# Presentation: 197239

## Slide 1

## CIO Vision:

***CIO Vision:***
***Deliver timely, high-quality, leading edge information technology guidance, products, and services, to support departmental mission requirements, and priorities.***

**Notes:**
Started with the DOC June 12, 2006.

DCIO-John McManus Started November 06

OCIO – Approximately 3100 IT Professionals throughout the Department.
	-  100 staff (Government and Contractors within OCIO)
     -  Five (5) Major OCIO Branches
        1.  Office of IT Policy and Planning
        2.  Office of IT Security Infrastructure and Technology
        3.  Office of Systems Development and Support
	  4.   Office of Networking and Telecommunications
       5.   Office of Computer Services		

## Successful Integration and Transformation

**Strategic Planning** –Describes and defines the over-arching, high-level strategic initiatives, including critical milestones and resource requirements.

**Enterprise Architecture** – Aligns business and IT strategy and planning; defines portfolio of investments to maximize ROI.

**Capital Planning and Investment – **Review, oversight and advice for effective IT Investment and portfolio management.

**Project Management Office (PMO)**** –**** **Promotes delivery of projects and investments to implement strategy; reporting of status, and project health to feed Capital Planning & Investment Control.

**Notes:**
(Animation –4 Clicks)

## On-going Strategic Initiatives for FY07

- _IT Cyber Security_
- _Protection of Personally Identifiable Information (PII) _
- _HSPD-12 Full Implementation_
- _Email Consolidation_
- _IPv6 Transition_
- _Project Management Office (PMO)_
- _Consolidation/Transformation-Helpdesk, Servers, etc._
- _Enterprise Architecture_

## Project Management Office

*Projects are the tools to implement strategy and effect change; failure to effectively manage projects jeopardizes strategic plans and the future of our organization.*

-   Provide departmental _**policy, guidance and resources**_ to support Bureau
-     requirements.
-   Provide _**better customer support**_ – deliver projects on time, within budget, within
-    scope.
-   Provide _**certified government Program Managers**_ to manage Projects.
-   Provide a framework for improving project management through _**systematic,**_
-     _**repeatable processes**__ _rather than by chance or luck.
-   Manage delivery of project results, departmental resource sharing, risk management
-    and budget control to _**achieve success and provide value delivery**_ to customers.

**Notes:**
(Animation – 1 Click)

## PMO Objectives

_**Strategic**__:_
- Enable DoC IT projects to deliver on time, within scope, within budget
- Promotes highest quality projects that are secure, reliable, and meet user requirements
_**Tactical**__:_
- Independent, project progress review
- Learning environment to encourage best practices, and lessons learned
- Monitors on a routine basis the over-all health of projects/programs
- Clearly outlines performance metrics, cost, schedule and risks

## Information Security Culture

- Establish a start-to-finish repeatable process
- Ensure consideration of information security throughout the system life cycle
- Train personnel to implement acceptable security practices
- Monitor continued effectiveness of policies, procedures, and practices

## C&A Responsibilities

**Notes:**
Green space to the left reflects responsibilities within OCIO.

Blue space to the right reflects responsibilities outside of OCIO.

“Certifying Official” is an independent third party that is not included in the management of the system

## Challenges

**Adequacy of supply of IT Security Professionals**

**Experience and quality of Contractors**

**Institutional knowledge**

**Resources Required for testing**

**Magnitude/Scale of task**

**Budget**

**Policy and Guidance**

## Personally Identifiable Information (PII)

| Reporting Incidents Involving Personally Identifiable Information |
| --- |
| DOC Federated Computer Incident Response Team responding to OMB M-06-19 |

| PDA Security |
| --- |
| Establish policy for PDAs |

| Categorization of Sensitive Data |
| --- |
| Task Force to define requirements.   (Awaiting clear policy/definition of PII, Sensitive Personal Information, and other categories.) |

| Protection of Sensitive Agency Information |  |
| --- | --- |
| Task Force Responding to OMB M-06-16 |  |
|   |   |

| DOC Remote Access Policy |
| --- |
| Review DOC Remote Access Policy for compliance with OMB and DOC Task Force recommendation   |

- New policy and guidance governing PII use and storage
- Weekly status reporting to senior executives
- Close coordination with property management organization
- Strict reporting and tracking by computer incident response teams

**Notes:**
Personally Identifiable Information 

OMB Guidance M-06-16 dated June 23, 2006-Provided extensive guidance on the Protection of Sensitive Agency Information. Encrypting Laptops, Time-outs on PDAs, Remote Access, two-factor authentication, etc.

OMB Guidance M-06-19 dated July 12, 2006-Guidance on reporting incidents involving PII.  All Incidents involving PII must be reported with 1-hour to US Computer Emergency Response Team (US CERT).

OMB Guidance (No Number) dated September 20, 2006 on the Formulation of an Agency Response to address Identity Theft Related Data Breaches.

## PII Risk Analysis Matrixwith Presumptive Responses 

**No controls**

**Password**

**Auto-wipe**

**Encryption**
**(FIPS 140-2)**

**Full controls**

**Likelihood of Unauthorized Use or Access**

**Telephone**
**Book**

**DOB**
**POB**

**SSN**

**Financial**

**BI/HR**

**Risk of Harm**

-  SSN:  Social Security Number
-  BI:  Background Investigation
-  HR:  Human Resources

**Presumptive response, subject to additional information**

_**HIGHER**_

_**LOWER**_

_**HIGHER**_

_**LOWER**_

**Notes:**

Draft matrix was vetted with bureau CIOs and their staffs.
	no substantive objections.
	requests for more granularity among the 5 x 5 categories.

Matrix approach endorsed by DepSec and Sec.

We want to finalize the decision matrix very soon. 

Discussion item:  are we going to set parameters or thresholds around #s of losses that trigger a response (victim letter, credit monitoring)?  Or will we take a conservative approach and send letters for even 1 PII loss?

## HSPD-12 Status

- Met OMB requirement—produced PIV-2 compliant card by October 27th
- Commerce specific requirements provided to GSA:
- Proximity antenna
- Interface to FBI fingerprint system
- Compliance with FIPS 201 and all associated Special Publications (including SP 800-79, SP 800-37)
- Working with GSA to support efforts for new HSPD-12 solution provider
- New GSA Contract just awarded April 2007
- Credentialing for contractors and subset of federal employees required by October 2007
- 100% compliance by October 27, 2008

## HSPD-12 Initial Deployment

- Original schedule: 60-75 days after April 23 contract award, GSA begins deployment of 8 stations- week of June 25 or July 9. (*Protest may impact dates*)
- DOC installations begin week of July 9 or July 23

**(2)**

## Email Consolidation

-   Transition to one departmental email system that will support all staff and Bureaus
-   Selection of Microsoft Outlook/Exchange as the standard 2/27/2007
-   Migration of DOC employees started April 2007
-   Completion of Office of the Secretary by October 1, 2007

**Notes:**
Do not address too many details or discuss future plans/rollow-on requirements

## Departmental Shared Services

## IPv6 Implementation

- IPv6 Implementation

- Policy and Guidance:  OMB Memorandum 05-22
- By November 15, 2005
- Identify an IPv6 agency lead
- Complete 1st inventory of IP-aware hardware devices in network Core
- By February 28, 2006
- Develop a network Core transition plan for IPv6
- Complete an IPv6 progress report
- By June 30, 2006
- Complete 2nd inventory of IP-aware applications and peripherals with dependencies on network Core
- Complete an IPv6 transition impact analysis
- By June 30, 2008
- Complete network Core transition to IPv6

**Notes:**
OMB has directed agencies to transition their network backbone over to IPv6 by June 30, 2008.  OMB Memorandum 05-22 requires agencies to take several specific actions along the way from now until June of 2008.

OMB felt that the best way to spark agencies to begin thinking and planning for the emergence of IPv6 in the marketplace was to require them to make the backbone “IPv6-ready”.   OMB wanted to push agencies to prepare for what we believe is the inevitable future of networking and internet technology around the world.  OMB wants agencies to get their infrastructure ready TODAY, to support the applications and technologies that will emerge around IPv6 in the future.

## IPv6Success Criteria for June 2008

- Agencies need to be able to demonstrate they are capable of performing at least the following functions, without compromising IPv4 capability or network security:
- Transmit IPv6 traffic from the Internet and/or external peers, through the Core, to the Access & Distribution networks
- Transmit IPv6 traffic from an Access or Distribution network, through the Core, out to the Internet and/or external peers
- Transmit IPv6 traffic from an Access or Distribution network, through the Core to another Access or Distribution network (or another node on the same Access or Distribution network)

## DOC Current Network State

- Multiple Providers
- No common Routing Protocol
- Multiple COOP Facilities
- No Centralized Management of Network Address Space

- IT Infrastructure Supporting:
- Over 45,000 Employees
- Over 200 Office locations located worldwide

## DOC Future Network End State

- Common Multi-service High Speed Backbone
- Co-located COOP sites
- Common DOC Application Development Environment
- Co-located datacenters at all  DOC campuses
- True Enterprise Management

- Site A

- Site B

- Site C

- Site D

- Site E

## How does it all fit together?

***Leveraging all three facets enables effective and efficient deployment of new services and technologies***

- Strategic Goals and Objectives provide the direction
- IT must align with these and provide the systems and services needed
- Programs and Projects are formulated to support the Goals and Objectives
- CPIC prioritizes Programs and Projects
- Disciplined Execution
- Adopt the strengths of an existing program / project management process

- Commerce Strategic Goals and Objectives

- Formulation

- Execution

- External
- Influence

## Closing

- The landscape includes a Department rich in tradition, with strong mission areas and deep ties to the private and commercial sector
- The IT base is solid with an extremely knowledgeable, creative and innovative workforce
- FY07 Strategic Initiatives are in various stages of progress,           some in testing, a few in procurement and several ready for department-wide deployment
- We will continue to maximize opportunities to improve, enhance and transform the technology base in support of the mission areas, taking advantage of leading edge technologies and methodologies

**Notes:**
(Animation – 4 Clicks)

## 

Questions

**Questions**