WHICH VA IT ORGANIZATIONAL

STRUCTURE WOULD HAVE BEST

PREVENTED VA’S “MELTDOWN” IN

INFORMATION MANAGEMENT

Hearing

before the

Committee on 

Veterans’ Affairs

House of Representatives

one hundred ninth congress

second session

June 28, 2006

Printed for the use of the Committee on Veterans’ Affairs

Serial No. 109-58

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC area (202) 512-1800

Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

u.s. government printing office

washington : 2007

28-454.PDF
Committee on Veterans’ Affairs

Steve Buyer, Indiana, Chairman

Michael Bilirakis, Florida Lane Evans, Illinois, Ranking

Terry Everett, Alabama Bob Filner, California

Cliff Stearns, Florida Luis V. Gutierrez, Illinois

dan burton, Indiana Corrine Brown, Florida

Jerry Moran, Kansas Vic Snyder, Arkansas

richard H. baker, Louisiana Michael H. Michaud, Maine

Henry E. Brown, Jr., South Carolina Stephanie Herseth, South 

Jeff Miller, Florida Dakota

John Boozman, Arkansas Ted Strickland, Ohio

Jeb Bradley, New Hampshire Darlene Hooley, Oregon

Ginny Brown-Waite, Florida Silvestre Reyes, Texas

Michael R. Turner, Ohio Shelley Berkley, Nevada

John Campbell, California Tom Udall, New Mexico

 John T. Salazar, Colorado

JAMES M. LARIVIERE, Staff Director

(II)
CONTENTS

June 28, 2006

 Page

1

 1

3

50

4

7

59

9

10

61

12

67

14

73

Which VA It Organizational Structure Would Have Best Prevented VA’s “Meltdown” In Information Management .........

OPENING STATEMENTS

Chairman Buyer .........................................................................

Hon. Bob Filner ..........................................................................

Prepared statement of Mr. Filner ..........................................

Hon. Sam Farr (introduction of his constituent, Robert J. 

Brandewie, Defense Manpower Data Center) .......................

Witnesses

Gauss, Hon. John A., Ph.D., President and Chief Operating Officer, FGM, Inc. (former Chief Information Officer, U.S. Department of Veterans Affairs) ................................................

Prepared statement of Hon. John A. Gauss ..............................

McFarland, Hon. Robert (former Assistant Secretary for Information and Technology, and former Chief Information Officer, U.S. Department of Veterans Affairs) .............................

Howard, MG Robert T. (Ret.), Senior Advisory to the Deputy 

Seretary Supervisor, Office of Information Technology, U.S. 

Department of Veterans Affairs...............................................

Prepared statement of Hon. Robert Howard .............................

Brandewie, Robert J., Director, Defense Manpower Data Center...............................................................................................

Prepared statement of Mr. Robert Brandewie ..........................

Bresson, Jim, Vice President and Managing Partner, Gartner 

Consulting ...............................................................................

Prepared statement of Mr. Jim Bresson ...................................

 

(III)
(1)

WHICH VA IT ORGANIZATIONAL STRUCTURE WOULD 

HAVE BEST PREVENTED VA’S MELTDOWN IN

INFORMATION MANAGEMENT

Wednesday, June 28, 2006

U.S. House of Representatives, 

Committee on Veterans’ Affairs,

Washington, D.C.

 The committee met, pursuant to call, at 10:40 a.m., in Room 334, 

Cannon House Office Building, Hon. Steve Buyer [chairman of the 

committee] presiding. 

 Present: Representatives Buyer, Bilirakis, Boozman, Filner, Brown 

of Florida, Brown-Waite, Udall, Salazar, Moran, Stearns, Herseth.

The Chairman. The full Committee of House Veterans’ Affairs Committee will come to order June 28th, 2006.

 Good morning, ladies and gentlemen. This is the fourth full Committee oversight hearing on the recent theft of sensitive information 

belonging to as many as 26.5 million veterans and 2.2 million servicemembers and their family members from a VA employee’s home 

in May of 2006.

 We will receive testimony today from current and former Department of Veterans Affairs’ Chief Information Officers. This testimony 

will help us examine the VA’s information technology reorganization 

and review the Secretary’s decision to move to a federated model versus a centralized approach recommended by VA’s own consultant, 

Gartner Consulting, which is one of the most leading-edge technology 

companies and they are experts with whom we have consulted.

 That judgment was also in the complete opposite direction to that 

which the House had recommended in the passage of legislation last 

year.

 This hearing will also focus on institutional barriers to an integrated departmental policy on cyber security and to protection of 

sensitive personal data presented by VA’s current IT organizational 

structure.

 Further, we will examine the implication of information security 

as it relates to the organization of VA IT. As we examine information 

management and security, two Federal statutes are of central impor-
2

tance, the Clinger-Cohen Act of 1996 and the Federal Information Security Management Act of 2002, more commonly known as FISMA.

The Clinger-Cohen Act created a Chief Information Officer for each 

Federal agency. As defined by the Clinger-Cohen, the CIO’s responsibilities include:

 One, assisting the agency head to ensure that IT is acquired and 

information resources are managed in a manner that implements the 

policies and procedures of the agency;

 Two, developing, maintaining, and facilitating a sound and integrated IT architecture for the agency;

And, three, promoting an effective and efficient design and operation of all major information resources management processes of the 

agency.

 This Committee’s examination of VA’s information management 

over the past eight years have clearly shown the extent and impact of 

information management decentralization at the VA.

 The Department’s CIO is not fully empowered to enforce policy and 

cannot fulfill either the letter or the intent of Clinger-Cohen.

 In our questioning last week of Tim McLain, the VA’s General 

Counsel, we saw how the Department’s lawyers in 2004 gave the narrowest of possible interpretations of then Secretary Anthony Principi’s decision to centralize IT authority.

 The General Counsel’s questionable opinion that his directive was 

outside the statutory authority of FISMA, I believe, was a contributing factor to the 16 unmitigated vulnerabilities. I have referred to his 

legal opinion as a heterodox legal opinion.

 The Federal Information Security Management Act or FISMA requires each agency to inventory its major computer systems, identify 

appropriate security protections, and develop, document, and implement an agency-wide information security program.

 FISMA also requires an annual independent review of agency information security program. This review assesses the effectiveness 

of the information security programs, plans, and compliance of FISMA.

The Office of Management and Budget is then required to compile 

a summary of Federal government security performance and report 

to Congress on the implementation of FISMA.

 In our hearing last week on academic and legal implications of the 

DA’s data loss, I said the Department does not identify who is in 

charge of developing policy, implementing policy, or enforcing policy.

The March 2006 FISMA report confirms my statement, indicating 

VA received a grade of “F” in a category on establishing and following 

information security policy.

 Today, despite evidence piled high over the years, the Department’s refusal to get control of its IT systems undermines efficiency, 

threatens the security of sensitive information, and endangers pa-
3

tient safety, despite the fact of the unprecedented data compromise 

that has revealed much larger problems related to decentralization.

 The centurions of the status quo in VA administrations, especially 

in its health administration, insist on protecting their turf, and veterans and families, I believe, could pay the price.

 Today through the eyes of two former VA CIO’s, Bob McFarland, 

Dr. John Gauss, we have unique opportunity to examine what occurred within the Department during the years that this evidence accumulated and was sadly disregarded by many who could have made 

a difference.

 We also welcome General Bob Howard, the VA’s Acting Assistant 

Secretary for Information and Technology; Robert Brandewie is the 

Director of Defense Manpower Data Center; and Jim Bresson is a 

Managing Partner and Vice President of Gartner Consulting.

 Gentlemen, we thank you in advance for your willingness to be 

here and to contribute to these proceedings. I believe your insights 

today will be extremely important.

 I also would like to recognize in the audience today, we have veterans from the Merchant Marines of World War II. We thank you for 

your presence. We welcome you to the Veterans’ Affairs Committee 

room, and we thank you for your service to country. You and your 

generation truly have made a difference in freedom of the world and 

you left liberty in your footsteps.

 I would like you to know we have some votes that are now about 

to occur. I will recognize Mr. Filner for an opening statement. And 

then I would welcome the Merchant Mariners to meet. There is a 

room directly behind.

 And what I will have is when we leave, I will turn you over to Kelly 

Craven, our Staff Director. Kelly is right here. Kelly, if you will 

stand up. And I will have Committee staff speak with the Merchant 

Mariners.

 Mr. Filner.

Mr. Filner. Thank you, Mr. Chairman, and thank you for your 

courtesy to the Mariners who are here.

 As you know, many are in their late seventies and eighties, served 

our country in World War II, had the highest casualty rates of any 

service in the war. And, yet, when the war was over, the GI Bill did 

not apply to them. And even later attempts to make up for a past 

injustice was not done. They missed out on the college education 

provided by the GI Bill, purchase of homes.

 As you know, Mr. Chairman, I have a bill House Resolution 23 

called a Belated Thank You to our Merchant Mariners of World War 

II. A majority of the Congress, over 260, have co-sponsored it. A majority of this Committee has co-sponsored it. And I think they would 

like to talk to you and your staff about trying to get a vote on that at 

some point in this Congress.
4

 So I appreciate your courtesy, Mr. Chairman. Am I recognized for 

the opening statement on this hearing?

 And we will have votes and the staff of both Democrats and Republicans will be talking to you and we will try to join you later during 

the hearing.

 Again, Mr. Chairman, your opening—

 The Chairman. Mr. Filner—

Mr. Filner. Yes, sir.

The Chairman. If I could do this by way of procedure. Mr. Farr of 

California is here and he would like to introduce one of the witnesses 

here today. Can we yield to Mr. Farr?

 Mr. Filner. Please.

The Chairman. Can we do that for an introduction?

 Mr. Filner. I will be happy to.

 The Chairman. Mr. Farr.

Mr. Farr. Thank you very much, Mr. Chairman and members of 

the Committee. It is a pleasure for me.

 I am a member of the Appropriations Subcommittee with this jurisdiction, the military quality of life and Veterans’ Affairs. And we 

had a similar hearing yesterday. In that hearing, the Chairman was 

there and I appreciate this effort.

 I want to just tell you that out in my district, I represent the former 

Ft. Ord, which is the largest military base ever closed in the United 

States, and out of that, the Department of Defense kept a Manpower 

Development Center there. It is a center where all of the personnel 

information for all of the people in the military and their families is 

kept.

 And it is available 24/7, and you get calls from all over the world 

from spouses wondering about healthcare insurance or about issues 

of family or soldiers or, you know, divorce status or all the kinds of 

data that one would have. And that center has been leading in helping the Department of Veterans Affairs with their security issues.

 And the fellow who has really done the work to keep this center a 

state-of-the-art, quality center in that is Robert Brandewie who is 

here as a speaker today. He has developed the Defense Biometric 

Identify System which has centralized the database. It integrates 

biometric and other information.

He has also received all kinds of awards and is now being considered as one of the four finalists for the 2006 Service to America Metal 

to be awarded in September. And it is just a pleasure to have somebody with such high skills and such incredible accomplishments come 

and share what they are actually doing on the ground to help men 

and women in uniform.

 So I thank you for allowing me to introduce my constituent to you 

and good luck with your Committee.

 The Chairman. Thank you very much, Mr. Farr. We appreciate 
5

your work on Appropriations as you work with us to come to these 

solutions and be of assistance to the VA. So thank you for your quality work.

 Members, we have one vote. It is a motion to adjourn. I would like 

to recess the Committee. When we return, then Mr. Filner will give 

an opening statement and we will proceed with testimony.

 The Committee stands in recess for about seven minutes.

[Recess.]

The Chairman. The Committee will come back to order.

 Mr. Filner, you are now recognized for an opening statement.

 Mr. Filner. Mr. Chairman, since we have kept these people waiting 

through the vote, I am going to submit my statement for the record. I

do agree with what you said and so I do not need to add anything.

 I would just like to add one little remark, if I may. Mr. Chairman, 

Secretary Nicholson said that they are going to correct this problem, 

but we have to be patient. And I think we know what he means by 

being patient, as you have been personally working on it. It took the 

VA at least seven years to address this problem.

And during our May 25th hearing, you directed VA officials to submit a chronology, time lines of events related to the handling of information related to the data loss, and you asked it for about ten days.

 I note that over one month has now elapsed since the breach, and 

we are still being asked to be patient to respond to your request. We 

might think about directing VA to provide these time lines by the 

end of close of business today. Maybe we should consider asking that 

they be prepared independently, have them signed under a perjury 

clause, witnessed and sealed by the Inspector General.

 We should have these time lines not only from the panel that we 

met with on May 25th, but also from the witnesses scheduled for 

tomorrow. I think it is time to send a message that we have been 

patient long enough.

 Thank you, Mr. Chairman.

[The statement of Bob Filner appears on p. 50] 

The Chairman. Mr. Filner, all members that may have opening 

statements will be submitted for the record. And I thank the gentleman for bringing that issue back to the Chair’s attention.

 I note that sitting in the audience is the Deputy Secretary, and if 

you could make sure that someone has that prepared. Any questions 

on it, please be in touch with the Staff Director. And if you could 

bring that with you tomorrow and submit it to the Committee. Someone, I am sure, has been working on it.

 And I think that is probably the best way to handle that, Mr. Filner. Would that be acceptable?

Mr. Filner. That is fine.

The Chairman. All right. Should not be any problem with that, 
6

should there?

Deputy Secretary Mansfield. No.

The Chairman. Okay. All right. With this panel, we have an Army 

veteran, Robert McFarland. He served in the Vietnam War. He was 

nominated by President George W. Bush to serve as the Assistant 

Secretary for Information and Technology in the Department of Veterans Affairs on October 15th, 2003, and was confirmed by the Senate 

on January 22nd, 2004.

 Prior to his appointment, he served as Vice President of Government Relations for Dell Computer Corporation. Mr. McFarland left 

the Department of Veterans Affairs on May 18th of 2006.

 We will also hear testimony from Dr. John Gauss who served 32 

years in the United States Navy. Following his retirement, Rear Admiral Gauss was nominated by the President and confirmed by the 

Senate to serve as the Assistant Secretary for Information and Technology and Chief Information Officer for the Department of Veterans 

Affairs from August 2001 through June 2003.

 Rear Admiral Gauss transitioned from government service to the 

private sector accepting a senior position with Science Application 

International Corporation in September of 2003. His primary focus 

at this company was the Olympic C41 Security Project considered 

critical for safe and successful 2004 Summer Olympic Games in Athens, Greece.

 In January of 2005, Admiral Gauss founded Gauss Consulting 

Services and in February 2006, he joined FGM, Incorporated as the 

company’s President.

 We will also hear testimony from Major General Howard. General 

Howard is the Acting Assistant Secretary for Information and Technology and Acting Chief Information Officer at the Department of 

Veterans Affairs.

 We will also hear from Mr. Brandewie who currently serves as the 

Director, Defense Manpower Data Center, Field Activity, reporting to 

the Office of the Secretary of Defense, Personnel and Readiness. He 

is responsible for the oversight of the largest and most comprehensive 

automated personal database in DoD, management of a dozen major 

operational DoD programs, and supervision of a multi- disciplinary 

staff of approximately 800.

 Recently he led the DMDC efforts to redesign the Department’s 

medical benefits and entitlements database for the new TRICARE 

system, to design and field a comprehensive web authentication capability for the Department of Defense, to develop and field an identification card and biometric- based force protection system now widely 

deployed throughout the world, and to design and develop and field 

the common access smart card as the new DoD identification card. 

Currently more than ten million have been issued.

 Pronounce it Bresson?
7

 Mr. Bresson. It is actually Bresson.

The Chairman. Bresson. Jim Bresson is the Vice President of Gartner Consulting where he was the managing partner for U.S. Department of Veterans Affairs within Gartner’s USA Federal Consulting 

Practice. He is based in Arlington, Virginia, and his responsibilities 

for Gartner Consulting involve business development, associate development, and engagement and delivery.

 We look forward to your testimony, and we will start with you Dr. 

Admiral Gauss. Which do you want, Dr. Admiral, Secretary?

Admiral Gauss. John is fine, sir.

 The Chairman. All right, John. Proceed.

 Do all of you have written testimony?

Admiral Gauss. Yes, sir.

 The Chairman. All of you do, even—Mr. McFarland, do you not?

Mr. McFarland. No.

 The Chairman. So Mr. Brandewie, Dr. Gauss, Major General Howard, and Mr. Bresson, all of you have written testimony. It will be 

submitted for the record. Hearing no objection, so ordered.

 You are now recognized, John.

STATEMENTS OF HON. JOHN A. GAUSS, PRESIDENT AND 

CHIEF OPERATING OFFICER, FGM, INC., (FORMER ASSISTANT SECRETARY FOR INFORMATION AND TECHNOLOGY AND FORMER CHIEF INFORMATION OFFICER, 

U.S. DEPARTMENT OF VETERANS AFFAIRS); HON. ROBERT MCFARLAND (FORMER ASSISTANT SECRETARY

FOR INFORMATION AND TECHNOLOGY AND FORMER 

CHIEF INFORMATION OFFICER, U.S. DEPARTMENT OF 

VETERANS AFFAIRS); MG ROBERT T. HOWARD (RET.), 

SENIOR ADVISOR TO THE DEPUTY SECRETARY SUPERVISOR, OFFICE OF INFORMATION AND TECHNOLOGY, 

U.S. DEPARTMENT OF VETERANS AFFAIRS; ROBERT J. 

BRANDEWIE, DIRECTOR, DEFENSE MANPOWER DATA 

CENTER; JIM BRESSON, VICE PRESIDENT AND MANAGING PARTNER, GARTNER CONSULTING; ACCOMPANIED 

BY JOE CLARKE, DIRECTOR, GARTNER CONSULTING 

STATEMENT OF HON. JOHN A. GAUSS

Admiral Gauss. Thank you, Mr. Chairman. Good morning to members of the Committee. Thank you for inviting me here today to discuss the important issues related to the Department of Veterans Affairs’ information technology reorganization efforts.

 I would like to provide the Committee with some background information to help in understanding the thought process that goes into 

the remarks that follow.
8

At the time of my confirmation hearing as the VA’s Chief Information Officer, the Department was faced with many challenges, including an ever-expanding IT budget, programs that were defined in a 

stovepipe manner due to the lack of an enterprise architecture, programs that were consistently overrunning budget, behind schedule, 

failing to meet their performance parameters.

 The Department was faced with implementing a comprehensive 

cyber security program and having to implement an executive oversight process which was a recurring deficiency in many GAO audits.

 As a result of the above and as presented in my opening statement 

before the Senate Veterans’ Affairs Committee on 2 August 2001, 

during my confirmation hearing, I stated that I had five strategic 

objections:

 First, complete the enterprise architecture road map for the future;

 Two, integrate the disparate telecommunications networks to improve performance and responsiveness for our veterans;

 Three, implement a strong information security program and infrastructure;

 Four, create a program and project management process to oversee 

and help information technology program managers deliver products 

that meet requirements, are delivered on time, and stay within budget;

And, finally, establish information technology metrics to continuously measure our ability to meet our veterans’ needs.

 Although implementing a strong information security program is 

listed as number three in the above list, it was my number one priority. Establishing a comprehensive enterprise architecture and integrating the telecommunications networks will place higher in the 

order since I believe they are prerequisites to attacking the cyber 

security problem.

 During my 32 years in the Navy, I learned to address organizational issues by using the following simple thought process:

First, define the problem to be solved;

Second, define the optimal yet affordable solution to the problem;

Three, define what work should be accomplished by government 

and what work should be performed by industry and then organize 

to implement.

Given the problems and strategic objectives defined above, I concluded three things:

 First, all IT programs and IT related activities affecting the three 

administrations and the central office should be centrally managed 

at the Department level with funding located in the departments and 

not the administration’s budgets, specifically enterprise architecture, 

cyber security, telecommunications networks, corporate data centers, 

any program with the above characteristic that would result from 
9

developing a comprehensive enterprise architecture such as VA-wide 

registration and eligibility and a central call center, and, finally, all 

IT programs under the auspices of any VA central office code;

 Second, all development activities related to individual administration of IT programs should be managed at the Department level and 

funded from the Administration budget because they are the ones 

who have the business requirement for the program;

 And, third, the operations and maintenance of in- service IT systems directly related to mission execution within an Administration 

should be managed by that Administration subject to a comprehensive budget and funding execution approval process with ultimate 

authority for approving the expenditure of funds residing in the Office of the CIO.

 I recognize that the above conclusions are not consistent with current thinking, but I would respectfully ask the Committee to consider 

the following:

 Without a central management of the development activities, how 

will the Department ever implement a comprehensive, enterprisewide enterprise architecture to eliminate duplication, to cross-functionally integrate the business processes, and ultimately slow or stop 

the growth of the Department’s IT budget?

 I hope this information will help the Committee in its deliberations. 

Thank you for the opportunity. I stand ready to answer questions.

The Chairman. Thank you very much.

 Mr. McFarland, you are now recognized.

[The statement of Hon. John A. Gauss appears on p. 59] 

STATEMENT OF ROBERT MCFARLAND

 Mr. McFarland. Thank you, Mr. Chairman.

 Although I have no prepared statement, I have had the privilege 

to appear before this Committee on many occasions over the last two 

plus years. Our discussions have always been frank, and I have appreciated this Committee’s support in my previous efforts to bring 

the VA’s information and technology infrastructure into the 21st century.

 I am honored to be here today and would be pleased to answer any 

questions this Committee may have regarding my experiences while 

Assistant Secretary and CIO at the Department.

The Chairman. You sound like a man that has been at a trout 

stream.

 Mr. Filner. Explain it to us city guys.

The Chairman. Explain it to a city guy?

 Mr. Filner. Yeah.

The Chairman. Well, you know, he worked at the Department for 

a long time. He took a break. He got jammed while he was there for 
10

a while. He went to a trout stream to gather his mind, and we have 

pulled him back to Washington, D.C. He is not too excited about being back in Washington, D.C. And he says I will show up, but that 

does not mean I have to give a statement. And if you want to ask any 

questions of me, go right ahead.

Mr. Filner. Thank you, sir.

The Chairman. So that sounds like a man with a clear mind that 

has been to a trout stream.

 Mr. Filner. All right. Now I get it. Thank you.

The Chairman. You got it?

 Is that about right, Mr. McFarland?

Mr. McFarland. That is pretty close, sir.

 The Chairman. All right. Thank you.

 General Howard, you are now recognized.

STATEMENT OF ROBERT HOWARD 

General Howard. Mr. Chairman and members of the Committee, 

good morning. Thank you for your invitation to discuss the Department of Veterans Affairs’ information and technology reorganization 

plan and the recent data loss incident.

 First a short update on the VA IT realignment. The VA IT system model has been developed and approved. The key focus is to 

transition the IT community to operate within a management system 

that separates the development and operations and maintenance domains.

VA will establish required business practices and processes that 

harmonize the oversight and budgetary responsibilities of the Office 

of the CIO, the functionality of the domains, and business relationships of the IT service provider and the customer for all IT activities 

across the entire VA.

 As background, in an executive decision memo dated October 19th, 

2005, the Secretary of the Department of Veterans Affairs approved 

the concept of a new IT management system for the VA. This decision to move to a new management construct was made to correct 

long-standing deficiencies in the current decentralized IT management system.

 The concept separates the IT community into two domains, an operations and maintenance domain that is the responsibility of the 

Assistant Secretary for Information and Technology and a smaller 

application development domain that is the responsibility of the administrations and staff offices. Although the domains are separated, 

the VA CIO will retain oversight responsibilities for all VA IT projects.

As Secretary Nicholson testified at the House Appropriations Committee hearing yesterday, the long-range plan is to also centralize the 
11

application development domain under the CIO.

 The new VA IT management system will clearly enhance the Department’s ability to strengthen the protection of sensitive information. With all information security officers reporting to the CIO under this new management system, the CIO will be able to:

 One, create and operate the agency-wide information security program;

 Two, establish information security policies and procedures and 

control techniques for the agency which when followed will ensure 

compliance with all of the above requirements;

Three, to train and oversee personnel with significant responsibilities for information security;

And, finally, assist senior agency officials concerning their information security responsibilities including the analysis process.

 The VA IT system model was developed as a framework for the 

future IT management system. The principal elements of the model 

include the following:

Definitions of the roles, responsibilities, and initial boundaries between the operations and maintenance domain and the application 

development domain. And this includes determination of business 

needs and priorities.

 Although the domains are separated, the model prescribes procedures between the domains in order to provide the CIO with oversight 

and budget responsibilities for all VA IT projects. It also provides the 

authority, delegation of authority, and governance structure and process for the conduct of all VA IT related business.

 The model also contains key IT service delivery business process 

flows and sample scenarios to illustrate how domain activities are coordinated by these process flows. These flows must be clearly defined 

to reflect the critical interdependence of business applications and 

the performance of the IT infrastructure.

 Finally, the model contains a recommended “to be” organization for 

the Office of the CIO designed to balance the tactical needs of operating a complex infrastructure as a shared service with the strategic 

needs of aligning IT resources to best meet the mission requirements 

of the Department.

 Transitioning now to the recent data loss incident, as you are 

aware, the Secretary initiated several recent actions to tighten our 

privacy and data security programs.

 On May 24th, the Data Security Assessment and Strengthening 

of Control Program was established to provide a high priority, and 

much more focused effort to strengthen our data privacy and security 

procedures.

The two principal objectives of this program are to first reduce the 

risk of a reoccurrence of incidents such as the recent data loss and 

second to remedy the material weakness reported by the Inspector 
12

General.

 There are three phases to this effort: Assessment, strengthening 

of controls, and enforcement. We are almost through the assessment 

phase and have actions underway in the other two phases as well.

 On May 26th, the Secretary issues a directive that requires the 

top leadership to instruct all VA managers, supervisors, and team 

leaders of their duty and responsibility to protect sensitive and confidential information.

 In this memo, the Secretary also announced that he had convened 

a task force of VA senior leaders to review all aspects of information 

security and make recommendations to strengthen our protection of 

sensitive information.

One of the first tasks of this group is to complete an inventory of all 

positions requiring access to sensitive VA data and to complete that 

by the end of June.

 This past Monday, we began a Security Awareness Week at all VA

facilities. We are emphasizing training and privacy and cyber security for all employees. We require all VA employees, contractors, 

and volunteers to complete both cyber security and privacy training 

annually.

 Normally employees are required to complete this training by September 30th of each year. However, given the recent incident, the 

Secretary has directed that this be accomplished by the end of June.

 We will be conducting a department-wide inventory of laptops to 

ensure that they carry the encryption and other cyber security software necessary to ensure remote access users are operating in a safe 

and secure environment. This effort is on hold, however, due to several class action lawsuits. It will continue once legal clearance is 

obtained.

 Finally we are reviewing all policies, directives, and handbooks related to privacy, cyber security, and records management to ensure 

they are accurate, clear, and focused. All of these efforts will provide 

for a more secure environment for sensitive data used in the VA.

 Mr. Chairman, that concludes my statement. Thank you for the 

opportunity to appear before you today.

 The Chairman. Thank you very much.

 Mr. Brandewie, you are now recognized.

[The statement of Hon. Robert Howard appears on p. 61] 

STATEMENT OF ROBERT BRANDEWIE

Mr. Brandewie. Mr. Chairman and members of the Committee, 

thank you for the opportunity to appear before you today to discuss 

the data exchanges between the Department of Defense and the Department of Veterans Affairs.

 Our center is a central repository of automated human resource 
13

information in the Department of Defense, and we have been actively 

engaged with the DVA on most of the personnel information flowing 

between the two departments. These exchanges are very basic to providing an improved experience for the veteran and also for coordination of benefits between the two departments.

 It is important to note that these exchanges have been ongoing 

for more than 25 years. The purpose of the data exchanges between 

DVA and DoD are twofold: To provide information to the DVA on 

currently serving and recently separated individuals who are eligible 

for DVA benefits and services, and to competently administer programs in both agencies that benefit servicemembers, former servicemembers, and their families.

 These data exchanges can be categorized as follows: Data for administering educational benefits, active duty and selected Reserve, 

Montgomery GI Bill; data for administering insurance programs, 

specifically veterans group life insurance; data for epidemiological 

studies and for assessing post-war illness; data for coordination of 

benefits and prevention of fraud, waste, and abuse; and data to estimate veteran population and expedite delivery of benefits.

 Data exchanges with the VA, although long-standing, have expanded in breadth in recent years. And an effort to consolidate the 

exchanges began in earnest about three years ago. Close cooperation 

and increased exchanges of information have also received encouragement from the Congress and the Administration.

 For example, the President’s management agenda directed efforts 

to make the transition from DoD to the DVA seamless, and I quote, 

`` Transition should be seamless from the veterans’ perspective and 

could be made seamless through data sharing between VA and DoD

as well as within VA.’’

 Public Law 108-136 established an interagency Committee known 

as the DVA DoD Joint Executive Council to direct joint coordination 

and data sharing efforts between the two departments. DoD believes 

there is great value to current servicemembers and veterans in the 

close cooperation evidenced by these data exchanges that has developed between DoD and the Department of Veterans Affairs. However, it is equally important that the exchanges are done with utmost 

attention to security to ensure no unauthorized disclosure of information.

 The DVA has been a partner with us in the implementation of secure transfer between the two agencies. In that regard, we have continued to improve that process and add security to this data transfer 

process.

 My organization did the work to assess the impact of the recent 

data breach on currently serving active duty, Reserve, and Guard 

members. We continue to work on mitigation efforts with respect to 

the compromised information.
14

 In spite of this tragic loss, it is important to reinforce the point 

there are many benefits to current data exchanges between the two 

departments. They are done securely and they result in better service and better benefit delivery for servicemembers and veterans.

 Mr. Chairman, I thank the Committee for the opportunity to report 

on data exchanges between DoD and DVA and would welcome the opportunity to answer any questions.

The Chairman. Thank you very much.

[The statement of Robert Brandewie appears on p. 67] 

The Chairman. We have another vote, just one vote. It is a procedural vote. So we are going to have to stand in recess for about seven 

minutes, and we will return.

[Recess.]

The Chairman. All right. The hearing will come back to order.

 The Chair now recognizes Mr. Bresson for his statement.

STATEMENT OF JIM BRESSON

Mr. Bresson. Mr. Chairman, Mr. Vice Chairman, and members of 

the Committee, I appreciate the opportunity to participate in today’s 

hearing regarding the Department of Veterans Affairs’ information 

technology reorganization plan and VA’s decision to pursue the federated model.

 I am a managing partner within the consulting division at Gartner, 

the leading provider of research and analysis in the global IT industry. I am accompanied today by my colleague, Joe Clarke, Director 

with Gartner Consulting, who is the lead subject matter expert in the 

methodologies we employed in our most recent consulting engagement for the VA.

 Unlike many of our competitors, Gartner does not offer IT systems 

or software implementation services that would compromise our independence and objectivity. It is our objectivity combined with our 

past performance at the VA that was the basis for Gartner Consulting being selected to convert our originally recommended centralized 

model to a federated model at VA leadership’s direction. I was the 

lead consultant for this effort.

 In December 2005, the Assistant Secretary for IT directed Gartner 

Consulting to determine the best approach to implement a federated 

model for VA. Our focus was on ensuring that the VA’s federated 

model would yield a blueprint for implementation that incorporated 

the seven critical dimensions to achieving a higher performing IT organization at the VA. Those seven dimensions are:

 One, organizational structure, the structure in which the IT organization delivers value at a risk level that is tolerable to the Department and best supports its one VA mission;
15

 Two, processes, the critical IT processes, their interfaces, and 

their dependencies required for IT delivery across the Department;

 Three, roles, the IT management practices, responsibilities, and accountabilities required for IT delivery, what VA associates need to do 

to deliver IT value;

 Four, IT services, the necessary IT capabilities that are valued and 

readily understood by the VA’s business community, not just the IT

community;

 Five, guiding principles, the IT policies that establish focus, governance, and the decision-making fabric within and between VA’s IT

and business communities;

Six, performance management, the definition of IT performance 

objectives and success criteria and high-level analysis of IT performance relative to peers in government, insurance, and healthcare 

delivery;

 Seven, culture and norms, the changes required in the underlying 

culture and norms to effect improved IT management behaviors.

 In my written testimony, I have provided details about how Gartner Consulting derived roles and responsibilities and simulated scenarios to illustrate for VA’s consideration how the federated approach 

would work within VA’s environment.

 It is important to note as we have in our intermittent engagements 

with the VA that organizational structure alone is not the silver bullet. It is just one dimension of necessary change to the existing IT

organization at VA.

 There is a tendency for government agencies to want to jump 

straight to organizational structure alone when seeking to initiate 

and drive change. Encouraging desirable IT management behavior 

is less about structure and is more about relentless focus on strategy 

and execution.

 Gartner research and our engagement results indicate that the 

VA must allow for a balance between line of business autonomy and 

common enterprise-wide needs. VA’s desired end state is not small 

change. It will require overt, firm, sustained action and persistent 

messaging supportive of the change from all levels of leadership 

across the Department.

 What will be critical is sustaining the focus of executive leadership in seeing this change through and realizing improved IT performance. Whether VA leadership will achieve the desired end state 

in an expeditious manner may be less important than whether they 

are able to successfully institutionalize the federated IT management 

system.

I firmly believe that VA leadership is taking the right steps forward.

 Mr. Chairman, Mr. Vice President, and members of the Committee, 

this concludes my statement. Thank you again for the opportunity to 
16

discuss such an important matter to support our veterans. I would 

be pleased to respond to any questions that you or other members of 

the Committee may have at this time.

[The statement of Jim Bresson appears on p. 73] 

The Chairman. Well, I would like to pick up right where you left 

off. I firmly believe the VA is now taking the right steps. You have 

to reconcile that. You have to reconcile that with the testimony that 

Gartner Consulting gave to this Committee and your recommendation for a centralized model that was stiff-armed by the VA.

 You are a consultant to the VA; are you not?

 Mr. Bresson. We have been a consultant on occasion to the VA. 

We are— 

The Chairman. Are you a consultant to the VA right now?

Mr. Bresson. We are currently not under engagement with the 

VA.

 The Chairman. Okay. And were you hired in as a consultant to the 

VA with regard to the federated approach and its implementation?

 Mr. Bresson. Yes, we were.

The Chairman. Do you anticipate future work with the VA?

 Mr. Bresson. I would like to anticipate future work with the VA, 

yes, sir.

 The Chairman. And would your future anticipation to work with 

the VA have anything to do with your last statement before this Committee?

 Mr. Bresson. Not at all, sir. Not at all.

The Chairman. Then reconcile your testimony, sir.

Mr. Bresson. Okay. I believe, as I said earlier, that organizational 

structure is one dimension. The work that we did in converting the 

model that was recommended last spring, 2005 that is, to the federated model dove down deep into processes, roles, services, principles, 

performance management, and culture and norms.

And in constructing that model, we identified for the VA what path 

forward they should take in order to make this adhere in their environment. And I believe that from that model they are stepping 

toward that direction heeding what we advised them to do.

The Chairman. Does Gartner Consulting as a company still stand 

by its recommendation to the United States Congress that the VA

centralize, have a centralized model for IT management?

Mr. Bresson. We do stand by that, sir.

The Chairman. In your written testimony to the Committee, I note 

that you have a quote in here, `` Given the poor state of the VA’s IT

investment management process and the stated demand to drive benefits over a shorter horizon, we recommended the centralization option to maximize the opportunity to create value for our veterans.’’

 You stand by that statement today?
17

Mr. Bresson. Yes, we do, sir.

The Chairman. Okay. Now, Gartner has given this statement, calls 

it, `` The poor state of VA’s IT investment management.’’

 Well, now I am going to turn to Dr. Gauss and Mr. McFarland. 

Can you explain to me why Gartner Consulting would call it a poor 

state of investment management when, in fact, both of you were the 

managers?

Admiral Gauss. Mr. Chairman, I really have no idea why that finding was uncovered. I can speak to the time between July of 2001 and 

June of 2003.

When I first became CIO, our capital investment control process for 

IT was poor. And with a focused effort and working with the Office 

of Management and Budget, within one year, we turned around our 

process from a budget submission to OMB of about a five percent first 

pass acceptance to about a 95 percent first pass acceptance.

 And after I departed VA, there was a substantial gap before Mr. 

McFarland became CIO. And during that interval, I know I do not 

know what went on at VA and I am not sure whether Mr. McFarland 

does.

The Chairman. Mr. McFarland, what are your thoughts with regard to that statement?

Mr. McFarland. Sir, I believe that we continued the enterprise 

information board environment that Dr. Gauss started which was 

to review the individual development projects and sustainment projects. But our biggest issue was not making the decisions over which 

investments were good investments, although where I came from, 

we dealt with ROI, which is a difficult thing to do in the government 

because it is not the same as it is in the private sector.

 But what we had a problem with was the use of the funds, and this, 

as you know, is something I was focused on for quite a while, which 

was to change the budget environment.

 So when you use the words poor state of investment management, 

I think what Gartner was trying to say is that you may pass at an 

executive level a project spin plan and a project budget, and then the 

dissemination of that money and the use of that money in many cases 

which is not being able to be tracked and followed through the chain 

as it is used out in the field.

 And I think that to me was the area where I felt the investment 

management process was failing, in the budget itself and the expense 

of the money, because we were never sure that the money was spent 

on exactly what it had been appropriated for. And to me, that, I

think, is what Gartner was trying to say when they said part of the 

issue of poor investment management process.

The Chairman. To Mr. Bresson, I want you to know that we recognize that a movement to cure is more than just about structure. We 

recognize that. But we also have painfully recognized over the years, 
18

and we have embraced the testimony that Gartner had given to this 

Committee and the counsel that they gave to the VA prior to their 

judgment on which option to choose.

 The reason we do focus on structure and lines of authority is that 

as we do the forensics here of trying to put this together in understanding what went wrong, we cannot move to cure until we create 

the right structure with the proper lines of authority so that we know 

who has authority to do what, who has the tools to do what.

 And so that is kind of why we are focusing on those kinds of things 

at the moment. We recognize culture and many other things that you 

also had testified to.

 The ROI mentality, Mr. McFarland, that you brought to the VA, 

we have no objections to that at all because we are looking out at the 

interest of taxpayers, had to deal with the pains that you did with 

regard to the core FLS and the vets net.

 And there is a reason that we here in Congress wanted the development side under your gentlemen’s authorities. And we understand 

that they fight against that, and we recognize that there are crucibles 

out there for initiative and that your job is not to say no to that, but 

just to make sure that it is all compliant under the one architecture.

 Gentlemen, we are considering many things in our packages. So 

what I would like to do here today, we want to do some forensics, we 

want your opinion on cure. What are your thoughts that if we were 

to, in our package we are to elevate the position of the CIO to an Under Secretary?

 Mr. McFarland?

 Mr. McFarland. I would think that would be a good move, sir. I

believe that in this day and age, the VA like any other agency simply 

cannot do business for its veterans without an IT infrastructure.

 The Chairman. And then if we make the CISO a Deputy Secretary 

right under the CIO as an Under Secretary?

 Mr. McFarland. You mean an Assistant Secretary, sir?

The Chairman. Assistant Secretary, yes.

 Mr. McFarland. I certainly would applaud those moves because 

I think that the infrastructure that runs the VA today in its current 

state is an IT infrastructure and it is important enough that given 

the past history that those moves would certainly help. It would give 

the CIO an equal seat at the table with the main administrations to 

be able to provide the service that keeps the business running.

 The Chairman. Admiral Gauss?

Admiral Gauss. Mr. Chairman, I think your idea is an excellent 

one. And if I may, I have been associated in management positions 

in the last 14 years of government service where I have had the opportunity to observe how Chief Information Officers can be effective 

not only at the Department of Veterans Affairs but in other parts of 

government as well.
19

Without the Chief Information Officer being elevated to the status of Under Secretary or Under Secretary equivalent, the CIO does 

not have a seat at the table at any department within government, 

and the founders or the people who created the Clinger-Cohen Act 

will continue to be disappointed in results until such a bold action is 

taken.

 I would highly endorse your suggestion, sir.

 The Chairman. Thank you.

 Mr. Filner.

 Mr. Filner. Thank you, Mr. Chairman. Thank you for putting 

together this panel. I learned a lot today.

 Mr. Chairman, you said you cannot move to a cure unless certain 

steps were taken, and I would include in those steps at least a recognition of the problem and get out of a sense of denial.

 Every time Mr. Howard referred to what happened on May 3rd, 

the incident. I do not know if you have been out in the field talking 

to veterans, but they are scared to death. You got 26 million or more 

people worried about identity theft.

 We have had testimony here that if it was a professional has the 

data, and there are some circumstances about the theft that may lead 

to that conclusion, it may be a year before they even know that their 

identity has been stolen.

 So we have a major disaster here. And until you guys start calling 

it that, I do not think we are going to get the kind of response that 

we need.

 So I hope you folks in the front row there will take that message 

back to the Secretary, that if he is in a state of denial still, although, I

do not know, it took a week to hear the other news, maybe he will not 

get this message by tomorrow.

 Dr. Gauss, you started, your opening sentence was quite an indictment of this situation. Could you just read that for me again or did 

you have that written out?

 Admiral Gauss. Yes, sir. At the time of my confirmation hearing— 

 Mr. Filner. No, no. Before that. I think it was the first sentence. 

You outlined the situation as you saw what was— 

Admiral Gauss. Yes, sir. That was at the time of my confirmation— 

 Mr. Filner. Oh, okay.

Admiral Gauss. —the Department was faced with—

Mr. Filner. Okay. Right.

 Admiral Gauss. —an ever-expanding IT budget, programs that 

were defined in a stovepipe manner due to the lack of an enterprise 

architecture, programs that were consistently overrunning budget, 

behind schedule, and failing to meet their performance requirements, 

was faced with implementing a comprehensive cyber security pro-
20

gram, and having to institute executive-level oversight process as a 

result of a recurring theme of GAO reports.

Mr. Filner. I mean, I would like to ask a very generalized set of 

questions that maybe several of you can respond to. I mean, that 

is a cultural indictment, and I would like to know if it still exists as 

you see it, Mr. McFarland? Has it changed? Why hasn’t it changed? 

What did you think of the polyanna statement by Mr. Howard, everything has changed and we are moving forward?

 And I might just for Dr. Gauss, I was not at the hearing, but I think 

at one hearing where Chairman Buyer said to you, would you like to 

have centralized line control of the system, and I guess you had to say 

no at that time. I do not know if that was your personal opinion or 

OMB’s opinion because I think they had to approve your statements 

here.

 But if you can go back from that statement, and has anything 

changed since you have left? Does Mr. Howard’s statement sound 

right to you? I mean, and what needs to be changed for it to come 

true? Please, and then Mr. McFarland if he can. Get him off the 

trout stream there.

Admiral Gauss. Let us see. I am really not qualified to discuss 

what has happened recently because my knowledge of what has happened is what I have read in the newspaper and in preparing for this 

hearing, material that I found on the VA web site.

 Mr. Filner. But you were there for a couple years.

Admiral Gauss. Yes, sir.

Mr. Filner. So did it change while you were there?

Admiral Gauss. During that time—

Mr. Filner. You mentioned one major thing.

Admiral Gauss. For the record, sir, all of the testimony that I gave 

in front of this Committee was my testimony. It was the truth. I was 

not influenced by OMB or my senior— 

 Mr. Filner. They did not have to be approved?

Admiral Gauss. I am sure it had to be approved, but I held no 

punches and I spoke my views.

Mr. Filner. We did have testimony at an earlier hearing of one of, 

I think, your successors, Mr. Brody, right, who said, because I asked 

him, he said that he could not say what he wanted to say because it 

was approved by OMB. So that seemed to be the procedure.

Admiral Gauss. I stand by today—

Mr. Filner. Okay. Thank you.

Admiral Gauss. —the testimony that I gave in front of the Subcommittee at the hearings for which I participated.

 Now, from a cultural perspective—

 Mr. Filner. Did I get that right that you said no to Mr. Buyer when 

he said would you like to have the centralized control?

Admiral Gauss. I believe that in my answer, I qualified it along the 
21

terms of what I had in my opening statement, that I felt that the development activity should be centralized. The CIOs should have the 

authority over all development activities, but that the operations and 

maintenance of the products that were deployed to the field should 

still be distributed within the administrations.

 And a little bit of the background, we are all an invention of our 

past. And having served for 32 years in the Navy, I look at the model 

that is proposed today and it equates to allowing commanding officers 

to develop their command and control capability, but, yet, to operate 

it, maintain it, and fix it, you have to go back to the Pentagon. And 

somehow that just does not seem right based on my experience.

 As far as the culture goes, there were cultural impediments at VA

that precluded making progress while I was there. Specifically at the 

executive level, there was commitment to have reform, but there was 

not commitment to effect the type of change necessary to make that 

reform.

When you find you are broke, the processes and procedures you operate under are not going to fix you because if they would, you would 

not be broke in the first place. So change was fundamental, but the 

attitude was fix it within the current process.

 Second, the VA concurrence process is onerous. In my testimony in 

September of 2002, I talked about a memo the Secretary had signed 

in August directing the centralization of IT activities. I testified in 

front of the Subcommittee that we put a team together to build a plan 

and it would go to the Secretary by November of 2002. That did not 

happen. It took until May to get it done because the VA concurrence 

process waters everything down to the lowest common denominator 

in which people can agree.

 I was told one time I could not offer a differing view because nothing goes to the Secretary without the principals concurring.

And, three, the financial management of the programs, the money 

is distributed into the Administration budget, at least it was during 

the two years I was there, for such things as enterprise architecture, 

cyber security, the data networks, all of the infrastructure things 

needed to run, the machinery needed to run the IT at the Department 

and for the administrations, and it was left to my office to have to get 

the money from the administrations in the year of execution.

The budgets should reflect the execution because at the end of the 

day, the real organization follows the flow of the money. And with 

the money spread in execution, it is very difficult to get the resources 

one needs to execute the job.

Mr. Filner. Okay. That was pretty clear.

 Mr. McFarland, would you concur or do you have anything to add 

to that?

 Mr. McFarland. I do concur with Dr. Gauss on the state of what 

he left was pretty much what I found when I got there. I believe the 
22

VA has moved forward in doing some things that will make the job 

easier.

 With the help of this Committee and Congress, there is now a consolidated budget, although I would tell you that I was disappointed 

that the budget contained only nonpay dollars and not the full budget. I will be frank about that. That does allow better oversight over 

the spend. There is now under this federated model at least a consolidation of the infrastructure.

 And where I might disagree with Dr. Gauss a little bit, I do believe 

that the infrastructure has to be consolidated because I believe that 

if you do not consolidate the infrastructure under the CIO, then all 

you will do is be involved with directives and guidelines over policy of 

privacy and security.

 Without control of that infrastructure, technical control of that infrastructure, you cannot ensure that the environment is safe. So I

would disagree. I believe the infrastructure should be consolidated 

and that not only— all those assets need to be under a single control. 

The— 

Mr. Filner. Mr. Howard, are you heading in that direction or not?

 General Howard. Sir, with respect to the operations and maintenance domain, we are. And as I indicated in my testimony— 

 Mr. Filner. Wait, wait. He just said something very clear. He said 

control of the infrastructure.

General Howard. Yes, sir.

Mr. Filner. Is that what you are talking about or not?

 General Howard. With respect to the operations and maintenance 

infrastructure, that is correct. The data centers— 

 Mr. Filner. But he was not restricting it like you are. I mean, he 

did not have any qualification over infrastructure. What other part 

of the infrastructure there is? Development?

General Howard. Development is not included in the—

 Mr. Filner. Why not?

General Howard. —IT organization that has currently been approved.

 Mr. Filner. That is the point, Mr. Howard. I am saying should it 

be in that?

 Mr. McFarland, did you include what he said, operations, maintenance, and development in the consolidated structure— 

 Mr. McFarland. Under the current plan—

 Mr. Filner. —infrastructure?

 Mr. McFarland. Under the current plan—

Mr. Filner. I do not even talk the language you do, so I am trying 

to get this.

 Mr. McFarland. I understand. Infrastructure to me does not include development. Infrastructure is the basic assets and people necessary to provide the IT service to the community.
23

 In the current federated model, that infrastructure is supposed to 

be consolidated under the CIO. And the administrations and staff 

offices become users of that infrastructure. I strongly believe you 

cannot allow the infrastructure to be managed by administrations 

and staff offices.

Mr. Filner. So explain to me the differences in federated model 

and the centralized model. I mean, what— 

Mr. McFarland. The difference—

 Mr. Filner. — is included in one and not the other?

Mr. McFarland. The difference under the Gartner scenarios that 

were developed is only one issue, that the applications development, 

the development of new products to serve the needs of veterans in 

each of the administrations and staff offices, whether it be a financial 

system or whether it be a medical system, the development of those 

products, application development, is done in the federated model by 

the administrations. Everything else is managed by the CIO.

 In the centralized model, all of that would be managed by the CIO. 

And what would happen would be the staff offices and the administrations would provide the specifications and requirements for their 

needs to the CIO who would then go to the marketplace and develop 

those products for them.

 Mr. Filner. And you agree that that is okay?

 Mr. McFarland. I am sorry, sir.

 Mr. Filner. We got word directly from the Secretary about what 

Mr. Howard should say, so maybe you should read the note for us, 

Mr. Howard.

 The Chairman. Mr. McFarland, to be responsive to the question, I

think it would be that do you concur with the centralized model that 

development should be under authorities of the CIO? I think that is 

where Mr. Filner was getting to.

Mr. McFarland. I have been on record from day one as being preferring the centralized model. I have agreed to support the federated 

model when I was in office because that was the recommendation of 

the agency and it was candidly the best I could get.

 Mr. Filner. And give me again as concise as you can why— you defined the federated—you gave us a clear explanation, but why would 

you prefer the centralized? I mean, what did it do that the other did 

not?

Mr. McFarland. I believe you have to have control over development.

Mr. Filner. Well, that is what I asked you at the beginning, and 

you said no. I asked what did consolidation of infrastructure mean, 

and you said operation, maintenance, but not development. Now you 

are saying development should be.

 Mr. McFarland. Let me define infrastructure for you, sir.

 Mr. Filner. Okay.
24

Mr. McFarland. Infrastructure is the assets and people that provide IT services— 

 Mr. Filner. Okay.

 Mr. McFarland. —provide the electrons to anyone who uses those 

electrons, your e-mail, your whatever, no matter whether you are a 

doctor, a benefits coordinator, whatever, the users of those workstations. That is the infrastructure.

 The development of product is actually the generation of new 

code— 

Mr. Filner. All right.

Mr. McFarland. —to run applications.

Mr. Filner. And both should be under the CIO in your preference?

Mr. McFarland. It has been my professional—

Mr. Filner. Okay.

Mr. McFarland. —opinion that they should be consolidated— 

Mr. Filner. Okay.

Mr. McFarland. —under one environment.

Mr. Filner. And so they are going in a different direction than that 

right now?

 Mr. McFarland. They are using—

Mr. Filner. All right. That is all.

Mr. McFarland. —the federated model, yes.

Mr. Filner. Thank you.

 Thank you, sir.

 The Chairman. Mr. Bilirakis, just as a follow-up, if I may.

 Mr. Bresson, Gartner Consulting, you are consulting to the leading 

top 100 companies in the world; are you not?

Mr. Bresson. Yes, sir.

The Chairman. Are there any of these companies that you are a 

consultant to in the world of these companies ever take the development side outside the—to take the development outside the authority 

of the CIO?

Mr. Bresson. Indeed there are, yes, sir. And I think one of the 

nuances to the federated model as it may exist in commercial and 

outside of public sector is that while development may remain outside the CIO’s control, in order for those products to run on the infrastructure, they still must, you know, pass through the wickets and be 

certified to run on that infrastructure. So there is a transfer.

 The Chairman. Thank you.

 Mr. Bilirakis.

Mr. Bilirakis. Mr. Chairman, virtually everything has kind of been 

covered on a detailed basis. If this continues on, it is just going to 

continue to make work for us and take us away from being concerned 

about healthcare and about claims processing and things of this nature. Somewhere along the line, it has got to be solved.
25

 Let me ask. My impression is that all testimony, I mean, for—it 

goes all the way back, not just this Administration, the prior Administration and Administration before that. All testimony before coming before Congress has to go to OMB; is that correct? Does anybody 

know? That is true, right?

General Howard. [Nods head affirmatively.]

Mr. McFarland. [Nods head affirmatively.]

Mr. Bilirakis. Okay. So this is not something that is new.

 Dr. Gauss, you prepared your testimony. Of course, obviously, 

OMB does not tell you what to respond to when you are asked questions from the panel up here. But you prepared your testimony for 

today, and then there is a process? It went up the line, did it, up 

through the— 

Admiral Gauss. [Shakes head negatively.]

Mr. Bilirakis. No? Where does your testimony go?

 Admiral Gauss. As a private citizen—

Mr. Bilirakis. You are a private citizen, right. All right. I am going 

to go to General Howard. Forgive me for doing this. Getting a good 

opportunity for this old Staff Sergeant to talk to a Major General.

General Howard. It has to go through OMB, sir.

 Mr. Bilirakis. Has to go. All right. But does it go up the line 

through the VA first— 

General Howard. Yes, sir.

 Mr. Bilirakis. —before it goes to OMB?

General Howard. Yes, sir, it does. General Counsel- -

Mr. Bilirakis. Do you like that as a former General officer?

General Howard. Sir, it was probably the same way in the Pentagon, although I cannot remember.

Mr. Bilirakis. Yeah, I will bet. I will bet.

General Howard. But that is the process.

Mr. Bilirakis. You know, what is happening here is, you know, we 

have got a Veterans Administration that I have always had very high 

regard for. When I came to Congress 24 years ago, there was one 

committee that I specifically fought for. I guess I did not have to fight 

too very hard, but the point is I wanted to get a VA Committee, and I

did 24 years ago, first day one.

 And Mr. Buyer may not know this, but when our side came up with 

this idea of grading committees, certain committees are considered 

A committees, B committees, C committees. The rule was that if you 

had an A committee, you could not serve on any other committee. 

And the Veterans Committee was considered other than an A committee.

 And so Energy and Commerce was considered and still is considered an A committee. And the deal was if you wanted to stay on an A

committee, you had to give up any other committees.

 I let it be known that I would be glad to give up Energy and Com-
26

merce if I could keep Veterans Committee. That is how much I feel 

about this Committee and that is why I get awfully frustrated and 

angry sometimes when we get partisan here and throw stones at each 

other, which is something we did not used to do on this Committee. 

But that is besides the point.

 The point here is that activity like this, promises made to Congress 

on record and whatnot and not kept on what, you know, contract on 

IT was to be awarded June the 10th and contract work was to be 

started on June the 15th of this year of 2006 when, in fact, that has 

not taken place, that is the result of testimony before this Committee 

back in March of this year.

 Other things. We have gone through hearing after hearing. We 

have had round-table discussions, everything on IT, and still do not 

see very much progress being made. I mean, that hurts the image of 

the Veterans Administration.

 And, you know, we would like to hear from the veterans, complaints 

about maybe healthcare, about their claims, or something of that nature. And what we are hearing is they are concerned about privacy 

and the lack of privacy and their concern about what might happen to 

their personal situation as a result of what has transpired.

 Mr. McFarland, you came aboard with a heck of a background, a 

tremendous IT background. You were given a certain responsibility. 

Was your background respected in the VA? Now, you should be free 

to respond here.

Mr. McFarland. Yes, sir. I never got a feeling that my background 

was not respected. I think I felt I brought a business acumen to the 

VA— 

 Mr. Bilirakis. Yeah.

 Mr. McFarland. —which I think was—

Mr. Bilirakis. All right. But—

 Mr. McFarland. —somewhat new, and I think it was respected 

certainly in the beginning. I am not sure— 

 Mr. Bilirakis. In the beginning. What happened—

 Mr. McFarland. —if it is respected today.

Mr. Bilirakis. What happened after the beginning?

Mr. McFarland. Well, I think whenever you embark on change, 

you are going to run into culture. I have said many times I did not 

believe that a majority of the issues at VA were so much about technology as they were about culture.

Mr. Bilirakis. Yeah.

Mr. McFarland. It is a long-standing history of decentralized management. And when you bring a business acumen that says you want 

to centralize many of those management functions, I think you run 

into cultural problems.

 But that being said, I do not think anyone disrespected my background. I never had— 
27

 Mr. Bilirakis. Well—

Mr. McFarland. —anybody chastise me for it, so—

 Mr. Bilirakis. Yeah. I do not think anybody would have done that, 

but I am not referring to that obviously. I am referring to— I mean, 

were you paid attention to? Were you taken seriously in terms of 

some of the changes as a result of your actual background and experience and that sort of thing?

 Mr. McFarland. Oh, I think I was taken very seriously, sir, on 

many occasions. I do not think it was ever an issue of taking me 

seriously. It was that the problem was the disagreement over the 

change.

 Mr. Bilirakis. All right. So you were taken seriously, but there 

were disagreements? Some people disagreed with you?

Mr. McFarland. Yeah.

Mr. Bilirakis. General Howard, you know, here we are. And the 

Chairman’s idea of legislation, basically upgrading the CIO position 

and whatnot is a good idea. But here we are trying to micro manage. 

And damn it, we should not be doing that. And, yet, we feel that we 

almost have to from the questions that have been asked here, detailed-type questions for crying out loud.

 We should not have to be concerned with something like that, I

do not think. And, yet, we are because we see a process that just is 

not moving. It is not progressing the way it should be. And then, of 

course, these errors such as the loss of those files.

 General Howard, your testimony had to be cleared, but your responses to us are not cleared, do not have to be cleared.

General Howard. No, sir. That is correct.

 Mr. Bilirakis. All right. Now, you are a General Officer. Are we 

going to fix this?

 I mean, Mr. McFarland mentioned the word culture. He knew darn 

well that I was going to mention culture because I talked about it constantly during our past hearings. There is a culture there. There is 

a turf thing there that exists up here, too, and I am the first one to 

admit that. If I had to say the one thing that bothers me about the 

Congress is the turf, turf fighting, and committees’ jurisdictions and 

things of that nature.

 What do you think? Are we on the right path here? Are we going 

to fix this? Are we going to be as proud of the VA in terms of IT as we 

are on our work on healthcare and the Spinal Cord Injury Center, for 

instance, Haiti Hospital in Tampa?

There was a young lady here with Pfizer who lives down in that 

area and who volunteers there one day a week. And as I went out to 

vote, she was boasting to me about the great work that they do.

 I mean, there is a lot of pride there. But the pride does not exist as 

far as IT is concerned. Respond to that.

General Howard. Sir, there is, first of all, no question that this can 
28

be fixed. Obviously we cannot predict the future. But in my mind— 

Mr. Bilirakis. What do you mean by that?

General Howard. You said will we fix it. We can fix it and we are 

heading in the right direction. There is no question about that.

 The issue regarding centralization is still, you know, full centralization, that is, including the development domain, is still on the table. 

But I think based on the Secretary’s testimony yesterday, that also 

will be centralized. And he went public with that yesterday during 

the Appropriations hearing. I think that is a very important aspect 

of it.

Can we do it right away? My personal opinion is we should not. 

We are already very deep into moving the operations and maintenance and consolidating that.

 In the contract you refer to, you are correct. That was delayed due 

to contracting procedures, but that is ready to be signed. If it is not 

signed today, it will be in the next few days to bring in the contractor 

who is going to help us further refine the details of the current approved IT reorganization. But as the Secretary mentioned yesterday, 

he is going to take the next step.

Mr. Bilirakis. All right. You said something, you mentioned contract procedures, delays as a result of the contract procedures. Should 

those procedures in your opinion be changed?

General Howard. Sir, those are typical government procedures. It 

just takes time to work through that. I did not see anything really 

out of line. It just took longer than we thought. I mean, we followed 

all of the procedures. We had written proposals. We had oral presentations and a thorough review.

 The last reviews that had to take place were with General Counsel 

and the Contracting Office. You know, I got an e-mail this morning 

that indicated those are complete.

 So there is no reason why this contract should not be signed. And 

that will be a very significant piece to what we are discussing today 

because they will come in, this contractor will come in and help us 

refine the processes and procedures under which we should operate.

Mr. Bilirakis. Are we going to pay attention to them? Are we going 

to— 

General Howard. Sir, we are going to pay a lot of attention to 

them. And the fact of the matter is, you know, we have already detailed 4,600 people to the Office of Information and Technology. And 

that detail will become permanent on the 1st of October.

Sir, that is in effect as we would refer to in DoD, that is a field operating agency. That is not a staff section. That is a large number of 

people, and we are now in the process of organizing them, delivering 

the guidance, an important subset, for example, of the Information 

Security Offices that exist throughout the VA. There is slightly over 

300 of them. They are now under my control.
(29)

 You know, we are the ones that issue them instructions, that give 

them the training, that develop their careers, all of that. Bob McFarland did not have that, but we do. And that alone is very helpful in 

terms of improving our information security.

 Mr. Bilirakis. Well, I am reminded by staff that this was said 

something like last October that it was going to take place, and here 

it is what, June, almost July of the next year.

General Howard. Yes, sir. It happened in April, sir. That is— 

 Mr. Bilirakis. In April.

General Howard. That is when the detail took place. But to sort of 

summarize, I am fully confident that we can fix this problem. Clearly 

it is an organization issue, but it is more than just moving the boxes 

around.

 As Gartner mentioned, processes are very important and probably 

more important than anything else is the leadership and the emphasis we place upon the whole enterprise.

 Mr. Bilirakis. Yeah. Just my last question. What say you to this 

culture thing that has been admitted to over a period of time in the 

VA?

General Howard. Sir, I have been in the VA just a little over a 

year. I came out of the private sector. There is a culture issue. And 

one of the reasons for that, I think we all know that we are operating 

with an agency that is very decentralized. And you cannot fix that 

overnight. I mean, that has to be done over time. We need to put 

more emphasis on it.

 But, again, under Dr. Kaiser, it was deliberately decentralized and 

the result of that, quite frankly, was more effective healthcare. I

mean, it was, you know, innovation in the field and all of that. And 

in many ways, that is a good thing. What we probably did not do is 

maintain sufficient controls over that decentralization.

 Even in the Army, you know, you can encourage innovation and to 

a degree decentralization, but you have regulations and clear directives to make sure that things are followed correctly.

 And one comment on directives. The business about are we going 

to fix this. Sir, one first step, a major first step is to publish very clear 

directives. I have only been in OI&T a little over a month and clearly 

that is a problem. Bob McFarland had difficulty with that.

 And no longer guidelines and handbooks and all of that. Our policies need to be in very clear directives with signatures on them so 

that people are very clear about what they— 

 Mr. Bilirakis. Yeah. That seems natural. Why did Mr. McFarland have trouble with it and why do you say that it is going to be 

difficult? I mean, why?

General Howard. Sir, I do not see that difficulty anymore.

Mr. Bilirakis. All right. Why was it—

General Howard. It took us less than a week to publish 6504. In 
30

fact, the Deputy Secretary was a co- signature on it along with myself. And 6500 is another very critical directive that we are currently 

working on.

Mr. Bilirakis. Yeah.

General Howard. And there are more. We cannot rely on memos 

and guidance that is not signed out and approved at the very high 

level.

Mr. Bilirakis. Will enforcement exist?

General Howard. Sir, on the enforcement part, I mentioned in my 

testimony that we have established an overarching program to address these issues, the Data Security Assessment and Strengthening 

of Controls Program. This is an overarching program sanctioned by 

the Deputy Secretary. We have a very detailed list of actions that 

must occur. In fact, we would be happy to brief this Committee at 

any time. There are a lot of things that need to be done.

 As I mentioned to you, there were three phases to it. The last phase 

is enforcement. And to give you an example, I think in the area of 

enforcement, one of the most important things we can do is improve 

our audit and inspection capability.

 As an old Army guy, if you roll into an organization and you do not 

have a good inspection program, you got a problem right from the 

very beginning. And we do not have that right now. We have some. 

We have the IG, of course.

 But within OI&T, for example, it is relatively small. It is nowhere 

near as robust as it needs to be. And along with that capability needs 

to be the authority to go anywhere within the VA, knock on the door, 

and walk in and see what is going on.

 Sir, I know you are laughing, but we need that and it needs to be robust. And you know what I am talking about. You are talking about 

unit inspection programs.

 Mr. Bilirakis. I am not sure why the Chair is laughing. I think 

because he is happy.

 But we had testimony what, last week from the counsel that you 

did not have the authority, the enforcement authority. Am I wrong 

there or do you have it? Do you feel that you have it?

General Howard. Sir, right now I have certain authority as a result of the approval of the IT organization up to this point. For example, in the area of information security, I own these people. I am 

responsible for telling them what to do. I have the authority to discipline them.

 What I do not have is the authority to discipline somebody in VHA. 

I do have the authority to lay out the policies and regulations that 

must be adhered to. And if the VHA folks, for example, do not discipline someone who violates these policies, you know, then it is a matter for the tenth floor, you know, the Secretary level.

 Now, I will say that so basically within what has already happened, 
31

I do have some authority. Now, with respect to additional authority, 

there is a memo being debated right—not debated. It is being finalized and reviewed by the Secretary, regarding further delegation of 

authority. It has not been signed yet. He may talk to that tomorrow. 

But there is more to come on that issue.

Mr. Bilirakis. Well, I know I have taken much more time than I

should have. Thank you, General, gentlemen.

 Mr. Chairman, we all have suffered through an awful lot of frustration here. I yield back whatever time.

 The Chairman. Well, Mr. Bilirakis, this is a challenge. It has been 

a challenge for us for a long time.

 And I am smiling whenever I can hear you talk about authority.

 Back in 2002, Ms. Carson asked you, Dr. Gauss, a direct question, 

are you the man in charge. That is exactly how she asked it. And you 

said, yes, ma’am, it is me. Very close. You may have been in charge, 

but you did not have a lot of authority in reality.

 And that is what also then we learned with your successor, Mr. 

McFarland. He was in charge. The Secretary even wrote a directive, 

and then that is undercut by a General Counsel in his interpretation 

of FISMA that says that you have responsibility, but you do not have 

authorities.

General, reflecting upon your days in the United States Army, 

pretty hard for you to have received responsibility to ensure compliance, but then you have no authority to accomplish a mission. You 

are to take the hill. You are to ensure compliance of having taken the 

hill, but you have no authority to give orders to anyone.

 That is why I use the form heterodox, because it is totally against 

everything in our society. So my challenge with the Office of the General Counsel, it is how you get to yes. How do you get to yes?

 You do not create these odd anomalies that then has a detrimental impact upon an organization. We figure out how we get to work 

together and pull in the same direction, not to create these divisions 

and as someone had earlier testified to as decentralizations of mass 

dispersions, equate to mass dispersions in the VA.

 So that is why I am smiling. I am pleased that the VA is moving 

toward that direction with regard to lines of authority.

 I now recognize Ms. Herseth.

Ms. Herseth. Thank you, Mr. Chairman.

 Let me just follow-up on the line of questioning of Mr. Bilirakis and 

some of the comments that the Chairman just made. And I appreciate the testimony that you have offered, written testimony that I had 

a chance to review and some of your oral testimony today that in the 

light of the vote, some of us missed.

 But I just want to make sure that we have turned a corner and that 

we will be able to confirm some of this further with the Secretary tomorrow. But the Chairman says, you know, how do we get to yes.
32

 It is sort of like what we say to members of our staff here in Washington or back home serving constituents. You know, it is one thing 

to move the ball down the field and get to the five yard line, but they 

all need to get it over the line. It is not just about getting it close. It 

is getting it there.

 And in the questions that Mr. Bilirakis posed to Mr. McFarland 

about how you were received given your background, your experience 

when you arrived at the VA, you felt that, you know, you brought this 

business acumen, it was respect, but there was disagreement then 

based on the proposals of centralizing the IT function.

 And then in response to the question posed to you, General Howard, about once we get the contractor, are you going to pay attention 

to them. You said, yes, you are going to pay attention to them.

 But what if there is disagreement with how they are advising to 

refine the processes? Have we turned the corner to say now that 

the Secretary has made the decision to centralize, we have got the 

contractor that is going to be in place, are we behind that now? It is 

not about disagreement anymore? It is about simply executing and 

implementing the recommendations of refining the processes?

General Howard. Ma’am, I cannot say there will never be disagreements. I mean, you are always likely to run into that. But my feeling 

right now is those have been greatly minimized.

Ms. Herseth. May I interrupt? Even if there is disagreement, 

though, you are right. There is going to be disagreement. But despite the disagreement, are we going to just rehash the disagreement 

and— 

General Howard. No.

Ms. Herseth. —push back on the contractor about the recommendations or is it, you know, we disagree, but your job was to advise us, 

recommend, now we are going to implement the recommendations?

General Howard. We have turned the corner. There is no doubt 

in my mind about this. Just the reassignment of people alone, you 

know, including the empty spaces that have been given to us upon 

the insistence of the Deputy Secretary. He says do not just move the 

people. We want the spaces, too, so that we can flesh out this organization in the correct manner.

 So everything that I see from our leadership is heading in the right 

direction. There is no doubt in my mind about that.

 Ms. Herseth. Okay.

General Howard. But to execute is going to require very strong 

leadership and determination right down until when you finally take 

the hill, sir, you are right.

Ms. Herseth. And authorities, right, General Howard? So do you 

feel— 

General Howard. And the authorities. And as I mentioned, a very 

important delegation memo is currently being worked and— 
33

Ms. Herseth. Great. We hope to see that soon and to ask the Secretary about it tomorrow because that was again a line of questioning 

we pursued last week with the General Counsel who kind of, I felt, 

was trying to have it both ways by reiterating his interpretation of 

FISMA, but then talking about certain options the Secretary had to 

delegate certain authorities.

 And it was just really hard to pin him down on whether or not he 

was trying to allow his interpretation of FISMA to trump what these 

reserved powers that could be delegated from the Secretary.

 So I hope we have turned the corner there, that we are getting very 

close, that we are moving in the right direction, but not just moving 

in the right direction and down the field, but that delegation exists to 

get us to score the goal.

 Let me move to a different line of questioning. Mr. Brandewie, we 

have also in past weeks in different hearings gone into what is happening in other Federal agencies with the relative organization of the 

CIO.

 Are there some weaknesses? Are there strengths that we should 

be evaluating to assist us with the Department of Veterans Affairs’ 

situation?

 I know that the Chairman has asked for a GAO investigation and 

report on other interpretations of FISMA by other General Counsels 

and different agencies.

 And so in your statement, you note that the DMDC is at the center 

of most of the human resource information flowing between DoD and 

the Department of Veterans Affairs. Under the definition in FISMA, 

is DMDC considered a strategic security system?

Mr. Brandewie. No, ma’am, it is not. The data sources for the information that flows to the VA are not classified as national security 

systems.

 Ms. Herseth. Okay. So it does not contain information about security clearances and military job codes?

 Mr. Brandewie. No, it does not. If I could just comment in a little 

more detail. The information that goes to the VA starts out very skeletal. I mean, it is just the basic identification information. It grows 

as events happen in a servicemember’s life.

 For example, they become eligible for Montgomery GI Bill is a good 

example. Then we add information on that program and feed it to the 

VA. So the information that goes from DoD to VA is basic identification and then programmatic information.

Ms. Herseth. Okay.

 Mr. Brandewie. It is not national security information.

 Ms. Herseth. I appreciate your responses and it relieves me of 

some of the concerns there.

 However, let me just ask this question. I know the Chairman is 

interested whether, you know, based on your responses that it does 
34

not include national security information. But over the course of a 

servicemember’s lifetime as that information grows, you know, how 

do you feel about data sharing with an agency system plagued by 

such vulnerabilities as we know the Department of Veterans Affairs’ 

system has been?

Mr. Brandewie. Well, I mean, naturally we are concerned. I mean, 

we are concerned because of the massiveness of the scale. Essentially 

as came out in the data breach, a vast majority of our active duty and 

Reserve members’ information potentially was compromised in the 

data breach.

 However, in our data use agreements with the VA, we require security evaluations be done on the recipient systems. They have been 

studious about doing that. I know they are rereviewing a number of 

the systems right now to make sure that they are, in fact, meeting the 

security requirements. And so we have to in a partnership sense rely 

on our partner in the VA to maintain security in the system, but we 

all remain concerned.

One fix that we have been pursuing actually began under Admiral 

Gauss is to consolidate the feeds that go from DoD to VA and try 

and minimize the kind of proliferation of data throughout the agency. 

And by concentrating that information, I think we can concentrate 

our efforts to make it more secure and protected.

 Ms. Herseth. I agree. But I think a very important first step, especially in light of the concern that as it does get spread out more, you 

then have the potential of employees within the different administrations— well, just the potential for more possibilities of compromise, 

I should say.

 One last line of questioning, if I might pursue that, Mr. Chairman.

The Chairman. Yes, ma’am.

Ms. Herseth. And I think, Admiral Gauss, you answered part of 

this question when you were talking about the VA concurrence process and that you were told at one point within the chain of command, 

so to speak, in the VA that you could not go to the Secretary with 

some of your concerns unless it was consistent, unless it meant these 

concurrence principles. And, otherwise, if things got watered down 

to the point that some of your concerns were inconsistent with the 

minimum threshold of what it was watered down to that it was hard 

for you to reach the Secretary with those concerns.

 So my question is for Mr. McFarland and for you, Admiral. Last 

week, Bruce Brody, who was a former Associate Deputy Assistant 

Secretary for cyber and information security at VA, testified before 

the Committee. And he explained that while he served in that capacity, he was not permitted to speak openly about many of the problems 

associated with VA’s management and information security.

So during each of your tenures as Chief Information Officer for 
35

DVA, were you ever instructed by the Secretary or other senior Department officials to withhold from members of Congress any concerns you held regarding the Department’s information system?

Admiral Gauss. Let me start since Bruce worked for me first before 

he worked for Bob.

 I was never instructed nor did I direct Bruce to withhold information from Congress. What I did, and this is me doing it, is Bruce 

sometimes could be quite colorful in the presentation of his issues, 

and sometimes the importance of his issue could be lost in the colorful 

flavor that he would present them. And I did ask him to tone some 

things down, but never to obfuscate an issue.

Ms. Herseth. I appreciate the response.

 Admiral Gauss. And if I may on the first part—

Ms. Herseth. Yes.

Admiral Gauss. —when I talked about the concurrence process, I

did not mean to imply that I could not go to see the Secretary. The 

process, though, required as you lumbered your way through to get a 

document that could be approved, it required the concurrence.

 In fact, I was called once by the former Deputy Secretary, and he 

said I need you to take your nonconcurrence off. And I said why. It is 

my view. And he said, well, if it goes the other way, will you support 

it. And I said of course I will. And that is the only time a dissenting 

view got documented from my office.

 Mr. McFarland. I would concur with Admiral Gauss on the issues. 

I also managed Bruce Brody and I did see some of the colorful presentation, but he was always straightforward and given the ability to 

speak his mind. And never was I ever either told that I had to water 

down my opinions or could not speak, nor was I ever told not to submit anything to Congress.

 The concurrence process to me, I agree with Admiral Gauss, is 

troublesome. Unlike what I understand DoD’s concurrence to be, at 

the VA, there is no penalty for not meeting concurrence deadlines. 

And so what happens is you get the slow roll.

And without having a defined, definitive concurrence deadline such 

as, I believe, DoD has where if you do not concur or nonconcur, you do 

not do anything, then you opt out and have no say because one of the 

reasons you have problems in getting things done quickly is because 

this concurrence process takes a long time when people simply do not 

concur, neither nonconcur or concur.

 The process allows nonconcurrence. That is not an issue. I believe 

that we have moved ahead with issues at the VA. Even with nonconcurrence, we have moved ahead. An example would be the federated 

model. I did not concur with the federated model, but I agreed to 

support it. So my nonconcurrence on the federated model was welldocumented.

 The issue is the time frame and this problem of slow roll, which is 
36

what happens, is what causes you the delays in many of these occurrences from happening in the time frame they should happen. And I

strongly believe that that time frame should be changed and I have 

spoken so.

 Ms. Herseth. One last question then. Do you feel that the Chairman’s proposal to elevate the status and authority of the CIO position would be sufficient to effect the concurrent process or do we also 

need— again, not that we want to micro manage, but do we also need 

to somehow specifically address the time frame of the concurrence 

process or would elevating the position of the CIO with that type of 

authority make that move on its own? Would it effectuate the change 

on its own as opposed to independently from another proposal of the 

Committee?

Mr. McFarland. Well, I support the move, the proposed move to 

Under Secretary status. And I think that will help. I also believe 

that the VA has at the top level competent management and I believe 

competent management can deal with this issue.

 I do not believe personally that Congress should have to deal with 

an issue of concurrence in its time lines. People at the VA at executive 

level are competent. They can deal with this.

Ms. Herseth. I know I have taken up a lot of time, and I appreciate 

that response. So may I read into your response that with the competent senior leadership at the VA that elevating CIO to an Under 

Secretary status would allow the competency of senior management 

in addition to the individual holding the CIO position to address the 

issue of the concurrence process because if both you and the Admiral 

are saying that this has been a problem because it has been taking 

too long, but, yet, you have confidence in senior management at the 

VA, is it just that one move of elevating the position to Under Secretary status, and will it happen eventually because I also get the 

sense that you really do not think the Committee should have to do 

anything on that front, but is there something else that needs to happen to address it effectively?

Mr. McFarland. I think it will help greatly because at an Under 

Secretary level that the CIO will get to sit regularly with Admiral 

Cooper, Dr. Perlin, Bill Tuork and discuss these issues at that level 

which should ferret the problems out earlier. That is my opinion.

Ms. Herseth. Thank you.

 Thank you, Mr. Chairman.

The Chairman. I would like to thank Minority Council. They have 

brought to this hearing testimony of March 13th, 2002.

 It is you and me, Dr. Gauss. You got this one too?

Admiral Gauss. Is it the verbal? If it is the verbal, I do not have 

that one.

The Chairman. You know, that is all right. Yesterday Chairman 

Walsh referred to this as groundhog day. And, you know, I listened 
37

to him, and I kind of half chuckled. Reading this, now I almost want 

to laugh out loud. There are things that we have talked about here. 

This is back in 2002.

 You and I had a little banter going back and forth here and I asked 

you a specific question. Oh, gosh. We talked about who is in charge. 

I am in charge. A lot of your questions, I mean, you are the Admiral 

here. I am in charge. I am responsible. I am in charge of the ship.

But then when we got into specific lines of authority, do you have 

the specific line authority, and your answer is, no, sir, I do not have 

direct line authority. I have indirect authority for matters of IT and 

I have suborganizations within the structure where I deal directly 

with these people on matters of enterprise architecture and cyber 

security and that it is an efficiency gained over the past year because 

I do not have to go to an Under Secretary to get it approved to go to 

the Deputy Under Secretary in order to get one of the CIOs. I pick up 

the phone. I call. I direct.

 So basically you are saying that I could get it done. I could achieve 

even though I do not have line authority. I think looking back on all 

of that, you would probably look at this and say that was pretty hard 

to accomplish because what we have learned here is that unless we 

give you the tools, how can you really accomplish that, you know?

 I mean, that is kind of where we are. I am not picking on your 

testimony and your role. What I am trying to do is is I am trying to 

go back in time, see where we were, where are we today, and how we 

move to cure.

 And there is something else in here. Let me go to this one. We 

even had a conversation, and this deals with compliance, and we 

were talking about the lines of authority again. And then I got into 

the question about the rating of people. And I asked you what input 

do you have with regard to rating people, and you said I have direct 

input to the reporting seniors of these folks for what goes into their 

performance evaluation.

 I then say okay. Then with regard to promotions and merit bonuses, do you have an input into that also, and you then say the process 

at the VA? And I said if you are working with someone in one of those 

administrations who is messing with you and making life difficult to 

get implementation to the one VA is what you were talking about at 

the time, going, do you have the ability to say no to a merit bonus. 

And you say I do not have that.

  The reason I took time to go back in history with regard to this 

conversation is that since your days at the VA to today, we advance 

ourselves, the VA has continued to receive this failing grade, yet, we 

have individuals of whom received bonuses.

 Now, going back to this whole question that Mr. Bilirakis brought 

up about micro management, you are absolutely right. We do not like 

to do that. We have an oversight responsibility and function.
38

 But if we are going to create a package and part of that package is 

also going to be on personnel issues, whether it is in specific statutory authority or in report language, if we are to say that with regard 

to performance reviews, if as a CIO you are to ensure compliance, 

should IT compliance be one of the criteria of performance reviews or 

merit bonus?

 So I am interested in your thoughts, Dr. Gauss, Mr. McFarland, 

General Howard.

 Admiral Gauss. Mr. Chairman, as far as the recommendation of 

including those as part of the evaluations, I would agree.

The Chairman. All right. Thank you.

 Mr. McFarland.

Mr. McFarland. I would submit to you that I not only agree. I

would submit to you that there is proof that it works because if you 

remember last time we got an F, one of the major reasons we got an 

F is because we did not have our 600 major systems certified and accredited.

 And when Secretary Principi got very upset about that, we asked 

for authority to include the potential of bonuses not being paid in 

the outcome if all of those 600 systems did not get C and A’d within 

a year. Those 600 systems did get C and A’d in a year and it was because of that potential financial threat.

 I am convinced of that because he was very clear with the management team that he would look very harshly on bonuses and people’s 

paychecks would be affected if this did not happen. So I would submit to you that it does work.

The Chairman. General Howard.

General Howard. I totally agree, sir. It is a good mechanism that 

ought to be put in place.

The Chairman. All right. Let us envision this for a moment. How 

would this work under the federated model? You are now an Under 

Secretary. You have the responsibility under FISMA to ensure compliance. The Secretary has now directed authorities to you. I am 

anticipating that finally this slow roll approach over Directive 6500 

after three years is finally coming and that is what I am hoping for. 

How do we do it? How do you do this?

General Howard. Sir, the area that it would be difficult is punitive 

action, you know, any action that must be taken against a person 

from the person’s supervisor. In other words, if Art, for example, 

worked in another department and violated one of these policies and 

violated an item— 

The Chairman. Can you turn that on for me, your microphone on, 

please.

General Howard. —you know, violated one of these policies, we 

can make it very clear that he has done so. But the punitive action 

itself cannot be taken by the CIO. It would have to be taken by his 
39

supervisor.

The Chairman. Right. But let us keep it to the question on a performance measure.

General Howard. Right.

The Chairman. So I am in one of the stovepipes.

General Howard. Right.

The Chairman. So I am now a middle-level manager, just like you, 

directing a battalion.

General Howard. Right.

The Chairman. You have given a directive to your battalion commander that you want certain things to be noted. So all of your officers, they have to make sure that they are compliant with one of your 

directives. So how do you as now an Under Secretary and CIO, and 

you now have got CIOs completely under you, right?

General Howard. Right. And I—

The Chairman. So how are we going to do that?

General Howard. Those folks belong to me. There is no question 

about, you know, disciplinary action, any kind of action against folks 

who directly work for the CIO. If they work somewhere else, you 

know, clearly violations of anything should be reported to the CIO. 

You can have that provision.

The Chairman. All right. Wait. You are off subject again. Let us 

go back to the issue on bonuses.

General Howard. On bonuses?

The Chairman. On merit, performance, and bonus.

General Howard. And the individual is in one of the stovepipes?

The Chairman. Yes.

General Howard. And gets a bonus?

The Chairman. Wants a bonus.

General Howard. And should not have gotten—

 The Chairman. But is not compliant.

General Howard. And should not have gotten the bonus?

 The Chairman. Uh-huh.

General Howard. The only thing you can do is elevate it to a higher 

level because, you know, or— 

 The Chairman. Wait. Time out. Let us break this out. One of your 

CIOs is at one of the medical centers.

General Howard. So he belongs to me.

The Chairman. But he is at one of the medical centers.

General Howard. Does not matter. He belongs to me.

 The Chairman. He is at one of the medical centers and he belongs 

to you?

General Howard. Yes, sir.

The Chairman. He is sitting at the table as any good hospital administrator would do. He has got him at the table there, and that 

hospital administrator, one of his issues is to be compliant.
40

And what I am trying to figure out under the federated approach, 

since the CIO is not going to be in these lines of authority with regard 

to punitive actions, but if you make it a performance measure, then it 

is the Secretary through the Under Secretary that has to ensure that 

certain directives are made and have compliance.

General Howard. Yes.

The Chairman. That is our challenge with tomorrow’s panel— 

General Howard. Sir—

The Chairman. —because what is clear today is that with regard 

to the General Counsel’s legal opinion that said unto Bob McFarland 

that you do not have this authority, then that authority then vested 

with the Secretary, and directive 6500 just sat out there. Nothing 

was really acted on with regard to those authorities. It vested with 

the Deputy and the three Under Secretaries.

 And even though you had the responsibility of compliance, authority was not exercised to bring the Department in compliance with 

FISMA.

General Howard. Sir—

The Chairman. I am just letting you know that.

General Howard. Okay, sir.

 The Chairman. So my challenge here is if we are going to go under 

the federated approach and we say, fine, we are going to bring it into 

a performance measure, your CIOs out there can be counsel to that 

administrator, you know, meeting with them, making sure that they 

are compliant because here is what is in the pipeline or here is what 

is going on. That is what he is there for. He is to be the counsel to the 

administrator. You agree with that?

General Howard. Sir, he also has a black hat on his head, too, 

that— 

 The Chairman. What does that mean?

General Howard. —needs—he needs to report instances that are 

not in compliance.

The Chairman. And who does he report that to?

General Howard. Up the chain to me.

 The Chairman. All right. But he also has a responsibility to the 

hospital administrator, correct?

General Howard. Yes, sir. He sure does as a customer. You know, 

he is a service provider.

The Chairman. Okay.

General Howard. But he also has eyes and ears and he needs to 

keep them open. And if he uncovers things that are not going on, I

expect him to do something about it. Obviously to inform the hospital 

director, but me too.

I mean, it is like first brigade and second brigade. You know, I cannot give an Article 15 to some guy in first brigade, but I sure can put 

heat on that brigade commander through the division commander. 
41

And it is particularly a problem in the punitive type of action.

The Chairman. So this is going to require—let me turn now to Gartner—under this federated approach, in order for this to work, this 

is going to require some pretty stern leadership from the Secretary, 

Deputy Secretary to the Under Secretaries to perfect it.

 Mr. Bresson. It does not relinquish leadership at any level, sir. 

You characterized it as stern. That would probably be a good thing. 

But the model itself does not preclude that leadership from being 

exercised, those authorities to be implemented.

 The Chairman. I appreciated your insights with regard to Ms. 

Herseth’s questions. You did a very good job today with regard to the 

concurrence and nonconcurrence. That was insightful or us.

 And I appreciate the Deputy Secretary being here today, that you 

are hearing this, and those are things that you struggled with over 

the years that you have worked. But those time lines, I think, that 

have been recommended are probably pretty important.

 Having that directive sitting out there for three years was probably 

not a good thing, and we will get a chance to talk about that tomorrow.

 With regard to nonpay contractors involved in software development, do you know how many there are?

General Howard. Numbers of contractors, sir, I am not sure. I will 

have to get that for you.

The Chairman. Mr. McFarland, would you have any idea approximately?

Mr. McFarland. Contractors are in nonpay, yes. I do not know exactly how many are there. I could give you an educated guess. I would 

say it is somewhere between 500 to 700, I would guess, throughout 

the Department. And that is made up of administrations and staff 

offices. That would be my guess.

The Chairman. Now, there is—

General Howard. Sir, if I could pile on. I mentioned that we have 

phase one of this program we put in place, assessment. We finished 

the internal part. The next steps is contractors, you know, where are 

they, what are they doing, et cetera, et cetera.

 The Chairman. The—

General Howard. When we get through with that, we can give you 

some feedback.

The Chairman. The Secretary gave testimony yesterday to Mr. 

Walsh’s Subcommittee on Appropriations with regard to the concerns 

about a subcontractor perhaps releasing data if they did not receive 

a proper payment. The Secretary responded that he was not aware 

that he had any prime contractors that were offshore.

 Now, as I understand, this may be, in fact, technically correct. But 

what happens if we also put in our package so that we are not jeopardized nor our national security, if we are going to have contractors, 
42

that they may not subcontract with any off-shore entity.

 What are your thoughts?

General Howard. Sir, I am not familiar with the details of the 

incident. I believe you are right. It was a subcontractor that was 

involved.

The Chairman. If you know about that, will you make sure the Secretary is briefed for tomorrow?

General Howard. Yes, sir.

The Chairman. All right. Mr. McFarland, your thoughts.

Mr. McFarland. I think it is important to know who subcontractors are. There are difficulties in the IT world today. It is an international product. So much of what is put into IT both hardware and 

software today, much of it does come from various overseas subsidiaries and various overseas environments through contracts.

 I think it is wise in the contracting process to understand who your 

subcontractors are and put in a requirement that requires they notify 

you if they intend to push any of that work offshore, and then you can 

make a decision at that point whether you believe that is—I mean, 

pushing something offshore to Britain, for example, may not be near 

the issue it would be to pushing something offshore to China. And 

I think it is a matter of understanding and having a requirement 

would be good to know what, if any, off-shore requirements come up.

The Chairman. All right. I am going to go to Dr. Gauss, but I want 

you to think about this because I am going to come right back to you, 

Mr. McFarland, about your counsel to us with regard to what should 

be included in our package. But I want you to think about it and I am 

going to come back to you.

 Dr. Gauss.

Admiral Gauss. I would think that in dealing with the purchase 

of purely commercial products and the support services that go with 

those commercial products, it would be very difficult to sever off-shore 

relationships.

 That said, any contract that is done for the government where 

the government is getting specific products and services that meet a 

specific government need, I think you could impose restrictions that 

limit off-shore involvement. But there are two separate camps here, 

I believe.

The Chairman. Well, we have experience in this in the Department 

of Defense with regard to our procurement policies, who is going to 

build what, who gains access to what, from weapons systems to guidance systems. I mean, you name it.

 I hate to create that type of system, but I am very insulted that 

there is a company out there in another country that would try to 

blackmail our country, and that is what they tried to do.

 And what that does is create a heightened awareness. And you are 

absolutely right. You do not want to penalize Great Britain or penal-
43

ize any of our valued allies in the world, but I am pretty concerned.

 I am going to come back to you, Mr. McFarland. Take your concept 

and take it to the next step. What is your best counsel to me?

Mr. McFarland. Well, as Dr. Gauss said, there are two distinct 

domains here. Those are products and services that are bundled, if 

you will, such as a workstation, a printer, any kind of bundled service 

where components come from all over the world. You have things 

called TAA and BAA by American act, those kinds of acts that preclude you from taking product made in certain countries that do not 

meet those requirements. So you are protected there.

 I think your biggest problem is the other domain which is the services domain where you contract with someone for a service, transcription services, you name it. And there you run into the problem.

 I think you should require that before any subcontractor, allow any 

of that work to go off-shore, that he get clearance from the VA so that 

the VA has an understanding of whether that offshore is Great Britain or if that offshore is China. And I think it would be wise to- -

The Chairman. So, number one, would be a notification procedure?

Mr. McFarland. Right. And then an approval.

The Chairman. And then an approval process, right?

Mr. McFarland. Right.

The Chairman. Go ahead.

Mr. McFarland. I mean, I am not familiar enough with our contracts for services in the VA to know, and I am sure each of them is 

unique for the service. But those to me ought to be clauses that are 

boiler plate and that an approval process be required if a subcontractor is an off- shore entity or any of the information is offshore.

The Chairman. All right. Here is why I am taking a little time on 

this particular issue.

Mr. Bresson. Excuse me, Mr. Chairman.

The Chairman. Yes.

 Mr. Bresson. The only thing I might add with respect to services is 

it would be significant, yes, to identify the subcontractor as an entity, 

but quite often knowing the key personnel and their background and/

or other attributes about them might also be significant and important to such an action.

The Chairman. Thank you for that because the Secretary has 

brought up several times the issue about, background checks -- that 

individuals with access to certain data even within the VA have not 

had background checks.

 So what? We are going to highly scrutinize Americans, yet permit 

some of the services and access to data to be subcontracted to a thirdworld country with no form of notification or compliance or approval. 

So I think we need to pause and think about that as we develop our 

systems. So thank you very much.

 So now let me turn to DoD, and that is why I am pretty concerned. 
44

My first question would be, because I do not know the answer to 

this, when a forensic analysis of the data was done with regard to 

what was stolen, with regard to active duty Guard and Reserve, were 

MOSs included?

 Mr. Brandewie. No, sir.

The Chairman. No?

Mr. Brandewie. No, sir.

The Chairman. Okay. Does the VA within the universe of their 

data, would they have the MOS?

Mr. Brandewie. No. We do not furnish the MOS as part of our data 

transfer. On separatees, the DOD Form 214, and I am not exactly 

a hundred percent positive, on separatees, I believe the MOS is included on the DOD Form 214.

 That does not come in a data exchange. It comes through a basically paper form and is actually automated by the VA. When it is automated, I am not sure if they include the MOS, but I would assume 

they do. But it is not part of our automated feed from the Department of Defense to VA.

The Chairman. Much of our present War on Terror is operated in 

the dark world. And I have heightened awareness of our special operators and they sure do not want the world to know who they are 

and what they have done.

 And I am really concerned with regard to protections of data that 

is out there because I look at this and say, well, yes, this may have 

happened, but what is next, what could happen.

 And I do not want to blow up worst case scenarios, but, Mr. Deputy 

Secretary, this is an issue I want to explore with you over the next 

several weeks, and we will bring it up tomorrow on how we develop a 

system because, you know, as we work here with the Department of 

Defense, they are not going to be too keen about how do we gto health 

medical records.

 You know, if we cannot give veterans assurances, how can we give 

our partners assurances? I do not have an expertise or background in 

procurement law and so I am going to have to turn to experts to help 

us on how we devise a system to do this.

 Let me ask a question about biometrics, user ID numbers. I am 

also considering placing in our package—this package will be large 

enough that it will have jurisdictional referrals to other committees. 

We are going to recommend changes to FISMA.

 I am not going to have any of this in the future about lawyers’ interpretations. We are going to make this pretty doggone clear. And I

have already spoken with Mr. Davis about it, so we are going to make 

those corrections.

 I am also considering saying to the Department of Defense in this 

legislation and the VA that you cannot use the Social Security number. So let me ask for your thoughts about that.
45

 Mr. Brandewie. If could start out—

 The Chairman. You are going to have to come up with a soldier’s ID

number or some type of number that both the VA and DoD use that 

is not the Social Security number.

Mr. Brandewie. In passing, sir, I referred to a consolidated feed 

between DoD and the VA which were to replace the legacy feeds that 

we do. In that consolidated feed, we feed the VA a new ID number 

which we give a very odd name to. It is called electronic data interchange personal ID.

 It is a made up number. And it is the number we actually trade 

with the VA in the consolidated feed instead of Social Security number. And it could form the basis for interaction between the two departments without reliance on Social Security number.

 Having said that, Social Security number remains an important 

identifier in establishing identity. Once identity is established, then 

between agencies and in large- scale computer systems, it would be 

possible to only use Social Security number simply as an identity anchor and not a way to trade information between systems.

 I might add we do that also with the medical community and we 

have established this number as a patient ID with the medical community, and also pass that over to the VA as well. There are new 

technologies that are emerging that would allow us to deemphasize 

Social Security number as a universal identifier.

 Having said that, totally banning it from IT systems would create chaos, but it could be deemphasized especially in terms of data 

interchange. And, again, once identity is established, its importance 

recedes, and that could be emphasized in legislation.

The Chairman. Our challenge here is that so long as the financial 

services industries rely upon that Social Security number, therein 

lies our challenge. So if I take that out of their criteria, you know, I

at least can protect our veterans and our military.

 What we would have to do is is when they take their oath of enlistment or commission, we are reverting back to the old days where you 

get your ID number, your soldier number, or whatever.

 Do you remember what yours is, Mr. McFarland?

Mr. McFarland. Yes, sir.

The Chairman. What is it?

Mr. McFarland. US54342381.

 The Chairman. There you go.

 You guys knows yours?

General Howard. Yes, sir, 097560.

The Chairman. Wow. Well, I am just letting you know that is where 

I am considering going. And it might create a heartache for you because if you have come up with some other kind of number, we will 

figure out how we can best do this, and we want to work with DoD to 

do that because that will also be what we will use with regard to our 
46

patient medical records and that type of thing.

General Howard. Sir, I might add within the VA for employees, we 

have discussed going to ID numbers for employees.

The Chairman. Just to let you know some of the major areas where 

we are thinking about, and this is not an exclusive list at all, as this 

Committee and others work together, we are going to look at this issue on performance reviews and criteria. We are going to consider 

this movement of the CIO to an Under Secretary and elevate the 

CISO to the Deputy Secretary or Assistant Secretary. I am sorry.

 I personally asked the Secretary what personnel changes, if any, 

does he need with regard to his authorities with regard to disciplinary actions to make sure he can ensure compliance or fire someone.

 We are going to look at the issue on the credit monitoring package. 

I am deeply appreciative to the VA on what they had done in stepping forth to offer that to veterans along with the insurance package. 

That was a good thing.

 I am deeply disturbed with regard to the lawsuit. For the VA to 

move forward, to take actions to help the veterans and now for a class 

action lawsuit to prevent you from advertising that assistance, what 

it does for us is it shows that time is of the essence for us to move our 

package, and we are going to have to give a directive.

 The Secretary shall. And we want to work with you with regard 

to our language. But when I come in and I use mandatory language 

instead of discretionary language, what I have done is I have shot a 

hole through this class action lawsuit out there.

 We will also include some FISMA changes and that DoD, VA are 

not authorized to use Social Security numbers with regard to personal identification. We might direct them to really create a soldier’s 

number, an identification number. It probably would be better to do 

it in the prospective manner than to say that you shall not or cannot 

use a Social Security number. I mean, that does not make a lot of 

sense.

 We want to address the issue with regard to the outsourcing and 

we are also going to bring back our issue on centralization. I have not 

let it go. I cannot let it go. I respect your opinions. I got to figure out 

how we can get there.

 Let me ask Gartner. I will not keep you here much longer, but let 

me ask Gartner Consulting. When you turn to one of your major corporations out there and you have now said we need to centralize your 

IT, how long does that take?

Mr. Bresson. Mr. Chairman, there are a number of factors in that 

kind of advice, particularly the current business environment, because, as we all know, it is not all about IT meaning that the way 

decisions are made in the business or in this case in the mission and 

the business will set the stage for how successful centralizing and/or 

federating the IT portion of that business.
47

 We do counsel that once the decision is made, centralization, rough 

order of magnitude, would probably take anywhere between 12 and 

36 months, and there are a lot of variables there, the global dispersion 

of the assets and the people and the organization, the sheer volume of 

systems and other items that need to be brought under control.

 The Chairman. All right. Let me break it down and go right to 

security. So when the VA designs a security policy, they finally get 

that done, what kind of training is going to be needed to promulgate 

that policy to make sure it is properly implemented? What kind of 

time are we looking at?

 Mr. Bresson. I would be guessing, sir.

 The Chairman. I mean, you are consulting a lot of companies out 

there that make changes and all. I mean, three months, six months, 

nine months?

 Mr. Bresson. Right. There is probably a footprint that needs to 

be established that has a defined period in which it should be established. And then beyond that, there is the continual changes of new 

personnel coming aboard, potentially other changes in personnel roll, 

et cetera, that would need to be addressed.

 In terms of time—

 The Chairman. Let me reask the question because you are very 

good at dancing now. What is a reasonable time line with regard to 

implementation of a security policy for an entity such as the VA or a 

major corporation?

 Mr. Bresson. Implementation of a security policy. Well, I am not a 

security expert, sir, but I would imagine that something implementation-wise starts within a 90-day period and potentially to a 180-day 

period.

The Chairman. How long did it take DoD?

 Mr. Brandewie. To implement a security policy?

The Chairman. Yes.

Mr. Brandewie. I mean, in the basics, it has taken a number of 

years. I mean, and security is always evolving and changing. I mean, 

the centralization of the global information grid took probably over 

two years, you know, and the security policies associated with it. But 

we are very diverse and decentralized with IT, so I am not sure there 

is a corollary there for the VA.

The Chairman. Well, kind of because you are very decentralized 

and so is the VA. And it is not that it is all that bad either.

Mr. Brandewie. No.

The Chairman. And just because it is decentralized does not mean 

you do not have security policies. They have security policies. It is 

that it is agency-wide security policy. So it is the development of the 

agency-wide security policy and its implementation as you centralize 

that is our challenge, right?

Mr Brandewie. If I could make one comment. I mean, there are 
48

policies all over the place and security policy is certainly one of them. 

It takes a long time to articulate and work its way through the system.

 One thing that DoD has done that has been very effective, I believe, 

is the establishment of a joint task force for network operations protection, JTFGNO. And they are very fast in terms of identifying a 

security issue, finding a fix to a security problem, mandating that the 

fix be implemented, and enforcing the implementation of that fix.

 It is like, if you will, a kind of go team that takes the security policy, 

puts it against the real world threats that are out there, monitors 

those threats, and then takes action. And that I found to be particularly effective within DoD.

 The Chairman. So let me ask this about FISMA for a moment. 

When the FISMA audits have come back and have given the VA very 

poor ratings over the last four years, as we proceed in this federated 

model, the responsibility here rests with the Secretary. He acknowledges responsibility.

 Who does he delegate this to with regard to compliance based on 

the FISMA audit? Are you aware, General Howard?

General Howard. Sir, it will be cleared up with this delegation 

memo I referred to. But as I sit here today, it is my problem, you 

know, to set the policies and set the actions that need to take place to 

alleviate a deficiency because the reorganization that will take place, 

a good number of those will rely with me now.

 For example, take the protection of server rooms and things like 

that. That is now my responsibility with the current direction we are 

going in the IT reorganization.

 I do not know if that answers your question, but—

The Chairman. You have a really difficult job. You do. I am not 

here to beat you up at all because you are saying to this Committee 

it is me. That is no different than what Admiral Gauss said back in 

2002 to Ms. Carson, it is me.

 So you can do everything you want. But if you do not get the backing from the Deputy Secretary or the Secretary to make sure things 

happen to those Under Secretaries, you are going to be back before 

this Committee. Members of Congress are going to be asking you 

why once again did you get an “F” in the audit.

General Howard. Sir, the backing is absolutely necessary. You are 

exactly right. But it is up to me to make it clear as to what should 

occur. That is my problem. And we have got a lot of work to do in 

that area.

The Chairman. DoD, you received an “F” on your audit, too, did you 

know, from FISMA?

Mr. Brandewie. I believe that is correct.

 The Chairman. Why did that happen?

mr. Brandewie. I really do not know. I am not familiar with the 
49

detailed reasons for the DOD score.

 The Chairman. All right. I just thought I would let you know I

knew. You thought you were going to get away with it, didn’t you?

 All right. I want to thank all of you for coming. I have a great deal 

of respect for you and what you are trying to do here. It is hard for 

me. I have never been a CEO. I have never run a major organization. 

It is hard for me, though, in today’s time whether it is a government 

department or agency or whether it is a company or any form of entity, when I have IT involved, why I would not make the CIO my new 

best friend. I do not understand why that would not happen.

 I had an opportunity, just to let you know, McKesson Company out 

there. Bloomington Hospital just outside of my district, they wanted 

to modernize their IT. They wanted to do some centralization and do 

some things. And they brought in McKesson. And the hospital administrator brought in someone from Purdue University, very sharp 

in information management, and made that CIO his best friend.

 And it sent such an incredible signal to the medical director to 

get on board, that these things are coming, these changes are made, 

whether it came from the business side of the house; tell me what 

your recommendations are, what you are looking for. The CIO is going to look at it.

On the medical side of the house, whether it is filmless or that medical technologies, everything had to be compatible and everything had 

to go through the CIO. And everybody at the board table knew that 

and everybody was also enthused to talk about how as a team they 

were all going to work. And they all wanted to know and associate 

with the CIO. That was a system of pure empowerment, and they 

were able to perfect changes in a hospital setting rapidly.

 So it is challenging for me, General Howard, why you are not the 

new best friend. I do not know if you are or you are not. But what 

I am saying is that I recognize you have a very difficult job because 

you have to be the agent of change. And I do not care if you are going to change the flavor of ice cream at lunch, you are going to have 

somebody attack the agent of change. And it should never be taken 

personally when you are the agent of change. All right?

General Howard. Yes, sir. I agree.

The Chairman. We want to continue to work with you. Please, if 

you have recommendations based on the questions, please be in touch 

with the Committee as we formulate the package.

 To Gartner Consulting, thank you very much. You have well 

earned your pay in your counsel and advice to the VA. It has been 

very sound, and we appreciate that.

 To DOD, you have still got your own work to do, and we will send 

you back. We appreciate you coming out here today.

 This hearing is now concluded.

[Whereupon, at 1:42 p.m., the Committee was adjourned.]
50

APPENDIX
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78