Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 10/09/06 issue

House gives urgency to IT security

Along with OMB guidance, agencies under pressure to do more

By Mary Mosquera, GCN Staff

The Office of Management and Budget and Congress are increasing the pressure on agencies to tighten IT security. Executive branch officials and lawmakers are working on separate but parallel paths to harden data security in agencies, with OMB cajoling agencies to adopt certain policies, and Congress moving to make them law.

A sense of urgency over seemingly endless data leaks drove the House recently to pass legislation that tightens requirements under the Federal Information Security Management Act for all agencies. Additionally, Rep. Tom Davis (R-Va.), sponsor of the bill, was expected to release more information about agencies’ past data breaches. Sources called the information potentially “astounding.”

Davis was expected to issue the report after press time.

Davis packaged his bill, HR 6163, the Federal Agency Data Breach Protection Act, in another piece of legislation aimed at shoring up data security at the Veterans Affairs Department, the Veterans Identity and Credit Security Act, HR 5835. The Senate must now vote on the bill.

OMB officials said they view the House bill as helping agencies meet FISMA’s standards for security requirements.

“We support efforts that strengthen this important tool,” said an OMB spokeswoman.

Appalled at the flood of data breaches, most spectacularly the incident in which a VA employee lost data on millions of veterans, Davis sought from agencies summaries of data breaches that occurred over the past three years. In one case, the Commerce Department revealed that it couldn’t account for 1,100 notebook PCs, including some containing personal Census Bureau data, because it did not track inventory.

The deluge of data breaches caused swift action in both the executive and legislative branches (see chart). But while OMB, which has come out with several guidance documents since June, is pushing policy and best practices, congressional officials said their bills carry more weight.

“Davis’ bill has far more teeth than OMB’s guidance to date,” said Dave Marin, spokesman for the House Government Reform Committee, which Davis chairs.

The bill requires agencies to adhere to IT security improvements, such as timely notice to individuals whose sensitive information may be compromised, centralizing data security enforcement under the CIO when authorized and ensuring that hardware containing personal information is maintained and accounted for, he said.

“Until now, there was no requirement that people be notified if their information is compromised,” Marin said.

Despite the compelling need for congressional response, it is uncertain whether the Senate will pass a version of the VA IT security bill, with or without Davis’ FISMA language, Marin said.

More news on related topics: IT Security, Business Process Management, FISMA, IT Management



GCN Popup