Access Management: Path to Improvement Presented by NFC Access Management Branch

Problem Statement NFC Manages over 45,000 access accounts for its information systems and constantly fields new requests for system access. In FY 2012, NFC did not meet customer needs in provisioning these access accounts in a timely manner. Customer needs as specified in the Service Level Agreements was an average of 5 days. NFC’s actual average time to provision access was more than 19 days. Fewer than 20% of the access requests were completed within the agreed upon standard. The backlog of requests was approximately three weeks. Because of this backlog, customers submitted expedited requests, which only exasperated the situation. As a result, customers were very dissatisfied with NFC’s access provisioning. To address this, NFC started a major process improvement effort to meet customer needs for access provisioning. (from USDA Signature Process Improvement Initiative) 2

Change is vital, improvement the logical form of change. James Cash Penney 3

DISCOVERY Large backlog of requests Lengthy processing time Unrealistic customer expectations Lack of automation Frequent distractions for Admins Admins: Chaotic Provisioning ASOs: Numerous Complaints 4 Everybody: Frustration

IMPLEMENTATION CHALLENGEIMPACTACTION Chaotic communication ASOs’ concerns not addressed timely Resumed/revamped/ increased User Group meetings High volume of incorrect access requests Rework for ASOs Delayed processing of request Incorrect access given Began to develop access forms Stale, infrequent Training Low attendance No new information Used Webinars Scheduled Weekly Removed cost 5

IMPLEMENTATION ISSUEIMPACTACTION Inability to accurately track requests Lost Requests Disorderly processing of Requests Implement Remedy Requester Console (USDA) FIFO Processing Website stale Lack of information Updated website Large number of ASO training courses Reduced resources available to process requests Changed Weekly to Monthly training 6

IMPLEMENTATION CHALLENGEIMPACTACTION High number of expedited requests Delays processing of other requests LIFO processing Implemented Expedite Policy No SLA Expectation that all requests completed in 5 days Rewrote SLAs based on # userIDs and Complexity Manual delivery of notices and reports Time consuming Implemented GovDelivery All users not in RRC Extra work to collect performance measures Implemented non-USDA to RRC 7

IMPLEMENTATION CHALLENGEIMPACTACTION Access not tracked by LOB Difficult tracking / billing Added RRC Summary Lines Manual training registration Lost attendees Less time to process requests Set up automatic scheduling for TSO training Effort by admins on non- critical tasks Less time to process complex requests Transferred password resets to OSC Information not covered in existing training Incident tickets, inquiries and questions Added Reports & Intermediate Training Lack of managed customer feedback Multiple sources for customer feedback Distributed automated surveys 8

IMPLEMENTATION CHALLENGEIMPACTACTION Expedited requests processed before due dates No credit for processing access requests early Updated SLA: # userIDs, Complexity and Average Number of Days No access forms Incorrect, incomplete access requests Lengthens processing time Adversely impacts metrics Published Access Request Forms Implemented cancellation & mandatory forms use policies Manual training registration Lost attendees Less time to process requests Expanded automated scheduling to ASO training 9

Improvements Realized Changes to SLAs Example 1 is completed with a better average number of days and total combined days than Example 2, but fails the old SLA target. Example 2 met the old SLA target, but requests were completed in a greater number of days. Under the new SLA based on average number of days, both examples would have passed. Example 1 – Simple Average days: 4 Total days to complete: 8 SLA Percent: 50% Status: Failed Request days Passed Request days Failed Example 2 – Simple Average days: 5 Total days to complete: 10 SLA Percent: 100% Status: Passed Request days Passed Request days Passed 10

Changes to SLAs 4. SLA Performance Metrics using Volume, Complexity & Average Number of Days (Estimated Turnaround Time in business days) Access Request Type Target: The average processing time of all requests will meet or exceed the time frames shown 95% of the time <=10 User IDs User IDs User IDs >50 User IDs Simple 5 days 10 days 15 days Negotiated Moderate 10 days 15 days 20 days Negotiated Complex 15 days 20 days 25 days Negotiated SLA Performance Metrics using Volume only <=10 UserIDs UserIDs UserIDs >50 UserIDs 5 days 10 days 30 days Negotiated 3. SLA Performance Metrics using Volume & Complexity (*Estimated Turnaround Time in business days) Request Type Average Processing Time Per User ID Request Completion Time Frame Target: The processing time of all requests will meet or exceed the time frames shown 95% of the time <=10 UserIDs UserIDs UserIDs >50 UserIDs Simple 30 min 5 days 10 days 15 days Negotiated Moderate 2 hrs 10 days 15 days 20 days Negotiated Complex 8 hrs 15 days 20 days 25 days Negotiated 1. All requests 5 days

Training Averages 12 TRAINING COURSE AVERAGE ASOs TRAINED PER MONTH ASO Basic6 Remedy Requester Console 11 ASO Intermediate1 TIPS8 DPRW ASOs3 Average of 14 ASOs added per month (Mainframe Apps) Average of 56 ASOs added per month (DPRS, CLER)

Volume Variations Ends of CY & FY are high volume periods 13

Improvements Realized 14 Goal: Decrease in Incident Tickets. Password Resets transferred to OSC in January 2013.

Improvements Realized 15 75% decrease in average number of days to process a request

Improvements Realized 16 Decrease in Expedited requests after Expedite policy implemented January 2013

Improvements Realized Expanded Training BEFORE: 1 ASO Training Class – Quarterly – Fee based – Maximum class size: 12 AFTER: 5 SO Training Classes – Monthly – ASO Basic – Remedy Requester Console – Intermediate – Specialized courses (Security Coordinators, DPRS, CLER, TIPS, etc.) – No cost – Maximum class size: 25 17

THE WAY AHEAD CHALLENGEIMPACTACTION Unnecessary account deletions due to inactivity Users repeatedly lose access ASOs repeatedly request access users of inactive accounts Failure to use access forms Continued inaccurate/ incomplete requests Automate Access Request Entry Complex, tedious provisioning of access Longer time to process requests Greater probability of errors Automate Access Provisioning Tickets assigned incorrectly Longer time to resolve incidents Use checklist/form to triage/assign trouble tickets All SOs not in RRC Extra work to collect performance measures Add remaining SOs to RRC Too many profiles Excessive access combinations Difficult to manage Use Role Based Access Increasing training needs Fewer resources to process requests Develop web based training 18

THE WAY AHEAD ACTION Continuously monitor and evaluate performance Update policies & procedures as necessary 19 RESULT Improve Processes GOAL Improve Customer Service