costs more and more, and we become more and
    more insecure.
        Ms. Kelly. And what happens if we just turn it off?
        Mr. Powner. Well, right now, we need a lot of these
    mission-critical systems to actually do the mission. You know,
    the IMF system at IRS, that's where we get $3.3 trillion in
    revenue through tax returns. It's critical.
        Ms. Kelly. Uh-huh.
        Mr. Powner. Chairman Hurd's held hearings on the VA VistA
    system. I mean, we still need that to apply medical services to
    our veterans.
        But, again, you know, that's why we need to keep them
    running, because they're mission-critical.
        Ms. Kelly. Okay. Thank you.
        The Modernizing Government Technology Act is a key
    component of this administration's continued effort to improve
    Federal technology by providing financial resources and
    technical expertise to agencies.
        Does the MGT Act continue to be, you think, a priority for
    the Trump administration and OMB?
        Ms. Weichert. Absolutely. The MGT Act and the Technology
    Modernization Fund are absolutely priorities for the
    administration.
        And we've actually pulled together in the President's
    Management Agenda, which will be released next week and was
    hinted at in the President's budget in February, a wholistic
    perspective on how we tackle these issues, which is not purely
    the technology piece, as you have mentioned. It includes issues
    around data and data structure. It also includes very critical
    people issues.
        We want to solve these issues wholistically, build on past
    successes, and we believe that the MGT and the Technology
    Modernization Fund will be great stepping stones toward the
    future of really pulling all of these dimensions together so
    that they are not siloed by function, where, you know, we have
    CIOs, you know, who, by the way, need more authority--and you
    all have done great work in FITARA to do that, and we support
    that. But we also need the human capital element, the financial
    element, the procurement element to be at the same table.
        And so what we're laying out in the President's Management
    Agenda is that wholistic framework. It was why I was so eager
    to actually be here and share. Because one of the root-cause
    observations that we had when we looked at how government was
    tackling these issues versus the private sector, it was that
    lack of integration across function. And we plan to tackle
    that, leveraging these authorities that Congress has provided
    through the MGT Act and TMF.
        And, by the way, we really hope the appropriators actually
    fund the TMF.
        Ms. Kelly. Okay. Thank you.
        Mr. Powner, can you comment on the steps that OMB is
    taking?
        Mr. Powner. Well, I think, clearly, the guidance that OMB
    just put out, you know, that's the right direction. And that
    guidance was very solid. You know, now the hard part is
    implementation. You know, we're really good at plans and
    guidance in this town, but we're not always good at getting
    things done and implementing them completely.
        So let's do this right with the MGT Act, because we got
    savings out there. As Mr. Zielinski said, with shared services
    or still with some data centers, we can populate these working
    capital funds and really do MGT right.
        Ms. Kelly. Thank you.
        And I yield back.
        Mr. Hurd. Mr. Blum, you're now recognized for 5 minutes.
        Mr. Blum. Thank you, Chairman Hurd.
        Thank you to our panelists for being here today.
        Mr. Powner, your challenge is, in the next 5 minutes, to
    make me an expert on cloud computing. Cloud computing has been
    in the news lately with the Federal Government. Department of
    Defense, I think, is looking at going to cloud computing. I
    assume the entire government will be there at some point.
        Can you talk to me about the efforts to go to cloud
    computing, A? B, financially, is that going to save the
    taxpayers money or not? And, C, I'm particularly interested in
    the following, and that is, will it be more secure or less
    secure or perhaps the same level of security that we have
    today, not being in the cloud?
        Mr. Powner. So there's all kinds of various aspects of the
    cloud. So, like, for instance, on our data center situation we
    have, when I say that some agencies by 2020 should get out of
    the business of data centers, that's because we have
    inefficient data centers that they're not going to optimize,
    maybe two-thirds of them. And what we could do there is we
    could host our existing applications in a cloud environment or
    on servers and infrastructure maintained by contractors who are
    cloud providers.
        So that's one way that we could actually save money and
    have optimized data centers, by actually outsourcing all of it
    to the cloud.
        We can also, too, in some of the shared service areas that
    we talked about, you can actually buy software as a service in
    the cloud from many of these cloud providers. And that's
    another way where we can save money.
        However, there are some of these mission-critical
    applications like some of these homegrown systems that are
    critical to agencies' mission that you're not going to find
    that as a software, as a service, that we've got to actually
    just do the hard work and convert those old systems.
        So cloud, there's a great opportunity. It's not the
    solution for everything. But there's substantial savings.
        And from a security perspective, you know, if you really
    look, the intel community kind of led the cloud migration. We
    were concerned on the civilian side about having enough
    security. So if it was good enough for intel, it's probably
    good enough for a lot of others.
        The other thing you could do is, through your contracting
    provisions--and we did work on this, looking at service-level
    agreements and contracts--you can specify the level of security
    you want from those cloud providers and actually dictate the
    level of security. So, in many ways, cloud services can be more
    secure than what we currently have.
        Mr. Blum. Do you think all Federal IT should eventually end
    up in the cloud?
        Mr. Powner. There are some aspects that won't be in the
    cloud because they're unique to agency missions, but there's a
    large portion that could end up being in the cloud.
        But there are these pockets of unique applications that we
    do that no one else has that we have to do the hard work and
    convert those to more modern platforms and modern software.
        Mr. Blum. Where are we at today in this journey to the
    cloud?
        Mr. Powner. So that's a good question. We're doing some
    work for this committee where we've done prior works, and we
    try to measure it as a percentage of budget or IT spend, and
    it's very difficult. You know, we did this work a couple years
    ago, where agencies varied from 2 to 7 percent of their IT
    budgets were in the cloud. That's improved somewhat. But it's
    very difficult to give you a good, hard number right now. We're
    working on that for this committee.
        Mr. Blum. Thank you.
        Ms. Weichert, is it?
        Ms. Weichert. Yes.
        Mr. Blum. OMB, how involved are they in this migration to
    the cloud?
        Ms. Weichert. So it's a great question, and it is actually
    one of the priorities that we're laying out as part of the
    President's Management Agenda. Now that the Federal CIO is in
    place, it is on her top priority list.
        And we're working closely with GSA and the centers of
    excellence on the implementation. They've already met to put
    together tiger teams in terms of cloud email adoption, and
    they're looking at other areas where commercially available
    solutions are already in place, secure, and working at some
    agencies, to elevate the lessons from those and extend them
    across government.
        But ultimately the test, to the question that you asked
    earlier around which things should migrate to the cloud, it's
    essentially going to be dependent on the mission; the service
    aspects, so how well we can serve the needs of our citizens and
    the American people; and then the stewardship aspects of
    financial stewardship. So we're really going to be looking at
    balancing those three items.
        Mr. Blum. Thank you.
        Mr. Zielinski--I hope I pronounced that right--this is kind
    of interesting. The centers of excellence, can you just briefly
    tell me about that and that effort?
        Mr. Zielinski. Certainly. Thank you for the question.
        Going back to some of the things that Mr. Powner mentioned,
    as agencies are making these decisions about their strategies
    for moving to the cloud or considering the cloud, the centers
    of excellence are places where we bring together technical
    expertise, the engineers and others who understand the dynamics
    of matching those business applications and those business
    functions to where they best lend themselves to a cloud
    application, whether that software is a service or platform is
    a service, and then help agencies to find acquisition
    strategies for them to be able to move.
        So there's a lot of direct assistance that those centers of
    excellence provide to a customer agency, and they do that
    through bringing together the expertise, as Ms. Weichert said,
    being able to make sure that we have all of those functions
    working hand in glove, the technical expertise as well as the
    acquisition.
        Mr. Blum. Is it more of a planning function or more of an
    execution function, the centers of excellence?
        Mr. Zielinski. It's absolutely an execution function, sir.
        Mr. Blum. Because I agree with what Mr. Powner said earlier
    about we're good at planning, not so good at following through.
        Thank you very much. I am out of time and I yield back.
        Mr. Hurd. I now recognize the ranking member.
        Ms. Kelly. I just have one quick question and not for Mr.
    Powner.
        How long have all of you been in your positions you're in
    now?
        Ms. Manfra. I was appointed in June of last year, ma'am.
        Mr. Zielinski. I've been with GSA for 2 years.
        Ms. Kelly. In the position you're in now?
        Mr. Zielinski. Six months.
        Ms. Weichert. The Senate confirmed me on Valentine's Day of
    this year.
        Ms. Kelly. All relative newbies, okay. No insult to you, I
    just knew you'd been around. Thank you.
        Mr. Hurd. He's been there forever, I think is the right
    answer.
        Mr. Zielinski, can we follow up on the centers of
    excellence. I recognize myself for 5 minutes. How does this
    program differ from 18F?
        Mr. Zielinski. So thank you for the question, sir. The 18F
    has those technical experts that the centers of excellence can
    actually tap into. So as I talked about bringing together the
    different discipline areas to be able to bring to bear on a
    particular agency problem set and to assist them in being able
    to understand the dynamics of their business case and how they
    can move forward, 18F, as an organization, would be one of the
    areas into which the centers of excellence can reach to bring
    that technical expertise to the table.
        Mr. Hurd. Got you. And how do we ensure these centers of
    excellence, other than having GAO white glove it, how do we
    ensure that these don't duplicate efforts that are going on in
    the rest of the government?
        Mr. Zielinski. So going back to the agenda that has been
    laid out by the administration in and around starting with the
    IT modernization report as well as with the President's
    Management Agenda, it's a very tight weave in terms of ensuring
    that there's a collaboration across all those functional areas.
        And there are many opportunities for those functional areas
    to be brought together to ensure that we are all bringing to
    bear the best talent and that we're also not duplicating
    effort, sir.
        Mr. Hurd. Good copy.
        Ms. Weichert, one of the things that is still frustrating,
    and I'm glad Mr. Powner alluded to this in the beginning of his
    remarks, is CIO authorities. We can't hold CIOs accountable if
    we don't give them all the power they need. FITARA gives them
    that authority, but in many places the agency CIO doesn't have
    the complete budget authority of those--of that entire
    operation.
        And Transportation is an example. I think they have nine
    CIOs, people with the title, nine CIOs, $3 billion-plus budget.
        Can we reprogram the funds from those various sub-CIOs
    into--under the Federal--under the agency CIO in order to
    streamline that budget authority?
        Ms. Weichert. So not being an expert on appropriations, I
    want to caveat and say that I would love to answer that in more
    detail after conferring with some of our budget folks. But what
    I can say is absolutely agree with your frustration. It's
    something we in the administration share and are looking very
    closely at how do we address.
        I think in the President's Management Agenda we are laying
    out how all of the components of the various authorities across
    government, how they work together and how they align together,
    and to avoid duplication, while giving the maximum elevated
    level of capability to the CIOs.
        I think the Technology Modernization Fund and the MGT, in
    providing new capabilities around working capital funds, that
    is a place we are going to start and are already exploring ways
    that we can work with agencies to help them focus and target
    resources towards the highest priority projects, as Mr. Powner
    has suggested.
        In terms of getting additional capabilities, I think the
    authorities are different in terms of transfer and how they can
    use their working capital funds, that I wouldn't want to give
    you an across-the-board answer.
        Mr. Hurd. But would you have heartburn if we were to
    reprogram some of these to ensure that the agency CIO had all
    the budget authority for IT spend across that network?
        Ms. Weichert. So I haven't studied that specific issue.
        Mr. Hurd. Okay. That's a fair answer.
        Ms. Weichert. But what I can say is we are absolutely in
    alignment in terms of the idea that the CIO for the broad
    agency needs to have all the capabilities and tools to make
    these very profound investments.
        And the more we can align to the way the private sector
    works, where you've got a general manager of a division or an
    agency, and their C-suite includes the chief information
    officer, the chief financial officer, the chief people officer,
    and, where appropriate, the procurement officer, they need to
    all be there in lockstep.
        Mr. Hurd. And the CIO. I think you said that.
        Ms. Weichert. I said that first, yes.
        Mr. Hurd. Okay, first. Okay. Gotcha. Gotcha. I agree. And
    my teams would get mad because we're talking about how do we
    change the FITARA Scorecard to penalize agencies that don't
    have the Federal CIO reporting directly to the agency or deputy
    agency head.
        We've asked everybody why, what's going on, why is that the
    case? We've gotten a lot of excuses: ``Oh, it's kind of already
    there.'' Well, if it's already there, then change the damn
    structure. And so we are looking at having that be reflected in
    the FITARA Scorecard.
        Mr. Powner, do you have any opinions on the reprogramming
    and giving complete budget authority to the CIA--CIO? Let me
    rephrase that. The CIO, not the CIA. I don't want anybody to
    get mad and run an ad against me.
        Mr. Powner. I think the first step is that we understand
    all the IT spend. I think many CIOs, we don't even know the
    full totality of what we spend at these departments and
    agencies. So once we understand that, I do think the CIOs
    should control that more.
        It's okay, too, if there ARE some business units that
    control it and they act in partnership, where the CIO is
    working with those business units to spend it appropriately, to
    oversee it the right way and that.
        So I think there's probably even some blend. I think right
    now if we did it completely whole hog, you have complete budget
    authority, the whole bit, I don't know if that would--maybe we
    need to shock the system as you're intending. That's one way to
    do it.
        Mr. Hurd. Your word, not mine, sir.
        Mr. Powner. But the other way to do it is to have some type
    of blend where we know the entire spend and the CIO has a role,
    whether they control every dollar or not, but they're still
    responsible for governing over it. We've got too much IT spend
    that we don't have IT people on it.
        Mr. Hurd. You reminded me of something I was going to ask.
        And, Ms. Weichert, this may not be something on the top of
    your mind.
        Or, Mr. Zielinski, I think this is outside of your scope.
        The Department of Defense recently made the decision to not
    publish their IT amount. I believe it was in a recent--was it
    an OMB report? What was it? The analytical prospectus. It said:
    Hey, we're going to stop showing DOD's number on IT along with
    everyone else.
        So we went from spending, the Federal Government spending
    $90 billion to $40 billion, and they said, you know, asterisks,
    fiscal year 2018, it was roughly $50 billion.
        Do you have any insight into that decision, that process?
    And we will be bringing--again, not to, you know, show our
    hand--but we'll be bringing DOD for the next FITARA Scorecard
    hearing to have them answer that directly. But I'd welcome your
    thoughts.
        Ms. Weichert. Yeah. Unfortunately, that was prior to my
    being confirmed, so I wasn't read in on that particular
    decision.
        Mr. Hurd. When you're talking to them----
        Ms. Weichert. I will note it.
        Mr. Hurd. --tell them this committee is interested.
        Ms. Weichert. I will share that.
        Mr. Hurd. And I'd love to have the answer prior to--should
    I introduce these into the record?
        So, yeah. The analysis in this chapter excludes the
    Department of Defense and classified spending, which in fiscal
    year 2008 was $42.5 billion, or 44 percent of the IT budget. So
    we're going to start showing only 66 percent of the budget as a
    whole number, which seems a little odd to me.
        Ms. Manfra, one of the things I want to do with the FITARA
    Scorecard is transition it into more of a digital hygiene
    scorecard as well. I think the elements, as Mr. Powner has
    talked about, we've got to continue to double down on those
    issues.
        But I think being able to highlight at the macro level good
    digital hygiene is important. I think the inclusion of the
    MEGABYTE Act on that was one of that. Do you know all the
    software that's running on your system? And I think only three
    were able to answer yes, which is pretty shocking. And, again,
    these are self-reporting numbers.
        So what are some of the areas that you think that we should
    or could be exploring when it comes to digital hygiene and how
    we look across that over the entire enterprise?
        Ms. Manfra. So I think, first of all, I think that's a
    great idea, to include that. Frankly, shining a light on some
    of these basic practices has been useful in agencies
    prioritizing.
        So I briefly alluded to the critical vulnerability
    patching. What we saw through years of assessments was just
    continued poor patch management programs. Some of it does have
    to do with legacy systems and all that.
        But what we decided to issue, our first binding operational
    directive, was actually to require the time to patch a critical
    vulnerability down to 30 days.
        And the important way, though, that we were able to be
    successful, I think, with this and with other directives and
    other guidance that we provide is that we can independently
    validate. We're not relying on self-reporting. And so the more
    capability that DHS is deploying--in this case it's the
    external scanning that we're doing of all internet-facing
    devices--that we can say, no, I can see that you haven't
    actually patched.
        The good news story is that when we--I think fiscal year
    2014 average time to patch was somewhere in excess of 200 days
    for critical vulnerabilities, which is bad. After the
    directive--and it continues, which shows how these things
    change behavior--we're averaging in the 10 to 15 days.
        And so it's helping them prioritize their very limited
    resources by focusing on known issues, and that's what we want
    to continue to do, but it's also important that we can
    independently validate this.
        You talked about knowing what software on your system. So
    the Continuous Diagnostics and Mitigation Program that we've
    been deploying, the first phase is hardware and software asset
    management. And we've learned a lot through that program in
    what agencies thought they had on their network was not exactly
    what we found that they had on their network after deploying
    these.
        And I know in one sense it's frustrating to sort of be in
    that environment, but at least we're in a position now where we
    do know. We know what's connected to the network and as we
    deploy more tools.
        And as a side note, this program actually is also very
    cost-effective, and we've been able to identify that I think
    it's 75 percent cost savings off of schedule--if they had
    bought these on Schedule 70.
        So we're deploying common tools that are identifying what
    and who is on networks. And I believe that this will
    fundamentally transform the way that we do, in the first case,
    vulnerability management for the government, but eventually we
    will get to event management and ongoing authorization in those
    programs.
        But it has to be through the deployment of these
    standardized tools that then feed data back to an agency CIO
    and DHS so that we can, through automated sensors, understand
    where they are.
        Mr. Hurd. Would you have security concerns of publishing
    that number of how long it takes to patch software, like the
    average it takes to patch software from agency from agency?
        Ms. Manfra. I don't know how----
        Mr. Hurd. You can take time to think about it.
        Ms. Manfra. Yeah.
        Mr. Hurd. It's just I think that's an element that, self-
    reporting, we can establish a letter grade based on what are
    industry best practices. Is a week an A? Two hundred days is
    definitely an F, right? Where that's something that we could
    package and keep track of and make sure that we're continuing
    to shine a light on.
        Ms. Manfra. Absolutely, sir. And there's a few other things
    that we've identified as very common practices that we're
    focusing our guidance on. And we'd be happy to work with you on
    how we can improve those practices.
        Mr. Hurd. And before we get to the gentleman from the
    Commonwealth of Virginia, my last question is, one of the
    things that I've--in the 3-1/2 years we've been doing this
    together, we've asked a lot of questions about, are you doing
    technical vulnerability assessment, penetration testing? And a
    lot of agencies have said yes, and then you find out after the
    fact they're just doing a scan, that they're not bringing a
    third-party system, a third-party vendor to come in and do that
    testing.
        Your organization has been doing that. Have you seen an
    increase in that as a best practice?
        Ms. Manfra. So you're right, there isn't a very common
    definition of what people mean by penetration testing. You
    know, as I noted, we do passive scanning, but that is to
    identify one set of issues.
        We also do our risk and vulnerability assessments, which is
    penetration testing, which is actively going and trying to
    identify and exploit vulnerabilities. That's what we would
    consider.
        We haven't previously taken statistics on what agencies are
    using penetration testing. I can tell you that just in the last
    fiscal year, we did 42. We focus, prioritize high-value assets.
    So we go through all of the high-value assets to do a full risk
    and vulnerability assessment, which includes a penetration test
    as well as a report to them. But we could definitely follow up
    on that.
        Mr. Hurd. Well, we'll be asking the agencies this question,
    so when we collect that information we'll share it with you so
    that you're aware.
        Ms. Manfra. Thank you, sir.
        Mr. Hurd. Now I'd like to recognize the gentleman from the
    Commonwealth of Virginia, the ranking member, Mr. Connolly.
        Mr. Connolly. I thank my friend.
        And welcome to our panel.
        And thank you both to Mr. Hurd and Ms. Kelly for their
    leadership of this subcommittee and on this subject matter.
    We're really fortunate to have Members who care about the
    subject matter and delve into it. It's actually rare. You'd
    think more Members would be involved in IT, but they actually
    aren't, for various and sundry reasons.
        And so one of the great pleasures of serving on this
    committee is that--and Mr. Meadows is not here, but the four of
    us have really worked seamlessly, in a nonpartisan way, to try
    to help rationalize Federal IT policy. And I think for all four
    of us, it doesn't matter whether it's a Democrat or a
    Republican administration, we want it to work.
        And so, in that spirit, welcome.
        Ms. Weichert, in March of last year the White House
    announced the Office of American Innovation. And after that,
    OAI was credited with a whole bunch of projects as large as
    pushing the overhaul at the Veterans Administration healthcare
    IT system, setting the policy for the Federal Government's
    adoption of AI, and presumably implementation of FITARA, data
    center consolidation, moving to the cloud, empowerment of CIOs,
    and so forth.
        Now, under the E-Government Act of 2002, normally that role
    would be played by the Federal CIO. Now that presumably we're
    going to have a Federal CIO, what is OAI's role going forward,
    and how does OMB play a role in all of this as well?
        Ms. Weichert. I think it's a great question, and we are
    working in lockstep across the administration to set out a
    focused agenda for all the elements around not only IT
    modernization, but the other enabling capabilities around data
    transparency and accountability, as well as the people
    dimensions of that.
        And OAI did a great job providing catalytic capabilities in
    getting a lot of these activities started. But what's been
    included in the President's budget in February and what will be
    rolled out next week in the President's Management Agenda is
    the comprehensive go-forward plan.
        We do have a Federal CIO, an outstanding leader from the
    private sector who has done execution of change in complex,
    highly regulated environments in the financial services and
    other industries, who's really here to help continue to carry
    that torch.
        I think a lot of the activities that have been enabled by
    the MGT Act and the TMF are stood up. The Federal CIO actually
    met earlier this week with the members of the IT Modernization
    Fund Board, and they did a dry run, so that when appropriations
    come--I'm hoping they're coming soon--that the board will be
    prepared to act quickly.
        We continue to work very closely with OAI in terms of
    helping shape the strategy and bring to bear the best thinking
    of the administration and also marshal resources outside of
    government to provide insights that might be helpful in our
    journey.
        But we in OMB are really leading the direction with the
    President's Management Agenda and bringing the executive branch
    along. And I look forward to having you all get to see what
    we're putting together that's going to be in the PMA launch
    next week.
        Mr. Connolly. So I know that the chairman talked about
    maybe broadening the current FITARA Scorecard at some point to
    a digital hygiene scorecard. I would be supportive of that once
    we make more substantial progress on implementation of what's
    in front of us, because we've seen some backsliding. You know,
    DOD, the Big Kahuna, got an F. And so we want to see more
    progress, but we can't really see it without leadership coming
    from your office.
        I assume, but let me ask, you are committed to the metrics
    set in the law, FITARA, and the tools, allowing us to try to
    facilitate that, that MGT, just passed into law, also gives
    agencies, to facilitate implementation of the law.
        I assume you're trying to push agencies to meet the metrics
    set for them in the law.
        Ms. Weichert. Absolutely. And I think the focus
    historically, that has been very siloed. In a lot of cases some
    of the challenges around FITARA implementation and some of the
    things measured in the scorecard hit root cause issues that
    were underlying those things. In a lot of cases, people issues
    are part of the problem.
        Mr. Connolly. Yes.
        Ms. Weichert. In some cases data and even the ability to
    see the problem is part of it.
        So part of what we want to do is actually use the broad
    management table to really shine a light on those issues. And
    to the extent the scorecard needs to evolve or mature, we'd be
    very happy to take input from GAO and work with Congress on
    that. But we are very supportive of the spirit of FITARA and
    moving forward with that.
        And I guess the last thing I'll just say is, my perspective
    in the private sector, if you've got a broad failing to meet
    the needs outlined in a strategic plan or a set of metrics,
    it's incumbent upon the person who's accountable for those,
    especially if it's me, to really understand are there root
    cause issues that are preventing us from doing that and then
    addressing those as well.
        Mr. Connolly. Yes, I couldn't agree with you more. And like
    you, I come from the private sector. I spent 20 years as a
    corporate officer. And what I learned in the private sector and
    the public sector is, if the boss doesn't care, neither do I.
        Ms. Weichert. Right.
        Mr. Connolly. I'll give it lip service.
        Ms. Weichert. I care. I care a lot.
        Mr. Connolly. Exactly.
        But they need to feel pressure. They need to know I'm going
    to be evaluated by the boss on implementation, on meeting those
    metrics.
        And the other thing, and then I'll be quiet, but with
    respect to personnel, we've got to empower, in Latin we call it
    primus inter pares, the first among equals in CIOs. There has
    to be a primus CIO who's got the responsibility, the
    accountability, and the power to make decisions. They've got to
    be empowered, and everyone has to know that.
        If the CIO of an agency is reporting to the deputy
    assistant Gromit in the basement, that does not escape the
    attention of everybody else. And I might give lip service, but
    I know he or she doesn't really have the boss' attention.
        We elevate the issue--I mean, we elevate the role of that
    person and the stature of that person, we elevate the issue and
    its importance in everybody's eyes.
        I commend that to you as a reform. It doesn't cost a lot of
    money, but I think it would have a profound effect on
    performance and would save a lot of money for agencies over
    time and make us a lot more effective.
        Thank you, Mr. Chairman.
        Mr. Hurd. Thank you, sir.
        And I failed to spend some time on MGT, so I have a few
    questions. And, Ms. Weichert, they're probably best for you.
        The agencies are still planning to present their
    implementation plans of the MGT working capital fund on the
    27th of March. Is that correct?
        Ms. Weichert. That is correct.
        Mr. Hurd. And will you be able to share those with us?
        Ms. Weichert. So we will be able to share the status on the
    working capital funds early this summer. So we are actively
    working with the agencies to understand what specifically their
    needs are in terms of implementing on that.
        So we already have a number that are well on the way of
    implementing it. We have identified some challenges related to
    transfer authorities that we need to work out. And we'll
    actually be coming back to Congress with some thoughts about
    ways to streamline what's needed to actually make it work as
    intended in the legislation. But we will be coming back
    imminently.
        Mr. Hurd. The sooner you come to us on that, we'll do
    everything we can to help, because I think it's important by
    the end of this fiscal year to have some money deposited in
    those funds at a handful of agencies to be sure that it's
    working.
        Ms. Weichert. We absolutely agree, yes.
        Mr. Hurd. Mr. Powner, do you think we can do that?
        Mr. Powner. Definitely, definitely. And we'll continue to
    work with you. I know that's one of the things we want to focus
    on the scorecard, too, as we evolve that, to look at the
    establishment of those MGT funds and the accountability, who's
    in charge of those and that type of thing.
        Mr. Hurd. Because if you are able to deposit money in your
    MGT working capital fund, it shows a culture of modernization,
    and I think that's important to monitor and focus on.
        I'd like to thank our witnesses again for being here today.
    The hearing record will remain open for 2 weeks for any member
    to submit a written opening statement or questions for the
    record.
        If there's no further business, without objection, the
    subcommittees stand adjourned.
        [Whereupon, at 4:26 p.m., the subcommittees were
    adjourned.]

                                    APPENDIX

                                  ----------

                   Material Submitted for the Hearing Record

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     [all]