# Presentation: 511250

## eGovernment Program

eAuthentication Draft Business Case
Executive Summary

January 2003

**eAuthentication Draft Business Case**
- Executive Summary
- January 2003

## Agenda

**Business Case Team Roster**
**Background and Context**
**High Level Business Requirements**
**Existing USDA Services to be Leveraged**
**Alternatives Analyzed**
**Conceptual Approach**
**Summary of Costs and Benefits**
**Timeline & Milestones**
**Next Steps**

**Notes:**
High energy Welcome.

Get jazzed.  

Good things are happening:

	EITIRB meeting tomorrow for 30 minutes exclusively on 	eGov

	EC and I will be meeting with DS ideally this week as well 	but may slip to next week

	Relatively positive feedback from OMB based on our 	efforts – only Yellow

Thanks for efforts to date.  Time to roll up sleeves again.

## Business Case Team Roster

***The following people assisted in the development of this business case:***

## Background and Context - Our Approach

**Background and Context - Our Approach**

***For the past 90 days, cross-Agency teams have been working to define USDA eAuthentication business needs.***

**The business case includes all sections required by the CPIC process**
**The process the teams followed to complete the business case is as follows:**

- Form cross-Agency teams

- Review,modify, anddeliver draftbusinesscase

- Review anditeraterequirements

- Completeremainingbusinesscasedocuments

- 1. Met with Agencykey contactsand receivednames ofparticipants.

- 2. Facilitated breakoutsessions withfunctional teams todefine AgencyBusiness, Functional and Technicalrequirements.

- 3. After vetting withteams and withother Agencystaff, therequirementswere completed.

- 4. Driven by requirements,teams completedremainingdocuments.(included demos,visiting SME’s, understanding bestpractices and surveys)

- 5. Business caseready for formalreview

- Completeoveralltechnologyapproach

- Finalizefunctional & technicalrequirementsfrom allAgencies

- DefineBusiness, Functional & Technical requirements

## Background and Context - Our Approach

***The following are the major sections of the draft business case:***

**Overview**
- Introduction
- Executive Summary
- Concept of Operations
**Business Profile**
- Performance Measures
- Functional Requirements
**Risk Profile**
- Risk Management Plan
- Early Adopters Plan

**Financial Profile*** *
- Cost Benefit and Alternatives Analysis
**Technological Profile*** *
- Technical Requirements
- Security Plan
- Telecommunications Plan
- Analysis of Existing Systems
- Technical Architecture Plan
**Management and Planning Profile**
- Project Plan
- Acquisition Plan

***These documents are posted on the USDA eGovernment website.  ***

## Background and Context - What is eAuthentication?

***eAuthentication verifies a user’s identity when accessing online services... ***

**USDA’s eAuthentication solution will consist of a set of products and services to authenticate the identity of persons accessing USDA’s online offerings. **
**USDA’s eAuthentication approach will include the use of:**
**Electronic signatures (eSignatures) which allow a user to “sign” an online transaction.  An eSignature signals a person’s consent, approval, or acknowledgement. An electronic signature can take many forms, such as a name typed at the end of an email message, a digitized image of a handwritten signature, or even a secret code or PIN that identifies the sender to the recipient; and **
**Digital signatures, a more advanced electronic signature, that support greater levels of  confidentiality, integrity, and non-repudiation.  **

**Notes:**
High energy Welcome.

Get jazzed.  

Good things are happening:

	EITIRB meeting tomorrow for 30 minutes exclusively on 	eGov

	EC and I will be meeting with DS ideally this week as well 	but may slip to next week

	Relatively positive feedback from OMB based on our 	efforts – only Yellow

Thanks for efforts to date.  Time to roll up sleeves again.

## Business Requirements

**Help facilitate transformation of the way USDA conducts its business with Citizens and Public and Private Organizations (outward facing only).**
**Integrate fully with the Presidential eAuthentication Gateway.**
**Reuse “credentials” and share common access across all Government resources.**
**Support compliance with related legislation.**
- Government Paperwork Reduction Act (GPEA), immediate focus is to support agency implementation efforts to meet the October 2003 GPEA deadline;
- Electronic Signatures in Global and National Commerce Ace (E-Sign); and
- Freedom to E-File Act.
**Support Agency eGovernment initiatives.**
- Provide different levels of Authentication - a range of solutions from low to high assurance;
- Support requirements for availability, confidentiality, integrity, and non-repudiation; and
- Support requirements for security services.

**Notes:**
High energy Welcome.

Get jazzed.  

Good things are happening:

	EITIRB meeting tomorrow for 30 minutes exclusively on 	eGov

	EC and I will be meeting with DS ideally this week as well 	but may slip to next week

	Relatively positive feedback from OMB based on our 	efforts – only Yellow

Thanks for efforts to date.  Time to roll up sleeves again.

## Business Requirements

**Provide a suite of products and services for Agencies to use across the Enterprise. Existing solutions will be leveraged to the extent possible/practicable and external solutions will be used to complete the suite;**
**Leverage security best practices.  A consolidated approach can ensure that each Agency is drawing upon the best authentication solutions to ensure proof of identify and to protect the confidentiality and sensitivity of data in the applications;  ****	**
**Integrate USDA resources with other Government resources as part of the Presidential Initiative;**
**Improve the user’s experience by not requiring multiple authentication credentials, such as multiple passwords or certificates; **
**Promote both interoperability and enhanced security across USDA applications; and**
**Reduce the cost associated with the development and maintenance of multiple sets of authentication solutions.**

## Existing USDA Services That May be Leveraged  

***National Finance Center’s Public Key Infrastructure***
**The NFC has developed a PKI to provide secure e-commerce over the Internet and satisfy Agency requirements for strong authentication.  **
**Certified by the Federal Bridge Authority.**
**Supports Government to Government transactions only. **

***Web Central Authentication and Authorization Facility (WebCAAF)***
**Three county-based Agencies, FSA, NRCS, and RD, have implemented WebCAAF.**
**WebCAAF currently provides authentication services to 40,000 employees and 2,000 farmers.  **
**Several web farms provide both a network and administrative infrastructure, and a security architecture that authenticates users.**** **
**Supports Government to Citizen and Government to Business transactions.**

***Only OCIO-approved Authentication solutions will be leveraged.  Opportunities include:***

***The Agricultural Marketing Service’s Livestock Mandatory Price Reporting (MPR)****** ***
**Web-enabled, Government to Business database management system.  **
**Using PKI security technology, the system electronically accepts the data from the livestock industry, archives the data, validates and analyzes the data, produces and stores aggregated data, and creates industry reports for distribution to the public via the USDA's web site. **

**Notes:**
High energy Welcome.

Get jazzed.  

Good things are happening:

	EITIRB meeting tomorrow for 30 minutes exclusively on 	eGov

	EC and I will be meeting with DS ideally this week as well 	but may slip to next week

	Relatively positive feedback from OMB based on our 	efforts – only Yellow

Thanks for efforts to date.  Time to roll up sleeves again.

## Alternatives Analyzed

**Alternative 1 -  ****Status Quo Approach**
- USDA Agencies individually acquire and manage authentication solutions.
- Advantage of this approach is early availability, but the disadvantages are high implementation and maintenance costs of disparate authentication solutions, possible lack of interoperability, and multiple sets of customer credentials.
**Alternative 2 -   ****Combination of Alternative 1 and Alternative 3**
- Offers individual Agencies flexibility to select their own solutions for unique business needs but uses a consolidated approach for most authentication solutions.
- Disadvantages are possible lack of interoperability and multiple sets of customer credentials.
**Alternative 3 -  Managed**** eAuthentication Approach – Recommended Alternative**
- Offers multiple products and services tailored to fit Agency needs.
- Requires some application reengineering to ensure current authentication mechanisms are supported.
- Offers economy of scale and cost reductions since resources are Enterprise-wide.
- Allows for re-usability of resources as new applications are developed.
- Intends to leverage approved USDA Authentication solutions.
- Improves ability to share credentials across USDA services and with Government and business partners.
- Eases integration with the Presidential Initiative for eAuthentication.

***Three implementation alternatives were considered for eAuthentication.***

## Conceptual Approach

- IRS

- HHS

- USDA

- Dept of Ed.

- Federal eAuthentication Gateway

- USDA Services

- USDA
- Authentication
- mechanism

- USDA.Gov

- Agency.gov

- no access

- access

- Credential directory

- First Gov Portal

## Conceptual Approach

- Federal eAuthentication Gateway

- USDA Services

- USDA
- Authentication
- mechanism

- access

- Credential
- Directories

- USDA
- Agency.gov

- USDA.gov

- No access

- No access

- USDA.gov

- IRS.gov

- IRS
- Authentication
- mechanism

- IRS Agency.gov

- IRS.gov

- IRS Services

- access

- No access

- No access

## Summary of Costs and Benefits

***The managed eAuthentication approach offers several quantitative benefits.***

**Benefits accrue from**:
- Reduced management and maintenance of user roles
- Increased Customer usability
- Reduced Authentication system maintenance
- Economies of scale purchasing
- Consolidation of business processes

## Timeline and Milestones

***The recommended eAuthentication approach will be implemented in phases.  ***

| Milestone | Description | Date Achieved |
| --- | --- | --- |
| 1 | Pre-Implementation Tasks  – Tasks that must be performed prior to implementation.  These initial tasks include evaluating opportunities across the government, integrated eGovernment Reporting, as well as creating and configuring the technology infrastructure and physical network. | Q2 FY2003 -       Q3 FY2003 |
| 2 | GPEA Compliance Implementation – A full implementation of Authentication products & services for GPEA compliance.  This implementation includes project planning, design, conversion, and workforce transition activities. | Q3 FY2003 –      Q4 FY2003 |
| 3 | Expanded Implementation – Similar set of tasks as the GPEA Compliance Implementation with the same Release 1 functionality.  During this time, USDA Agencies will integrate additional transactions with the authentication services. Also includes increased integration with expanded government-wide services.  | Q1 FY2004 –      Q1 FY2005
 |
| 4 | Additional Functionality Releases –  Additional functionality will be added after refining application requirements during the previous year,.  These additional functionality releases are called Release 2 and Release 3 and will be implemented for Agency use during FY05 and FY06 respectively. | Q1 FY2005 -       Q4 FY2006 |

## Timeline and Milestones

***USDA Agencies will adopt the eAuthentication solutions over the next five fiscal years...***

## Next Steps

***The Next Steps to begin implementing the eAuthentication initiative are: ***
**Integrated eGovernment Reporting**
- Analyze detailed transaction-by-transaction data from agencies to identify needed levels of assurance.
**USDA Approval and Funding**
- Incorporate review comments into the draft business case and seek EITIRB approval; and
- Secure funding for eAuthentication project (FY03, FY04, and FY05).
**OMB Approval**
- Seek approval from OMB for FY05 budget cycle.
**Project Establishment and Kick Off **
- Select project manager(s) for implementation phase; and
- Identify and staff project team to support implementation.
**Conduct Pre-Implementation Tasks **
- Refine application requirements;
- Evaluate USDA existing Authentication mechanisms against requirements;
- Begin integration with the GSA eAuthentication gateway; and
- Begin design of development and production environments.