# Presentation: 411383

## Update on NOAA IT Security and 30-Day Assessment

- Joseph KlimaviczNOAA CIO
- February 13, 2007

## IT Security Update

- Certification and Accreditation (C&A) Status
- 134 IT systems total
- 98 IT systems secure
- 36 IT systems without full Authority to Operate (ATO)
- 32 IT systems ATO will expire in CY07
- C&A Way Forward
- ATO for 23 of 36 systems without an ATO by end of March
- ATO for 30 of 32 systems with expiring ATOs by the end of CY07
- 4 systems without valid ATO at the end of CY07
- Encryption
- Laptops:  55% are FIPS 140-2 encrypted
- Personal Digital Assistants (PDAs)
- Ongoing efforts to capture inventory in CAO database
- Product issues have delayed PDA encryption

## IT Security Update

**What We’ve Done**
- Detailed 2 people from IT operations to IT security
- Worked with DoC CIO to identify C&A automation tool
- Met with DoC IG:
- Debrief 2006 C&A results
- Described 2007 C&A expectations
- Met with all LO CIOs:
- Assessed IT security and built integrated C&A schedule
- Identified 10 packages to submit to DoC IG** **
- Personally Identifiable Information (PII) Implementation, and IT Security Training memorandums distributed
**Plans**
- Meet with OMB to discuss priority IT security needs
- Schedule for FISMA C&A packages:
- April 1, 2007  to NOAA OCIO
- May 1, 2007  to DoC CIO
- June 1, 2007 to DoC IG

## Future IT Security Management

**Future IT Security Management**

***IT Security***
***Effort***

***Line Office  System Owners***

***Line Office***
***IT Security***
***Officers***

***OCIO IT Security Officers***

***IT ***
***Security***
***Effort***

- “As is”

- “To be”

- Centralized Policy
-   Insufficient asset management, processes, automation, and change control

- Decentralized
- Implementation

- Decentralized
- Monitoring

- Centralized policy/governance,
- NOAA-wide processes,  monitoring, and metrics,
- comprehensive architecture,
- and workforce plan

- Conduct Risk Assessment
- Implement Controls
- Provide Documentation

- Quality Assurance
- Data Validation
- Guidance to System Owners

## Path Forward Guiding Principles for IT

- Simplify, standardize, automate
- Reduce burden and add value
- Plan, invest and implement NOAA-wide
- Focus on enterprise-wide solutions
- Consolidate and eliminate duplication, e.g. NOAAnet
- Be creative with recruiting and retaining talent
- Professional program management

**Common Solutions to Common Problems **
**to Improve Service and Reduce Cost**

**Notes:**
Connect the dots end-to-end

Security is tied to the plans
Security:
Vulnerable – multiple servers, access points
Incidents of failure to act – more consolidation decreases the amount of failures to act

## What Has Been Done

***Lead NOAA IT***

***Transform NOAA IT ***

**What Has Been Done**

**Security**
- Established security metrics
- Reallocated 2 people to security
- Worked with NOAA CFO to fund IT Security from earmarks
- Worked with DoC CIO to identify C&A automation tool
- Met with DoC IG
- Built integrated C&A schedule
- Identified 10 packages to submit to DoC IG** **
- Defined PII Implementation
**OCIO Role**
- Conducted All-Hands
- Met with most key stakeholders and visited several operations
- Developed revamped OCIO web-pages
- Instituted daily mission readiness meetings
**IT Talent**
- All vacancies being advertised
**Technology**
- Inventory of systems

***Build NOAA’s OCIO***

***Strengthen******NOAA’s IT ******Security***

***Understand what NOAA has and what NOAA needs***

## What Needs to be Done

*Plan:*  Develop actionable Enterprise Architecture to build in IT security, and develop IT Modernization Plan for FY10 per PDM
*Invest:** *Develop and implement comprehensive IT Workforce Improvement Plan to include the Line Organizations.   Identify Project $ and ITRB to approve expenditures >$25K
*Secure:**  *Develop and implement comprehensive Information Assurance Plan, and simplify, standardize and automate the processes
*Implement:**  *Establish NOAA CIO Program Management capability and link to Line Organizations’ execution

***Align Organization to Support These Key Priorities****** ***

## $

- NOAAnet PM
- Help Desk PM
- HPCC PM
- Others as needed

_**Notional Examples**_*** ***
- Help Desk

_**Program Funding and Execution**_Centers of Excellence (COE)_**  **_

_**Program Management and Leadership**_

- NOAAnet
- Ops/R&D HPCC

- Web Portal, Phones
- R&D HPCC

*CLASS*

*E-mail*

***OCIO***

***OAR ******COE***

***NWS***
***COE***

***NOS***
***COE***

***NESDIS***
***COE***

***NMFS***
***COE***

- Shared program management funding

- Oversight of funding, schedule and performance, to include Service Level Agreements

**$**

- Project $ identified and ITRB to approve >$25K expenditures
- (June 12, 2001 DoC memo)

- NOAA CIO input to LO CIO performance evaluation

***Providing Common Solutions to Common Problems***

_**Transforming NOAA IT**_

## What is a NOAA Center of Excellence?

**What is a COE?**
- An entity or single organization that is a “provider” for an operational capability that fulfills a cross-organizational need
- Centralized core IT operational functions
- Drivers of change
**Why have COE’s?**
- To achieve economies of scale for NOAA
- Institutionalize lessons learned and aggregation of expertise, i.e. “critical mass”
- To drive innovation and streamlined processes
**Why be a COE?**
- Resources to strengthen core skills
- Ability to direct resources on core skills
- Agency and Government-wide recognition for excellence

## Key Shifts to Transform NOAA IT 

| FROM... |  | ...TO |
| --- | --- | --- |
| Line Organization view |  | NOAA-wide view |
| Coordination and Collaboration |  | Consolidation and Integration |
| Optional participation |  | Responsible partnerships |
| Ad Hoc Processes |  | Explicit Operations and Authorities |
| Dispersed execution |  | Centers of Excellence |
| Stovepiped problems/solutions |  | Common problems/solutions |

***Unity of Effort****** ***

**Multiple/Duplicate Efforts **

***How do we shift to execution of NOAA-wide efforts?***

## Key Reasons to Transform NOAA IT 

| FROM... |  | ...TO |
| --- | --- | --- |
| No coordinated purchases |  | Economies of scale and increased ROI |
| LO best practices and tools |  | Shared blue prints and tool for success |
| Strong LO presence in specific arenas |  | Government-wide recognition for excellence |
| Uncoordinated request for IT modernization funding |  | One voice approaching OMB to get more funding |
| Difficulty getting upgraded/new IT |  | Simplified processes for IT upgrades |
| Not sure who has what/who does what |  | One place for who knows what and who has what |

***Common Solutions***

**Common Problems **

***What’s in it for me?***

## NOAA CIO Key Priority“Transformation Roadmap”

**Build COE’s ******** *****Transform IT ***

**Define and Build PMO ******** *****Manage IT Transformation ***

***Implement***
***Centers of Excellence***

***COE 1***

***COE 2***

***COE 3***

**Performance Metrics ******** Monitor Transformation **

- Define OCIO organization structure
- Review and Update Documentation and Policies
- Identify Project $ and ITRB to approve expenditures >$25K

**Lead: **LO CIO and OCIO PM
**Partners: **OCIO Staff, LO Staff
**Timeframe: **Apr on...

**Strengthen & Revitalize Plans ******** *****Plan IT Transformation***

- Build Security Embedded Architecture
- Information Assurance Plan
- IT Modernization Plan for FY10
- Develop IT Workforce Improvement Plan

**Lead: **OCIO “champion”
**Partners:  **IT committees, LO staff, other s
**Timeframe: **Feb - Apr

**Lead: **OCIO
**Partners:  **LO CIO’s, OCIO Staff
**Timeframe: **Feb - Apr

## Path ForwardShort-term Roadmap

| Jan 2007 | Feb 2007 | March 2007 | April 2007 |  |
| --- | --- | --- | --- | --- |
|  |  |  |  |  |

***30 Day Assessment***

***Leadership Team ***
***Alignment Session***

**Value ****Proposition**

***Implement***
***Centers of Excellence***

**Stakeholder Interviews**

_**NOAA-wide Strategy:**_
- Alignment on  objectives to support each IT priority goal
- 500 day Roadmap with success criteria
- Short term priorities and plans
- Performance Metrics
- Accountability for each initiative

**Work Team Planning**

***NOAA CIO 500 Day Plan***

- Understanding of stakeholder’s perspective on the current state
- Clarity on stakeholder’s priorities

_**NOAA-wide Strategy:**_
- Draft NOAA-wide IT priority goals
_**OCIO Implementation:**_
- OCIO Vision, Mission, & Value Proposition
- OCIO organizational realignment plan w/PMO
- Draft OCIO & CIO Council priority plans (e.g. IA Plan, Workforce Improvement Plan, EA with IT Security, IT Modernization Plan)

***CIO ***
***Council***
***Briefing***

***Leadership Team ***
***Alignment Session***

***COE 1***

***COE 2***

***COE 3***

***NEP/NEC Briefing***

## Secure

***Information Assurance ***
***1***

***IT Policy, Planning and Architecture  ***
***1***

***IT Resource Management***
***0***

***IT Program Management***
***0***

**High Performance Computing and Communications (HPCC) Office – 2.5**

**Homeland Security Program Office – 5**

- NOAA CIO Council
- HPC Board
- NITRB

***IT Operations and Support***
***4***

***Secure***

***Plan***

***Invest***

***Implement***

***Operate***

**Budget and Administration – 6/1**

- GEOLoB/FGDC
- NEP
- NEC
- NOSC
- PMC

***Oversight***

- Cyber Security
- 4 / 2 vac

- Risk Management and
- Incident Response
- 0

- Compliance Management
- 1

- Privacy and Records Management
- 0

- Enterprise
- Architecture
- 0/ 1 vac

- Business
- Relationship
- Management
- 0

- IT Strategy, Planning,
- and E-Gov
- 1

- IT Policy
- Management
- 3

- IT Capital Planning
- And Portfolio Management
- 2

- Asset Management
- 0

- Vendor/Supplier Management
- 0

- IT Workforce Management
- 0

- Performance and
- Results-Based Management
- 1

- NOAAnet (PM) - 1

- NOAA Executive and Staff Office Support
- 30 / 1 vac

***Other Ops ***
- Boulder Library - 7 / 1 vac
- Network Operations - 10
- Phones - 2

- Help Desk (PM) - 1

- Corporate Business Applications
- 24

- Phones (PM) - 1

- Web Portal (PM) - 1  unfunded

**Notes:**

I did a bottom up review of the org; Gartner, VA and others

## Summary

- Agreement on Priorities
- Agreement on Approach
- Agreement on Path Forward

## Backup

## 30-Day Assessment 

- IT security fragmented and lacks enterprise-wide controls, standards and tools
- OCIO role and authority not exercised in NOAA
- “One NOAA IT” progress limited
- NOAA IT has not evolved with industry best practices
- Lack of focus on attracting, retaining and growing IT talent

***OCIO Should be the Flagship of NOAA IT***

## Gartner IT Maturity ModelIndustry Best Practices