Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 02/23/04 issue

OMB snaps purse closed for new IT

By Jason Miller, GCN Staff

18 agencies told to fix security holes before receiving any other funds

The Bush administration is pulling in the IT security reins on 18 agencies, requiring them to fix weaknesses in existing systems before developing new ones or upgrading old ones.

In rolling out the president’s fiscal 2005 budget proposal, the Office of Management and Budget told the agencies they would have to tap 2004 and 2005 funds allotted for development and enhancement efforts to do the security fixes.

That makes perfect sense on paper. But what appears to be a smart idea doesn’t always translate well in reality. Why? Because reprogramming funding is a long, arduous process, several CIOs said. It involves approval up and down the command chain within an agency, as well as the OK of OMB and Congress.

“The process takes weeks to months depending on the situation,” Veterans Affairs Department deputy CIO Ed Meagher said. “This is the right thing to do, but the mechanism to do it is not very good.”

Karen Evans, OMB’s administrator for IT and e-government, said the 18 agencies were allocated $8.5 billion in all this year for development, modernization and enhancement efforts (see chart). If problems continue into next year, she said, agencies will need to again shift funds to security fixes from the $8 billion requested for new projects and upgrades for 2005.

“We don’t want agencies to layer a new system on top of an infrastructure that is not secure,” Evans said. “Agencies need to secure what they have, and if they do it efficiently, they will have remaining dollars to meet other priorities for modernization efforts.”

Eight agencies got high marks, and OMB has exempted them from this stricture: the Commerce, Defense and Energy departments, the Environmental Protection Agency, NASA, the National Science Foundation, the Nuclear Regulatory Commission and the Office of Personnel Management.

The requirement dovetails with the administration’s and Congress’ renewed emphasis on IT security. In turn, agencies failed to meet OMB’s December goal that at least 80 percent of systems be certified as secure by third parties or their inspectors general.

Bad report card

Rep. Adam Putnam (R-Fla.), chairman of the House Government Reform Subcommittee on Technology, Information Policy, Intergovernmental Affairs and the Census, gave the federal government a “D” on its overall cybersecurity in his annual report card.

The subcommittee has scheduled a March 10 hearing on the report card and implementation of the Federal Information Security Management Act. Later in the spring, Putnam plans to hold hearings on patch management, IT security and information sharing as well.

More news on related topics: IT Security