FITARA Revamping IT in the Federal Government Presentation to DIR Information Security Forum Richard A. Spires April 14, 2016

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. Agenda  Status of Federal IT Management  Legislative History  Federal IT Acquisition Reform Act (FITARA)  Current Implementation Status  ACT-IAC FITARA Support IT Management Maturity Model Proven Practices Measures of Success  Potential Impact on Federal Cyber Security

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. Status of Federal IT Management  Highly Federated Office of Management and Budget (OMB) provides policy guidance Appropriations to Departments/Agencies down to Program Level Generally been weak controls and oversight from Department to Bureau to Program  General Accountability Office (GAO) recently put Government-wide IT Acquisition on High-Risk List Indictment of Federated Process and Weak Oversight Numerous very large (billion dollar plus) program failures leading to this Tremendous duplication in number and type of IT systems 1  Nominally $80 Billion Annual Spend Closer to $100 billion adding in the other Programs/Intelligence Community Up to 80% spent on Operations & Maintenance (O&M) of legacy systems Houston, we have a problem!

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. Legislative Impact  Clinger-Cohen Act (1996)  E-Gov Act (2002) Federal Information Security Management Act (FISMA)  FISMA Reform (2014)  Federal IT Acquisition Reform Act (2014)

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. Federal IT Acquisition Reform Act (FITARA)  Address systemic weaknesses in IT Management and Acquisition  Core is revamped Agency CIO Authorities IT Budget review and approval Program Oversight Human Resources Planning Bureau CIO Oversight  Additional Elements of the Act Data Center Consolidation IT Acquisition Cadres Government-wide IT buying via strategic sourcing

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. Current Implementation Status  OMB developed and promulgated “baseline” guidance to agencies Development of agency plans to meet that guidance Vetted and approved by OMB (22 of 24 Agency plans approved) Published on the agency website  Congressional Scorecard Created (24 Agencies)  Question of sustainability through the Administration Change

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. IT Management Maturity Model – 5 Management Functions  Governance – the collaboration and decision making glue by which IT management works  Budget – the process to formulate, obtain approval, and execute the use of funds to support IT  Acquisition – the buying process used to obtain IT products and services  Organization & Workforce – the process to determine needed competencies and develop a workforce that has those competencies through recruitment and professional development  Program Management – 1) the set of disciplines used to deliver IT capabilities to meet an agency mission or business need 2) operations and maintenance of an existing system Program Management Governance Budget Acquisition Organization & Workforce Organization & Workforce

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. FITARA – Showcasing Proven Practices in IT Management Candidates  Governance IRS Enterprise Governance Framework  Budget DOJ Department Investment Review Council DOJ Information Resources Management Program IRS Portfolio Investment Planning Process FDA Cost Allocation Model FDA OIMT Enterprise Services and Activities  Acquisition DOC Acquisitions/Strategic Sourcing DOD ESI Strategic Sourcing Program GSA 18F Agile BPA GSA Digital Services Training Program Air Force Rapid IT Acquisition and Assessment Process DISA Agile Cloud Broker DHS IT Acquisition Review

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. FITARA – Showcasing Proven Practices in IT Management Candidates  Organization & Workforce Skills Framework for the Information Age (SFIA) USGS Workforce Planning Desk Guide National Cybersecurity Workforce Framework (NCWF) NASA Human Capital Plan 2015: A Guide to Building a Highly Engaged Workforce  Program Management VA Project Management Accountability System (PMAS)

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. FITARA – Recommended Measures of Impact  Strive for a balanced set of measures to include assessment of both IT management processes and outcomes IT Management Maturity IT Service Delivery Improving Agency Efficiency and Effectiveness  Strike a balance of between being comprehensive and having too many measures Resulted in 14 measures across 3 categories  Develop a set of measures that can support an agency over a 5+ year period as it works to mature its IT management

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. FITARA – Recommended 14 Measures across 3 Categories  IT Management Maturity Governance Maturity Budget Maturity Acquisition Maturity Organization & Workforce Maturity Program Management Maturity  IT Service Delivery IT Infrastructure: Data Center Consolidation IT Infrastructure: Server Density Customer Service: Meeting System Service Level Agreements (SLAs) Customer Service: Effective Use of Customer Surveys Reduction of System Duplication Program Delivery Success IT Security Posture  Improving Agency Mission Effectiveness and Efficiency Improved Mission Effectiveness and Efficiency Based on IT Management and System Improvements Improved Business Effectiveness and Efficiency Based on IT Management and System Improvements

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. FITARA – Potential Impact on Cyber Security  Drive Improved IT Management Processes Service Management (Patching, Upgrades) Real Time Continuous Monitoring  Simplification and Consolidation of IT Infrastructure Data Center Consolidation Leverage of Cloud Computing (FedRamp Certification)  Improved Program and Project Management Security Requirements as Core Security Accreditation and ongoing Testing

© Learning Tree International, Inc. All rights reserved. Not to be reproduced without prior written consent. QUESTIONS