Protection of the IT 

Infrastructure and Rela

Topics (Open)

Deputy Executive Directo

for Corporate Managemen

December 15, 2008
Agenda

• Introduction• Federal Information Security 

Management Act (FISMA) Up

• Information Technology (IT) 

Modernization

• Closing
Federal Information Secu

Management Act Updat

Paul Ricketts

Senior IT Security Officer

FISMA Compliance and Overs

Branch

Computer Security Offic
FISMA Update

Overview

• Past

– Targeted implementation of the 

IT Security Program through thnewly created Computer SecurOffice (CSO)

– Emphasis on FISMA complianc
FISMA Update

Overview (cont’d)

• Present

– Planning, directing, and overse

implementation of the NRC IT Security Program

– Maturing CSO capabilities
FISMA Update

Overview (cont’d)

• Future

– Mature the Program and seek 

efficiencies through effective rmanagement and enhanced technical capabilities, policy, training, and reporting

• Conduct an enterprise risk assess• Construct a viable situational 

awareness capability
FISMA Update

Overview (cont’d)

• Future (cont’d)

• Establish quarterly compliance re

process

• Expand the role-based training eff• Develop and integrate the securit

architecture

• Document an Information Security 

Strategic Plan (ISSP)
FISMA Update

Overview (cont’d)

• Future (cont’d)

• Establish an Information Systems 

Security Officer (ISSO) frameworkforum, and training program
FISMA Update

Accomplishments

• Established Computer Secur

Office

– CSO authorized by the Commis

on 11/25/07 

– New office reports to the Depu

Executive Director for CorporatManagement (DEDCM)
FISMA Update

Accomplishments (cont’

• Established Computer Secur

Office (Cont’d)

– Headed by the Chief Informatio

Security Officer (CISO) 

– CISO assigned on 3/17/08– CSO now fully staffed with 14 

personnel
FISMA Update

Accomplishments (cont’

• Material Weaknesses in the N

IT Security Program Have BeEliminated 

– Two significant deficiencies w

identified in the FY07 FISMA Authe areas of certification and accreditation (C&A) and continplanning
FISMA Update

Accomplishments (cont’

• Material Weaknesses in the N

IT Security Program Have BeEliminated (Cont’d)

– The FY08 FISMA Audit reflects 

• Over 50% of NRC’s FISMA-reportable sys

are now authorized to operate (4 times tnumber completed in 2 previous fiscal y

• 100% of NRC’s FISMA-reportable system

have tested contingency plans
FISMA Update

Accomplishments (cont’

• Other Advancements

– 100% of FISMA-reportable syst

are now categorized

– 100% of NRC owned/operated 

systems have completed annuatesting of security controls
FISMA Update

Accomplishments (con’

• Other Advancements (cont’d

– Staff augmentation contract 

awarded to improve CSO proceand enhance capabilities 

– ISSP Steering Committee 

established and ISSP under development
FISMA Update

Accomplishments (cont’

• Other Advancements (cont’d

– Additional systems received 

authority to operate (ATO) sincFY08 FISMA Audit 
FISMA Update

Fiscal Year 2009 Gaps

• Certification and Accreditati

– 11 FISMA-reportable systems 

remaining 

– Funding C&A work for 8 system

Quarters 2 & 3 FY09
FISMA Update

Fiscal Year 2009 Gaps (co

• Program Office Funding for 

Continuous Monitoring

– Contingency plan testing– Annual security controls testin– Plan of action and milestones 

(POA&M) weakness remediatio
FISMA Update

Fiscal Year 2009 Gaps (co

• Funding Continued Developm

– Enterprise security architectur– Digital forensic capability in 

conjunction with Infrastructure Computer Operations Division (and Support from the Office of Inspector General (OIG)
FISMA Update

Fiscal Year 2009 Gaps (co

• Funding Continued Developm

(cont’d)

– Unissued policies and standard– Additional role-based training
FISMA Update 

Actions Taken to Meet Ga

• Certifying and accrediting 5 

systems in Q1 FY09 under continuing resolution

• Requested program offices fu

their continuous monitoring security needs
FISMA Update 

Actions Taken to Meet Ga

(Cont’d)

• Initiated outreach to other of

requesting funding of remainC&A effort for FY09

• Consolidated 7 separate syst

into a single infrastructure system
FISMA Update

What Will be Different th

Year?

• Initiate Actions to Demonstra

Further Progress

– Accredit remaining Major 

Applications and General SuppSystems by 06/30/09

– Complete contingency plan tes

and updates by 6/30/09
FISMA Update

What Will be Different th

Year? (cont’d)

• Initiate Actions to Demonstra

Further Progress (Cont’d)

– Complete annual control testin

6/30/09 

– Use of contractor support to 

augment CSO staff capability aimplement best practices
FISMA Update

What Will be Different th

Year? (cont’d)

• Initiate Actions to Demonstra

Further Progress (cont’d)

– Expand role-based training– Issue updated policies and 

standards

– Enhance the POA&M process
FISMA Update

What Will be Different th

Year? (Cont’d)

• Initiate Actions to Demonstra

Further Progress (Cont’d)

– Update system inventory to inc

all security assets

– Establish ISSO Forum to improv

communication with program o
FISMA Update

What Will be Different th

Year? (Cont’d)

• These actions will enhance t

NRC’s security posture and improve its level of FISMA compliance
Information Technolog

Modernization

Thomas Rich, Director

Infrastructure and Computer Opera

Division

Joseph Holonich, Director

Information and Records Servic

Division

Office of Information Services 
IT Modernization

• Strategic and Tactical Plans

– IT/IM Strategic Plan– Infrastructure Planning Team R– IT Roadmap
IT Modernization

• Key Business Drivers

– Working from anywhere– Getting access– Improving productivity– Maintaining a robust, efficient 

infrastructure

– Getting information– Doing business during emergen
IT Modernization

Working from AnywhereStaff can securely access the syst

and information they need no mawhere they’re located
IT Modernization

Working from Anywhere

Accomplishments• Modernized video-teleconferenci• Memory of remote access person

settings

• Outlook Web access
IT Modernization

Working from Anywhere 

(cont’d)

Short Term• Mobile communications expansio• Secure wireless mobile computin• Remote access application expa
IT Modernization

Working from Anywhere 

(cont’d)

Planning for the Future• New IT infrastructure support co
IT Modernization

Getting AccessUsers can securely access the IT 

systems and information they nethrough a single or minimal pointentry
IT Modernization

Getting Access

Accomplishments• Increased communication bandw

to remote locations

• Implemented Managed Public Ke

Infrastructure (MPKI)
IT Modernization

Getting Access (Cont’d

Short Term• Single authoritative employee 

directory
IT Modernization

Getting Access (cont’d

Planning for the Future• Identity management• Single sign-on
IT Modernization

Improving ProductivityIndividuals and groups of staff can 

efficiently to accomplish the age

mission
IT Modernization

Improving Productivity

Accomplishments• Enterprise SharePoint deploymen• Enterprise project management (

Pilot)

• Migration to Microsoft Outlook
IT Modernization

Improving Productivity (co

Short Term• SharePoint training and support 

program
IT Modernization

Improving Productivity (co

Planning for the Future• Obtain voice mail through E-mail • Know how to contact your 

staff/manager wherever they are
IT Modernization

Maintaining a Robust, Efficient 

Infrastructure

The agency continues to upgrade t

Infrastructure to improve operatieffectiveness and more efficientlsupport agency business needs
IT Modernization

Robust, Efficient IT 

Infrastructure

Accomplishments• Modernized telephone capabilitie• Data center efficiency enhancem• Network refresh
IT Modernization

Robust, Efficient IT 

Infrastructure (cont’d)

Short Term• More flexible network access co
IT Modernization

Robust, Efficient IT 

Infrastructure (cont’d)

Planning for the Future• New IT infrastructure support co• Centralized IT operations• Voice/data/video convergence
IT Modernization

Getting Information• Staff can access the information 

need to perform their work

• Stakeholders can access the 

information they need to participeffectively in the regulatory proc
IT Modernization

Getting Information

Accomplishments• Kept information to staff and 

stakeholders available via ADAM

• Began modernization of ADAMS
IT Modernization

Getting Information (cont

Short Term• Continue ADAMS modernization• Obtain public Web content 

management services

• Acquire tools for public users of t

NRC’s Web site
IT Modernization

Getting Information (cont

Planning for the Future• Implement information managem

framework and complete modernization

• Redesign public Web site
IT Modernization

Challenges

• Ensuring that the delivery of 

services is commensurate wagency expectations and resources available

• Identifying requirements to 

support a corporate view for acquiring and providing Serv
IT Modernization

Challenges (cont’d)

• Maintaining legacy systems a

infrastructure versus modern

• Reducing customization
Acronyms

• ADAMS – Agencywide Documents 

Access and Management System

• ATO – Authority to Operate• C&A – Certification and Accredita• CISO – Chief Information Security 

Officer

• CSO – Computer Security Office• FISMA – Federal Information Sec

Management Act

• FY – Fiscal Year
Acronyms (con’t)

• ICOD – Infrastructure and Computer Operation

Division

• ISSO – Information Systems Security Officer• IT – Information Technology• MPKI – Managed Public Key Infrastructure• NRC – Nuclear Regulatory Commission• NRO – New Reactor Office• OIG – Office of Inspector General• OIS – Office of Information Services• POA&M – Plan of Action and Milestones• Q - Quarter