# National Science Foundation Business and Operations Advisory Committee 

April 25, 2003

Mr. Thomas N. Cooley

Director, Office of Budget, Finance,

and Award Management

Mr. Anthony Arnolie

Director, Office of Information and

Resource Management

Dear Mr. Cooley and Mr. Arnolie:

The National Science Foundation's (NSF) Advisory Committee on Business
and Operations met on April 8, 2003 to consider issues that highlighted
"Planning for Safety and Security." The meeting commenced with opening
remarks by Mr. Tom Cooley, Director of the Office of Budget, Finance,
and Award Management and Dr. Nathaniel Pitts, Director of the Office of
Integrative Activities followed by an introduction of Mr. Anthony
Arnolie, NSF's new Director for the Office of Information and Resource
Management.

# *The committee offers the following thoughts and perspectives on the items discussed at the meeting.*

#  What's Been Happening

The committee formally welcomes Mr. Anthony Arnolie as Director of OIRM
and looks forward to working with him in the future.

The committee observes that the funding concerns outlined by Mr. Cooley
could have a significant impact on NSF's ability to uphold its
traditionally high levels of customer service if not addressed. In
particular, the committee was distressed to learn that the Congress did
not provide the modest increases in funding requested to support
additional personnel needed by the Foundation for Fiscal Year 2003. The
committee notes that the total number of NSF employees (FTE) is now
below that of many years ago. Further, even with the most up-to-date
productivity tools, NSF has now reached the point where its operations
will be adversely impacted if these personnel needs are not addressed by
the Administration and the Congress. The committee offers its assistance
to NSF in educating policymakers about this vital issue.

Of the "coming attractions" Mr. Cooley discussed, the committee notes
the increased prominence of issues related to grant monitoring and
oversight, and discussed the need for improved government-wide
coordination of these issues.

# Updates and Status Reports

[Business Analysis]{.underline}: The committee welcomes the information
on how the business analysis is engaging the external community, an
issue that was highlighted by the committee at its October 2002 meeting.
The committee also believes, based on the experience of committee
members with the survey of Principal Investigators (PIs) being conducted
as part of the business analysis, that NSF should supplement the survey
results with follow-up personal or telephone interviews of PIs.

[Review by the National Academy of Public Administration]{.underline}:
The committee is encouraged to see that NAPA has recognized at the
outset the need to coordinate its activities with the business analysis.
It encourages both NAPA and Booz Allen Hamilton to make special efforts
to establish a working relationship and to realize synergies from their
efforts to the maximum extent possible.

[Revised GPRA Strategic Plan]{.underline}: The committee notes two
important aspects of NSF's revised GPRA Strategic Plan: 1) it
establishes a goal for "Organizational Excellence," thereby focusing
equal attention on administration and management as has been focused on
NSF's People, Ideas, and Tools goals; 2) it seeks to establish a
framework for NSF's efforts to align budget, cost, and performance --
including the definition of "program" for the purposes of the PART
(OMB's Program Assessment Rating Tool). Because the public comment
period for the revised Plan will not coincide with any meetings of the
meeting, the committee plans to hold a teleconference over the summer to
discuss the draft Strategic Plan.

National Science and Technology Council Subcommittee on Research
Business Models

The committee wishes to express its support for and interest in the
agenda outlined by Dr. Constance Atwell of the National Institutes of
Health. The committee also believes a number of issues raised during its
discussion deserve further attention as the subcommittee's work
proceeds:

-   Ensuring that the subcommittee's agenda remains consistent with the
    President's Management Agenda.

-   Considering the impact of business practices on the culture of
    science and engineering, particularly as it relates to the dynamic
    of basic and applied research.

-   Exploring how grant monitoring and oversight can be manageable while
    also providing the needed level of accountability, especially when
    involving different types of institutions.

-   Seeking perspective from the President's Council on Integrity and
    Efficiency and the Inspector General (IG) community because they
    have audit cognizance over all of the grants.

The committee also would like to restate its offer of assistance to Dr.
Atwell and the NSTC subcommittee. The committee would like also to
recognize the importance of the subcommittee's work and the significance
of OSTP and the NSTC for the first time establishing a formal structure
for the systematic and thoughtful consideration of administration and
management issues.

# Meeting with NSF Director Rita Colwell and Deputy Director Joseph Bordogna

The committee found the discussion with Dr. Rita Colwell and Dr. Joseph
Bordogna to be especially productive and enlightening, and it wishes to
express its sincere thanks to them for taking the time to meet jointly
with the committee.

The committee also appreciates Dr. Colwell's initiative in asking the
committee to help determine the appropriate role for NSF in post-award
audit, monitoring, and oversight. The committee embraces this suggestion
and plans to make it the focus of its Fall 2003 meeting. Toward this
end, the committee believes a number of issues raised during the
discussion are important to incorporate into the agenda for the fall
meeting:

-   Reviewing "audit cognizance" -- as it relates to grantees having to
    respond to multiple audit requirements from multiple agencies.

-   Exploring the option of creating networks of institutions to share
    best practices for post-award management, such as linking more
    experienced institutions with non-traditional grantee institutions.

-   Examining ways to keep the NSF mission front and center so that
    post-award management issues do not constrain the progress of
    science and engineering.

-   Considering a range of options for establishing new processes, such
    as pilot programs, training and certification in audit and oversight
    for grantees, and engaging Congress in discussions of new approaches
    to developing audit standards.

-   Providing opportunity for input from the IG community.

The committee also expresses its appreciation to Dr. Colwell and Dr.
Bordogna for clarifying an important aspect of the committee's role and
purpose, notably that the committee's advice should be high-level and
strategic, in keeping with NSF's leadership role across the government.

# Information Security and Corporate Responsibility 

The committee welcomed the opportunity to hear a one-hour presentation
on corporate responsibility and information security breaches, presented
by guest speakers, Mr. Timothy Rosenberg and Mr. Ronald Plesco of
GWSolutions. The presentation included demonstrations of current events
outlining how unauthorized users have invaded individual and corporate
privacy and utilized the invasions to inflict serious harm on third
parties. Upon understanding the nature of the threat, the focus shifted
to the potential physical and resultant civil/criminal consequences.

The committee found the information to be both informative and
enlightening. The insight gained gave committee members a broader
perspective on how malicious users can use IT resources to commit crime
and inflict harm.

# Emergency Preparedness 

The committee heard from Ms. Mary Lou Higgs, Director of Administrative
Services and Dr. Stephen Prior, Research Director at the National
Security and Health Policy Center at the Potomac Institute for Policy
Studies regarding emergency preparedness and contingency planning, and
more specifically about how NSF is coordinating efforts with its
neighbors in the community. The committee commends NSF for being both
proactive and pragmatic in its approach to emergency preparedness. The
committee noted that NSF has accomplished this while focusing on the
best interests of NSF staff, their families, the community, and the
organization. The committee considers NSF a model for other agencies for
its work in emergency preparedness.

# IT Security 

The committee enjoyed a lively discussion generated by the IT Security
presentation given by Dr. George Strawn, NSF Chief Information Officer,
on the overall status of IT security. This presentation included NSF's
security management structure, the new NSF-wide security working group,
the certification and accreditation of major IT systems and disaster
recovery. Overall, the committee thought that NSF's approach to IT
Security is proactive and well executed. The committee observed that:

-   NSF needs to continue to be proactive in monitoring and "plugging
    holes" in the network.

-   While they have been successful, NSF must continue to be vigilant in
    following-up on IT security vulnerabilities particularly those
    associated with remote access.

-   NSF might be considered by other agencies to be a "model agency" for
    the work already devoted to disaster recovery and may want to
    consider sharing the strategies and knowledge gained with other
    agencies.

# Committee Discussion

The committee appreciates the information provided in the survey results
provided by the General Services Administrations, and it encourages NSF
to follow-up on two of the items highlighted in the survey.

First, the committee encourages NSF to foster more communication and
sharing of information between meetings.

Second, the committee encourages NSF to regularly provide feedback on
the ways its advice and guidance has been utilized.

Toward these ends, the committee is pleased to learn that NSF plans to
develop a web site for the committee -- modeled after the sites that
have been developed for other NSF advisory committees.

In closing, we hope these observations help to inform and guide the
Foundation as it addresses the range of issues discussed at the meeting.
We would like to thank the staff who helped make this meeting a
successful one. We look forward to reviewing anticipated progress on the
various issues discussed at this meeting and to discussing other
mission-critical issues at our next meeting.

On behalf of the committee,

Dr. Norine Noonan

Chair, April 8, 2003 Meeting