Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 08/23/04 issue

USDA, HUD race to document IT security

By Mary Mosquera, GCN Staff

Agencies at the bottom in OMB report, but predict good grades later this year

In a recent report card on agencies’ compliance with federal IT security requirements, the scores of the Agriculture and Housing and Urban Development departments stuck out like sore thumbs.

Agriculture had only four percent of its systems certified and accredited as secure by outside authorities, according to the Office of Management and Budget’s August report, The Federal Government is Results Oriented. And HUD received a zero on the 100 percent scale.

The scores fell well below the governmentwide average of 70 percent compliance and even further below the goal of 80 percent set out by OMB.

But both Agriculture and HUD said they are working to meet the requirements and predicted much higher scores when the next report cards come out in November. They have hired contractors to handle the work and expect to have most of their IT systems certified and accredited by the end of the year.

Officials said the departments’ broad scope contributed to their problems. Both Agriculture and HUD have offices scattered across the nation, running a wide variety of systems.

In the past, Agriculture has been unable even to complete an inventory of its information systems and has lacked the funding to follow through on certification and accreditation, CIO Scott Charbo said.

The price tag for certification and accreditation, sometimes referred to as C&A, can run up to $150,000 per system. “That’s too much,” he said.

Agriculture assembled a blanket purchasing agreement for vendors to compete for the work, and the department has arranged its IT systems in groups of about 15 systems.

“We felt there were economies if we grouped the systems by likeness or by region, which would reduce that contractor’s travel time and expenses,” Charbo said.

The strategy worked. The department accepted bids from 11 vendors, some indeed as high as $150,000 per system, but others as low as $30,000 per system. Agriculture now has more than 400 systems grouped and in the C&A process, he said.

The department has completed the process for more than 100 systems. Many others have made significant progress, Charbo said.

Agriculture will be certified and accredited for 50 percent of its systems by the end of August and more than 85 percent by Sept. 30, Charbo said.

“With the plan we have in place, we’re where we want to be,” he said.

Frugal funds

A common obstacle has been convincing lawmakers to appropriate money the department needs for security.

More news on related topics: E-Government, Enterprise Architecture, IT Infrastructure, IT in Action, Management