U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

26–248 2017

HELP OR HINDRANCE? A REVIEW OF SBA’S 

OFFICE OF THE CHIEF INFORMATION OFFICER 

HEARING 

BEFORE THE

COMMITTEE ON SMALL BUSINESS 

UNITED STATES 

HOUSE OF REPRESENTATIVES 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

HEARING HELD 

JULY 12 , 2017 

Small Business Committee Document Number 115–028 

Available via the GPO Website: www.fdsys.gov 

SBREP-219A with DISTILLER


Congress.#13
(II) 

HOUSE COMMITTEE ON SMALL BUSINESS 

STEVE CHABOT, Ohio, Chairman 

STEVE KING, Iowa 

BLAINE LUETKEMEYER, Missouri 

DAVE BRAT, Virginia 

AUMUA AMATA COLEMAN RADEWAGEN, American Samoa 

STEVE KNIGHT, California 

TRENT KELLY, Mississippi 

ROD BLUM, Iowa 

JAMES COMER, Kentucky 

JENNIFFER GONZA ́ LEZ-COLO ́ N, Puerto Rico 

DON BACON, Nebraska 

BRIAN FITZPATRICK, Pennsylvania 

ROGER MARSHALL, Kansas 

RALPH NORMAN, South Carolina 

NYDIA VELA ́ ZQUEZ, New York, Ranking Member 

DWIGHT EVANS, Pennsylvania 

STEPHANIE MURPHY, Florida 

AL LAWSON, JR., Florida 

YVETTE CLARK, New York 

JUDY CHU, California 

ALMA ADAMS, North Carolina 

ADRIANO ESPAILLAT, New York 

BRAD SCHNEIDER, Illinois 

VACANT 

KEVIN FITZPATRICK, Majority Staff Director 

JAN OLIVER, Majority Deputy Staff Director and Chief Counsel 

ADAM MINEHARDT, Staff Director 

SBREP-219A with DISTILLER

(III) 

C O N T E N T S 

OPENING STATEMENTS 

Page 

Hon. Steve Chabot ................................................................................................... 1 

Hon. Nydia Vela ́zquez ............................................................................................. 2 

WITNESS 

Ms. Maria Roat, Chief Information Officer, United States Small Business 

Administration, Washington, DC ........................................................................ 4 

APPENDIX 

Prepared Statement: 

Ms. Maria Roat, Chief Information Officer, United States Small Business 

Administration, Washington, DC ................................................................ 21 

Questions for the Record: 

None. 

Answers for the Record: 

None. 

Additional Material for the Record: 

None. 

SBREP-219A with DISTILLER

SBREP-219A with DISTILLER

(1) 

HELP OR HINDRANCE? A REVIEW OF SBA’S 

OFFICE OF THE CHIEF INFORMATION OFFICER 

WEDNESDAY, JULY 12, 2017 

HOUSE OF REPRESENTATIVES, 

COMMITTEE ON SMALL BUSINESS, 

Washington, DC. 

The Committee met, pursuant to call, at 11:00 a.m., in Room 

2360, Rayburn House Office Building. Hon. Steve Chabot [chairman of the Committee] presiding. 

Present: Representatives Chabot, Luetkemeyer, Brat, Knight, 

Kelly, Blum, Bacon, Fitzpatrick, Norman, Vela ́zquez, Evans, Murphy, Lawson, Adams, Espaillat, and Schneider. 

Chairman CHABOT. Good morning. The Committee will come to 

order. 

Before we get started, I wanted to take this opportunity to welcome our newest member here, Congressman Ralph Norman, who 

was sworn in a little over 2 weeks ago. He joins us from the beautiful State of South Carolina, and I know because my wife and I 

were just there a couple of days ago as a matter of fact, and it is 

a beautiful great state. My mom is from North Carolina. As a real 

estate developer, Congressman Norman brings real world experience, I think, to this Committee, knows an awful lot about small 

business, and we are looking forward to having him be a great contributing member of the Committee. So I think both sides would 

like to welcome you. 

Mr. NORMAN. Thank you so much. 

Chairman CHABOT. Thank you. 

We also welcome everyone else for being here today. The Committee is here today to examine the Small Business Administration’s Office of the Chief Information Officer. This office is tasked 

with managing and overseeing the agency’s IT investments and IT 

security. That is a big job and it is an important job. The Office 

of the Chief Information Officer must protect taxpayer dollars and 

small businesses’ information while helping the agency run more 

efficiently and more effectively. 

Unfortunately, the Office of the Chief Information Officer has 

struggled over the past several years. It has experienced very high 

turnover at that position, in particular, the Chief Information Officer position. The SBA is on its eighth CIO since 2005. Let me repeat that, the eighth CIO since 2005. I was reminded by some of 

the local Redskins fans that that is about how many quarterbacks 

SBREP-219A with DISTILLER

2 

they have had over that same period of time. Of course, I am a 

Bengals fan, so I really do not care. 

But on the serious side, a high turnover rate, especially at the 

Chief Information Officer position, undermines the Office’s ability 

to not just make improvements, but to even meet its basic obligations: its obligation to deliver effective IT products and initiatives, 

its obligation to ensure strong IT security, its obligation to manage 

IT spending, its obligation to reduce security risks, and on and on. 

In its annual Management Challenges report, the SBA Office of Inspector General listed the lack of IT leadership as one of SBA’s top 

challenges for fiscal year 2017. The message from the OIG is that 

SBA cannot even begin to address its many IT weaknesses without 

strong and effective leadership, and that requires, in part, stability 

and continuity within the Office of the Chief Information Officer. 

Notably, this report was released just as Chief Information Officer Maria Roat, our witness here today, was starting at SBA. Prior 

to her arrival, her post had been vacant for over a year. The Committee welcomed her arrival then and continues to be hopeful about 

the positive change Ms. Roat is trying to bring about. From what 

the Committee has seen and heard so far, Ms. Roat is trying to 

strengthen the leadership and voice of her office, but this hearing 

will give us the opportunity to better understand what improvements she had made and what improvements she is still planning 

to make. As we know, there is plenty of room for improvement. 

I impress upon Ms. Roat the responsibility of both her and her 

office. It is important that she and her office be fully engaged in 

SBA’s IT investment portfolio, overseeing the many ongoing IT 

projects and all the while guard against security breaches. SBA 

must do so to ensure that the office is running well and supporting 

the agency’s operations and small businesses, as well as protecting 

taxpayer dollars. 

I want to thank Ms. Roat for being here today. We look forward 

to your testimony and obviously asking you some questions. 

And I would now like to yield to the Ranking Member, Ms. 

Vela ́zquez, for her opening statement. 

Ms. VELA ́ ZQUEZ. Thank you, Mr. Chairman. 

Of the committee’s many responsibilities, one of our most critical 

is overseeing and examining the Small Business Administration. 

As the only federal agency charged specifically with helping small 

businesses grow and succeed, all of the SBA’s functions should 

strengthen and preserve the entrepreneurial foundation of our 

economy. For small businesses to fully reap the benefits of SBA’s 

programs, it is important for the agency to operate efficiently and 

effectively. In particular, the Office of the Chief Information Officer 

plays a critical role in promoting information technology to support 

and enhance business decisions and agency operations. 

Despite its critical role, historically, SBA—this is under Republican administration and Democratic administration—SBA has neglected to prioritize this office. This is evidenced by high turnover 

and an absence of a OIO for over a year. Such disregard not only 

wastes taxpayers’ dollars, it weakens IT security, putting the government and small firms at risk. 

Cybersecurity vulnerabilities are always of tremendous concern, 

but are especially grave in light of events last year. Our intelSBREP-219A with DISTILLER

3 

ligence community has concluded that Russia used cyberattacks in 

an attempt to influence last year’s presidential and congressional 

elections. We can expect that Russia’s intelligence services and 

other bad actors will continue seeking weaknesses in our IT security system for political gain and personal profit. 

As stories unfold now almost daily about Russia’s digital meddling in our democratic process, we should expect every federal 

agency to make cybersecurity a top priority, so it is disconcerting 

that the OCIO has had such severe problems for so long. There 

have been numerous GAO and IG reviews of SBA’s IT operations 

highlighting these deficiencies. In its 2015 review, GAO found that 

SBA had not prioritized long-term IT organizational transformation 

and had not conducted regular reviews of its IT investment to ensure they continue meeting agency needs. 

Additionally, the IG found that overseeing and addressing IT investment and security risks was one of the agency’s most serious 

management challenges for this fiscal year. The reports indicate 

that some progress has been made in implementing recommendations from these evaluations. Over 30 remain outstanding. This is 

unacceptable. 

It has been noted Ms. Roat recently took the reins as CIO, and 

it is my hope that she will make oversight of the OCIO a priority. 

I look forward to working together to ensure SBA deploys adequate 

steps to strengthen IT security and management of the OCIO. Effective management of the agency’s IT system helps ensure small 

businesses receive the assistance they need to grow and create jobs. 

Equally important, bolstering the agency’s cybersecurity will ensure government and small businesses’ sensitive data is safeguarded from those who have already conducted cyberattacks on 

our Nation and others who may have similar plans. 

I look forward to the witness’ testimony on how these challenges 

are being tackled. 

Thank you, and I welcome you. 

Chairman CHABOT. Thank you very much. The gentlelady 

yields back. 

If Committee members have opening statements prepared, I 

would ask that they be submitted for the record. 

Now I will briefly explain our timing rules. Since we only have 

one witness it is pretty easy. We operate under the 5-minute rule, 

and the lighting system will help you. The green light will be on 

for 4 minutes. The yellow light will come on to let you know you 

have a minute to wrap up. And then the red light, if you could 

wrap up, you know, at or near that time, we would greatly appreciate it. 

Now, we would like to introduce our witness here this morning. 

Our witness is Maria Roat. Ms. Roat is Chief Information Officer 

for the Small Business Administration, as we have mentioned a 

number of times already this morning. She has been in this post 

only since October of last year. Prior to accepting this position, Ms. 

Roat was the Chief Technology Officer at the Department of Transportation. Ms. Roat also served for 10 years at the Department of 

Homeland Security, and worked in the private sector gaining relevant information technology experience there. Lastly, and very impressively, Ms. Roat accumulated 26 years of active duty and reSBREP-219A with DISTILLER

4 

serve service before retiring from the United States Navy in 2007, 

and we appreciate your service to our country. We thank you again 

for your service. We welcome you here this morning. And you are 

recognized for 5 minutes. 

STATEMENT OF MARIA ROAT, CHIEF INFORMATION OFFICER, 

UNITED STATES SMALL BUSINESS ADMINISTRATION 

Ms. ROAT. Thank you. Good morning, Chairman Chabot, Ranking Member Vela ́zquez, and members of the Committee. Thank you 

for the opportunity to discuss the technology transformation underway at the Small Business Administration. 

I on-boarded as the CIO in October last year and began with a 

frank and honest conversation about the state of IT at the agency. 

Even before I arrived, it was clear that transformation was overdue. In November, we embarked on a fast-paced journey to change 

how the SBA builds, buys, and manages information technology to 

support small businesses and entrepreneurs. I was laser-focused 

about our targets through the end of 2017: stabilize and modernize. 

For the first 4 months, the CIO team inventoried, upgraded, and 

patched operating systems, software, and applications, and shut 

down approximately 170 servers in our primary data center. We 

launched an infrastructure modernization to lay the foundation for 

future capabilities. I eliminated duplicative software and cut unnecessary expenditures. I am leveraging our small business contractors to bring in solution architects and senior engineering expertise. We developed a cloud architecture model and are in the 

staging process to move our systems to the cloud. 

All of these activities will enable us to take an enterprise approach to business solutions and launch initiatives like virtual 

counseling that would help improve citizen-user experience with 

the SBA. We are standardizing and increasing our users’ capability 

with an enterprise deployment of Windows 10, Office 2016, and 

One Drive later this summer. We turned on cloud-based collaboration tools internally and are piloting the capability externally with 

the Tech Coalition. 

We are collaborating with our stakeholders to introduce business 

intelligence capabilities and modernize enterprise reporting. We 

must be able to quickly generate and share interactive reports to 

visualize and analyze our data to better understand results and 

target SBA services to small businesses. 

We are aggressively modernizing, pushing the envelope, and testing new capabilities and security remains paramount. We are introducing advanced threat protection capabilities, encryption, and 

data loss prevention. We are approaching security by design, building it in, not bolting it on. While much of this work is behind the 

scenes, there are several public-facing activities underway. We are 

actively modernizing SBA’s website to make information readily 

available and making it responsive to mobile devices. We are modernizing incrementally. Lender match is launching shortly and improvements in functionality with access points for counseling, 

events, and resources are launching later this year. The certify program continues to also incrementally deliver capabilities. The 

HUBZone Map launched last month and tools such as ‘Am I EligiSBREP-219A with DISTILLER

5 

ble’ help small businesses determine if the certification programs 

are a good fit for their businesses. 

Transparency is critical, and I hold monthly IT forums. We recently held the first CIO open house to provide a sneak peek at the 

tools and technologies that will be deployed in a few months. We 

also reimagined and modernized OCIO’s internet site to share information and resources. 

Opportunities remain abundant. We must continue to attract, 

hire, and retain the right talent and develop the entire SBA IT 

workforce as we transition to an organization capable of supporting 

modern technology stacks, cloud-based platforms, and being an enabling partner to SBA’s program offices. Over the next 12 to 18 

months, IT management capabilities will continue to mature as we 

enhance governance and transparency and improve risk management of IT investments. 

To overcome the inherent inertia of the status quo, we are making a radical and difficult, but deeply considered and well-planned 

turn, moving to an environment where the CIO is a partner to and 

enabler of the business of SBA. We have an opportunity to get this 

right. We are aggressively hiring the right team, modernizing our 

business and technology capabilities. We are introducing innovation, not just to support the SBA of today, but the SBA of the future. 

Thank you for the opportunity to speak with you today, and I 

look forward to your questions. 

Chairman CHABOT. Thank you very much. I will now recognize 

myself for 5 minutes to begin the questioning. 

According to the Inspector General’s risk management report for 

2017, the SBA had 39 open recommendations related to IT security, some dated back to fiscal year 2011. Do you know generally 

the status of those open investigations—excuse me, recommendations, and how many of them still remain? And what are you and 

your folks doing to ensure that the office meets its obligations 

under the Federal Information Security Modernization Act, 

FISMA? 

Ms. ROAT. Yeah, we did have quite a few that were old ones. 

I will say that we did close a couple of those old ones that were 

there. Over the last few months we have closed more than a half 

a dozen, and then we actually have a schedule of another halfdozen or so that will be closed through the end of this year. There 

are some that are low-hanging fruit that have been open for quite 

some time and so we are tackling those first, and there are some 

that are a little bit longer-term that we have scheduled to close 

through the end of this calendar year and into next year. So we acknowledge that there are more than 40 that were open, closer to 

50 with the new report that came out, and we are working through 

those now. It is a priority. 

Chairman CHABOT. Is there anything you could give us, an example of, you know, why something would be still open? Why it is 

particularly tough that you have to deal with? 

Ms. ROAT. For some of the older ones it was a matter of just 

taking action and documenting. Some of the things were already 

done, but it is a matter of coordinating with the IG’s office. Nobody 

took the next step to say we did this and showed the evidence to 

SBREP-219A with DISTILLER

6 

say that this was done. In some cases that was all that was needed 

to be done. You have to prove it to the IG. You have to provide that 

evidence. And in some of those instances where we have been able 

to close them quickly, we have provided that evidence and said we 

have done the work. 

Chairman CHABOT. Thank you. 

Currently, what are the biggest challenges that your office is facing, and how are you working to overcome those challenges? 

Ms. ROAT. Walking in the door, the biggest challenge was really 

stabilizing the IT environment, just what we had. I also had a challenge around vacancies that I had coming in to make sure we filled 

the billets, get people on board, and getting our arms around the 

work the contractors were doing. But by far, the biggest thing was 

the workforce; getting the right people in and stabilizing the environment. And then modernizing it, which is the work we are doing 

right now. So this first 12 months is critical to really setting the 

stage to move forward for the long term. 

Chairman CHABOT. Thank you. 

Do you believe that the SBA’s enterprise IT architecture needs 

to be improved? What specifically, and how do you intend to go 

about improving it? 

Ms. ROAT. So the infrastructure overall, when you look at it 

from the network perspective, we have 120 circuits across all of 

SBA. More than a third of those were overloaded by the amount 

of data and traffic. They were just overloaded. We are modernizing 

the entire infrastructure to begin with to all of our field offices, and 

moving from a multitude of T1s and T3s to a pure Ethernet backbone, which is going to give us a lot more capability in the long run 

to roll out capabilities—whether it is Skype or virtual counseling— 

or doing more things online where we are currently much more 

paper-based. So we are setting the capability for that. Moving to 

the cloud is also a big piece of that from an enterprise perspective, 

putting those services in place. Ultimately, this office needs to 

transition from being just an office that does computers to a service 

organization; so that as program offices want to grow their business, as they want to add more capabilities, we are there to be able 

to support that. 

Chairman CHABOT. Obviously, there has been a considerable 

high turnover rate, and I think that has had a pretty significant 

impact on the office. Could you comment on that? If you want to 

talk about the Redskins quarterback, we can do that, too, but we 

will stick with your office, I guess, at this time. 

Ms. ROAT. You know, I am fully aware of the turnover and the 

transition that has happened over the last 10 to 12 years. The 

CIOs and Acting CIOs with no deputy, that has really hurt the organization overall. And part of what I have done is put the leadership team in place so that we do not have those gaps. But it has 

hurt the organization having that turnover, the transition, not having that line of sight over the next couple of years, where the business of SBA needs to go rather than having stovepipes and silos. 

It has hurt the organization. 

Chairman CHABOT. Thank you. Well, we welcome you again 

aboard and we are expecting great things. And anything you need 

from the Committee, please let us know, or our staff, because we 

SBREP-219A with DISTILLER

7 

will definitely work with you to make improvements. And I am 

pleased to see that you have a positive attitude. I am not surprised 

after spending the time you did in such a tremendous organization 

as the U.S. Navy, and again, thank you for your service there. 

I will now yield back my time and recognize the Ranking Member for 5 minutes. 

Ms. VELA ́ ZQUEZ. Thank you, Mr. Chairman. And welcome, Ms. 

Roat. 

We want to ensure that access to resources for small businesses 

of all demographic groups is important and recognize that SBA.gov 

serves as the primary source of such information. In the prior administration, there was a page on the site for LGBT small businesses outreach, and now it appears to no longer be available due 

to page updates. This information has been down since at least last 

January, and I would like to know when you plan to have this page 

back up and running? 

Ms. ROAT. So we have been doing a lot of work on modernizing 

SBA.gov. There were a number of pages that are not available, like 

you indicated. Some are coming back up online. I know Tech Coalition was one of those that was taken down, as well as some of the 

others. The Tech Coalition is back up online. So as we are working 

through with the front office and with the program offices, we are 

evaluating all of those pages and bringing them online. 

Ms. VELA ́ ZQUEZ. Okay. Recent government security breaches, 

such as the OPM breach and the Russian election hacking, have 

heightened the importance of continuously monitoring against outside threats. But in an annual evaluation of the SBA system and 

networks, the IG has found significant enterprise-wide 

vulnerabilities. How has the SBA responded to the threat of such 

risk? 

Ms. ROAT. I would say there are several things that we have 

done. One I mentioned earlier was the patching, the configuration 

management, and the inventory; understanding what we own and 

what we have, as well as modernizing all of those, getting them to 

current levels for operating systems and those kind of things. So 

those specifically have taken us a long way to address security. In 

addition, we are in phase one of deploying the DHS CDM, the Continuous Monitoring Diagnostic and Mitigation System, so we are 

deploying that right now. So that will give us future capabilities as 

well for monitoring. We do have a security operation center and a 

network operation center that are now working very closely together. 

Ms. VELA ́ ZQUEZ. So it is imperative that the tools SBA offers 

to facilitate access to capital operate at their optimum capacity, 

and I heard you mention that the rebranding of the lender match 

will be launched soon. How soon? 

Ms. ROAT. Tomorrow. We did the demo for the administrator 

yesterday. 

Ms. VELA ́ ZQUEZ. Very good. Ms. Roat, Kaspersky is a Moscowbased firm and one of the biggest cybersecurity firms in the world. 

According to reports, its software has been procured by some federal agencies. This is very concerning in light of the threat Russia 

poses to our government and U.S. customers. Does SBA use this 

SBREP-219A with DISTILLER

8 

software? And are you coordinating with other agencies to mitigate 

cyber threats? 

Ms. ROAT. So we have been coordinating with DHS, as have the 

other Federal agencies, and we do not have any Kaspersky software installed in our environment. 

Ms. VELA ́ ZQUEZ. Very good. Last year, SBA established the Office of Digital Services to improve systems and capabilities. Can 

you please elaborate on the work this office performs and how the 

SBA determines the impact it has had? 

Ms. ROAT. So the Office of Digital Services was stood up a little 

over a year ago, almost a year and a half ago. They have taken on 

SBA.gov, the redesign and the rebuild of that. They have done a 

lot of work introducing agile methodology, new and modern tools, 

and technologies. They have also—where we had multiple GitHub 

sites across SBA, whether they were contractor managed—consolidated all of that work. So the Office of Digital Services has brought 

a lot of benefit to SBA as far as modernizing and bringing in additional capabilities. 

Ms. VELA ́ ZQUEZ. Very good. And given the fact that there is a 

history of a lot of turnover and eight CIOs since 2005, I would like 

to know what succession planning SBA engages in to ensure continuity in IT operations? 

Ms. ROAT. Well, for the first time, right now we have a CIO and 

a Deputy together, and I also, in January, hired a CTO as well. So 

when you look at succession planning, we go three deep right now. 

Ms. VELA ́ ZQUEZ. What would be key elements of that succession planning? 

Ms. ROAT. Being engaged and being a part of the entire modernization and moving forward in planning. The CTO right now is 

incredibly engaged with the businesses offices as we are taking the 

enterprise approach to SBA, so we work together as a team, the 

three of us as we lay the strategy moving forward for SBA. 

Ms. VELA ́ ZQUEZ. Thank you, Mr. Chairman. I yield back. 

Chairman CHABOT. Thank you. The gentlelady yields back. 

The gentleman from California, Mr. Knight, who is the—excuse 

me. Or is Mr. Kelly here? Mr. Knight, I apologize. Mr. Knight, who 

is Chairman of the Subcommittee on Contracting and Workforce, is 

recognized for 5 minutes. Thank you. 

Mr. KNIGHT. Thank you, Mr. Chairman. Mr. Kelly and I look 

alike so—— 

Chairman CHABOT. You talk alike, too. 

Mr. KNIGHT. We do talk alike. 

I have some just basic questions. I appreciate your service in the 

military and information to the military is very important, but the 

control of that information is just as important. So I understand 

that your background will help with that. But my questions are 

very kind of simple. A lot of these questions have gone over the 

turnover of how many CIOs we have had over the last 5, 6, 7, 8 

years, and how we continue the continuity moving forward. So can 

you give me an idea of—and I have heard, you know, in your statement of all of the things that are coming, all the things that have 

been in place, and the perfect answer to say that tomorrow is a 

great day, but how do we keep the continuity moving forward with 

your leadership? 

SBREP-219A with DISTILLER

9 

Ms. ROAT. That is really, really critical because walking in and 

walking into such a big vacancy within the Office of the CIO, it is 

imperative that I build the team that understands the modernization, the stabilization, where we are going as an agency. It is so 

important for the CIO, the Deputy, the CTO, and the team to be 

tied and understand the mission of SBA, why do we do what we 

do? And that is important to succession planning because it is not 

just about the technology. It is about the business of SBA. And 

until you have the Deputy in place, until you have a CTO and the 

rest of the leadership team that truly understands what that business is, then all we are going to be doing is deploying computers. 

We have to look at it from an enterprise-wide perspective across 

SBA and you have to have the team that is committed to that. And 

they are going to be part of the mission. They are not just there 

to deploy desktops or laptops. 

Mr. KNIGHT. And one of your answers was we are engineering 

this in instead of trying to replace and build on some of these types 

of things. Have you reached out to some of the business world and 

talked to them about what they do on a continuing basis? And not 

just smaller businesses that have to do with kind of some of these 

things that might be restrictive on how much money they can 

spend, but maybe some of the larger businesses that do this on a 

kind of day-to-day basis because they can and because they have 

to control their information? 

Ms. ROAT. Yeah, it is incredibly important to work with our 

partners, both the ones we have contracts with as well as understanding where technology is going in the long run. Security, building it in by design is really, really important because you cannot 

have a hard outer shell and a soft squishy inside. You have to build 

it in. So with our deployments, with the work we are doing now 

with partnering with Microsoft as we are moving to the cloud, 

working with other businesses and organizations, building that security in as we are doing the system development. Even our publicfacing website, upgrading that, and working with other businesses 

is incredibly important; and working with small businesses as well 

that have that expertise, bringing them in. 

So I am actively engaged with the business community and the 

technology world. I meet with them regularly, whether it is events 

or meetings or with ACT-IAC and other organizations that are out 

there. 

Mr. KNIGHT. Well, I appreciate your first 10 months. I look forward to you staying in office, and I yield back, Mr. Chair. 

Chairman CHABOT. Thank you. The gentleman yields back. 

The gentleman from Pennsylvania, Mr. Evans, who is the Ranking Member of the Subcommittee on Economic Growth, Tax, and 

Capital Access, is recognized for 5 minutes. 

Mr. EVANS. Thank you, Mr. Chairman. 

A growing number of workers are teleworking, which saves commuting time and creates efficiencies. What percentage of SBA employees teleworked considering the past problems? Does this create 

any special problems for your oversight and operation of the SBA 

IT infrastructure? 

Ms. ROAT. So we have to make sure the environment is available and it is up and it is running for those workers who are teleSBREP-219A with DISTILLER

10 

working. We just recently completed the deployment of another 

1,200 laptops so that people can telework, so that they can work 

from home, because there are long commutes in many areas across 

the country. So putting the infrastructure in place is really important to enable the telework and having that mobile workforce. So 

a lot of the work we have done to date is stabilizing the current 

infrastructure that was there when I arrived, as well as adding capability and pushing out laptops and making sure that people can 

take their laptops home and telework because we do have a good 

number of our workforce that does telework. 

Mr. EVANS. From your testimony, it sounds like you have made 

some headway in testing systems and refining methodologies. Do 

you feel that you have adequate staffing in your office to continue 

to correct the deficiencies in the SBA IT infrastructure and continue to support the system’s daily operation? 

Ms. ROAT. So between the Federal workforce being able to 

hire—coming in with—a fair number of vacancies—the right people 

that have that vision to be able to look forward, as well as 

leveraging our contractors saying this is the direction we are going 

and this is the direction we are headed, that is how we have been 

able to make headway in what we are doing. I could not do it without the team that we have today that we have built. They have 

been incredible. We have been very, as I said earlier, very laserfocused on what we are doing and where we are going, and have 

been very direct about where we are going on our strategic direction, especially these first 12 months which are critical. So not only 

is it the Federal workforce, it is also the contractor staff that is on 

board as well. 

Mr. EVANS. I know this is very early and you have only been 

there for 10 months—and again, like the chairman, I want to 

thank you for the service that you have provided to the country, 

10 months—and you had to kind of evaluate the situation, how 

would you evaluate it at this point? 

Ms. ROAT. I would say that by January we made just a huge 

amount of progress stabilizing the environment. We are now not 

just making incremental improvements. We are taking big steps to 

modernize right now. So the rollout we are doing, moving to the 

cloud, getting ready to shut down our data center, those are big 

steps. 

Over the last 3 months, we have already done our cloud architecture. We have done the migration planning. And we are doing the 

migration staging right now. We are getting ready by the end of 

the summer to migrate and get out of our failing data center that 

we currently have. So we are moving very fast and very hard. 

Mr. EVANS. Thank you for your service. I yield back the balance 

of my time. Thank you, Mr. Chairman. 

Chairman CHABOT. Thank you. The gentleman yields back. The 

gentleman from Mississippi, Mr. Kelly, who is Chairman of the 

Subcommittee on Investigations, Oversight, and Regulations, is recognized for 5 minutes. 

Mr. KELLY. Thank you, Mr. Chairman. You say Mr. Knight and 

I talk alike, have the same accent. 

Ms. Roat, in your testimony, you state that over 15 million people per year visit the SBA.gov. Obviously, in light of the growing 

SBREP-219A with DISTILLER

11 

number of security breaches at the Federal Government, IT security is becoming increasingly important. And I also appreciate your 

service in the United States Navy. 

And I think one of the things that our military services do pretty 

well is on cybersecurity. Although we have got to get better, I think 

it is one of the things that we probably sometimes are a little further ahead because I think, number one, we understand who the 

threats are. It is not just Russia. It is Russia, China, Korea, countries in South America. There is a litany of people who are trying 

to hack our systems and to get in there to gain value for whatever 

organization, whether it be a terrorist organization or a foreign 

country, you have been exposed to all that. 

That being said, as well as protecting our nets, we also have to 

have access to the right people to the net. And as a traditional 

guardsman, I find that many times our IT people deny the people 

who need access under the guise of security. So even though I may 

be a brigade commander and a colonel, I cannot access information 

because I do not have the right permissions and those kind of 

things. 

So I would like for you to talk a little bit about cybersecurity and 

what we are doing to reduce the risk of a security breach while also 

ensuring that we have access to the right person, whether that be 

permissions or whether that being separating nets that certain information you get on one net and others. What things are you 

doing there, Ms. Roat? 

Ms. ROAT. So there are a number of things. One, as you indicated, access permissions. We have done a sweep of who has administrator access across all of SBA to our systems and we have 

said, who has access? Who has a need to have access? So that is 

from an administrative perspective. So we have tightened down on 

that to make sure that only those that need it have it. That goes 

to access, access permissions for users. Do they have access to what 

they need to do to do their job? That is really important. 

There are also users at SBA who have been there for 30 and 40 

years that as they have moved jobs and changed jobs, they have 

carried their permissions along with them. They do not need access 

to what they needed to 10 years ago for their job today, so we also 

have to get our arms around what those permissions are. 

So as you said, you might not have access which you need to. 

You need that access to what you have to, right, to get your job 

done. You may not need access to somebody else’s data, so we have 

to understand what that is. We need to understand your work environment, what systems you access, so that goes to the user experience. What do you need to do to do your job? So that is part of 

what we are doing, getting our arms around that. And that is so 

tied to security and making sure that the right people have the 

right access to the right data to do their jobs. 

In addition, we have been out there doing training for users so 

that when an email comes in, whether it is a malware, do not click 

on that; doing testing and those kind of things and that is so important that people understand spam and malware. If you see 

something that just does not look right, raise the question. Just ask 

somebody. So user training, not only is it from a technical perspective, but there is also the other side of it from the user side. 

SBREP-219A with DISTILLER

12 

Mr. KELLY. And then kind of as a follow-up, I agree with you, 

10 months on the job, I think you are the right person. Okay, let 

us start with that. But I think it is also just as important that you 

get the right people around you that you choose who carry out not 

only your strategic vision and help you develop that strategic vision, but also help you execute it once it is figured out. 

How far are you along in making sure that if we do have a 

breach, number one, that you identify it, whether that be someone 

who does not have a permission is on a system that they should 

not be on? And number two, once you identify there is a breach, 

what steps have you put in place to mitigate those risks to the system then? 

Ms. ROAT. So there is a number of things that we have done. 

So one is our incident response procedure. So we went through 

those in January and February this year, updated all of our incident response procedures. So we have got a network and security 

operations center. If there is an indicator of something, they know 

what to do—all the steps are laid out. We updated all of those. We 

did a sweep of all of those. 

We actually used that document when WannaCry came out back 

in March. We walked through that to make sure that we were 

doing all the steps we needed to as we assessed our environment 

and did that. So putting the processes, the procedures in place, 

having the security operation center, as well as the network operation center, all of those things tie into being able to respond. 

And it is really important knowing what is on your network, understanding how your network operates normally. If you see a 

spike in something and you go, oh, that is not right, is that data 

exfiltration or is that somebody just doing an upload or a download 

or moving data somewhere? You have to understand your network 

environment and that is the environment we are getting to. 

So in the meantime, as we move to that and as we are being 

more aware of our network, we have the incident response procedures in our network and security operations center, tightening up 

the tools they use and the processes they are using. 

Mr. KELLY. Mr. Chairman, my time is expired. Thank you. 

Chairman CHABOT. Thank you very much. The gentleman’s 

time has expired. 

The gentlelady from Florida, Ms. Murphy, who is the Ranking 

Member of the Subcommittee on Contracting and Workforce, is recognized for 5 minutes. 

Ms. MURPHY. Thank you so much for being here and for your 

service. 

I wanted to talk a little bit about the IT capabilities in the Federal Government. I come from the private sector and have some experiences as I have used some of the Federal Government’s technology systems and have personally seen a significant difference. 

How do you respond to some of the concerns that the Federal Government lags in its IT capabilities as compared to what is available 

in the private sector? 

Ms. ROAT. Across the Federal Government? 

Ms. MURPHY. Well, specifically SBA. 

Ms. ROAT. For SBA, we are making very big steps to catch up. 

We have got a decade of turnover and transition to catch up on and 

SBREP-219A with DISTILLER

13 

we are doing that very fast. I am probably very forward-leaning 

when it comes to technology. I am the co-chair for the Federal CIO 

Council Innovation Committee, working with the CTOs across the 

Federal Government. I have always been forward-leaning as far as 

technology. Even with the team today I said, turn it on, try it. Let 

us test it within my office. Why not? And that is what they have 

heard me say time and time again, test it. 

Security is paramount, but why can we not turn on a capability? 

What is stopping us? Can we test advanced threat protection 

against our email? Turn it on. Let us try it. Let us try it for a small 

set of users and then deploy it further across SBA. So that is one 

of the things that as I am forward-leaning, I do like to try things. 

I do like to test things. I am working that within my office before 

we roll it out enterprise-wide to kick the tires on it and make sure 

it is going to work. 

But as far as practices go, those are industry practices. You 

know, data loss prevention, advanced threat protection, all of those 

things we are putting in place are things industry is already doing. 

Ms. MURPHY. Do you find that the acquisitions processes, or 

any of the sort of the way that the government goes about procurement and things like that, inhibit your ability to acquire some of 

the most cutting-edge products that are on the market? 

Ms. ROAT. Like anybody else in the Federal Government, we 

have our acquisition processes. I think the work that has been done 

over the last year or 2 years around agile procurement, being able 

to do things faster. You know, within the FAR, you can do a lot 

of things and you can move very quickly. And I think applying 

those, you know, I am working with the Procurement Office, the 

acquisition folks at SBA to say, how do we move things along faster? How do we use agile acquisition methodologies? How do we do 

that to move things along instead of the traditional route moving 

paper? How do we be creative? So I am working with that office 

as well. 

Ms. MURPHY. And then from a recent hearing on SBA’s—is it 

VERA/VSIP program, we learned about some of the agency’s programmatic and demographic workforce challenges. Additionally, in 

general, in the Federal Government, there has been some challenges to recruiting and retaining competitive IT staff. Can you 

talk a little bit about some of the steps that the agency has taken 

to recruit and retain competitive IT staff? 

Ms. ROAT. So we have been using our direct hire authorities 

with the digital services team, certainly schedule A to bring people 

in directly, direct hires. With the CIO office, we have a big responsibility. I do not care what job you have around cybersecurity. So 

we have been using the direct hire authority for cybersecurity to 

bring in the right talent. 

People do not come into the Federal Government just to work for 

the Federal Government; they come in for the mission. They are 

not here for the money. They are in for the mission. It is like my 

father worked for a small business. You know, I saw what he went 

through; or my mother did or something like that. 

I found that people come in and they really want to work. The 

IT people come in and they really want to work because they are 

truly supportive of the mission. They get it. They understand it. 

SBREP-219A with DISTILLER

14 

They know somebody, and that is the talent that we are going 

after. Is it easy? No, but we are turning over the rocks and trying 

to recruit as much as we can. 

Ms. MURPHY. And on the retention of people like that, once you 

are able to recruit them in for the mission, what do you think 

causes them to stay? And are there things that can be done to ensure retention and that they are not hired away into the private 

sector? 

Ms. ROAT. I think the work we are doing now leaning forward, 

trying innovative things, not being status quo and just doing the 

same old, same old is drawing interest from people who want to be 

a part of that movement forward and to really modernize and really take SBA to the next level. So I think that is what is going to 

keep people there. 

Ms. MURPHY. That is great. Thanks so much, and I yield back 

the remainder of my time. 

Chairman CHABOT. Thank you very much. The gentlelady 

yields back. And now we have reached that big moment. Our newest member, the gentleman from South Carolina, Mr. Norman, is 

recognized for 5 minutes. Do not screw it up. 

Mr. NORMAN. That is a tall task. Thank you, Ms. Roat. I appreciate your time here. 

I know in the private sector, when you have people, and particularly, you have been on the job 10 months, what is your opinion 

of having a self-assessment of the members there to get an idea of 

problem employees that from their peers are judged in not so good 

of a light? 

And my second question is, and we have got constituents in my 

hometown in South Carolina where the universities play a big part 

in the SBA, is there an outreach to them or are they coming to you 

to reach out to play a part with SBA loans? 

Ms. ROAT. So for the first part of your question around the employees and how they are doing and working, you know, we did put 

in place performance management. That is very important for the 

employees, making sure that this is what we are doing this year 

and that people are on board. If they need training, we make sure 

to offer them training; performance management is a big deal to 

make sure that we are all on the same bus, we are all moving in 

the same direction, and that if people need training, we offer it and 

making sure they are working. 

For the universities, I would have to defer to our HR office, as 

well as the capital access folks and some of the others that are 

working much more closely with the universities and some of the 

others on the loans. 

Mr. NORMAN. Okay. And I guess back to one of the previous 

questions, for the training and staying up to speed on the changing 

world of technology, you feel comfortable with what you have now 

and what you see for the future? 

Ms. ROAT. So especially for what we are doing moving into the 

cloud right now, it is really, really important that the operations 

folks and the security folks really understand cloud architecture, 

and not just from a technical perspective, but monitoring and managing, and how do you offer those services across SBA to those program offices that may need different environments, test-dev and 

SBREP-219A with DISTILLER

15 

things like that. That training is really important, so we have had 

offsite sessions. 

We do weekly Lunch and Learns as well. There are other opportunities across SBA just around agile training methodologies that 

we have done. And it is not just around agile development, but 

around agile methodologies as a whole. So we are offering all of 

those kinds of training from Lunch and Learn to formal, paid training classes. 

Mr. NORMAN. I appreciate you taking the task and, from your 

testimony, you are up to the task and we appreciate your willingness to do this. 

I yield the time to the chairman. 

Chairman CHABOT. Thank you. The gentleman yields back. And 

in the opinion of the chair, the gentleman did just fine. So thank 

you very much. Looking for great things from you. 

And now we move to the gentlelady from North Carolina, Ms. 

Adams, who is the Ranking Member of the Subcommittee on Investigations, Oversight, and Regulations, for 5 minutes. 

Ms. ADAMS. Thank you, Chairman, and Ranking Member 

Vela ́zquez, thank you as well. And thank you for your testimony. 

Thank you for being here, and thank you for your service to our 

country. We appreciate it. 

Your statement shows that you have made remarkable strides 

since you became CIO, reducing the vacancy rate from 30 percent 

to now 15. That is pretty impressive and we appreciate that. 

You identify developing the right workforce as one of the remaining challenges of SBA, so have you submitted or do you plan to 

submit a plan to the SBA to outline how you can better, as you put 

it, determine need competencies and develop and sustain a workforce that can use, deliver, and support not just the technologies, 

but those of the future? Not the technologies of today, but those of 

the future? 

Ms. ROAT. So one of the things that was put in place prior to 

my arrival was putting in a workforce plan. There are 170 IT specialists across SBA and part of the FITARA implementation was to 

have an actual IT workforce plan that really looked at that roadmap for the workforce. We are actually just getting ready to do a 

kickoff on that within the next month to lay out where we need to 

go for a workforce because it is not just my office that I have responsibility for in the IT, it is all of the IT personnel across all of 

SBA. So part of this work that we are kicking off in the next few 

weeks will be putting in place a long-term strategy for the workforce, looking at those skills, looking at those companies. 

It is so important that we get the right people, that they understand the environment, that we are not doing the same old, same 

old that we have been doing for a long time. So this workforce plan 

is really going to assess our as-is and set the stage for where we 

are going in the long run. 

Ms. ADAMS. Right. Thank you. 

With over 30 outstanding recommendations, as well as many 

planned initiatives, how does SBA prioritize its IT improvement efforts? 

Ms. ROAT. So for those things that were open from the IG, we 

tackled the low-hanging fruit first, right? Those things we could adSBREP-219A with DISTILLER

16 

dress very quickly that needed to be closed, that needed to be addressed. We are also looking—it is very important from a security 

perspective—what were those findings from the IG that we needed 

to address? Have we taken care of that over the last 10 months, 

and what are we going to do to close out the rest of those? Because 

some of them, again, we can resolve very quickly. Some of those are 

a little bit longer term. So we are prioritizing all of those. 

We understand that some of those are a little bit longer term, 

but there are steps to be taken. You lay out a project plan. How 

are we going to get to 12 months from now for a couple of those 

that are going to take a year? So here are the steps. Here are the 

major milestones. And here is what we are going to do. It is not 

about, well, we are going to do it next September. It is going to be 

what is the plan to get it done? 

Ms. ADAMS. Okay. So the low-hanging fruit, you feel that you 

have already accomplished that? 

Ms. ROAT. We have addressed quite a few of those. Yes. 

Ms. ADAMS. Great. Thank you very much. Mr. Chair, I yield 

back. 

Chairman CHABOT. Thank you. The gentlelady yields back. 

The gentleman from Iowa, Mr. Blum, who is the Chairman of the 

Agriculture, Energy, and Trade Subcommittee, is recognized for 5 

minutes. 

Mr. BLUM. Thank you, Mr. Chairman. And I would also like to 

commend Representative Adams on her lovely hat today as normal. 

Very nice. 

Thank you, Ms. Roat, for your service to our country and for 

being here today. 

I come from the private sector. I was CEO of a publicly traded 

company, so I am very interested in management. Were you 

aware—I am sure you were—when you interviewed for the job that 

there were eight different CIOs in 12 years? 

Ms. ROAT. I was very aware. 

Mr. BLUM. Very aware. So I am sure, and you strike me as 

somebody who is very intelligent, you probably asked, what was 

the problem? That would be a logical question, would it not? 

Ms. ROAT. Correct. 

Mr. BLUM. And the reason I ask this is know it is in the past, 

and I think you are going to change the future, but if we do not 

know why it happened, then how do we know how to change it? 

What were you told when you asked that question? 

Ms. ROAT. I think there was not a focus on the role of the CIO, 

what needed to be done, understanding, you know, technology is 

changing and that the CIO absolutely has to be tied to the business, understand the business of the organization. I think that was 

lost somewhere along the line. I think the program offices just 

went and kind of did their own thing. You know, no fault of their 

own. They had to do something around technology. 

When I asked the question, I think the IG report last year, as 

well as some of the GAO reports that came out, really honed in 

about a year ago that said, wow, we have got a problem. And even 

before, you know, when I was approached about the job, I did my 

homework. I looked at the IG reports. I looked at the GAO reports. 

SBREP-219A with DISTILLER

17 

You do not walk into a job like this with blinders on. And I did 

my homework. 

And I did ask those questions, and it was really having a leadership perspective that really understood what it took to be a CIO, 

how the CIO is tied to the business of an organization, that they 

are not just there to deploy laptops and those kind of things. They 

are there to be a true enabler of the business and really manage 

and have oversight and governance over the IT investments of the 

agency. So I asked a lot of those hard questions before I came on 

board. 

Mr. BLUM. So do you think they made poor hires in the past or 

do you think there is or was a structural problem within the SBA 

that caused these people to subsequently leave shortly after starting? 

Ms. ROAT. I am not sure that I can answer the question on the 

people that were in the role. I know some of them and they are 

very smart people. I think there may have been some leadership 

challenges structurally within SBA. 

Mr. BLUM. Inherent in the SBA? 

Ms. ROAT. Inherent in SBA. That is my opinion and I think last 

year—— 

Mr. BLUM. Are some of those still there? 

Ms. ROAT. I think that as of last year, with the prior administration, and even the current administration, has been incredibly 

supportive of turning the agency around as far as the role of the 

CIO. I have an incredible amount of support right now and the 

runway that I have been afforded over the last 10 months to make 

things happen and affect change, I could not have done that without leadership support. 

Mr. BLUM. It is good to hear. It is good to hear. Because oftentimes things are structural. They are embedded and they have 

been there for a long time and change does not happen quickly in 

Washington, as you are well aware. And if those things are still 

there, you can be a very bright person and do an excellent job and 

we are still going to have issues. So you need to be looking for that 

within the organization that you control, that is for sure. And in 

the private sector, sometimes you need to clean house, correct? 

Ms. ROAT. Correct. 

Mr. BLUM. Speaking of the OIG, they criticized SBA’s organizational structure for potentially undermining IT investment oversight and they talked specifically about chief digital officer perhaps 

as duplicative with your role. Do you report to the deputy COO? 

Ms. ROAT. So I report to the chief operating officer. The position 

of the chief digital services officer, or the chief digital officer, does 

not exist anymore. That position was hired as a political appointee 

roughly a year and a half ago, and with the change of the administration, that person left. The digital services team that was stood 

up about a year ago, they work very closely with my office, and 

part of the work that we have done earlier this year was to request 

a reorganization so that the digital service team reports directly 

into my office. 

Mr. BLUM. Good to hear. So you report to the COO? 

SBREP-219A with DISTILLER

18 

Ms. ROAT. That is correct. And then I have monthly meetings 

with the administrator that are scheduled. Bi-weeklies with the 

chief of staff as well. 

Mr. BLUM. Excellent. Good to hear. 

Last question. The OIG once again last reported there were 39 

open recommendations related to IT security, some dating back to 

2011. Are these recommendations still valid in your estimation? 

And are we giving them the priority that they deserve and require? 

Ms. ROAT. So some of those recommendations we have closed already, in particular the oldest ones we closed a couple of months 

ago. So we have tackled a lot of those. It was a matter of documenting what we did. Some of the recommendations, when you 

look back 3 or 4 years, they are really OBE because of technology 

changes, whether it is moving email to the cloud. So we are addressing those specifically with the IG. 

So we are actually tackling those, and we have closed more than 

a half a dozen of those in the last couple of months, and we have 

another half-dozen or so that we are scheduled to close through the 

end of this fiscal year, and we have a plan to work on the rest of 

them as well. 

Mr. BLUM. Very good. My time is expired, but welcome to the 

SBA administration, and I personally think you are going to do an 

absolutely splendid job. 

Ms. ROAT. Thank you. 

Mr. BLUM. I yield my time, Mr. Chairman. 

Chairman CHABOT. Thank you very much. The gentleman’s 

time is expired. And unless we are joined by any other members, 

the last questioner today will be the gentleman from Florida, Mr. 

Lawson, who is the Ranking Member of the Subcommittee on 

Health and Technology. 

Mr. LAWSON. Thank you, Mr. Chairman. And thanks for giving 

me 10 minutes. 

Mr. Chairman and Ranking Member Vela ́zquez, I am honored 

that you all would host this meeting today. And I want to thank 

you for only 6 months on the job and the tremendous progress that 

has been made with the SBA. 

And one of the questions, I do not want it to be a duplicate, but 

I wanted to know about it. You might have already answered it. 

With 6 months into the administration, what roadblocks and challenges have you seen so far that are blocking the OCIO from implementing some of the recommendations and changes from the OIG 

and the GAO reports? 

Ms. ROAT. So a lot of the OIG recommendations were really 

technology focused as far as audit logs and access controls and all 

those kinds of things. So those are the ones that we are tackling 

right away, moving through those. 

Some of the broader ones around investment management, governance, dealing with IT investments across all of SBA, there is an 

Investment Review Board that I co-chair. So part of addressing 

some of GAO’s concerns specifically was around, you know, the 

CIO’s role in managing those IT investments, the oversight, having 

that governance authority. So I do co-chair the Investment Review 

Board that looks at all the investments across SBA, as well as 

working very closely with the CFO and the COO on those things. 

SBREP-219A with DISTILLER

19 

So I think the work around that we are doing with the Investment Review Board, with the Architecture Review Board, with the 

COO, with the CFO, is taking us a long way to addressing the concerns, particularly around the management of the IT investments 

across SBA. 

Mr. LAWSON. And are you satisfied with the recommendation 

concerning cybersecurity that you all are implementing? 

Ms. ROAT. The specific recommendations? 

Mr. LAWSON. Right. 

Ms. ROAT. So the ones that came out most recently, they were 

very specifically technically focused. Some of the broader ones were 

under management. I think we are making a lot of strides and a 

lot of headway in that progress as far as from a management perspective, getting our arms around all the cybersecurity. Security is 

layered throughout an organization and we are addressing it all 

the way through. So we are building it in as we go. 

Mr. LAWSON. Okay. A couple of months ago I was at a business 

roundtable in Jacksonville, Florida, and some of the concerns that 

were expressed there from some of the business leaders, or the 

small business people in there, is that they did not feel like they 

really knew a lot of things that were going on in SBA. And I know 

that you have field operations all over the place. How do you go 

about communicating to those field operations to let the businesses 

know that you are available for them and that they can access a 

lot of the information and have access to capital and so forth? 

Ms. ROAT. So I do work closely with the Office of Field Operations. They do have weekly calls with the field, so I do participate 

in those. And when there are questions that arise as far as what 

information could be available on the SBA website, you know, we 

are acting on that. So the team is working very closely with the 

field operations as well as capital access to make sure that the information is available on the website for one, and consolidating the 

information. I know that the information historically has been very 

hard to find on the website, so we have been working hard at consolidating events to make that available. 

I do participate in the weekly calls with the field operations, so 

as anything bubbles up. I also participate with the Tech Coalition, 

which partners with industry as well. So hearing their concerns 

and making sure that we are responsive to them. 

Mr. LAWSON. And since women-owned businesses are the fastest-growing small businesses in America, how are you all catering 

more towards them to make sure that they feel comfortable in accessing the information from you? 

Ms. ROAT. So I think there is an event coming up in the next 

few weeks, GCBD, with women entrepreneurs and women business 

owners coming up. I think it is the end of the month, the 26th or 

27th. So there is a lot of outreach going out and very targeted to 

those communities, whether it is small business, the women-owned. 

So that event is one example of how SBA is targeting those groups. 

Mr. LAWSON. And I would like for you to send my office some 

information on that because I would like to make sure that we find 

out everything we possibly can because I am always approached by 

some of the women in business. 

And with that, Mr. Chairman, I yield back. 

SBREP-219A with DISTILLER

20 

Chairman CHABOT. Thank you very much. The gentleman 

yields back. 

I would just conclude by saying, Ms. Roat, the office that you 

now hold has obviously struggled in recent years and I would say 

that based upon the testimony that you have given us and the answers to the questions that both sides have asked, I would say that 

I am encouraged. I think a lot of other members are as well, that 

you will work to improve your office in order to better fulfill the 

requirements of the SBA and how they serve small businesses all 

across the country. 

We would encourage you to keep the Committee updated on the 

progress that you make. And if you run into any problems, please 

let us know, either us or our staff, so that we can assist you in 

doing the best job that you can for those small businesses. So 

thank you very much for your testimony today. 

I would ask unanimous consent that members have 5 legislative 

days to submit statements and supporting materials for the record. 

Without objection, so ordered. 

And if there is no further businesses to come before the Committee, we are adjourned. Thank you. 

[Whereupon, at 12:03 p.m., the Committee was adjourned.] 

SBREP-219A with DISTILLER

21 

1https://www.sba.gov/sites/default/files/oig/FY—2017—-—Management—Challenges—- 

—10—14—16—7.pdf 

A P P E N D I X 

STATEMENT OF MARIA ROAT 

CHIEF INFORMATION OFFICER 

U.S. SMALL BUSINESS ADMINISTRATION 

BEFORE THE 

COMMITTEE ON SMALL BUSINESS 

U.S. HOUSE OF REPRESENTATIVES 

HEARING ON 

HELP OR HINDRANCE? A REVIEW OF SBA’S OFFICE OF THE 

CHIEF INFORMATION OFFICER 

JULY 12, 2017 

Chairman Chabot, Ranking Member Velazquez, and Members of 

the Committee, thank you for the opportunity to discuss how the 

Small Business Administration (SBA) is improving its leadership 

roles in overseeing and addressing information technology (IT) investments and security risks. I would like to share with you today 

where SBA is in the process of rationalizing its IT infrastructure, 

and stabilizing and modernizing to drive standardization, consolidation, and integration across its IT portfolio. 

In October 2016, the Office of the Inspector General issued its 

‘‘Report on the Most Serious Management and Performance Challenges in Fiscal Year 2017.’’ The reports’ Challenge 2 focused on 

the Office of the Chief Information Officer (OCIO) and the need to 

improve its leadership roles in overseeing and addressing IT and 

security risks. Since 2005, SBA has had 8 Chief Information Officers and frequent turnover in key IT positions ‘‘adversely affecting 

the ability for SBA to make lasting improvements in its IT investments and security in multiple areas.’’1 I am here to tell you about 

how the Office of the Chief Information Officer is transforming to 

help the agency and support its mission of delivering services to 

small business owners. 

I on-boarded SBA on October 3, 2016 as the Chief Information 

Officer, after having served as the Chief Technology Officer at the 

US Department of Transportation for more than two years. By 

mid-November, I completed an initial assessment of the overall operating environment and identified stabilization and modernization 

targets to reach by the end of the fiscal year. It is necessary to 

pivot OCIO from a reactive, fire-fighting, technical support operSBREP-219A with DISTILLER

22 

ation to a more proactive services organization that is innovative 

and responsive to the business and technology needs of SBA’s mission. After I arrived, the OCIO began moving aggressively to address its network, systems, applications and overall operational 

challenges, move its primary data center to the cloud, address security deficiencies and decrease its personnel vacancy rate. 

When I arrived, SBA’s heating, ventilation, and air conditioning 

(HVAC) units in its data center were experiencing weekly incidents 

with temperatures rising to 120 degrees or more causing frequent 

outages and system degradation. SBA’s inventory of network, servers, software, and applications was incomplete, resulting in ineffective management of the entire network. Program offices were operating in silos with some network segments firewalled from OCIO 

visibility for monitoring and management. Further, operating systems were long past end-of-life, and others nearing end-of-life, introducing significant security risks into the environment. 

SBA’s network infrastructure was not adequately architected to 

support SBA’s requirements. Specifically, one third of all network 

circuits are overloaded, and the environment has aging voice equipment, single points of failure, inconsistent end-point management, 

and separate voice and data wide area networks (WANs). Gaps existed in the areas of configuration management, and a lack of a 

mature enterprise architecture capability has led to a fragmented 

technology stack with deficiencies in standardization, and duplicative or overlapping tools deployed across SBA. 

Strategies to Stabilize and Modernize 

It is imperative to modernize SBA’s infrastructure and build in 

security as a design principle to support a mobile workforce. To address the WAN performance issues, immediate actions were taken 

to make configurations changes to move certain traffic loads to offhours. With its service provider, OCIO developed plans to migrate 

from a Time-Division Multiplex (TDM) to a converged, Ethernet IP 

based network that will result in reduced network latency, improved application performance, address security gaps, and introduce scalability and resiliency. In working with the service provider, I provided direction that the effort must be cost-neutral—no 

additional funding was available. Orders for 111 circuits were 

placed and the first 20 circuits are on-line today. 

Of primary importance was stabilizing the primary data center’s 

environment. By December, the OCIO team conducted a detailed 

data center inventory from the physical devices to the applications. 

The inventory was produced with about 85% accuracy, and provided sufficient initial data to identify what could be shut down, 

upgraded, and/or moved to the cloud. The OCIO team made a determination to either upgrade systems or shut down unnecessary 

equipment in preparation for transitioning to the cloud. By March, 

the team shut down 170 servers directly resulting in HVAC stabilization, and a tangible reduction in power usage. Upgrades to 

operating systems and applications significantly reduced 

vulnerabilities and improved SBA’s security posture. Because of my 

direction that no new hardware would be purchased or placed in 

SBREP-219A with DISTILLER

23 

the data center, SBA is the first federal agency to deploy the Continuous Mitigation and Diagnostic system in a cloud environment, 

with Phase I starting in March. 

SBA migrated e-mail to Microsoft O365 in May 2016 due to failing on-premise e-mail servers; however, no other subsequent migration actions were planned to take advantage of the O365 platform’s 

capabilities. As the data center stabilization tiger teams stood 

down, cloud tiger teams stood up to migrate the data center to 

Microsoft’s Azure cloud and O365. The teams follow agile methodologies with daily stand-ups, releases and sprints, and all activities tracked in JIRA. The cloud architecture design was completed 

in March, migration planning is nearing completion, migration 

staging begins in July, and actual migration starts in August. Migration to SharePoint Online has been completed for those applications that could be migrated, and assessment is underway for remaining SharePoint applications to either be upgraded or considered for replatforming, consolidating or transitioning to commercial 

off the shelf (COTS) or other software as service applications. 

Prior end-user environments were deployed inconsistently across 

SBA with no standard image, resulting in security vulnerabilities, 

inconsistencies, and multiple versions of software installed on the 

desktops. Upgrades to Windows 10, Office 2016 and OneDrive for 

the entire SBA enterprise are underway. Deployment to pilot users 

was completed in May and OCIO-wide roll-out begins in July. SBAwide upgrades will begin at the end of the fiscal year. 

The Deputy CIO and I reviewed and evaluated all purchase requisitions for reduction or elimination based on duplication, overlap, 

gaps, and need as the transition to O365 and the cloud is underway. Additionally, OCIO leadership reviewed all service contracts 

and identified opportunities to eliminate duplicative services and 

address gaps. 

Pivoting from a functionally siloed organization to a customercentric and service-optimized structure requires an understanding 

of the customer’s requirements. Operational credibility is key to IT 

taking on a more strategic role within the enterprise. Improved 

support from the IT Service Desk including closing outstanding 

issues, implementing tiered support processes and receiving and incorporating customer feedback is improving customer satisfaction. 

Further, the data center stabilization efforts significantly reduced 

incoming calls to the Service Desk. 

Improving SBA’s IT Governance Structure 

The Federal Information Technology Acquisition Reform Act 

(FITARA) provides the tools needed to transform how we manage 

IT. It is imperative that the CIO, Chief Human Capital Officer, 

Chief Financial Officer and Senior Procurement Executive work 

collaboratively to understand SBA’s business needs and drive informed decisions. Over the last year, SBA has initiated a review of 

its IT portfolio and actively uses the agency’s Investment Review 

Board (IRB), co-chaired by the CIO and Chief Financial Officer. 

The IRB has oversight responsibility for major programs and is 

working to institutionalize its ability to deliver successful programs 

SBREP-219A with DISTILLER

24 

and mature SBA’s governance capabilities and improve transparency. 

Through a stronger governance model, the CIO has greater visibility to improve planning, identify cost savings opportunities and 

to better understand current and planned IT resources to support 

program objectives. This includes leveraging Enterprise Architecture as the roadmap to improve, integrate and streamline processes 

and systems, and requiring CIO approval for acquisition plans for 

all new IT contracts above the simplified acquisition threshold to 

safeguard against the procurement of duplicative and/or non-compatible technologies and services, and ensure alignment with SBA’s 

technology standard and strategic direction. I conducted four deep 

dives on major investment to review milestones, technology capabilities, funding and risks: Capital Access Financial Systems; Disaster Credit Management Modernization; Small Business Innovation Research Program; and Certify.sba.gov. Additionally, I conducted a TechStat on the Certify.sba.gov IT investment in June to 

examine program data with a focus on delivered and planned 

functionality that will lead to concrete actions to improve overall 

program performance and reduce risk. 

Leveraging IT to Support Mission Outcomes 

SBA delivers loans, loan guarantees, contracts, counseling sessions and other forms of assistance to small businesses. The agency’s primary public website (sba.gov) is visited by over 15 million 

people per year, but the agency has struggled with meeting the 

needs of these current and prospective small business owners. Information has been buried in confusing language and layers of 

navigation, and has been hard to access on mobile and table devices. Approximately 31% of SBA’s web site traffic comes from mobile devices and 5% from tablets, and mobile traffic grew by 2.5% 

last year. In 2016, a Digital Service team was stood up and onboarded a team of digital experts to lead a modernization effort for 

sba.gov. The Digital Service team moved sba.gov to a new Content 

Management System, established a modernization roadmap and is 

systematically changing the site to greatly improve SBA’s customer 

experience. The agency’s Leveraging Information and Networks to 

access Capital (LINC) capability will receive a major refresh and 

re-launch later this month to help connect small business borrowers with participating SBA lenders. As part of the modernization effort, the tool will be renamed to Lender Match for ease of 

communicating its purpose and value. Prospective borrowers complete a short online questionnaire, and the responses are forwarded 

to participating lenders that operate within the small business’ 

county. If lenders are interested in the referral, the lender and prospective borrower’s contact information will be exchanged. 

The OCIO is collaborating with the Office of Entrepreneurial Development to replace its legacy system, and the Office of Investment and Innovation to upgrade the SBIC Web technology stack 

and to transition the systems monitoring and management to 

OCIO. These outward facing systems that support mission objectives, such as partnering with Small Business Development Centers and Veterans Business Outreach Centers, and facilitating the 

SBREP-219A with DISTILLER

25 

flow of long-term capital to America’s small businesses must be secure. 

Developing SBA’s IT Workforce 

To be successful with cloud adoption, the OCIO must make fundamental changes to its organizational mission and roles. All IT 

personnel across SBA and functional areas, including security, infrastructure and operations, must maintain their relevance as technology evolves and OCIO transitions to support Development and 

Operations (DevOps), and a software centric organizations that incorporates hybrid cloud solutions. To keep up with rapid technology 

changes, typical organizational structures and the IT workforce 

must evolve to operating within small, autonomous teams that 

cross-collaborate to work on fast-flowing ideas, opportunities and 

improvements. Further, a risk-tolerant environment that allows for 

the exploration of ideas can accelerate the value delivered to the 

SBA. 

The OCIO’s vacancy rate was 30% in October 2016 and was reduced to 15% by February 2017. Ten employees were hired including a Deputy CIO, Chief Technology Officer, Director of Operations, 

Enterprise Data Manager, Section 508 Program Manager, Branch 

Chiefs for Information Security Operations and Compliance, and 

other staff positions. SBA initiated a reorganization to realign the 

Digital Service team into the OCIO and merge it with the existing 

development team. OCIO will hire 10 additional staff to fill existing 

vacancies. OCIO is hiring not for the organization of today, but for 

the organization that can support future capabilities. For example, 

an Enterprise Data Manager was hired to create business value 

through data and analytics and rethink how information as an 

asset can take a more active and dynamic role in the activities of 

SBA. 

As SBA continues its efforts to implement FITARA, the CIO and 

CHCO are committed to developing a holistic approach to build a 

strategic workforce plan for all SBA IT professionals. Attracting 

and developing IT staff is critically important to long-term success 

as legacy systems are modernized and shifted to the cloud, and an 

enterprise approach to IT is implemented. SBA has approximately 

170 IT specialists and digital service experts, of which 70 are directly assigned to the OCIO. Workforce planning requires significant improvement and SBA will initiate strategic workforce planning by the end of the fiscal year. SBA has a strong mission draw 

for IT and cybersecurity professionals and we must partner with 

the CHCO to better market ourselves. 

Challenges Remain and Opportunities Exist 

Even with the progress outlined above, challenges related to the 

fiscal environment have put pressure on IT organizations. Internal 

and external customers and stakeholders expect SBA to deploy 

services and technology on par with their personal use and interaction with private sector firms. The need for speed and agility in 

acquisition is vital to deliver products and services. 

SBREP-219A with DISTILLER

26 

Develop the Right Organization and Workforce - SBA must determine needed competencies and develop and sustain a workforce 

that can use, deliver and support not just the technologies of today, 

but those of the future. Recruiting the right people into the federal 

government with the right skills and the capacity to freely and 

quickly change and innovate is difficult at best. The ability to leverage and integrate with trusted private sector partners to supplement the federal IT workforce is more critical than ever. 

Build the flexibility to implement IT best practices - SBA’s program office applications and systems were generally developed in 

silos. Customer information, for example, is duplicated across systems and information sharing is limited. Program offices are looking for modern, easy-to-use applications that can be quickly deployed, while OCIO concurrently takes a strategic approach to 

standardizing on a limited set of application suites to minimize integration issues, maximize security and reduce IT costs. Further, 

implementing shared services will evolve over time, and consolidating contracting of commodity IT requires flexible, agile acquisition practices and will result in increased value of the services to 

the business. 

Increase Visibility into IT Planned Expenditures - Data concerning planned and actual spending must be readily available, 

and capable to drive SBA’s ability to identify opportunities to improve leverage and operational cost. Further maturity in this area 

will ensure that information is accurate and that evidence based 

decision making is properly integrated with the governance process. 

Mature Cybersecurity Capabilities - Cybersecurity is critical in a 

modern information infrastructure that includes data 

virtualization, separation of storage, compute, and cloud-based data 

persistence. SBA must modernize to keep its IT systems current 

and secure with a clear understanding of risks to availability and 

reliability. 

Conclusion 

Information technology is a key enabler of digital transformation, 

and we are taking a multi-pronged approach that leverages current 

technologies while looking ahead to the future to proactively address the agency’s needs. We are focused on building a strong foundation that is robust, scalable, secure and responsive to changing 

business needs. Together with SBA’s program offices, we will build 

on this foundation to create and deliver digital solutions that will 

not only improve the public’s experiences with SBA’s services, but 

will also improve our internal customer experience. Actions to consolidate and update support contracts will continue, and areas such 

as system development and program support will be strengthened 

as OCIO transitions to a services-oriented organization. A robust 

enterprise governance that has leadership alignment will drive 

progress and ensure IT programs and projects are selected and 

managed to ensure SBA’s needs are met in an effective manner 

while minimizing unnecessary duplication. The CIO is a key stakeholder in driving horizontal and vertical collaboration to ensure 

SBREP-219A with DISTILLER

27 

that the right authority, with the right information, at the right 

time makes the best possible decision to effectively deliver IT programs. Thank you for the opportunity to speak with you today and 

I look forward to your questions. 

Æ 

SBREP-219A with DISTILLER