1. U.S. Department of Agriculture eGovernment Program eAuthentication Draft Business Case Executive Summary January 2003

2. U.S. Department of Agriculture eGovernment Program 2 Agenda Business Case Team Roster Background and Context High Level Business Requirements Existing USDA Services to be Leveraged Alternatives Analyzed Conceptual Approach Summary of Costs and Benefits Timeline & Milestones Next Steps

3. U.S. Department of Agriculture eGovernment Program 3 Business Case Team Roster The following people assisted in the development of this business case:

4. U.S. Department of Agriculture eGovernment Program 4 Background and Context - Our Approach For the past 90 days, cross-Agency teams have been working to define USDA eAuthentication business needs.  The business case includes all sections required by the CPIC process  The process the teams followed to complete the business case is as follows: Form cross- Agency teams Review, modify, and deliver draft business case Review and iterate requirements Complete remaining business case documents 1. Met with Agency key contacts and received names of participants. 2. Facilitated breakout sessions with functional teams to define Agency Business, Functional and Technical requirements. 3. After vetting with teams and with other Agency staff, the requirements were completed. 4. Driven by requirements, teams completed remaining documents. (included demos, visiting SME’s, understanding best practices and surveys) 5. Business case ready for formal review Complete overall technology approach Finalize functional & technical requirements from all Agencies Define Business, Functional & Technical requirements

5. U.S. Department of Agriculture eGovernment Program 5 Background and Context - Our Approach The following are the major sections of the draft business case:  Overview Introduction Executive Summary Concept of Operations  Business Profile Performance Measures Functional Requirements  Risk Profile Risk Management Plan Early Adopters Plan  Financial Profile Cost Benefit and Alternatives Analysis  Technological Profile Technical Requirements Security Plan Telecommunications Plan Analysis of Existing Systems Technical Architecture Plan  Management and Planning Profile Project Plan Acquisition Plan These documents are posted on the USDA eGovernment website.

6. U.S. Department of Agriculture eGovernment Program 6 Background and Context - What is eAuthentication? eAuthentication verifies a user’s identity when accessing online services…  USDA’s eAuthentication solution will consist of a set of products and services to authenticate the identity of persons accessing USDA’s online offerings.  USDA’s eAuthentication approach will include the use of: Electronic signatures (eSignatures) which allow a user to “sign” an online transaction. An eSignature signals a person’s consent, approval, or acknowledgement. An electronic signature can take many forms, such as a name typed at the end of an email message, a digitized image of a handwritten signature, or even a secret code or PIN that identifies the sender to the recipient; and Digital signatures, a more advanced electronic signature, that support greater levels of confidentiality, integrity, and non-repudiation.

7. U.S. Department of Agriculture eGovernment Program 7 Business Requirements  Help facilitate transformation of the way USDA conducts its business with Citizens and Public and Private Organizations (outward facing only).  Integrate fully with the Presidential eAuthentication Gateway.  Reuse “credentials” and share common access across all Government resources.  Support compliance with related legislation.  Government Paperwork Reduction Act (GPEA), immediate focus is to support agency implementation efforts to meet the October 2003 GPEA deadline;  Electronic Signatures in Global and National Commerce Ace (E-Sign); and  Freedom to E-File Act.  Support Agency eGovernment initiatives.  Provide different levels of Authentication - a range of solutions from low to high assurance;  Support requirements for availability, confidentiality, integrity, and non-repudiation; and  Support requirements for security services.

8. U.S. Department of Agriculture eGovernment Program 8 Business Requirements  Provide a suite of products and services for Agencies to use across the Enterprise. Existing solutions will be leveraged to the extent possible/practicable and external solutions will be used to complete the suite;  Leverage security best practices. A consolidated approach can ensure that each Agency is drawing upon the best authentication solutions to ensure proof of identify and to protect the confidentiality and sensitivity of data in the applications;  Integrate USDA resources with other Government resources as part of the Presidential Initiative;  Improve the user’s experience by not requiring multiple authentication credentials, such as multiple passwords or certificates;  Promote both interoperability and enhanced security across USDA applications; and  Reduce the cost associated with the development and maintenance of multiple sets of authentication solutions.

9. U.S. Department of Agriculture eGovernment Program 9 Existing USDA Services That May be Leveraged National Finance Center’s Public Key Infrastructure  The NFC has developed a PKI to provide secure e-commerce over the Internet and satisfy Agency requirements for strong authentication.  Certified by the Federal Bridge Authority.  Supports Government to Government transactions only. Web Central Authentication and Authorization Facility (WebCAAF)  Three county-based Agencies, FSA, NRCS, and RD, have implemented WebCAAF.  WebCAAF currently provides authentication services to 40,000 employees and 2,000 farmers.  Several web farms provide both a network and administrative infrastructure, and a security architecture that authenticates users.  Supports Government to Citizen and Government to Business transactions. Only OCIO-approved Authentication solutions will be leveraged. Opportunities include: The Agricultural Marketing Service’s Livestock Mandatory Price Reporting (MPR)  Web-enabled, Government to Business database management system.  Using PKI security technology, the system electronically accepts the data from the livestock industry, archives the data, validates and analyzes the data, produces and stores aggregated data, and creates industry reports for distribution to the public via the USDA's web site.

10. U.S. Department of Agriculture eGovernment Program 10 Alternatives Analyzed  Alternative 1 - Status Quo Approach USDA Agencies individually acquire and manage authentication solutions. Advantage of this approach is early availability, but the disadvantages are high implementation and maintenance costs of disparate authentication solutions, possible lack of interoperability, and multiple sets of customer credentials.  Alternative 2 - Combination of Alternative 1 and Alternative 3 Offers individual Agencies flexibility to select their own solutions for unique business needs but uses a consolidated approach for most authentication solutions. Disadvantages are possible lack of interoperability and multiple sets of customer credentials.  Alternative 3 - Managed eAuthentication Approach – Recommended Alternative Offers multiple products and services tailored to fit Agency needs. Requires some application reengineering to ensure current authentication mechanisms are supported. Offers economy of scale and cost reductions since resources are Enterprise-wide. Allows for re-usability of resources as new applications are developed. Intends to leverage approved USDA Authentication solutions. Improves ability to share credentials across USDA services and with Government and business partners. Eases integration with the Presidential Initiative for eAuthentication. Three implementation alternatives were considered for eAuthentication.

11. U.S. Department of Agriculture eGovernment Program 11 Conceptual Approach IRSHHSUSDADept of Ed. Federal eAuthentication Gateway USDA Services USDA Authentication mechanism USDA.Gov Agency.gov no access access Credential directory First Gov Portal

12. U.S. Department of Agriculture eGovernment Program 12 Conceptual Approach Federal eAuthentication Gateway USDA Services USDA Authentication mechanism access Credential Directories USDA Agency.gov USDA.gov No access USDA.gov IRS.gov IRS Authentication mechanism IRS Agency.govIRS.gov IRS Services access No access

13. U.S. Department of Agriculture eGovernment Program 13 Summary of Costs and Benefits The managed eAuthentication approach offers several quantitative benefits. Benefits accrue from:  Reduced management and maintenance of user roles  Increased Customer usability  Reduced Authentication system maintenance  Economies of scale purchasing  Consolidation of business processes

14. U.S. Department of Agriculture eGovernment Program 14 Timeline and Milestones The recommended eAuthentication approach will be implemented in phases. MilestoneDescriptionDate Achieved 1Pre-Implementation Tasks – Tasks that must be performed prior to implementation. These initial tasks include evaluating opportunities across the government, integrated eGovernment Reporting, as well as creating and configuring the technology infrastructure and physical network. Q2 FY2003 - Q3 FY2003 2GPEA Compliance Implementation – A full implementation of Authentication products & services for GPEA compliance. This implementation includes project planning, design, conversion, and workforce transition activities. Q3 FY2003 – Q4 FY2003 3Expanded Implementation – Similar set of tasks as the GPEA Compliance Implementation with the same Release 1 functionality. During this time, USDA Agencies will integrate additional transactions with the authentication services. Also includes increased integration with expanded government-wide services. Q1 FY2004 – Q1 FY2005 4Additional Functionality Releases – Additional functionality will be added after refining application requirements during the previous year,. These additional functionality releases are called Release 2 and Release 3 and will be implemented for Agency use during FY05 and FY06 respectively. Q1 FY2005 - Q4 FY2006

15. U.S. Department of Agriculture eGovernment Program 15 Timeline and Milestones USDA Agencies will adopt the eAuthentication solutions over the next five fiscal years…

16. U.S. Department of Agriculture eGovernment Program 16 Next Steps The Next Steps to begin implementing the eAuthentication initiative are:  Integrated eGovernment Reporting Analyze detailed transaction-by-transaction data from agencies to identify needed levels of assurance.  USDA Approval and Funding Incorporate review comments into the draft business case and seek EITIRB approval; and Secure funding for eAuthentication project (FY03, FY04, and FY05).  OMB Approval Seek approval from OMB for FY05 budget cycle.  Project Establishment and Kick Off Select project manager(s) for implementation phase; and Identify and staff project team to support implementation.  Conduct Pre-Implementation Tasks Refine application requirements; Evaluate USDA existing Authentication mechanisms against requirements; Begin integration with the GSA eAuthentication gateway; and Begin design of development and production environments.